Garden store Go web app
- Go 34.1%
- JavaScript 30.7%
- Go Template 29.7%
- PLpgSQL 5.4%
AScully24
21541da27e
Security: - XSS: HTML-escape name/slug in categoryRowHTML; JSON-encode JS args - Auth: use crypto/subtle.ConstantTimeCompare for admin token checks - Config: fatal at startup if STRIPE_SECRET_KEY set without STRIPE_WEBHOOK_SECRET - Checkout: look up all prices server-side; client-supplied prices ignored - Redirect: parse Referer to path-only; validate ?next= is relative in auth middleware and login handler - Logout: restrict to POST only (removes GET logout CSRF vector) Performance: - Sync: use CheckStock instead of GetDetail — avoids downloading full product data on every sync cycle - Migration 011: add 12 indexes on products, product_tags, product_images, orders, order_items Correctness: - Stripe: use math.Round for pence conversion (fixes float truncation) - supplierLabel: add 'marshalls' → 'Marshalls Garden' case - AI fill: add 90s context timeout; remove dead exitErr stub - Email: log send failures instead of silently discarding errors - Remove dead sendOrderFulfilledEmail function - admin_settings: remove hardcoded LAN IP fallback Deps/housekeeping: - go.mod: correct version 1.26.2 → 1.23.2 - Upgrade x/crypto 2019 build → v0.52.0 and all x/ siblings - go mod tidy: stripe-go now correctly marked direct - Add public/robots.txt disallowing /admin/ and /api/ |
||
|---|---|---|
| cmd | ||
| internal | ||
| migrations | ||
| public | ||
| templates | ||
| .env.example | ||
| .gitignore | ||
| agent-admin-api.md | ||
| AGENTS.md | ||
| garden-store.service | ||
| go.mod | ||
| go.sum | ||
| Makefile | ||
| UX-PLAN.md | ||