rcourtman 12a5a98117 fix: SSE race conditions, alert user spoofing, and security status oracle ...

SSE Broadcaster:
- Add per-client mutex to prevent concurrent writes to ResponseWriter
- Fix data race in cleanupLoop reading LastActive without synchronization
- Update LastActive in SendHeartbeat so clients aren't incorrectly pruned
  after 5 minutes of idle heartbeat traffic

Alert Acknowledgements:
- Extract authenticated user from X-Authenticated-User header instead of
  hardcoding 'admin' or trusting request body's User field
- Prevents audit log spoofing and ensures accurate user attribution

Security Status Endpoint:
- Remove ?token= query param validation from public /api/security/status
- Prevents endpoint from acting as a token validity oracle for attackers
- Authentication still works via session cookies and X-API-Token header

2026-02-03 17:40:58 +00:00

..

adapter_installsh_exec_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

adapter_installsh_execute_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

adapter_installsh_extra_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

adapter_installsh_helpers_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

adapter_installsh_more_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

adapter_installsh_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

adapter_installsh.go

docs: Add godoc comments to more exported functions

2025-12-02 16:03:57 +00:00

history_test.go

Add unit tests for UpdateHistory (internal/updates)

2025-11-30 20:34:40 +00:00

history.go

Improve update procedure tracking

2025-11-15 16:43:42 +00:00

manager_additional_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

manager_applyupdate_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

manager_check_updates_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

manager_checksum_test.go

Refactor: Core monitoring and update managers multi-tenancy

2026-01-22 16:43:24 +00:00

manager_fileops_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

manager_more_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

manager_sse_helpers_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

manager_test.go

fix(updates): Add RSS/Atom feed fallback for GitHub rate limits

2025-12-20 10:54:14 +00:00

manager.go

Refactor: Core monitoring and update managers multi-tenancy

2026-01-22 16:43:24 +00:00

mock_updater_additional_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

mock_updater_test.go

test: Add comprehensive test coverage across packages

2026-01-19 19:26:18 +00:00

mock_updater.go

docs: Add godoc comments to more exported functions

2025-12-02 16:03:57 +00:00

queue_test.go

Refactor update service to eliminate polling and race conditions

2025-11-11 09:33:05 +00:00

queue.go

style: fix gofmt formatting inconsistencies

2025-11-26 23:44:36 +00:00

sse_test.go

Refactor update service to eliminate polling and race conditions

2025-11-11 09:33:05 +00:00

sse.go

fix: SSE race conditions, alert user spoofing, and security status oracle

2026-02-03 17:40:58 +00:00

updater_test.go

Add unit tests for UpdaterRegistry (internal/updates)

2025-11-30 22:19:06 +00:00

updater.go

chore: remove additional dead code

2025-11-27 05:13:26 +00:00

version_additional_test.go

test: expand backend coverage

2026-01-25 21:08:44 +00:00

version_test.go

style: Apply gofmt to 37 files

2025-12-02 17:21:48 +00:00

version.go

perf: Pre-compile regexes in updates/version package

2025-12-02 15:14:15 +00:00