5 Commits

Author	SHA1	Message	Date
ga	2a765b5df5	Fix Safari: cookie SameSite=Lax (same-origin proxy работает)	2026-08-21 11:04:13 +00:00
ga	8cb0a066b8	Fix Safari login: Connection:close + SameSite=None (Grok analysis) ... Safari блокирует fetch после POST с Set-Cookie из-за keep-alive/HTTP2. - Login/Register: Connection: close, Cache-Control: no-store - Cookie: SameSite=None (кросс-поддомен buhapp → api.buhapp)	2026-08-21 10:57:22 +00:00
ga	5b70bc3137	Auth: HttpOnly cookie buhapp_at (без CORS preflight) ... - Login/Register ставят cookie (HttpOnly, Secure, SameSite=Lax) - Middleware читает cookie первым - CORS: AllowCredentials=true - Для прямых API-вызовов остался Authorization Bearer - Legacy ?_t= query fallback	2026-08-20 21:50:28 +00:00
ga	c30faf02ef	Sprint 6: security hardening ... 1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0	2026-08-20 20:42:22 +00:00
ga	8d754f9834	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO) ... - POST /api/v1/auth/register with mandatory consents - POST /api/v1/auth/login - GET /api/v1/me (protected) - GET /api/v1/legal/{terms,privacy,disclaimer} - Migrations for users, consent_log, audit_log - bcrypt + JWT (access + refresh) - Docker Compose stack	2026-08-20 15:41:05 +00:00