2 Commits

Author	SHA1	Message	Date
hobokenchicken	130187c7be	security: remediate all P0-P2 audit findings (12 tasks) ... P0 fixes: - WebSocket origin checking (reject untrusted origins) - WS session token moved from URL query param to first message frame - WebAuthn login cookie now uses Secure flag via shared SetSessionCookie - PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require) - Fixed DatabaseDSN to use real password instead of masked placeholder P1 fixes: - Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s) - Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.) - WS broadcasts scoped to server members (prevents cross-server data leak) - Webhook tokens stored as SHA-256 hashes (not plaintext) P2 fixes: - CSRF protection via Origin header validation on state-changing requests - MANAGE_CHANNELS permission enforced on channel update/delete - Upload validation: 25MB limit, extension allowlist, server-side MIME check - File serve: path traversal protection + Content-Disposition: attachment Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build). Zero CVEs (govulncheck, npm audit).	2026-06-29 09:30:50 -04:00
hobokenchicken	2a6b3830d5	Phase 5: TUI client (Bubbletea) ... - cmd/tui/main.go: entry point with --server, --token, --version flags - cmd/tui/config.go: config from ~/.config/dumpster/config.yaml or env vars - cmd/tui/auth.go: login flow, session cookie management - cmd/tui/api.go: HTTP client for servers, channels, messages, voice - cmd/tui/model.go: root bubbletea model with state management - cmd/tui/theme.go: Gruvbox dark lipgloss styles - cmd/tui/servers.go: server bar with [D] style initials - cmd/tui/channels.go: channel list with #text and 🔊 voice - cmd/tui/chat.go: IRC-style message viewport with colored usernames - cmd/tui/input.go: message input with > _ prompt - cmd/tui/members.go: member list with ●/◐/○ status - cmd/tui/ws.go: WebSocket client for real-time events - cmd/tui/voice.go: voice state tracking and mute toggle - cmd/tui/keys.go: vim-style keybindings (j/k, g/G, Tab, /, etc) - cmd/tui/views.go: multi-pane layout rendering - Makefile: added build-tui and run-tui targets - go.mod/go.sum: added charmbracelet dependencies	2026-06-28 17:46:19 -04:00