7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Digest 1: cmd/, admin/dto, admin/handlers (first 15 files)
Systemic Issues (across all admin handlers)
- SQL Injection via SortBy: Every admin list handler concatenates
filters.SortBydirectly into GORMOrder()without allowlist validation - Unchecked Count() errors: Every paginated handler ignores GORM Count error returns
- Unchecked post-mutation Preload errors: After Save/Create, handlers reload with Preload but ignore errors
bindingvsvalidatetag mismatch: Some request DTOs usebinding(Gin) instead ofvalidate(Echo)- Direct DB access: All admin handlers bypass Service layer, accessing
*gorm.DBdirectly - Unsafe type assertions:
c.Get(key).(*models.AdminUser)without comma-ok
Per-File Highlights
cmd/api/main.go - App entry point, wires dependencies
cmd/worker/main.go - Background worker entry point
admin/handlers/admin_user_handler.go (347 lines)
- N+1 query:
toUserResponsedoes 2 extra DB queries per user (residence count, task count) - Line 64: SortBy SQL injection
- Line 173: Unchecked profile creation error (user created without profile)
admin/handlers/apple_social_auth_handler.go - CRUD for Apple social auth records
- Same systemic SQL injection and unchecked errors
admin/handlers/auth_handler.go - Admin login/session management
admin/handlers/auth_token_handler.go - Auth token CRUD
admin/handlers/completion_handler.go - Task completion CRUD
admin/handlers/completion_image_handler.go - Completion image CRUD
admin/handlers/confirmation_code_handler.go - Email confirmation code CRUD
admin/handlers/contractor_handler.go - Contractor CRUD
admin/handlers/dashboard_handler.go - Admin dashboard stats
admin/handlers/device_handler.go (317 lines)
- Exposes device push tokens (RegistrationID) in API responses
- Lines 293-296: Unchecked Count errors in GetStats
admin/handlers/document_handler.go (394 lines)
- Lines 176-183: Date parsing errors silently ignored
- Line 379: Precision loss from decimal.Float64() discarded