senke 24b29d229d fix(v0.12.6.1): remediate 2 CRITICAL + 10 HIGH + 1 MEDIUM pentest findings ... Security fixes implemented: CRITICAL: - CRIT-001: IDOR on chat rooms — added IsRoomMember check before returning room data or message history (returns 404, not 403) - CRIT-002: play_count/like_count exposed publicly — changed JSON tags to "-" so they are never serialized in API responses HIGH: - HIGH-001: TOCTOU race on marketplace downloads — transaction + SELECT FOR UPDATE on GetDownloadURL - HIGH-002: HS256 in production docker-compose — replaced JWT_SECRET with JWT_PRIVATE_KEY_PATH / JWT_PUBLIC_KEY_PATH (RS256) - HIGH-003: context.Background() bypass in user repository — full context propagation from handlers → services → repository (29 files) - HIGH-004: Race condition on promo codes — SELECT FOR UPDATE - HIGH-005: Race condition on exclusive licenses — SELECT FOR UPDATE - HIGH-006: Rate limiter IP spoofing — SetTrustedProxies(nil) default - HIGH-007: RGPD hard delete incomplete — added cleanup for sessions, settings, follows, notifications, audit_logs anonymization - HIGH-008: RTMP callback auth weak — fail-closed when unconfigured, header-only (no query param), constant-time compare - HIGH-009: Co-listening host hijack — UpdateHostState now takes *Conn and verifies IsHost before processing - HIGH-010: Moderator self-strike — added issuedBy != userID check MEDIUM: - MEDIUM-001: Recovery codes used math/rand — replaced with crypto/rand - MEDIUM-005: Stream token forgeable — resolved by HIGH-002 (RS256) Updated REMEDIATION_MATRIX: 14 findings marked ✅ CORRIGÉ. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-03-12 05:40:53 +01:00
..
chat_message_repository.go	v0.9.7 beta	2026-03-06 18:58:37 +01:00
delivered_status_repository.go	feat(chat): Sprint 1 -- migrations, models, repositories for chat rewrite	2026-02-22 20:38:20 +01:00
gear_repository.go	feat(v0.501): Sprint 4 -- Cloud frontend + Gear advanced	2026-02-22 18:30:49 +01:00
live_stream_repository.go	feat(v0.10.6): Livestreaming basique F471-F476	2026-03-10 10:21:57 +01:00
notification_repository.go	refactor(backend): add track, notification, webhook repositories	2026-02-14 18:07:04 +01:00
playlist_collaborator_repository.go	v0.9.4	2026-03-05 23:03:43 +01:00
playlist_collaborator_repository_test.go	STABILISATION: phase 3–5 – API contract, tests & chat-server hardening	2025-12-06 17:21:59 +01:00
playlist_repository.go	feat(v0.10.4): Playlists collaboratives - F136, F140, F141, F143, F145	2026-03-09 16:49:05 +01:00
playlist_repository_test.go	stabilizing apps/web: THIRD BATCH - FIXED Playwright	2025-12-21 18:55:51 -05:00
playlist_track_repository.go	STABILISATION: phase 3–5 – API contract, tests & chat-server hardening	2025-12-06 17:21:59 +01:00
playlist_track_repository_test.go	adding initial backend API (Go)	2025-12-03 20:29:37 +01:00
playlist_version_repository.go	v0.9.4	2026-03-05 23:03:43 +01:00
reaction_repository.go	v0.9.6	2026-03-06 10:29:30 +01:00
read_receipt_repository.go	feat(chat): Sprint 1 -- migrations, models, repositories for chat rewrite	2026-02-22 20:38:20 +01:00
room_repository.go	feat(v0.10.7): Collaboration Temps Réel F481-F483	2026-03-10 13:34:16 +01:00
track_repository.go	refactor(backend): add track, notification, webhook repositories	2026-02-14 18:07:04 +01:00
user_repository.go	fix(v0.12.6.1): remediate 2 CRITICAL + 10 HIGH + 1 MEDIUM pentest findings	2026-03-12 05:40:53 +01:00
webhook_repository.go	refactor(backend): add track, notification, webhook repositories	2026-02-14 18:07:04 +01:00