kolaenteandkolaente 2c9e71a2b3 fix(ratelimit): don't panic on unauthenticated requests ...

With ratelimit.kind at its default value of "user", the rate limit
middleware logged the error from GetAuthFromClaims and then dereferenced
the nil web.Auth anyway. Every unauthenticated /api/v2 request produces
exactly that state, since v2 attaches the limiter to the single group
serving its public routes too - so enabling rate limiting turned
/api/v2/info, /api/v2/health and /api/v2/login into 500s. v1 is
unaffected because it splits its unauthenticated routes into their own
ip-keyed subgroups before the "user" limiter is attached.

Fall back to keying by IP, matching the "ip" kind and v1's
unauthenticated groups. Authenticated requests are unchanged.

2026-07-27 22:31:06 +00:00

..

_test.go.tpl

…

admin_share_bypass_test.go

…

admin_test.go

feat: audit admin reads and denied admin access

2026-07-03 16:56:03 +00:00

api_token_method_matching_test.go

fix: hide license-gated routes from api token scope list (#3216)

2026-07-18 10:00:37 +02:00

api_tokens_test.go

fix(api): derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

archived_test.go

…

background_test.go

…

caldav_test.go

feat(caldav): implement RFC 6578 sync-collection REPORT to sync task deletions

2026-07-07 11:57:04 +00:00

error_responses_test.go

…

healthcheck_test.go

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

huma_admin_actions_test.go

fix: dispatch pending events in admin handlers

2026-07-03 16:56:03 +00:00

huma_admin_test.go

test(api/v2): port full v1 admin projects coverage

2026-06-03 19:48:08 +00:00

huma_api_token_test.go

feat(api/v2): add API token list/create/delete on /api/v2

2026-06-05 08:49:23 +00:00

huma_archived_test.go

test(api/v2): isolate project tests per-handler, not via shared harness

2026-06-05 07:40:07 +00:00

huma_auth_login_test.go

fix(auth): build OIDC end-session URL with RP-Initiated Logout params (#2943)

2026-06-19 18:27:33 +02:00

huma_auth_refresh_test.go

feat(api/v2): port refresh-token endpoint to /api/v2

2026-06-17 20:34:38 +00:00

huma_auth_test.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

huma_avatar_test.go

test(api/v2): port full v1 avatar coverage to TestAvatar

2026-06-03 19:58:27 +00:00

huma_avatar_upload_test.go

fix(api/v2): reject non-decodable images (e.g. SVG) on avatar upload with 400

2026-06-02 11:55:25 +00:00

huma_background_download_test.go

test(api/v2): cover background download and unsplash proxy routes

2026-06-17 11:31:50 +00:00

huma_background_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_background_upload_test.go

feat(api/v2): add project background upload on /api/v2

2026-06-12 08:47:08 +00:00

huma_bot_user_test.go

feat(api/v2): add bot user CRUD on /api/v2

2026-06-05 08:51:39 +00:00

huma_bucket_test.go

feat(api/v2): add kanban bucket CRUD endpoints

2026-06-26 08:56:15 +00:00

huma_bulk_task_test.go

feat(api/v2): add bulk task updates on /api/v2

2026-06-09 20:13:02 +00:00

huma_caldav_token_test.go

feat(api/v2): add CalDAV tokens on /api/v2

2026-06-10 17:55:52 +00:00

huma_errors_test.go

test(api/v2): Label round-trip, ETag, PATCH, error shapes

2026-05-31 12:56:57 +00:00

huma_helpers_test.go

test(api/v2): Label round-trip, ETag, PATCH, error shapes

2026-05-31 12:56:57 +00:00

huma_info_test.go

fix(tasks): add labels sequentially when the backend db serializes writes

2026-06-19 14:19:19 +00:00

huma_label_task_bulk_test.go

feat(api/v2): add bulk label replacement on /api/v2

2026-06-10 11:56:05 +02:00

huma_label_task_test.go

feat(api/v2): add task labels (create/list/delete) on /api/v2

2026-06-05 08:33:47 +00:00

huma_label_test.go

feat(labels): let bot owners manage labels created by their bots

2026-06-09 11:40:04 +00:00

huma_link_sharing_test.go

fix(link-sharing): resolve share read permission via project id so by-id reads work

2026-06-05 09:17:25 +00:00

huma_migration_csv_test.go

test(api/v2): cover the v2 file and CSV migrator endpoints

2026-06-12 08:51:19 +00:00

huma_migration_file_test.go

test(api/v2): cover the v2 file and CSV migrator endpoints

2026-06-12 08:51:19 +00:00

huma_migration_oauth_test.go

feat(api/v2): port OAuth migrators (Todoist, Trello, Microsoft To-Do)

2026-06-11 18:35:55 +00:00

huma_non_crud_aliases_test.go

feat(api/v2): expose websocket endpoint under /api/v2

2026-06-17 20:35:28 +00:00

huma_notification_test.go

fix(api/v2): return 200 from notifications mark-all (creates nothing)

2026-06-07 10:05:24 +00:00

huma_project_duplicate_test.go

fix(projects): enforce write permission on target parent when duplicating a project (GHSA-f27p-pw2p-9pr4)

2026-07-19 18:59:34 +02:00

huma_project_team_test.go

feat(api/v2): add project team shares CRUD on /api/v2

2026-06-07 15:33:20 +00:00

huma_project_test.go

test(api/v2): cover central validation (422, invalid_fields, full-body webhook updates)

2026-06-06 21:09:56 +00:00

huma_project_user_test.go

feat(api/v2): add project user shares CRUD on /api/v2

2026-06-07 10:37:59 +00:00

huma_project_view_test.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

huma_rate_limit_test.go

fix(ratelimit): don't panic on unauthenticated requests

2026-07-27 22:31:06 +00:00

huma_reaction_test.go

feat(api/v2): add reactions on /api/v2

2026-06-09 21:34:22 +00:00

huma_richtext_test.go

feat(api): exchange rich-text fields as markdown on v2

2026-06-29 08:12:35 +02:00

huma_saved_filter_test.go

feat(api/v2): add saved filter CRUD on /api/v2

2026-06-07 10:40:20 +00:00

huma_session_test.go

feat(api/v2): add session list/delete on /api/v2

2026-06-05 08:21:48 +00:00

huma_subscription_test.go

docs: trim wordy comments to load-bearing whys

2026-06-07 09:57:51 +00:00

huma_task_assignee_bulk_test.go

feat(api/v2): add bulk assignee replacement on /api/v2

2026-06-09 19:42:16 +00:00

huma_task_assignee_test.go

feat(api/v2): add task assignees (create/list/delete) on /api/v2

2026-06-06 19:06:12 +00:00

huma_task_attachment_test.go

fix(attachments): keep blob mime type so pdf previews open inline (#3157)

2026-07-11 18:53:09 +02:00

huma_task_bucket_test.go

fix(kanban): authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)

2026-07-19 18:59:34 +02:00

huma_task_collection_test.go

feat(api/v2): add task collection (task lists) on /api/v2

2026-06-11 18:31:03 +00:00

huma_task_comment_test.go

test(api/v2): assert task comment max_permission and per-caller ETag

2026-06-05 07:43:38 +00:00

huma_task_duplicate_test.go

test(api/v2): port full v1 TaskDuplicate coverage

2026-06-03 20:29:15 +00:00

huma_task_position_test.go

feat(api/v2): add task position updates on /api/v2

2026-06-10 11:55:51 +02:00

huma_task_relation_test.go

feat(api/v2): add task relations on /api/v2

2026-06-09 20:42:00 +00:00

huma_task_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

huma_task_unread_status_test.go

feat(api/v2): add task read-status marking on /api/v2

2026-06-09 19:50:58 +00:00

huma_team_member_test.go

feat(api/v2): add team members (add/remove/admin-toggle) on /api/v2

2026-06-07 10:48:23 +00:00

huma_team_test.go

test(api/v2): assert both ETags non-empty in team permission test

2026-06-05 08:06:54 +00:00

huma_testing_test.go

test(api/v2): use cross-engine datetime literals in testing webtest

2026-06-17 12:13:50 +00:00

huma_time_entry_test.go

test(time-tracking): cover the v2 time-entry routes

2026-06-08 13:54:09 +00:00

huma_user_deletion_test.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

huma_user_export_test.go

fix(files): never cache file downloads in v1 or v2

2026-06-17 18:39:38 +00:00

huma_user_search_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_user_settings_test.go

feat(api/v2): add user account/settings on /api/v2

2026-06-11 07:02:31 +00:00

huma_user_totp_test.go

feat(api/v2): add totp qr code endpoint

2026-06-17 18:39:38 +00:00

huma_user_webhook_test.go

feat(api/v2): add user webhooks on /api/v2

2026-06-10 19:12:41 +00:00

huma_webhook_event_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_webhook_test.go

test(api/v2): cover central validation (422, invalid_fields, full-body webhook updates)

2026-06-06 21:09:56 +00:00

integrations.go

test(api/v2): isolate project tests per-handler, not via shared harness

2026-06-05 07:40:07 +00:00

kanban_test.go

fix(kanban): prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)

2026-07-19 18:59:34 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

link_sharing_auth_test.go

…

link_sharing_test.go

…

login_test.go

fix(auth): return ErrAccountLocked for locked accounts on login

2026-06-17 19:43:41 +00:00

main_test.go

…

oauth2_test.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

project_pseudo_parent_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

register_test.go

…

sessions_test.go

…

task_attachment_idor_test.go

…

task_attachment_upload_test.go

…

task_by_index_test.go

…

task_collection_test.go

fix(kanban): pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)

2026-07-19 18:59:34 +02:00

task_comment_test.go

…

task_test.go

…

token_test.go

…

user_change_password_test.go

…

user_confirm_email_test.go

…

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

…

user_totp_test.go

…

webhook_test.go

…