8 commits

Author	SHA1	Message	Date
senke	2ed2bb9dcf	v0.9.4	2026-03-05 23:03:43 +01:00
senke	7cfd48a82a	fix(release): v1.0.1 — Conformité complète ROADMAP checklist ... - Sécurité: npm 0 CRITICAL, cargo audit 0 vulnérabilités - OpenAPI: @Param id corrigé pour /tracks/quota/{id} - Tests: Payment E2E passe, OAuth DATABASE_URL fallback - Migrations: 000_mark_consolidated.sql - veza-stream-server: prometheus 0.14, validator 0.19 - docs: SECURITY_SCAN_RC1, V1_SIGNOFF, PROJECT_STATE	2026-03-03 20:17:54 +01:00
senke	286be8ba1d	chore(v0.102): consolidate remaining changes — docs, frontend, backend ... - docs: SCOPE_CONTROL, CONTRIBUTING, README, .github templates - frontend: DeveloperDashboardView, Player components, MSW handlers, auth, reactQuerySync - backend: playback_analytics, playlist_service, testutils, integration README Excluded (artifacts): .auth, playwright-report, test-results, storybook_audit_detailed.json	2026-02-20 13:02:12 +01:00
senke	a40a61d801	fix(backend): add table name whitelist in testutils/db.go ... - Add allowedTestTables map containing all known database tables - Add validateTableName() function that panics if table name is not in the whitelist - Call validateTableName() before all fmt.Sprintf("DELETE FROM %s") and fmt.Sprintf("TRUNCATE TABLE %s CASCADE") statements - Prevents potential SQL injection via table name interpolation, even though the risk is low (test-only code, table names come from hardcoded lists or DB introspection) Addresses audit finding: A03 (Injection) — minor risk in test utilities. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-02-11 22:57:40 +01:00
senke	d61d851f65	stabilizing veza-backend-api: phase 1	2025-12-16 11:23:49 -05:00
senke	2dfde29f7d	refonte: backend-api go first; phase 1	2025-12-12 21:34:34 -05:00
okinrev	1e4f7b1756	STABILISATION: phase 3–5 – API contract, tests & chat-server hardening	2025-12-06 17:21:59 +01:00
okinrev	2425c15b09	adding initial backend API (Go)	2025-12-03 20:29:37 +01:00