Trey t 7690f07a2b Harden API security: input validation, safe auth extraction, new tests, and deploy config ...

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-02 09:48:01 -06:00

..

apple_auth.go

Close all 25 codex audit findings and add KMP contract tests

2026-02-18 13:15:07 -06:00

auth_service.go

Migrate from Gin to Echo framework and add comprehensive integration tests

2025-12-16 13:52:08 -06:00

cache_service.go

Replace status_id with in_progress boolean field

2025-12-08 20:48:16 -06:00

contractor_service_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

contractor_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

document_service.go

Fix backend API parity: document filters, task days param, i18n locales, contract tests

2026-02-18 18:49:48 -06:00

email_service.go

Add webhook logging, pagination, middleware, migrations, and prod hardening

2026-02-24 21:32:09 -06:00

google_auth.go

Close all 25 codex audit findings and add KMP contract tests

2026-02-18 13:15:07 -06:00

iap_validation.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

notification_service_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

notification_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

onboarding_email_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

path_utils_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

path_utils.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

pdf_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

residence_service_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

residence_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

storage_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

subscription_service_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

subscription_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

task_button_types.go

Consolidate task logic into single source of truth (DRY refactor)

2025-12-07 11:48:03 -06:00

task_categorization_test.go

Migrate from Gin to Echo framework and add comprehensive integration tests

2025-12-16 13:52:08 -06:00

task_service_test.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

task_service.go

Harden API security: input validation, safe auth extraction, new tests, and deploy config

2026-03-02 09:48:01 -06:00

task_template_service.go

Add task templates API and admin management

2025-12-05 09:07:53 -06:00

user_service.go

Migrate from Gin to Echo framework and add comprehensive integration tests

2025-12-16 13:52:08 -06:00