graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/test/towerops_web/controllers/api/v1
History
Graham McIntire ca7bb75472 fix: 11 critical security/correctness bugs from code audit 
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts
- C2: Derive user_id from current_scope instead of client params in policy consent
- C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt())
- C4: Add owner/admin authorization check to MembersController update/delete
- C5: Require HMAC signature on agent release webhook (was optional)
- C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query
- C7: Move auth exemption to before_send callback in BruteForceProtection
- C8: Block </style>/<script injection in status page custom_css validation
- C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored
- C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value
- C13: Remove credentials from PubSub backup broadcast; channel resolves them

C11 (no force_ssl): by design — Cloudflared terminates TLS
C12 (device quota race): false positive — FOR UPDATE serializes correctly
2026-05-12 10:20:52 -05:00
..
activity_controller_test.exs test: add on-call, incident, and PagerDuty notification test coverage 2026-03-14 15:10:27 -05:00
agent_release_webhook_controller_test.exs fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
agents_controller_test.exs add missing REST API controller tests 2026-03-11 14:43:17 -05:00
alerts_controller_test.exs refactor/dry-improvements (#202) 2026-03-28 10:56:34 -05:00
check_results_controller_test.exs update 2026-05-09 15:24:00 -05:00
checks_controller_test.exs add service checks REST API, GraphQL API, and ping executor (#52) 2026-03-16 18:40:18 -05:00
coverages_controller_test.exs test: redis password branches + suppress 0.0 pattern warnings + coverages from() macro fix 2026-05-08 13:57:07 -05:00
devices_controller_test.exs fix: allow site_id on device create regardless of use_sites setting 2026-02-15 12:28:06 -06:00
escalation_policies_controller_test.exs feat: add REST API and GraphQL for on-call schedules and escalation policies 2026-03-11 14:01:15 -05:00
gaiia_webhook_controller_test.exs refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00
geoip_controller_test.exs test: expand coverage across resolvers, vendors, controllers, workers 2026-05-07 14:23:58 -05:00
integrations_controller_test.exs add missing REST API controller tests 2026-03-11 14:43:17 -05:00
invitations_controller_test.exs add missing REST API controller tests 2026-03-11 14:43:17 -05:00
maintenance_windows_controller_test.exs add maintenance windows REST API and GraphQL support 2026-03-11 14:33:25 -05:00
members_controller_test.exs add missing REST API controller tests 2026-03-11 14:43:17 -05:00
mib_controller_test.exs test: lift coverage to 78.42% and link Ansible collection in docs 2026-05-07 16:48:53 -05:00
mikrotik_webhook_controller_test.exs feat(mikrotik): webhook receiver for MikroTik RouterOS events 2026-05-11 18:02:21 -05:00
organization_controller_test.exs add missing REST API controller tests 2026-03-11 14:43:17 -05:00
pagerduty_webhook_controller_test.exs refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00
schedules_controller_test.exs feat: add REST API and GraphQL for on-call schedules and escalation policies 2026-03-11 14:01:15 -05:00
sites_controller_test.exs feat: add critical network switch sensor support (HP Comware, Dell PowerConnect, Dell SONiC) 2026-02-11 17:36:45 -06:00
stripe_webhook_controller_test.exs refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00