4 Commits

Author	SHA1	Message	Date
ga	c30faf02ef	Sprint 6: security hardening ... 1. CORS whitelist (was '*'): only buhapp.mygoodservice.ru, t.me, web.telegram.org 2. Rate limit on /auth/login (10/min/IP) and /auth/register (5/hour/IP) 3. TGHandler: removed unused JWTSecret, added WebhookSecret, real secret check 4. Login: constant-time bcrypt on user enumeration (dummy hash) 5. TgUsername saved in users (was lost) 6. User.IsVerified=true for Telegram users 7. Register: 409 instead of 500 on duplicate email 8. Bumped version to 0.4.0	2026-08-20 20:42:22 +00:00
ga	c6d219c51f	Telegram WebApp support + consent endpoint ... - Telegram bot (long polling) - /api/v1/auth/telegram (validate initData, auto-create user) - /api/v1/auth/consents (record acceptances) - users.telegram_id column, GetByTelegramID/CreateWithTelegramID - ValidateInitData (HMAC-SHA256 with WebAppData secret)	2026-08-20 17:43:20 +00:00
ga	d4997e85ef	Sprint 2: profile, preferences, location, search ... - PUT /api/v1/me (update name, city, bio, gender, photo) - GET/PUT /api/v1/me/prefs (drinks, activities, purposes, language) - PUT /api/v1/me/location (auto-noise ~300m) - PUT /api/v1/me/visibility (hide/show on map) - GET /api/v1/search/nearby?lat&lng&radius (haversine, 1h TTL) - GET /api/v1/users/:id (public profile, no email/phone) - migrations 0002: user_preferences, user_locations	2026-08-20 15:49:21 +00:00
ga	8d754f9834	Sprint 1: scaffold backend (Go + Fiber + PG + Redis + MinIO) ... - POST /api/v1/auth/register with mandatory consents - POST /api/v1/auth/login - GET /api/v1/me (protected) - GET /api/v1/legal/{terms,privacy,disclaimer} - Migrations for users, consent_log, audit_log - bcrypt + JWT (access + refresh) - Docker Compose stack	2026-08-20 15:41:05 +00:00