weichenandCursor 2dd8f46e64 fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8) ...

- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
  on login and register; successful login resets the counter; pure
  stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
  with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
  defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
  gate test actually guards the real flag

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-09-19 06:00:30 +00:00

..

admin_permissions_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

admin_roles_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

admin_system_handlers_test.go

test(sysadmin): cover author-only CAS, audit rollback, and HTTP gates

2026-09-17 09:15:15 +00:00

admin_system_handlers.go

feat(sysadmin): CAS author-only policy with transactional audit

2026-09-17 09:15:15 +00:00

admin_template_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

admin_workflow_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

asset_handlers_test.go

fix(quality): 闭环 Go 质量门禁（鉴权富化/V0.5/vet/health/KB gate/记忆轮询）

2026-09-13 02:50:23 +00:00

asset_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

auth_gate_a_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

auth_handlers_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

auth_handlers.go

fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

2026-09-19 06:00:30 +00:00

auth_helpers.go

fix(server): enforce principal identity and docgov project access (H1-H3)

2026-09-19 05:33:38 +00:00

auth_middleware.go

fix(server): enforce principal identity and docgov project access (H1-H3)

2026-09-19 05:33:38 +00:00

auth_phase1_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

bizdev_stage_gate.go

feat(authz): implement six-phase permissions, settings and workflow v2

2026-09-13 02:50:23 +00:00

body_limit_middleware_test.go

feat(taskrun): resume interrupted runs and harden P1 security gaps

2026-09-13 02:50:23 +00:00

body_limit_middleware.go

feat(upload): reuse MIME validator for workflow template uploads.

2026-09-13 02:50:23 +00:00

chat_digest_api.go

feat(chatflow): authorize rolling summary and surface digest freshness

2026-09-16 15:37:50 +00:00

chat_document_reader_test.go

fix(chat): add authorized readonly document summaries

2026-09-13 04:27:01 +00:00

chat_document_reader.go

fix(chat): add RWMutex to Session and snapshot accessors to close data race

2026-09-19 04:55:55 +00:00

chat_export_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_history_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_history_auth.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_history_refresh_pg_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_project_access_authz_test.go

fix(api): require project membership before chat and chat SSE

2026-09-13 12:25:22 +00:00

chat_recategorize_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_recategorize_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_restore_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_search_and_digest_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_search_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_session_ownership_pg_test.go

test(server): 跨用户会话挂靠负例测试（PG + 内存双实现）

2026-09-18 03:39:08 +00:00

chat_session_ownership_test.go

test(server): 跨用户会话挂靠负例测试（PG + 内存双实现）

2026-09-18 03:39:08 +00:00

chat_turn_api.go

fix(server): enforce principal identity and docgov project access (H1-H3)

2026-09-19 05:33:38 +00:00

chat_unread_and_export_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_unread_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_window_api_test.go

fix(server): fail-closed chat import when Env is empty

2026-09-17 17:03:08 +00:00

chat_window_api.go

fix(server): fail-closed chat import when Env is empty

2026-09-17 17:03:08 +00:00

chatflow_http.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

cors.go

fix(security): add CORS allowlist and enforce principal on chat handlers

2026-09-13 02:50:22 +00:00

document_revision_access.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

document_revision_authz_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

document_revision_duty_write_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

document_revision_handlers.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

document_revision_patch_order_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

document_revision_upload_register_test.go

feat(api): expose POST /freeform-documents for upload registration

2026-09-13 11:12:03 +00:00

e2e_test.go

feat(security): complete P0 release blocking remediation

2026-09-13 02:50:22 +00:00

e2e_workflow_governance_test.go

fix(ci): green governance PG on isolated TEST_DATABASE_URL

2026-09-16 03:20:32 +00:00

freeform_create_authz_test.go

feat(api): expose POST /freeform-documents for upload registration

2026-09-13 11:12:03 +00:00

freeform_create_nonmember_pg_test.go

feat(api): expose POST /freeform-documents for upload registration

2026-09-13 11:12:03 +00:00

freeform_doc_api_test.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

freeform_doc_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

handlers.go

fix(server): enforce principal identity and docgov project access (H1-H3)

2026-09-19 05:33:38 +00:00

intent_plan_handlers_test.go

feat(api): mount authenticated intent plan decision routes

2026-09-16 01:01:39 +00:00

intent_plan_handlers.go

feat(api): mount authenticated intent plan decision routes

2026-09-16 01:01:39 +00:00

lease_concurrency_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

login_rate_limit_test.go

fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

2026-09-19 06:00:30 +00:00

login_rate_limit.go

fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

2026-09-19 06:00:30 +00:00

me_settings_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

multi_intent_u8_piagent_pg_test.go

test(server): add Wave 2 real-PI evidence for U8 and full/none

2026-09-16 10:42:20 +00:00

notification_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

notification_reminder_loop.go

fix(server): 后台 ticker 纳入 Shutdown；vault Drain 告警；bizdev 心跳超时（R-6）

2026-09-18 03:44:08 +00:00

phase5_acceptance_pg_test.go

fix(projectworkflow): generate UTF-8 safe project codes for Chinese names

2026-09-13 02:50:23 +00:00

phase5_fault_injection_pg_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

phase5_finalize_fault_pg_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

phase5_soak_test.go

feat(ops): compose runner auth, upload MIME validation, and test soak

2026-09-13 02:50:23 +00:00

piagent_e2e_test.go

fix(kb): return offline client instead of Fatalf under require-online

2026-09-17 02:04:51 +00:00

principal_context.go

feat(authz): complete Phase 1 admin roles, sessions, and unified admin gate

2026-09-13 02:50:22 +00:00

project_create_pg_test.go

fix(projectworkflow): generate UTF-8 safe project codes for Chinese names

2026-09-13 02:50:23 +00:00

project_doc_content_error_test.go

feat(docquery): serve ledger when projection is missing

2026-09-14 14:07:05 +00:00

project_doc_handlers.go

feat(api): add FAV vault status stub with gated publisher

2026-09-16 15:40:10 +00:00

project_handlers_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

project_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

project_members_authz_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

project_members_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

project_members_role_test.go

fix(authz): clear reviewer/approver slots in the member-write transaction

2026-09-13 22:37:24 +00:00

project_settings_author_only_error_test.go

test(projectinstance): cover author_only planning and activation

2026-09-17 09:39:59 +00:00

project_settings_handlers.go

feat(api): map author-only policy errors on workflow settings

2026-09-17 09:39:59 +00:00

project_workflow_api_test.go

feat(rdev): add medical design-control workflow (13 stages / 60 docs)

2026-09-17 09:46:26 +00:00

reconcile_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

reply_export_api_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

reply_export_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

security_p0_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

security_penetration_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

server_test.go

feat(docgov): expose proposal HTTP and wire frontend decide flow

2026-09-17 14:07:52 +00:00

server.go

fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

2026-09-19 06:00:30 +00:00

software_project_handlers.go

feat(api): SWBOOT-05..08 wizard hooks and SWBOOT-10 allowlist stub

2026-09-16 15:43:13 +00:00

sse_wave0_test.go

fix(server): extend SSE write deadline for chat and run/stream

2026-09-17 16:42:56 +00:00

sse.go

fix(server): thread request ctx through session bootstrap, drop Background DB calls

2026-09-19 05:03:01 +00:00

stage_access_helpers_test.go

feat(api): duty-check canonical docs before they are persisted

2026-09-14 08:39:44 +00:00

stage_access_helpers.go

fix(chat): add RWMutex to Session and snapshot accessors to close data race

2026-09-19 04:55:55 +00:00

static_assets_test.go

feat(server): negotiate static compression and fix asset SPA fallback

2026-09-17 08:18:11 +00:00

static_assets.go

feat(server): negotiate static compression and fix asset SPA fallback

2026-09-17 08:18:11 +00:00

task_finalize_test.go

refactor(bizdev): delete eight locator getters

2026-09-15 13:08:25 +00:00

task_finalize.go

refactor(bizdev): delete eight locator getters

2026-09-15 13:08:25 +00:00

task_run_auth.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

task_run_authz_pg_test.go

fix(api): 任务同步与SSE入口补齐项目成员鉴权

2026-09-13 02:50:23 +00:00

task_run_busy_preflight_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

task_run_handlers.go

fix(server): chat/sessions upsert 与任务创建强制取 principal（R-1b）

2026-09-18 03:39:08 +00:00

task_run_idempotent_sse_test.go

fix(server): drain taskrun workers before TempDir cleanup

2026-09-16 09:33:41 +00:00

task_run_observer_test.go

feat(security): complete P0 release blocking remediation

2026-09-13 02:50:22 +00:00

task_run_persistence_pg_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

task_run_request_build_test.go

fix(docgov): pass dynamic StageKey into document ledger create

2026-09-17 09:46:09 +00:00

task_run_resume_pg_test.go

feat(taskrun): resume interrupted runs and harden P1 security gaps

2026-09-13 02:50:23 +00:00

taskstream_test.go

test(server,app): delete dead resume-workspace test; clarify plan_owner redirect

2026-09-18 03:02:06 +00:00

test_auth_helper_test.go

feat(security): complete P0 release blocking remediation

2026-09-13 02:50:22 +00:00

test_auth_helpers.go

fix(auth): restrict demo seed users to dev/test environments

2026-09-13 02:50:22 +00:00

test_helpers_test.go

test(governance): PI Agent PG 全链路实测通过并固化运行条件

2026-09-13 02:50:23 +00:00

vault_test.go

feat(events): add FAV subscriber shadow without live writes

2026-09-17 04:25:17 +00:00

vault.go

fix(server): 后台 ticker 纳入 Shutdown；vault Drain 告警；bizdev 心跳超时（R-6）

2026-09-18 03:44:08 +00:00

web_assets_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

workflow_approval_hook.go

feat(app): drop production outbox and approval hook registration

2026-09-15 14:23:07 +00:00

workflow_catalog_handlers.go

feat(workflow): SWBOOT-02..04 software manifests and catalog allowlist

2026-09-16 15:39:01 +00:00

workflow_governance_full_none_piagent_pg_test.go

fix(ci): load real KB password for host-side PI E2E

2026-09-17 00:52:01 +00:00

workflow_governance_pg_test.go

fix(ci): green governance PG on isolated TEST_DATABASE_URL

2026-09-16 03:20:32 +00:00

workflow_governance_piagent_pg_test.go

fix(kb): return offline client instead of Fatalf under require-online

2026-09-17 02:04:51 +00:00

workflow_instance_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

workflow_terminate_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00