buhapp-backend

ga/buhapp-backend

Fork 0

Commit Graph

Author	SHA1	Message	Date
ga	c30faf02ef	Sprint 6: security hardening 1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0	2026-08-20 20:42:22 +00:00
ga	4533ceaf2d	Sprint 3: chat with WebSocket - POST /api/v1/chats (ensure chat between users, normalized pair) - GET /api/v1/chats (list with last message + unread) - GET /api/v1/chats/:id/messages - POST /api/v1/chats/:id/messages (send text/photo, push via WS) - PUT /api/v1/chats/:id/read (mark all read) - PUT /api/v1/messages/:msgId (edit, owner only) - DELETE /api/v1/messages/:msgId (soft delete) - POST /api/v1/blocks, DELETE /api/v1/blocks/:id - POST /api/v1/reports - WS /ws?token= (real-time message push, ping/pong) - migrations 0003: chats, messages, blocks, reports	2026-08-20 15:51:05 +00:00
ga	8d754f9834	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO) - POST /api/v1/auth/register with mandatory consents - POST /api/v1/auth/login - GET /api/v1/me (protected) - GET /api/v1/legal/{terms,privacy,disclaimer} - Migrations for users, consent_log, audit_log - bcrypt + JWT (access + refresh) - Docker Compose stack	2026-08-20 15:41:05 +00:00

Author

SHA1

Message

Date

c30faf02ef

Sprint 6: security hardening

1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org
2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP)
3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check
4. Login: constant-time bcrypt on user enumeration (dummy hash)
5. TgUsername saved in users (was lost)
6. User.IsVerified=true for Telegram users
7. Register: 409 instead of 500 on duplicate email
8. Bumped version to 0.4.0

2026-08-20 20:42:22 +00:00

4533ceaf2d

Sprint 3: chat with WebSocket

- POST /api/v1/chats (ensure chat between users, normalized pair)
- GET  /api/v1/chats (list with last message + unread)
- GET  /api/v1/chats/:id/messages
- POST /api/v1/chats/:id/messages (send text/photo, push via WS)
- PUT  /api/v1/chats/:id/read (mark all read)
- PUT  /api/v1/messages/:msgId (edit, owner only)
- DELETE /api/v1/messages/:msgId (soft delete)
- POST /api/v1/blocks, DELETE /api/v1/blocks/:id
- POST /api/v1/reports
- WS   /ws?token= (real-time message push, ping/pong)
- migrations 0003: chats, messages, blocks, reports

2026-08-20 15:51:05 +00:00

8d754f9834

Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO)

- POST /api/v1/auth/register with mandatory consents
- POST /api/v1/auth/login
- GET  /api/v1/me (protected)
- GET  /api/v1/legal/{terms,privacy,disclaimer}
- Migrations for users, consent_log, audit_log
- bcrypt + JWT (access + refresh)
- Docker Compose stack

2026-08-20 15:41:05 +00:00

3 Commits