senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
veza/veza-backend-api/internal/api
History
senke 249fd99730 fix(v0.12.6): apply all pentest remediations — 36 findings across 36 files 
CRITICAL fixes:
- Race condition (TOCTOU) in payout/refund with SELECT FOR UPDATE (CRITICAL-001/002)
- IDOR on analytics endpoint — ownership check enforced (CRITICAL-003)
- CSWSH on all WebSocket endpoints — origin whitelist (CRITICAL-004)
- Mass assignment on user self-update — strip privileged fields (CRITICAL-005)

HIGH fixes:
- Path traversal in marketplace upload — UUID filenames (HIGH-001)
- IP spoofing — use Gin trusted proxy c.ClientIP() (HIGH-002)
- Popularity metrics (followers, likes) set to json:"-" (HIGH-003)
- bcrypt cost hardened to 12 everywhere (HIGH-004)
- Refresh token lock made mandatory (HIGH-005)
- Stream token replay prevention with access_count (HIGH-006)
- Subscription trial race condition fixed (HIGH-007)
- License download expiration check (HIGH-008)
- Webhook amount validation (HIGH-009)
- pprof endpoint removed from production (HIGH-010)

MEDIUM fixes:
- WebSocket message size limit 64KB (MEDIUM-010)
- HSTS header in nginx production (MEDIUM-001)
- CORS origin restricted in nginx-rtmp (MEDIUM-002)
- Docker alpine pinned to 3.21 (MEDIUM-003/004)
- Redis authentication enforced (MEDIUM-005)
- GDPR account deletion expanded (MEDIUM-006)
- .gitignore hardened (MEDIUM-007)

LOW/INFO fixes:
- GitHub Actions SHA pinning on all workflows (LOW-001)
- .env.example security documentation (INFO-001)
- Production CORS set to HTTPS (LOW-002)

All tests pass. Go and Rust compile clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-14 00:44:46 +01:00
..
admin chore: consolidate CI, E2E, backend and frontend updates 2026-02-17 16:43:21 +01:00
chat adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
collaboration adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
grpc adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
handlers release(v0.903): Vault - ORDER BY whitelist, rate limiter, VERSION sync, chat-server cleanup, Go 1.24 2026-02-27 09:43:25 +01:00
listing adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
message adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
offer adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
room adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
search adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
shared_resources adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
tag adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
track adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
user fix(v0.12.6): apply all pentest remediations — 36 findings across 36 files 2026-03-14 00:44:46 +01:00
websocket adding initial backend API (Go) 2025-12-03 20:29:37 +01:00
router.go feat(v0.12.8): documentation & API publique — rate limiting, scopes, OpenAPI 2026-03-12 18:44:09 +01:00
routes_admin_platform.go feat(v0.12.6.2): enforce MFA for admin/moderator + align refresh token TTL to 7 days 2026-03-12 06:53:27 +01:00
routes_analytics.go feat(v0.11.1): F396-F399 advanced analytics service, handler and routes 2026-03-10 17:12:26 +01:00
routes_auth.go feat(v0.13.3): complete - Polish Sécurité Avancée 2026-03-13 10:09:01 +01:00
routes_cloud.go feat(cloud): file versioning, restore, and sharing 2026-02-25 13:33:08 +01:00
routes_co_listening.go feat(v0.10.7): Collaboration Temps Réel F481-F483 2026-03-10 13:34:16 +01:00
routes_core.go feat(v0.12.6.2): enforce MFA for admin/moderator + align refresh token TTL to 7 days 2026-03-12 06:53:27 +01:00
routes_developer.go feat(developer): add API keys backend (Lot C) 2026-02-20 00:18:36 +01:00
routes_discover.go feat(v0.10.4): Playlists collaboratives - F136, F140, F141, F143, F145 2026-03-09 16:49:05 +01:00
routes_distribution.go feat(v0.12.2): F501-F510 distribution service, handler, and routes 2026-03-10 19:54:26 +01:00
routes_education.go feat(v0.12.3): F276-F305 video upload, HLS transcoding, education tests 2026-03-11 19:20:48 +01:00
routes_feed.go feat(v0.10.1): Tags & Genres discover - F351-F355 2026-03-09 01:52:56 +01:00
routes_gear.go feat(v0.802): frontend Cloud/Gear, MSW, docs, scope v0.803, archive 2026-02-25 14:00:58 +01:00
routes_live.go feat(v0.10.6): Livestreaming basique F471-F476 2026-03-10 10:21:57 +01:00
routes_marketplace.go feat(v0.13.5): polish marketplace & compliance — KYC, support, payout E2E 2026-03-13 14:57:19 +01:00
routes_moderation.go feat(v0.12.6.2): enforce MFA for admin/moderator + align refresh token TTL to 7 days 2026-03-12 06:53:27 +01:00
routes_playlists.go feat(v0.10.4): Playlists collaboratives - F136, F140, F141, F143, F145 2026-03-09 16:49:05 +01:00
routes_queue.go feat(queue): add queue session API (create, get, delete, add/remove items) 2026-02-20 18:41:12 +01:00
routes_search.go feat(v0.10.2): Recherche fulltext Elasticsearch - F361-F365 2026-03-09 10:13:18 +01:00
routes_social.go feat(groups): S2 frontend - request join, invite, roles, my groups, MSW handlers 2026-02-21 05:51:29 +01:00
routes_subscription.go feat(v0.12.1): subscription plans service, handler, and routes 2026-03-10 19:36:57 +01:00
routes_tag.go feat(upload): tags auto-suggest endpoint and additional audio formats 2026-02-25 13:39:59 +01:00
routes_tracks.go feat(v0.10.7): Collaboration Temps Réel F481-F483 2026-03-10 13:34:16 +01:00
routes_users.go feat(gdpr): v0.10.8 portabilité données - export ZIP async, suppression compte, hard delete cron 2026-03-10 13:57:04 +01:00
routes_webhooks.go feat(v0.912): Cashflow - payment E2E integration tests 2026-02-27 20:00:51 +01:00
routes_webhooks_test.go v0.9.4 2026-03-05 23:03:43 +01:00
versioning.go api-versioning: add X-API-Deprecated header and frontend deprecation warning 2026-01-15 16:56:21 +01:00
versioning_test.go api-versioning: add X-API-Deprecated header and frontend deprecation warning 2026-01-15 16:56:21 +01:00