graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/test/towerops_web/controllers
History
Graham McIntire ca7bb75472 fix: 11 critical security/correctness bugs from code audit 
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts
- C2: Derive user_id from current_scope instead of client params in policy consent
- C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt())
- C4: Add owner/admin authorization check to MembersController update/delete
- C5: Require HMAC signature on agent release webhook (was optional)
- C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query
- C7: Move auth exemption to before_send callback in BruteForceProtection
- C8: Block </style>/<script injection in status page custom_css validation
- C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored
- C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value
- C13: Remove credentials from PubSub backup broadcast; channel resolves them

C11 (no force_ssl): by design — Cloudflared terminates TLS
C12 (device quota race): false positive — FOR UPDATE serializes correctly
2026-05-12 10:20:52 -05:00
..
api fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
admin_controller_test.exs test: expand coverage across resolvers, vendors, controllers, workers 2026-05-07 14:23:58 -05:00
api_docs_controller_test.exs test: lift coverage from 85.84% → 86.28% 2026-05-08 17:44:18 -05:00
debug_controller_test.exs fix: remaining bugs.md findings — Repo calls, process dict, CSS, rate limits, Oban, debug route 2026-05-11 19:34:18 -05:00
error_html_test.exs Fix tests, credo issues, and Gaiia sync bugs 2026-02-15 11:55:49 -06:00
error_json_test.exs security: implement comprehensive security audit fixes 2026-03-05 13:08:10 -06:00
graphql_docs_controller_test.exs test: lift coverage from 85.84% → 86.28% 2026-05-08 17:44:18 -05:00
health_controller_test.exs test(agent_channel): cover assignment-disabled, missing-check, wrong-org branches 2026-05-09 13:38:35 -05:00
invitation_controller_test.exs refactor/dry-improvements (#202) 2026-03-28 10:56:34 -05:00
page_controller_test.exs feat: add Accept: text/markdown content negotiation for agent compatibility 2026-04-17 14:14:31 -05:00
page_html_test.exs fix: resolve compilation errors, test failures, and credo issues 2026-02-14 12:23:10 -06:00
sitemap_controller_test.exs test: improve sitemap controller test coverage 2026-04-17 14:00:57 -05:00
user_confirmation_controller_test.exs test: add on-call, incident, and PagerDuty notification test coverage 2026-03-14 15:10:27 -05:00
user_registration_controller_test.exs test: add controller and LiveView test coverage for untested endpoints 2026-03-14 15:21:12 -05:00
user_reset_password_controller_test.exs test: lift coverage 78.42% → 79.59% with focused unit + integration tests 2026-05-07 18:40:43 -05:00
user_session_controller_test.exs fix user session controller test 2026-02-03 13:42:24 -06:00
user_session_html_test.exs purge more passkey and gettext updates 2026-02-02 10:20:59 -06:00
user_settings_controller_test.exs Convert User Settings from controller to LiveView 2026-01-15 16:29:50 -06:00
user_settings_html_test.exs remove passkeys for now 2026-01-31 09:50:35 -06:00
user_sudo_controller_test.exs fix: address UserSudoController critical issues 2026-02-01 14:45:05 -06:00
well_known_controller_test.exs feat: add /.well-known discovery endpoints for agent readiness 2026-04-17 14:06:51 -05:00