Adam French b56f8253d9 Harden backend against critical and high security vulnerabilities ...

- Fix WebSocket CheckOrigin to use proper url.Parse instead of string stripping
- Add admin auth checks to Users/User GraphQL queries
- Remove GraphQL GET transport to prevent CSRF via cross-site links
- Add application-level IP-based login rate limiting (5 attempts/min)
- Add path traversal bounds check on radio file upload
- Require DEV_MODE for GraphQL introspection and playground
- Move notes backend endpoint behind admin middleware
- Add dedicated Nginx rate limit zone for GraphQL (10r/s)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-14 13:27:33 +01:00

..

model

Add job application quick reference for storing profile links and experience

2026-04-13 12:38:53 +01:00

schema

Add job application quick reference for storing profile links and experience

2026-04-13 12:38:53 +01:00

activity.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

bookmark.resolvers.go

Add database-backed bookmarks via GraphQL

2026-04-13 12:04:13 +01:00

context.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

favorite.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

generated.go

Add job application quick reference for storing profile links and experience

2026-04-13 12:38:53 +01:00

gitea_helpers.go

Move Gitea feed from frontend to backend with cached GraphQL proxy

2026-03-17 00:14:59 +00:00

job_app_reference.resolvers.go

Add job application quick reference for storing profile links and experience

2026-04-13 12:38:53 +01:00

job_application.resolvers.go

Add job application tracker (admin-only)

2026-04-13 09:51:31 +01:00

message.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

middleware.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

post.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

resolver.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

rowing.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

schema.resolvers.go

Harden backend against critical and high security vulnerabilities

2026-04-14 13:27:33 +01:00

spotify_helpers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00

steam_helpers.go

Add Steam integration showing online status and recent games

2026-03-26 01:59:34 +00:00

user.resolvers.go

Consolidate frontend REST calls with GraphQL

2026-03-16 15:29:22 +00:00