|
|
32a3d4c9e0
|
fix: P0-01 prevent LIKE injection in operation_log and device repos
- operation_log.go Search(): add escapeLikePattern + ESCAPE clause
- device.go ListAllCursor(): add escapeLikePattern + ESCAPE clause
The ESCAPE clause is required for SQLite to properly interpret
backslash as an escape character.
|
2026-04-18 13:06:44 +08:00 |
|
|
|
0795e126cc
|
fix: resolve P0 security issues per governance baseline
P0-01: LIKE injection fix in device.go (2 locations)
- Added escapeLikePattern() to prevent LIKE pattern manipulation
P0-03: Token refresh blacklist fail-closed
- RefreshToken() now returns error if cache.Set fails
- Prevents token double-spend on cache failures
P0-05: CORS dangerous default configuration
- Default changed to empty origins, credentials off
- init() panics if default config is dangerous
P0-06: UpdateUser IDOR vulnerability fix
- Added authorization check (self-or-admin)
- Prevents unauthorized user profile modification
Also: Fixed frontend lint errors in device-fingerprint.test.ts and http/index.test.ts
All 518 frontend tests pass, all backend tests pass.
|
2026-04-18 09:32:54 +08:00 |
|
|
|
09beb173cc
|
feat: complete production readiness improvements
- Fix DIP violations in service layer (device, stats, auth middleware)
- Add ReplaceUserRoles interface method for transaction safety
- Implement Magic Bytes validation for avatar uploads
- Standardize OAuth error handling with ErrOAuthProviderNotSupported
- Use crypto/rand for JWT secret generation instead of weak fixed key
- Apply code formatting with gofumpt and goimports
- Fix staticcheck issues (S1024, S1008, ST1005)
- Add comprehensive quality and functional test reports
- Achieve 36.3% test coverage (up from 16.3%)
- All E2E, integration, and business logic tests passing
|
2026-04-12 16:15:32 +08:00 |
|
|
|
5ca3633be4
|
feat: 系统全面优化 - 设备管理/登录日志导出/性能监控/设置页面
后端：
- 新增全局设备管理 API（DeviceHandler.GetAllDevices）
- 新增登录日志导出功能（LogHandler.ExportLoginLogs, CSV/XLSX）
- 新增设置服务（SettingsService）和设置页面 API
- 设备管理支持多条件筛选（状态/信任状态/关键词）
- 登录日志支持流式导出防 OOM
- 操作日志支持按方法/时间范围搜索
- 主题配置服务（ThemeService）
- 增强监控健康检查（Prometheus metrics + SLO）
- 移除旧 ratelimit.go（已迁移至 robustness）
- 修复 SocialAccount NULL 扫描问题
- 新增 API 契约测试、Handler 测试、Settings 测试
前端：
- 新增管理员设备管理页面（DevicesPage）
- 新增管理员登录日志导出功能
- 新增系统设置页面（SettingsPage）
- 设备管理支持筛选和分页
- 增强 HTTP 响应类型
测试：
- 业务逻辑测试 68 个（含并发 CONC_001~003）
- 规模测试 16 个（P99 百分位统计）
- E2E 测试、集成测试、契约测试
- 性能基准测试、鲁棒性测试
全面测试通过（38 个测试包）
|
2026-04-07 12:08:16 +08:00 |
|
|
|
dcc1f186f8
|
feat: backend core - auth, user, role, permission, device, webhook, monitoring, cache, repository, service, middleware, API handlers
|
2026-04-02 11:19:50 +08:00 |
|
