Address all golangci-lint v2.10.1 (CI's version) findings:
* Add http.MaxBytesReader hard cap to ParseMultipartForm sites in
rest_private.savePictureCtrl (32MB) and api/migrator (256MB) — fixes
G120 by bounding total request body before form parsing.
* Suppress G70x in CLI subcommands cmd/{backup,cleanup,import,remap}.go:
all four issue HTTP requests against operator-supplied RemarkURL/CLI
flags, never user input. Each suppression carries a one-line reason.
* Suppress G122 in image fs_store cleanup walk: staging directory tree
is server-only, no untrusted symlinks land there.
CI's golangci-lint v2.10.1 (newer rule set than my local 2.11.4) flags
four G70x cases the previous run missed. All are false positives:
backup.go and cleanup.go drive HTTP requests against the operator's own
RemarkURL from CLI flags (not user input); migrator.go removes a temp
file whose name was returned by os.CreateTemp (server-controlled). Add
targeted //nolint:gosec comments naming the reason at each site.
Replace WriteHeader() + RenderJSON() pattern with EncodeJSON() which
properly sets Content-Type header before writing status code. The
previous pattern caused Content-Type to default to text/plain instead
of application/json, breaking frontend JSON parsing.
Fixes#1979
Replace go-chi/render with go-pkgz/rest for JSON responses and custom
helpers for HTML/plain text responses.
Key changes:
- Replace render.JSON/render.Status with rest.RenderJSON and explicit
w.WriteHeader() calls
- Replace render.DecodeJSON with json.NewDecoder().Decode()
- Add SendErrorJSON helper that sets Content-Type header before
WriteHeader (required since rest.RenderJSON can't set headers after
WriteHeader is called)
- Add HTMLResponse and PlainTextResponse helpers
Fix export double-execution in migrator.go:
The original code called Export twice - once to io.Discard to check for
errors, then again to actually write. This was wasteful and had a race
condition risk. Now file mode buffers to memory first for atomic
success/failure, while stream mode writes directly with proper error
handling.
Previously, status 200 was set for file export, which is used
for backup, which resulted in an inability to set an error status code
in case of a problem with file generation.
After this change, status code 200 would be written automatically by Go
before we start writing the response's body.
* WIP: url mapper, wrapped reader approach
* create url mapper on start
* add pattern matching in mapper
* check pattern matching in test
* change site-id from radio-t to remark42 in tests
* create new url mapper on demand, based on given func, union strict and prefix rules
* rename convert to remap
* add import with mapper test
* rename mapper func to UrlMapperMaker, create comments in test via data service
* move /import/wait to /wait ctrl
* add remap cmd
* fix url naming
* fresh vendor
* enforce vendor flag with env
* move tree to service package
* move controllers routing to rest.go, remove separate subrouters
* cleanup/formatting
* missing vendor packages
* move rss, img proxy, robots and getstarted to top-level routes
* simplify logger middleware usage
* randomize server test ports
* check for non-admin in admin tests
* lint: minor warns
* admin test to jwt admin
* remove cache, switch to go-pkgz/rest/cache
* remove mongo cache from server test
* remove old caching code
* test tricky disqus inputs
* fix migrator test
* stacktrace dump test
* import with two-stages, wait api and prevnts double run for the same site #231
* lint: missing err check on tmp import file removal
* catch SIQQUIT
* add imprter comments
* add new import apis to spec
* add test for form import
* timeout for import wait api
* lint: uncecked errs
* support flags commands, move to cmd
* fix target name
* test for happy path importer
* add export cmd
* fix wrong import, lint warns
* increase test timeout
* add sellp to allow main test server to start
* implement all cmds
* handle backup/restore errors
* fix import status check, hide secret from logs
* backup cmd err tests
* randimize test port
* avoid dup code in Last controller
* add target to make all bin archives
* remove container in make
* add smiple scripts to simplify commands, update readme
* add docs on dockerless, enforce app user
* add restore info
* move last to lastCommentsScope const
* add keyStore and switch all secret usage to this store
- implement static ks
- add shared secret
* lint: shadow in jwt and missing comment
* rename static key group to shared and use top-level shared secret
* move siteID extraction (from token) to internal func
* lint: merge var and assign for key test
* add siteID to cache Get
* indirect option setters
* add mongo cache with tests, add Key and Flusher
* lint: minor warns
* workaround for cache parallel test
* repeater in mongo cache
* missing repeater vendor
* fix nop cache
* add cache mongo benchmark
* wired mongo cache, single opts group for mongo
* disable goconst
* stop cache repeated on not found error
* use local mongo for tests in travis
* WIP: start mongo engine
* WIP: mongo accessor and admin
* integrate mongo store to main
* disable mongo tests by default, only in CI
* connection with constructor
* add mongo buffered writer
* buffered mongo writer
* fix nil responses on an empty list from mongo
* missing mongo index for scores
* cancelable store
* add gridfs implementation of avatar store
* fix race on mongo session copy
* gridfs avatars without tmp files
* move avatar store
* minor comments and refactoring for avatar store
* merged from current master
* simplify gridfs reader
* lint: fix minor warns
* test mongo against env defined url
* pass MONGO_REMARK_TEST to docker and travis
* set dockerfile env for mongo test url
* increase connect timeout in mongo tests
* pass MONGO_REMARK_TEST to drone build
* add MONGO_REMARK_TEST to branch stage of drone
* mass mongo test url via build_args_from_env
* populate mongo IP to docker build hosts
* test env
* pass mongo ip via .mongo
* remove .mongo temp from git
* add .mongo -> env to linter step
* allow more time to autoflush writer test
* default mongo tests to "mongo" if not in env
* merge fresh master into
* add test for mongo cleanup
* msg for a failed test
* lazy fix for failed test
* add an ability to skip all mongo tests
* add backend dev instructions
* remove unused code from mongo server
* move mongo testing to connection_test
* restore testing.go
* lint: minor warns for testing code
Dmitry VerkhoturovandUmputun
romanilchyshynandUmputun
Anton KosourovandUmputun