fix(frontend): remove white flash on comments iframe load

on dark host pages the widget flashed an opaque white rectangle while loading.
the iframe element carries color-scheme from the theme param, but its document
had none until remark.tsx ran, and a mismatched color-scheme makes the embedded
canvas opaque instead of transparent. broken since #2023 added the element-side
color-scheme to fix a firefox dark-mode bug.

set the document's color-scheme from the theme param in an inline head script,
before first paint, using the same rule as create-iframe.ts. that closes the long
window but not the surface browsers paint before the document is parsed, which
webkit renders white and chromium hides behind paint holding. so also create the
iframe hidden and reveal it when the document posts inited, with a timeout
fallback so a failed bootstrap cannot leave the widget invisible.

the reveal lives in createIframe rather than embed.ts so the profile modal, the
other caller, gets it too. that modal focuses its iframe on open, and a hidden
element cannot take focus, so focus now fires from the reveal instead of a timer.

covered by a unit test for the reveal paths and the event.source guard, and by
e2e for the document's color-scheme and the iframe's visibility before inited,
after inited, and after the fallback.

.github/dependabot.yml

@@ -0,0 +1,72 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      "GitHub Actions updates":
+        patterns:
+          - "*"
+  - package-ecosystem: "gomod"
+    directory: "/backend"
+    schedule:
+      interval: "monthly"
+    groups:
+      "Go modules updates":
+        dependency-type: "production"
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "monthly"
+    groups:
+      "NPM modules updates":
+        dependency-type: "production"
+      "NPM modules updates for tests":
+        dependency-type: "development"
+  - package-ecosystem: "npm"
+    directory: "/frontend/packages/api"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "monthly"
+    groups:
+      "NPM modules updates":
+        dependency-type: "production"
+      "NPM modules updates for tests":
+        dependency-type: "development"
+  - package-ecosystem: "npm"
+    directory: "/frontend/e2e"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "monthly"
+    groups:
+      "NPM modules updates":
+        dependency-type: "production"
+      "NPM modules updates for tests":
+        dependency-type: "development"
+  - package-ecosystem: "npm"
+    directory: "/frontend/apps/remark42"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "monthly"
+    groups:
+      "NPM modules updates":
+        dependency-type: "production"
+      "NPM modules updates for tests":
+        dependency-type: "development"
+  - package-ecosystem: "npm"
+    directory: "/site"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: "monthly"
+    groups:
+      "NPM modules updates":
+        dependency-type: "production"
+      "NPM modules updates for tests":
+        dependency-type: "development"

.github/workflows/ci-backend.yml

@@ -5,24 +5,35 @@ on:
     branches:
     tags:
     paths:
-      - ".github/workflows/ci-test-backend.yml"
+      - ".github/workflows/ci-backend.yml"
       - "backend/**"
+      - "Dockerfile"
+      - "docker-init.sh"
+      - ".dockerignore"
       - "!backend/scripts/**"
       - "!**.md"
   pull_request:
     types: [opened, reopened]
     paths:
-      - ".github/workflows/ci-test-backend.yml"
+      - ".github/workflows/ci-backend.yml"
       - "backend/**"
+      - "Dockerfile"
+      - "docker-init.sh"
+      - ".dockerignore"
       - "!backend/scripts/**"
       - "!**.md"
+
 jobs:
   test:
     name: Test & Coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: debug if needed
         run: if [[ "$DEBUG" == "true" ]]; then env; fi
@@ -30,9 +41,10 @@ jobs:
           DEBUG: ${{secrets.DEBUG}}
 
       - name: install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.21"
+          go-version: "1.25"
+          cache-dependency-path: backend
 
       - name: test and build backend
         run: |
@@ -52,15 +64,15 @@ jobs:
           TZ: "America/Chicago"
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v1.58
+          version: "v2.10.1"
           working-directory: backend/app
 
       - name: golangci-lint on example directory
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v1.58
+          version: "v2.10.1"
           args: --config ../../.golangci.yml
           working-directory: backend/_example/memory_store
 

.github/workflows/ci-build.yml

@@ -1,18 +1,6 @@
 name: build
 
 on:
-  push:
-    branches:
-    tags:
-    paths:
-      - ".github/workflows/ci-build.yml"
-      - "backend/**"
-      - "frontend/apps/**"
-      - ".dockerignore"
-      - "docker-init.sh"
-      - "Dockerfile"
-      - "!**.md"
-      - "!frontend/packages/**"
   pull_request:
     paths:
       - ".github/workflows/ci-build.yml"
@@ -23,79 +11,56 @@ on:
       - "Dockerfile"
       - "!**.md"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-images:
-    name: Build Docker images
+    name: Validate Docker build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
-
-      - name: set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
-      - name: available platforms
-        run: echo ${{ steps.buildx.outputs.platforms }}
+      - name: expose GitHub Actions cache
+        uses: actions/cache@v6
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
 
-      - name: build docker image without pushing (only outside master)
-        if: ${{ github.ref != 'refs/heads/master' }}
+      - name: free disk space
         run: |
-          docker buildx build \
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          docker system prune -af
+
+      - name: build docker image without pushing
+        run: |
+          docker buildx build --load \
+              --cache-from type=local,src=/tmp/.buildx-cache \
+              --cache-to type=local,dest=/tmp/.buildx-cache-new,mode=max \
               --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true \
               --platform linux/amd64 .
 
-      - name: build example docker image without pushing (only outside master)
-        if: ${{ github.ref != 'refs/heads/master' }}
+      - name: build example docker image without pushing
         run: |
-          docker buildx build \
+          docker buildx build --load \
+              --cache-from type=local,src=/tmp/.buildx-cache \
               --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true \
               --platform linux/amd64 -f backend/_example/memory_store/Dockerfile .
 
-      - name: build and deploy master image to ghcr.io and dockerhub
-        if: ${{ github.ref == 'refs/heads/master' }}
-        env:
-          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
-          DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
-          USERNAME: ${{ github.actor }}
-          GITHUB_SHA: ${{ github.sha}}
-          GITHUB_REF: ${{ github.ref}}
+      - name: rotate cache
         run: |
-          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
-          echo "GITHUB_REF=${GITHUB_REF}, GITHUB_SHA=${GITHUB_SHA}, GIT_BRANCH=${ref}"
-          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
-          echo ${DOCKER_HUB_TOKEN} | docker login -u umputun --password-stdin
-          docker buildx build --push \
-              --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true --build-arg CI=github \
-              --build-arg GITHUB_SHA=${GITHUB_SHA} --build-arg GIT_BRANCH=${ref} --build-arg GITHUB_REF=${GITHUB_REF} \
-              --platform linux/amd64,linux/arm/v7,linux/arm64 \
-              -t ghcr.io/umputun/remark42:${ref} -t umputun/remark42:${ref} .
-
-      - name: deploy tagged (latest) to ghcr.io and dockerhub
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        env:
-          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
-          DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
-          USERNAME: ${{ github.actor }}
-          GITHUB_SHA: ${{ github.sha}}
-          GITHUB_REF: ${{ github.ref}}
-        run: |
-          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
-          echo "GITHUB_REF=${GITHUB_REF}, GITHUB_SHA=${GITHUB_SHA}, GIT_BRANCH=${ref}"
-          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
-          echo ${DOCKER_HUB_TOKEN} | docker login -u umputun --password-stdin
-          docker buildx build --push \
-              --build-arg SKIP_BACKEND_TEST=true --build-arg SKIP_FRONTEND_TEST=true --build-arg CI=github \
-              --build-arg GITHUB_SHA=${GITHUB_SHA} --build-arg GIT_BRANCH=${ref} --build-arg GITHUB_REF=${GITHUB_REF} \
-              --platform linux/amd64,linux/arm/v7,linux/arm64 \
-              -t ghcr.io/umputun/remark42:${ref} -t ghcr.io/umputun/remark42:latest \
-              -t umputun/remark42:${ref} -t umputun/remark42:latest .
-
-      - name: remote deployment to remark42.com from master
-        if: ${{ github.ref == 'refs/heads/master' }}
-        env:
-          UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
-        run: curl -s https://jess.umputun.com/update/remark42-core/${UPDATER_KEY}
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache || true

.github/workflows/ci-frontend-api.yml

@@ -18,38 +18,30 @@ jobs:
   type-check:
     name: Type check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [ 20 ]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -62,38 +54,30 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [ 20 ]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -106,38 +90,30 @@ jobs:
   test:
     name: Tests & Coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [ 20 ]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -147,7 +123,9 @@ jobs:
         run: pnpm coverage:api
         working-directory: ./frontend
 
-      - name: Submit coverage
-        run: ${{ github.workspace }}/frontend/apps/remark42/node_modules/.bin/codecov
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          working-directory: ./frontend
+          codecov_yml_path: ./frontend/apps/remark42/codecov.yml

.github/workflows/ci-frontend.yml

@@ -18,38 +18,30 @@ jobs:
   translations-check:
     name: Translations check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [20]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -62,38 +54,30 @@ jobs:
   type-check:
     name: Type check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [20]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -106,38 +90,30 @@ jobs:
   lint:
     name: Eslint & Stylelint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [20]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -151,21 +127,25 @@ jobs:
     name: Size limit
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       CI_JOB_NUMBER: 1
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
       - name: Check bundle size
-        uses: andresz1/size-limit-action@7313b26c76b3666c1dc41e2ca05370e201a9b7de
+        uses: andresz1/size-limit-action@94bc357df29c36c8f8d50ea497c3e225c3c95d1d
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           directory: ./frontend/apps/remark42
@@ -174,38 +154,30 @@ jobs:
   test:
     name: Tests & Coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
-        node: [16.20.2]
+        node: [20]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/checkout@v7
         with:
-          node-version: ${{ matrix.node }}
+          persist-credentials: false
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2.4.0
-        id: pnpm-install
+        uses: pnpm/action-setup@v6.0.9
         with:
-          version: 7
+          version: 10.10.0
           run_install: false
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "::set-output name=pnpm_cache_dir::$(pnpm store path)"
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
+      - name: Install node
+        uses: actions/setup-node@v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: ${{ matrix.node }}
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
         run: pnpm i
@@ -215,7 +187,9 @@ jobs:
         run: pnpm coverage
         working-directory: ./frontend/apps/remark42
 
-      - name: Submit coverage
-        run: ${{ github.workspace }}/frontend/apps/remark42/node_modules/.bin/codecov
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          working-directory: ./frontend/apps/remark42
+          codecov_yml_path: ./frontend/apps/remark42/codecov.yml

.github/workflows/ci-site.yml

@@ -1,10 +1,11 @@
 name: site
 
 on:
+  release:
+    types: [published]
   push:
     branches:
       - master
-    tags:
     paths:
       - ".github/workflows/ci-site.yml"
       - "site/**"
@@ -13,57 +14,131 @@ on:
       - ".github/workflows/ci-site.yml"
       - "site/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    name: Build
-    runs-on: ubuntu-latest
+    name: Build site image (${{ matrix.platform }})
+    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            artifact: linux-amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            artifact: linux-arm64
 
     steps:
       - name: checkout
-        uses: actions/checkout@v4
-
-      - name: set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
-      - name: available platforms
-        run: echo ${{ steps.buildx.outputs.platforms }}
+      - name: login to ghcr.io
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PKG_TOKEN }}
 
-      - name: build and deploy master image to ghcr.io and dockerhub
-        if: ${{ github.ref == 'refs/heads/master' }}
+      - name: build and push by digest
+        id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: ./site
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=site-${{ matrix.platform }}
+          cache-to: type=gha,scope=site-${{ matrix.platform }},mode=max
+          outputs: type=image,name=ghcr.io/umputun/remark42-site,push-by-digest=true,name-canonical=true,push=true
+
+      - name: export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: upload digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: site-digests-${{ matrix.artifact }}
+          path: /tmp/digests/*
+          retention-days: 1
+
+  merge:
+    name: Create site multi-arch manifest
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: /tmp/digests
+          pattern: site-digests-*
+          merge-multiple: true
+
+      - name: verify all digests present
+        run: |
+          expected=2
+          actual=$(find /tmp/digests -maxdepth 1 -type f | wc -l)
+          if [ "$actual" -ne "$expected" ]; then
+            echo "Expected $expected digests, found $actual"
+            ls -la /tmp/digests
+            exit 1
+          fi
+          echo "All $expected digests present"
+
+      - name: set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: login to ghcr.io
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PKG_TOKEN }}
+
+      - name: create manifest and push
+        working-directory: /tmp/digests
         env:
-          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
-          USERNAME: ${{ github.actor }}
-          GITHUB_SHA: ${{ github.sha}}
-          GITHUB_REF: ${{ github.ref}}
-        working-directory: ./site
+          GITHUB_REF: ${{ github.ref }}
         run: |
           ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
-          echo GITHUB_REF - $ref
-          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
-          docker buildx build --push --no-cache --platform linux/amd64,linux/arm/v7,linux/arm64 \
-            -t ghcr.io/umputun/remark42-site:${ref} .
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            docker buildx imagetools create \
+              -t ghcr.io/umputun/remark42-site:${ref} \
+              -t ghcr.io/umputun/remark42-site:latest \
+              $(printf 'ghcr.io/umputun/remark42-site@sha256:%s ' *)
+          else
+            docker buildx imagetools create \
+              -t ghcr.io/umputun/remark42-site:${ref} \
+              $(printf 'ghcr.io/umputun/remark42-site@sha256:%s ' *)
+          fi
 
-      - name: deploy tagged (latest) to ghcr.io and dockerhub
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        env:
-          GITHUB_PACKAGE_TOKEN: ${{ secrets.PKG_TOKEN }}
-          USERNAME: ${{ github.actor }}
-          GITHUB_SHA: ${{ github.sha}}
-          GITHUB_REF: ${{ github.ref}}
-        working-directory: ./site
-        run: |
-          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
-          echo "GITHUB_REF=$ref, GITHUB_SHA=${GITHUB_SHA}"
-          echo ${GITHUB_PACKAGE_TOKEN} | docker login ghcr.io -u ${USERNAME} --password-stdin
-          docker buildx build --push --no-cache --platform linux/amd64,linux/arm/v7,linux/arm64 \
-            -t ghcr.io/umputun/remark42-site:${ref} -t ghcr.io/umputun/remark42-site:latest .
+  deploy:
+    name: Deploy site
+    runs-on: ubuntu-latest
+    needs: merge
+    if: github.ref == 'refs/heads/master' || github.event_name == 'release'
+    permissions: {} # only calls an external URL via curl, no GitHub API access needed
 
-      - name: remote site deployment from master
-        if: ${{ github.ref == 'refs/heads/master' }}
+    steps:
+      - name: trigger deployment
         env:
           UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
-        run: curl https://jess.umputun.com/update/remark42-site/${UPDATER_KEY}
+        run: curl -sf https://jess.umputun.com/update/remark42-site/${UPDATER_KEY}

.github/workflows/docker.yml

@@ -0,0 +1,215 @@
+name: docker
+
+on:
+  workflow_run:
+    workflows: [backend, frontend]
+    types: [completed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build Docker image (${{ matrix.platform }})
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event != 'pull_request' &&
+      (github.event.workflow_run.head_branch == 'master' ||
+       startsWith(github.event.workflow_run.head_branch, 'v'))
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            artifact: linux-amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            artifact: linux-arm64
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+
+      - name: set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: login to ghcr.io
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PKG_TOKEN }}
+
+      - name: login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: umputun
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          docker system prune -af
+
+      - name: build and push to ghcr.io by digest
+        id: build-ghcr
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
+          build-args: |
+            SKIP_BACKEND_TEST=true
+            SKIP_FRONTEND_TEST=true
+            CI=github
+            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
+            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
+            GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
+          outputs: type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+
+      - name: build and push to DockerHub by digest
+        id: build-dockerhub
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          build-args: |
+            SKIP_BACKEND_TEST=true
+            SKIP_FRONTEND_TEST=true
+            CI=github
+            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
+            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
+            GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
+          outputs: type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+
+      - name: export digests
+        run: |
+          mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
+          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
+          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
+          touch "/tmp/digests/ghcr/${digest_ghcr#sha256:}"
+          touch "/tmp/digests/dockerhub/${digest_dockerhub#sha256:}"
+
+      - name: upload ghcr digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: digests-ghcr-${{ matrix.artifact }}
+          path: /tmp/digests/ghcr/*
+          retention-days: 1
+
+      - name: upload dockerhub digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: digests-dockerhub-${{ matrix.artifact }}
+          path: /tmp/digests/dockerhub/*
+          retention-days: 1
+
+  merge:
+    name: Create multi-arch manifest
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: download ghcr digests
+        uses: actions/download-artifact@v8
+        with:
+          path: /tmp/digests/ghcr
+          pattern: digests-ghcr-*
+          merge-multiple: true
+
+      - name: download dockerhub digests
+        uses: actions/download-artifact@v8
+        with:
+          path: /tmp/digests/dockerhub
+          pattern: digests-dockerhub-*
+          merge-multiple: true
+
+      - name: verify all digests present
+        run: |
+          expected=2
+          for registry in ghcr dockerhub; do
+            actual=$(find /tmp/digests/$registry -maxdepth 1 -type f | wc -l)
+            if [ "$actual" -ne "$expected" ]; then
+              echo "Expected $expected digests for $registry, found $actual"
+              ls -la /tmp/digests/$registry
+              exit 1
+            fi
+          done
+          echo "All digests present for both registries"
+
+      - name: set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: login to ghcr.io
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PKG_TOKEN }}
+
+      - name: login to DockerHub
+        uses: docker/login-action@v4
+        with:
+          username: umputun
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: create ghcr.io manifest and push
+        working-directory: /tmp/digests/ghcr
+        env:
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          if [[ "$HEAD_BRANCH" == v* ]]; then
+            docker buildx imagetools create \
+              -t ghcr.io/umputun/remark42:${HEAD_BRANCH} \
+              -t ghcr.io/umputun/remark42:latest \
+              $(printf 'ghcr.io/umputun/remark42@sha256:%s ' *)
+          else
+            docker buildx imagetools create \
+              -t ghcr.io/umputun/remark42:${HEAD_BRANCH} \
+              $(printf 'ghcr.io/umputun/remark42@sha256:%s ' *)
+          fi
+
+      - name: create DockerHub manifest and push
+        working-directory: /tmp/digests/dockerhub
+        env:
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          if [[ "$HEAD_BRANCH" == v* ]]; then
+            docker buildx imagetools create \
+              -t umputun/remark42:${HEAD_BRANCH} \
+              -t umputun/remark42:latest \
+              $(printf 'umputun/remark42@sha256:%s ' *)
+          else
+            docker buildx imagetools create \
+              -t umputun/remark42:${HEAD_BRANCH} \
+              $(printf 'umputun/remark42@sha256:%s ' *)
+          fi
+
+  deploy:
+    name: Deploy to remark42.com
+    runs-on: ubuntu-latest
+    needs: merge
+    if: github.event.workflow_run.head_branch == 'master'
+    permissions: {} # only calls an external URL via curl, no GitHub API access needed
+
+    steps:
+      - name: trigger deployment
+        env:
+          UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
+        run: curl -sf https://jess.umputun.com/update/remark42-core/${UPDATER_KEY}

.github/workflows/e2e-tests.yml

@@ -4,29 +4,37 @@ on:
   push:
     branches: [master]
     paths:
+      - ".github/workflows/e2e-tests.yml"
       - "frontend/apps/remark42/**"
       - "frontend/e2e/**"
+      - "frontend/Dockerfile.e2e"
 
   pull_request:
     branches: [master]
     paths:
+      - ".github/workflows/e2e-tests.yml"
       - "frontend/apps/remark42/**"
       - "frontend/e2e/**"
+      - "frontend/Dockerfile.e2e"
 
 jobs:
   tests:
     name: Tests
     timeout-minutes: 60
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Build & run containers
         id: tests
         run: COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 docker compose -f compose-e2e-test.yml up --build --quiet-pull --exit-code-from tests
 
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: playwright-report

.github/workflows/release.yml

@@ -0,0 +1,143 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+  pull_request:
+    paths:
+      - ".github/workflows/release.yml"
+      - ".goreleaser.yml"
+      - "Makefile"
+      - "scripts/**"
+      - "backend/**"
+      - "frontend/**"
+      - "README.md"
+      - "LICENSE"
+      - "CLAUDE.md"
+      - "site/src/docs/getting-started/installation/index.md"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: install go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25"
+          cache-dependency-path: backend/go.sum
+
+      - name: install pnpm
+        uses: pnpm/action-setup@v6.0.9
+        with:
+          version: 10.10.0
+          run_install: false
+
+      - name: install node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: test and build backend
+        run: |
+          go test -race -timeout=120s ./...
+          go build -race ./...
+        working-directory: backend/app
+        env:
+          TZ: "America/Chicago"
+
+      - name: test examples
+        run: |
+          go test -race ./...
+          go build -race ./...
+        working-directory: backend/_example/memory_store
+        env:
+          TZ: "America/Chicago"
+
+      - name: install frontend dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+        env:
+          CI: "true"
+
+      - name: check frontend
+        run: |
+          pnpm lint
+          pnpm type-check
+          pnpm test --runInBand
+        working-directory: frontend/apps/remark42
+        env:
+          CI: "true"
+
+      - name: check goreleaser snapshot
+        if: github.event_name == 'pull_request'
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: latest
+          args: release --snapshot --clean --skip=publish
+        env:
+          SKIP_PNPM_INSTALL: "true"
+
+      - name: clean generated release assets
+        if: always()
+        run: ./scripts/cleanup-release-assets.sh
+
+  release:
+    if: github.event_name == 'push'
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: install go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25"
+          cache-dependency-path: backend/go.sum
+
+      - name: install pnpm
+        uses: pnpm/action-setup@v6.0.9
+        with:
+          version: 10.10.0
+          run_install: false
+
+      - name: install node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: install frontend dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+        env:
+          CI: "true"
+
+      - name: run goreleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SKIP_PNPM_INSTALL: "true"
+
+      - name: clean generated release assets
+        if: always()
+        run: ./scripts/cleanup-release-assets.sh

.gitignore

@@ -15,6 +15,7 @@ debug.test
 .mongo
 remark42
 /bin/
+/dist/
 /backend/var/
 /backend/app/var/
 /backend/app/cmd/web/
@@ -26,3 +27,6 @@ compose-private.yml
 http-client.env.json
 /playwright-report/
 /backend/app/cmd/var
+
+# ralphex progress logs
+.ralphex/progress/

.goreleaser.yml

@@ -0,0 +1,69 @@
+version: 2
+
+project_name: remark42
+
+git:
+  ignore_tags:
+    - backend/*
+
+before:
+  hooks:
+    - ./scripts/prepare-release-assets.sh
+
+builds:
+  - id: remark42
+    dir: backend
+    main: ./app
+    binary: "remark42.{{ .Os }}-{{ .Arch }}"
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - freebsd
+      - windows
+    goarch:
+      - amd64
+      - arm64
+      - "386"
+      - arm
+    goarm:
+      - "7"
+    ignore:
+      - goos: darwin
+        goarch: "386"
+      - goos: darwin
+        goarch: arm
+      - goos: freebsd
+        goarch: arm64
+      - goos: freebsd
+        goarch: "386"
+      - goos: freebsd
+        goarch: arm
+      - goos: windows
+        goarch: arm64
+      - goos: windows
+        goarch: "386"
+      - goos: windows
+        goarch: arm
+    ldflags:
+      - -s -w -X main.revision={{ .Tag }}-{{ .ShortCommit }}-{{ trimsuffix (replace (replace .CommitDate "-" "") ":" "") "Z" }}
+
+archives:
+  - id: remark42
+    ids:
+      - remark42
+    name_template: "{{ .ProjectName }}.{{ .Os }}-{{ .Arch }}"
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+
+release:
+  name_template: "Version {{ .Version }}"
+  mode: keep-existing

CLAUDE.md

@@ -0,0 +1,59 @@
+# Remark42 Development Guidelines
+
+## Build/Test/Lint Commands
+- **Backend**:
+  - Run server: `make rundev`
+  - Build: `make backend`
+  - Race test: `make race_test`
+- **Backend Testing**:
+  - Run all tests: `cd backend/app && go test -timeout=60s -count 1 ./...`
+  - Run single test: `cd backend/app && go test -run TestName ./path/to/package`
+  - **IMPORTANT**: Run example tests: `cd backend/_example/memory_store && go test -race ./... && go build -race ./...`
+- **Frontend**:
+  - Development: `cd frontend && pnpm dev:app`
+  - Tests: `cd frontend && pnpm test`
+- **Lint**:
+  - Backend: `cd backend && golangci-lint run`
+  - **IMPORTANT**: Example lint: `cd backend/_example/memory_store && golangci-lint run --config ../../.golangci.yml`
+  - Frontend: `cd frontend && pnpm lint`
+  - **Before committing**: Always run tests and linter on both main backend AND examples
+- **Dependency Updates**:
+  - When updating Go modules in `backend/`, also run `go mod tidy` (and `go mod vendor`) in `backend/_example/memory_store` to keep indirect deps in sync. The example module replaces `github.com/umputun/remark42/backend` with `../../` so stale indirect deps there will break the example build.
+
+## Release Procedure
+
+Remark42 uses two tags for each release:
+- `vX.Y.Z` - product release tag used by GitHub releases, GoReleaser binary artifacts, and Docker image publishing.
+- `backend/vX.Y.Z` - nested Go module tag for `github.com/umputun/remark42/backend`.
+
+Release flow:
+1. Create the GitHub release for `vX.Y.Z` with title `Version X.Y.Z`. The GitHub release must exist before the `vX.Y.Z` tag reaches the remote; `gh release create vX.Y.Z` satisfies this because it creates and pushes the tag.
+2. The `vX.Y.Z` tag triggers GoReleaser, which builds and uploads binary artifacts to the existing release.
+3. Create and push the matching backend module tag pointing at the same commit:
+
+```bash
+git fetch origin --tags
+git tag backend/vX.Y.Z vX.Y.Z
+git push origin backend/vX.Y.Z
+```
+
+GoReleaser must ignore `backend/*` tags in `.goreleaser.yml` so release notes and current-tag detection use only product tags. Docker image publishing stays separate and is handled by the existing Docker workflow.
+
+For local artifact runs, install GoReleaser, Go 1.25, Node 16+, PNPM 8, and Perl, then use `make release`. The target runs a snapshot/no-publish GoReleaser build, leaves local artifacts and metadata in `dist/`, and cleans generated frontend embed files after GoReleaser exits. Do not run raw `goreleaser release` for local artifacts unless you also run `./scripts/cleanup-release-assets.sh` afterward.
+
+## Code Style
+- **Backend**: Formatting with golangci-lint, strict error handling
+- **Frontend**: TypeScript with ESLint, Stylelint and Prettier
+- **Imports**: Group stdlib, external packages, then internal packages
+- **CSS**: All components use CSS Modules (`component.module.css`). Class naming: BEM block = `.root`, elements = camelCase, modifiers = camelCase. Use `clsx` for conditional class composition. `raw-content.css` is the only global CSS file (syntax highlighting utility). Root wrapper keeps bare `.dark`/`.light` theme class — 8+ module CSS files depend on `:global(.dark)` ancestor. `comment_highlighting` uses `:global()` for imperative `classList` usage in root.tsx
+
+## Key Backend Packages
+- **Web/API**: `github.com/go-pkgz/routegroup`, `github.com/go-pkgz/rest`
+- **Auth**: `github.com/go-pkgz/auth/v2`
+- **Logging**: `github.com/go-pkgz/lgr`
+- **Testing**: `github.com/stretchr/testify`
+- **Notifications**: `github.com/go-pkgz/notify`
+
+## Repository Structure
+- Backend: Go server using BoltDB for storage
+- Frontend: Preact/Redux-based UI with iframe embedding

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM node:16.20-alpine AS frontend-deps
+FROM --platform=$BUILDPLATFORM node:20-alpine AS frontend-deps
 
 ARG SKIP_FRONTEND_TEST
 ARG SKIP_FRONTEND_BUILD
@@ -11,7 +11,7 @@ COPY ./frontend/apps/remark42/package.json /srv/frontend/apps/remark42/
 RUN \
   if [[ -z "$SKIP_FRONTEND_BUILD" || -z "$SKIP_FRONTEND_TEST" ]]; then \
     apk add --no-cache --update git && \
-    npm i -g pnpm@7; \
+    npm i -g pnpm@10.10.0; \
   fi
 
 RUN --mount=type=cache,id=pnpm,target=/root/.pnpm-store/v3 \
@@ -45,7 +45,7 @@ RUN \
     echo 'Skip frontend build'; \
   fi
 
-FROM umputun/baseimage:buildgo-v1.13.0 as build-backend
+FROM umputun/baseimage:buildgo-v1.17.0 AS build-backend
 
 ARG CI
 ARG GITHUB_REF
@@ -54,15 +54,15 @@ ARG GIT_BRANCH
 ARG SKIP_BACKEND_TEST
 ARG BACKEND_TEST_TIMEOUT
 
+# install gcc in order to be able to go test package with -race
+RUN apk --no-cache add gcc libc-dev
+
 ADD backend /build/backend
 # to embed the frontend files statically into Remark42 binary
 COPY --from=build-frontend /srv/frontend/apps/remark42/public/ /build/backend/app/cmd/web/
 RUN find /build/backend/app/cmd/web/ -regex '.*\.\(html\|js\|mjs\)$' -print -exec sed -i "s|{% REMARK_URL %}|http://127.0.0.1:8080|g" {} \;
 WORKDIR /build/backend
 
-# install gcc in order to be able to go test package with -race
-RUN apk --no-cache add gcc libc-dev
-
 RUN echo go version: `go version`
 
 # run tests
@@ -81,7 +81,7 @@ RUN \
     echo "version=$version" && \
     go build -o remark42 -ldflags "-X main.revision=${version} -s -w" ./app
 
-FROM umputun/baseimage:app-v1.13.0
+FROM umputun/baseimage:app-v1.17.0
 
 ARG GITHUB_SHA
 

Dockerfile.artifacts

@@ -1,64 +0,0 @@
-FROM node:16.20.2-alpine AS frontend-deps
-
-ENV CI=true
-
-WORKDIR /srv/frontend
-
-COPY ./frontend/package.json ./frontend/pnpm-lock.yaml ./frontend/pnpm-workspace.yaml /srv/frontend/
-COPY ./frontend/apps/remark42/package.json /srv/frontend/apps/remark42/package.json
-
-RUN apk add --no-cache --update git && npm i -g pnpm@7
-RUN --mount=type=cache,id=pnpm,target=/root/.pnpm-store/v3 pnpm i
-
-FROM frontend-deps AS build-frontend
-
-ENV NODE_ENV=production
-ENV CI=true
-
-WORKDIR /srv/frontend/apps/remark42/
-COPY ./frontend/apps/remark42/ /srv/frontend/apps/remark42/
-RUN pnpm build
-
-FROM umputun/baseimage:buildgo-v1.13.0 as build-backend
-
-ARG GITHUB_TOKEN
-ARG GITHUB_REF
-ARG GITHUB_SHA
-
-WORKDIR /build/backend
-ADD backend /build/backend
-ADD README.md /build/
-ADD LICENSE /build/
-
-COPY --from=build-frontend /srv/frontend/apps/remark42/public/ /build/backend/app/cmd/web/
-
-RUN find /build/backend/app/cmd/web/ -regex '.*\.\(html\|js\|mjs\)$' -print -exec sed -i "s|{% REMARK_URL %}|http://127.0.0.1:8080|g" {} \;
-
-RUN \
-  version=$("/script/version.sh") && echo "version=${version}" && \
-    GOOS=linux GOARCH=amd64 go build -o remark42.linux-amd64 -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=linux GOARCH=386 go build -o remark42.linux-386 -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=linux GOARCH=arm go build -o remark42.linux-arm -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=linux GOARCH=arm64 go build -o remark42.linux-arm64 -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=windows GOARCH=amd64 go build -o remark42.windows-amd64.exe -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=darwin GOARCH=amd64 go build -o remark42.darwin-amd64 -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=darwin GOARCH=arm64 go build -o remark42.darwin-arm64 -ldflags "-X main.revision=${version} -s -w" ./app && \
-    GOOS=freebsd GOARCH=amd64 go build -o remark42.freebsd-amd64 -ldflags "-X main.revision=${version} -s -w" ./app
-
-RUN \
-    apk add --no-cache --update zip && \
-    cp ../LICENSE ./LICENSE && cp ../README.md ./README.md && \
-    tar cvzf remark42.linux-amd64.tar.gz remark42.linux-amd64 LICENSE README.md && \
-    tar cvzf remark42.linux-386.tar.gz remark42.linux-386 LICENSE README.md && \
-    tar cvzf remark42.linux-arm.tar.gz remark42.linux-arm LICENSE README.md && \
-    tar cvzf remark42.linux-arm64.tar.gz remark42.linux-arm64 LICENSE README.md && \
-    tar cvzf remark42.darwin-amd64.tar.gz remark42.darwin-amd64 LICENSE README.md && \
-    tar cvzf remark42.darwin-arm64.tar.gz remark42.darwin-arm64 LICENSE README.md && \
-    tar cvzf remark42.freebsd-amd64.tar.gz remark42.freebsd-amd64 LICENSE README.md && \
-    zip remark42.windows-amd64.zip remark42.windows-amd64.exe LICENSE README.md
-
-
-FROM alpine
-COPY --from=build-backend /build/backend/remark42.* /artifacts/
-RUN ls -la /artifacts/*
-CMD ["sleep", "100"]

Makefile

@@ -2,16 +2,16 @@ OS=linux
 ARCH=amd64
 GITHUB_REF=$(shell git rev-parse --symbolic-full-name HEAD)
 GITHUB_SHA=$(shell git rev-parse --short HEAD)
+CLEANUP_RELEASE_ASSETS=$(CURDIR)/scripts/cleanup-release-assets.sh
 
 bin:
-	docker build -f Dockerfile.artifacts -t remark42.bin .
-	- @docker rm -f remark42.bin 2>/dev/null || exit 0
-	docker run -d --name=remark42.bin remark42.bin
-	docker cp remark42.bin:/artifacts/remark42.$(OS)-$(ARCH) remark42
-	docker rm -f remark42.bin
+	@set -e; \
+		./scripts/prepare-release-assets.sh; \
+		trap '$(CLEANUP_RELEASE_ASSETS)' EXIT; \
+		cd backend && CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build -o ../remark42 -ldflags "-X main.revision=$(GITHUB_REF)-$(GITHUB_SHA) -s -w" ./app
 
 docker:
-	DOCKER_BUILDKIT=1 docker build -t umputun/remark42 --build-arg GITHUB_REF=$(GITHUB_REF) --build-arg GITHUB_SHA=$(GITHUB_SHA) \
+	DOCKER_BUILDKIT=1 docker build -t umputun/remark42 -t ghcr.io/umputun/remark42 --build-arg GITHUB_REF=$(GITHUB_REF) --build-arg GITHUB_SHA=$(GITHUB_SHA) \
 		--build-arg CI=true --build-arg SKIP_FRONTEND_TEST=true --build-arg SKIP_BACKEND_TEST=true .
 
 dockerx:
@@ -21,35 +21,25 @@ dockerx:
 		-t ghcr.io/umputun/remark42:master -t umputun/remark42:master .
 
 release:
-	docker build -f Dockerfile.artifacts --no-cache --pull --build-arg CI=true \
-		--build-arg GITHUB_REF=$(GITHUB_REF) --build-arg GITHUB_SHA=$(GITHUB_SHA) -t remark42.bin .
-	- @docker rm -f remark42.bin 2>/dev/null || exit 0
-	- @mkdir -p bin
-	docker run -d --name=remark42.bin remark42.bin
-	docker cp remark42.bin:/artifacts/remark42.linux-amd64.tar.gz bin/remark42.linux-amd64.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.linux-386.tar.gz bin/remark42.linux-386.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.linux-arm64.tar.gz bin/remark42.linux-arm64.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.darwin-amd64.tar.gz bin/remark42.darwin-amd64.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.darwin-arm64.tar.gz bin/remark42.darwin-arm64.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.freebsd-amd64.tar.gz bin/remark42.freebsd-amd64.tar.gz
-	docker cp remark42.bin:/artifacts/remark42.windows-amd64.zip bin/remark42.windows-amd64.zip
-	docker rm -f remark42.bin
+	@set -e; \
+		trap '$(CLEANUP_RELEASE_ASSETS)' EXIT; \
+		goreleaser release --snapshot --clean --skip=publish
 
 race_test:
 	cd backend/app && go test -race -timeout=60s -count 1 ./...
 
 backend:
-	docker-compose -f compose-dev-backend.yml build
+	docker compose -f compose-dev-backend.yml build
 
 frontend:
-	docker-compose -f compose-dev-frontend.yml build
+	docker compose -f compose-dev-frontend.yml build
 
 rundev:
 	SKIP_BACKEND_TEST=true SKIP_FRONTEND_TEST=true GITHUB_REF=$(GITHUB_REF) GITHUB_SHA=$(GITHUB_SHA) CI=true \
-		docker-compose -f compose-private.yml build
-	docker-compose -f compose-private.yml up
+		docker compose -f compose-private.yml build
+	docker compose -f compose-private.yml up
 
 e2e:
 	docker compose -f compose-e2e-test.yml up --build --quiet-pull --exit-code-from tests
 
-.PHONY: bin backend
+.PHONY: bin docker dockerx release race_test backend frontend rundev e2e

README.md

@@ -2,7 +2,7 @@
 
 Remark42 is a self-hosted, lightweight and simple (yet functional) comment engine, which doesn't spy on users. It can be embedded into blogs, articles, or any other place where readers add comments.
 
-* Social login via Google, Twitter, Facebook, Microsoft, GitHub, Yandex, Patreon and Telegram
+* Social login via Google, Facebook, Microsoft, GitHub, Apple, Yandex, Patreon, Discord, Telegram and custom OAuth2 providers
 * Login via email
 * Optional anonymous access
 * Multi-level nested comments with both tree and plain presentations

SECURITY.md

@@ -12,4 +12,4 @@ We release patches for security vulnerabilities.
 
 ## Reporting a Vulnerability
 
-Please report (suspected) security vulnerabilities to umputun@gmail.com. You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
+Please report (suspected) security vulnerabilities either by using GitHub's [private vulnerability reporting](https://github.com/umputun/remark42/security/advisories/new) (click the "Report a vulnerability" button on the [Security tab](https://github.com/umputun/remark42/security)) or by emailing umputun@gmail.com. You will receive a response within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.

backend/.golangci.yml

@@ -1,38 +1,14 @@
-run:
-  timeout: 5m
-
-linters-settings:
-  govet:
-    enable:
-      - shadow
-  goconst:
-    min-len: 2
-    min-occurrences: 2
-  misspell:
-    locale: US
-  lll:
-    line-length: 140
-  gocritic:
-    enabled-tags:
-      - performance
-      - style
-      - experimental
-    disabled-checks:
-      - wrapperFunc
-# TODO: feel free to remove these excludes and fix the code
-      - hugeParam
-      - rangeValCopy
-
+version: "2"
 linters:
+  default: none
   enable:
     - bodyclose
+    - copyloopvar
     - dupl
-    - exportloopref
     - gochecknoinits
     - gocritic
     - gocyclo
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - misspell
@@ -40,26 +16,60 @@ linters:
     - prealloc
     - revive
     - staticcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unparam
     - unused
-  fast: false
-  disable-all: true
-
-issues:
-  exclude-dirs:
-    - vendor
-  exclude-rules:
-    - text: "at least one file in a package should have a package comment"
-      linters:
-        - stylecheck
-    - text: "package-comments: should have a package comment"
-      linters:
-        - revive
-    - path: _test\.go
-      linters:
-        - gosec
-        - dupl
-  exclude-use-default: false
+  settings:
+    goconst:
+      min-len: 2
+      min-occurrences: 2
+    gosec:
+      excludes:
+        - G117 # false positive: struct field name matches "secret" pattern
+    gocritic:
+      disabled-checks:
+        - wrapperFunc
+        - hugeParam
+        - rangeValCopy
+      enabled-tags:
+        - performance
+        - style
+        - experimental
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - staticcheck
+        text: at least one file in a package should have a package comment
+      - linters:
+          - revive
+        text: 'package-comments: should have a package comment'
+      - linters:
+          - revive
+        text: 'var-naming: avoid meaningless package names'
+      - linters:
+          - revive
+        text: 'var-naming: avoid package names that conflict with Go standard library package names'
+      - linters:
+          - dupl
+          - gosec
+        path: _test\.go
+    paths:
+      - vendor
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

backend/_example/memory_store/Dockerfile

@@ -1,11 +1,11 @@
-FROM umputun/baseimage:buildgo-v1.13.0 as build-backend
+FROM umputun/baseimage:buildgo-v1.17.0 AS build-backend
 
 ADD backend /build/backend
 WORKDIR /build/backend/_example/memory_store
 
 RUN go build -o /build/bin/memory_store -ldflags "-X main.revision=0.0.0 -s -w"
 
-FROM umputun/baseimage:app-v1.13.0
+FROM umputun/baseimage:app-v1.17.0
 
 ARG GITHUB_SHA
 

backend/_example/memory_store/README.md

@@ -4,9 +4,9 @@
 
 In order to run remark42 with memory_store copy provided `compose-dev-memstore.yml` to the root directory and run:
 
-1. `docker-compose -f compose-dev-memstore.yml build`
-1. `docker-compose -f compose-dev-memstore.yml up`
+1. `docker compose -f compose-dev-memstore.yml build`
+1. `docker compose -f compose-dev-memstore.yml up`
 
 As usual, demo site will run on http://127.0.0.1:8080/web/
 
-note: in order to work with the latest (current) version of master `go.mod` uses replacement directive for the backend package. In real-life usage `replace github.com/umputun/remark42/backend => ../../`  should not be used. 
+note: in order to work with the latest (current) version of master `go.mod` uses replacement directive for the backend package. In real-life usage `replace github.com/umputun/remark42/backend => ../../`  should not be used. 

backend/_example/memory_store/accessor/data.go

@@ -251,11 +251,11 @@ func (m *MemData) Flag(req engine.FlagRequest) (val bool, err error) {
 
 // ListFlags get list of flagged keys, like blocked & verified user
 // works for full locator (post flags) or with userID
-func (m *MemData) ListFlags(req engine.FlagRequest) (res []interface{}, err error) {
+func (m *MemData) ListFlags(req engine.FlagRequest) (res []any, err error) {
 	m.mu.RLock()
 	defer m.mu.RUnlock()
 
-	res = []interface{}{}
+	res = []any{}
 
 	switch req.Flag {
 	case engine.Verified:
@@ -391,10 +391,7 @@ func (m *MemData) checkFlag(req engine.FlagRequest) (val bool) {
 
 func (m *MemData) setFlag(req engine.FlagRequest) (res bool, err error) {
 
-	status := false
-	if req.Update == engine.FlagTrue {
-		status = true
-	}
+	status := req.Update == engine.FlagTrue
 
 	switch req.Flag {
 

backend/_example/memory_store/accessor/data_test.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"sort"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -198,7 +199,7 @@ func TestMemData_FindForUserPagination(t *testing.T) {
 	}
 
 	// write 200 comments
-	for i := 0; i < 200; i++ {
+	for i := range 200 {
 		c.ID = fmt.Sprintf("idd-%d", i)
 		c.Text = fmt.Sprintf("text #%d", i)
 		c.Timestamp = time.Date(2017, 12, 20, 15, 18, i, 0, time.Local)
@@ -286,7 +287,7 @@ func TestMemData_CountUser(t *testing.T) {
 
 func TestMemData_InfoPost(t *testing.T) {
 	b := prepMem(t)
-	ts := func(min int) time.Time { return time.Date(2017, 12, 20, 15, 18, min, 0, time.Local).In(time.UTC) }
+	ts := func(minute int) time.Time { return time.Date(2017, 12, 20, 15, 18, minute, 0, time.Local).In(time.UTC) }
 
 	// add one more for https://radio-t.com/2
 	comment := store.Comment{
@@ -484,7 +485,7 @@ func TestMemData_FlagVerified(t *testing.T) {
 func TestMemData_FlagListVerified(t *testing.T) {
 
 	b := prepMem(t)
-	toIDs := func(inp []interface{}) (res []string) {
+	toIDs := func(inp []any) (res []string) {
 		res = make([]string, len(inp))
 		for i, v := range inp {
 			vv, ok := v.(string)
@@ -521,51 +522,52 @@ func TestMemData_FlagListVerified(t *testing.T) {
 }
 
 func TestMemData_FlagListBlocked(t *testing.T) {
-
-	b := prepMem(t)
-	setBlocked := func(site, user string, status engine.FlagStatus, ttl time.Duration) error {
-		req := engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: site}, UserID: user, Update: status,
-			TTL: ttl}
-		_, err := b.Flag(req)
-		return err
-	}
-
-	toBlocked := func(inp []interface{}) (res []store.BlockedUser) {
-		res = make([]store.BlockedUser, len(inp))
-		for i, v := range inp {
-			vv, ok := v.(store.BlockedUser)
-			require.True(t, ok)
-			res[i] = vv
+	synctest.Test(t, func(t *testing.T) {
+		b := prepMem(t)
+		setBlocked := func(site, user string, status engine.FlagStatus, ttl time.Duration) error {
+			req := engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: site}, UserID: user, Update: status,
+				TTL: ttl}
+			_, err := b.Flag(req)
+			return err
 		}
-		return res
-	}
-	assert.NoError(t, setBlocked("radio-t", "user1", engine.FlagTrue, 0))
-	assert.NoError(t, setBlocked("radio-t", "user2", engine.FlagTrue, 50*time.Millisecond))
-	assert.NoError(t, setBlocked("radio-t", "user3", engine.FlagFalse, 0))
 
-	vv, err := b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "radio-t"}})
-	assert.NoError(t, err)
+		toBlocked := func(inp []any) (res []store.BlockedUser) {
+			res = make([]store.BlockedUser, len(inp))
+			for i, v := range inp {
+				vv, ok := v.(store.BlockedUser)
+				require.True(t, ok)
+				res[i] = vv
+			}
+			return res
+		}
+		assert.NoError(t, setBlocked("radio-t", "user1", engine.FlagTrue, 0))
+		assert.NoError(t, setBlocked("radio-t", "user2", engine.FlagTrue, 50*time.Millisecond))
+		assert.NoError(t, setBlocked("radio-t", "user3", engine.FlagFalse, 0))
 
-	blockedList := toBlocked(vv)
-	var blockedIDs = make([]string, len(blockedList))
-	for i, x := range blockedList {
-		blockedIDs[i] = x.ID
-	}
-	require.Equal(t, 2, len(blockedList), b.metaUsers)
-	assert.ElementsMatch(t, []string{"user1", "user2"}, blockedIDs)
-	t.Logf("%+v", blockedList)
+		vv, err := b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "radio-t"}})
+		assert.NoError(t, err)
 
-	// check block expiration
-	time.Sleep(50 * time.Millisecond)
-	vv, err = b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "radio-t"}})
-	assert.NoError(t, err)
-	blockedList = toBlocked(vv)
-	require.Equal(t, 1, len(blockedList))
-	assert.Equal(t, "user1", blockedList[0].ID)
+		blockedList := toBlocked(vv)
+		var blockedIDs = make([]string, len(blockedList))
+		for i, x := range blockedList {
+			blockedIDs[i] = x.ID
+		}
+		require.Equal(t, 2, len(blockedList), b.metaUsers)
+		assert.ElementsMatch(t, []string{"user1", "user2"}, blockedIDs)
+		t.Logf("%+v", blockedList)
 
-	vv, err = b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "bad"}})
-	assert.NoError(t, err)
-	assert.Equal(t, 0, len(vv))
+		// check block expiration
+		time.Sleep(50 * time.Millisecond)
+		vv, err = b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "radio-t"}})
+		assert.NoError(t, err)
+		blockedList = toBlocked(vv)
+		require.Equal(t, 1, len(blockedList))
+		assert.Equal(t, "user1", blockedList[0].ID)
+
+		vv, err = b.ListFlags(engine.FlagRequest{Flag: engine.Blocked, Locator: store.Locator{SiteID: "bad"}})
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(vv))
+	})
 }
 
 func TestMemData_DeleteComment(t *testing.T) {

backend/_example/memory_store/compose-dev-memstore.yml

@@ -11,7 +11,7 @@ services:
       args:
         - SKIP_BACKEND_TEST=true
         - SKIP_FRONTEND_TEST=true
-    image: umputun/remark42:dev
+    image: ghcr.io/umputun/remark42:dev
     container_name: "remark42-dev"
     hostname: "remark42-dev"
     restart: always

backend/_example/memory_store/go.mod

@@ -1,42 +1,39 @@
 module github.com/umputun/remark42/memory_store
 
-go 1.21
+go 1.25.0
 
 require (
-	github.com/go-pkgz/jrpc v0.3.0
-	github.com/go-pkgz/lgr v0.11.1
-	github.com/jessevdk/go-flags v1.5.0
-	github.com/stretchr/testify v1.9.0
+	github.com/go-pkgz/jrpc v0.4.0
+	github.com/go-pkgz/lgr v0.12.3
+	github.com/jessevdk/go-flags v1.6.1
+	github.com/stretchr/testify v1.11.1
 	github.com/umputun/remark42/backend v1.1000.0
 )
 
 require (
 	github.com/Depado/bfchroma/v2 v2.0.0 // indirect
-	github.com/PuerkitoBio/goquery v1.9.1 // indirect
-	github.com/ajg/form v1.5.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.13.0 // indirect
-	github.com/andybalholm/cascadia v1.3.2 // indirect
+	github.com/PuerkitoBio/goquery v1.12.0 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/didip/tollbooth/v7 v7.0.1 // indirect
-	github.com/didip/tollbooth_chi v0.0.0-20220719025231-d662a7f6928f // indirect
-	github.com/dlclark/regexp2 v1.11.0 // indirect
-	github.com/go-chi/chi/v5 v5.0.12 // indirect
-	github.com/go-chi/render v1.0.3 // indirect
-	github.com/go-pkgz/expirable-cache v1.0.0 // indirect
-	github.com/go-pkgz/rest v1.19.0 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.2 // indirect
+	github.com/go-pkgz/rest v1.22.0 // indirect
+	github.com/go-pkgz/routegroup v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/microcosm-cc/bluemonday v1.0.26 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/rs/xid v1.5.0 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	go.etcd.io/bbolt v1.3.9 // indirect
-	golang.org/x/image v0.15.0 // indirect
-	golang.org/x/net v0.24.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	go.etcd.io/bbolt v1.5.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/image v0.43.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

backend/_example/memory_store/go.sum

@@ -1,45 +1,30 @@
 github.com/Depado/bfchroma/v2 v2.0.0 h1:IRpN9BPkNwEpR6w1ectIcNWOuhDSLx+8f1pn83fzxx8=
 github.com/Depado/bfchroma/v2 v2.0.0/go.mod h1:wFwW/Pw8Tnd0irzgO9Zxtxgzp3aPS8qBWlyadxujxmw=
-github.com/PuerkitoBio/goquery v1.9.1 h1:mTL6XjbJTZdpfL+Gwl5U2h1l9yEkJjhmlTeV9VPW7UI=
-github.com/PuerkitoBio/goquery v1.9.1/go.mod h1:cW1n6TmIMDoORQU5IU/P1T3tGFunOeXEpGP2WHRwkbY=
-github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
-github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
-github.com/alecthomas/assert/v2 v2.6.0 h1:o3WJwILtexrEUk3cUVal3oiQY2tfgr/FHWiz/v2n4FU=
-github.com/alecthomas/assert/v2 v2.6.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.13.0 h1:VP72+99Fb2zEcYM0MeaWJmV+xQvz5v5cxRHd+ooU1lI=
-github.com/alecthomas/chroma/v2 v2.13.0/go.mod h1:BUGjjsD+ndS6eX37YgTchSEG+Jg9Jv1GiZs9sqPqztk=
-github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
-github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
-github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
+github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
+github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
+github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/didip/tollbooth/v7 v7.0.0/go.mod h1:VZhDSGl5bDSPj4wPsih3PFa4Uh9Ghv8hgacaTm5PRT4=
-github.com/didip/tollbooth/v7 v7.0.1 h1:TkT4sBKoQoHQFPf7blQ54iHrZiTDnr8TceU+MulVAog=
-github.com/didip/tollbooth/v7 v7.0.1/go.mod h1:VZhDSGl5bDSPj4wPsih3PFa4Uh9Ghv8hgacaTm5PRT4=
-github.com/didip/tollbooth_chi v0.0.0-20220719025231-d662a7f6928f h1:jtKwihcLmUC9BAhoJ9adCUqdSSZcOdH2KL7mPTUm2aw=
-github.com/didip/tollbooth_chi v0.0.0-20220719025231-d662a7f6928f/go.mod h1:q9C80dnsuVRP2dAskjnXRNWdUJqtGgwG9wNrzt0019s=
-github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
-github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/go-chi/chi/v5 v5.0.7/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
-github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/render v1.0.1/go.mod h1:pq4Rr7HbnsdaeHagklXub+p6Wd16Af5l9koip1OvJns=
-github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
-github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
-github.com/go-pkgz/expirable-cache v0.1.0/go.mod h1:GTrEl0X+q0mPNqN6dtcQXksACnzCBQ5k/k1SwXJsZKs=
-github.com/go-pkgz/expirable-cache v1.0.0 h1:ns5+1hjY8hntGv8bPaQd9Gr7Jyo+Uw5SLyII40aQdtA=
-github.com/go-pkgz/expirable-cache v1.0.0/go.mod h1:GTrEl0X+q0mPNqN6dtcQXksACnzCBQ5k/k1SwXJsZKs=
-github.com/go-pkgz/jrpc v0.3.0 h1:Fls38KqPsHzvp0FWfivr6cGnncC+iFBodHBqvUPY+0U=
-github.com/go-pkgz/jrpc v0.3.0/go.mod h1:MFtKs75JESiSqVicsQkgN2iDFFuCd3gVT1/vKiwRi00=
-github.com/go-pkgz/lgr v0.11.1 h1:hXFhZcznehI6imLhEa379oMOKFz7TQUmisAqb3oLOSM=
-github.com/go-pkgz/lgr v0.11.1/go.mod h1:tgDF4RXQnBfIgJqjgkv0yOeTQ3F1yewWIZkpUhHnAkU=
-github.com/go-pkgz/rest v1.15.6/go.mod h1:KUWAqbDteYGS/CiXftomQsKjtEOifXsJ36Ka0skYbmk=
-github.com/go-pkgz/rest v1.19.0 h1:FNMi5QX5dDIkuC+/e0r+CWsTuOTwUiWMRSA16Ou+9+A=
-github.com/go-pkgz/rest v1.19.0/go.mod h1:Po+W6zQzpMPP6XDGLdAN2aW7UKk1IyrLSb48Lp1N3oQ=
+github.com/dlclark/regexp2/v2 v2.2.2 h1:MYWvNYw8okuqNhwTYO587EZMiDruVa2vhV6fsGpfya0=
+github.com/dlclark/regexp2/v2 v2.2.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/go-pkgz/jrpc v0.4.0 h1:oD7xiGrzDkndkuCjeHGugQXxbggLSV7O1QmHhoc5pYY=
+github.com/go-pkgz/jrpc v0.4.0/go.mod h1:JFoY3bRjRyx4M3CbEVDFQStMB1m2gmQ7OjqFK7q3kOo=
+github.com/go-pkgz/lgr v0.12.3 h1:QDug7kRkEsuQtruT9fNF5PVT2kZUqCDPc4GmsgS3fP8=
+github.com/go-pkgz/lgr v0.12.3/go.mod h1:lpCDgVvCIxBHZp8+sGCj9MPctIzKZyZ3QdE19ddqd54=
+github.com/go-pkgz/rest v1.22.0 h1:d3XFKlmAGBiU9MQER9/n46iXpyUr8IQUtfjU8JlqkkY=
+github.com/go-pkgz/rest v1.22.0/go.mod h1:+AHzjHazq7Z3Tk/kRWOhbbAz/YZlUV40feC1Hf4NtbE=
+github.com/go-pkgz/routegroup v1.6.0 h1:44XHZgF6JIIldRlv+zjg6SygULASmjifnfIQjwCT0e4=
+github.com/go-pkgz/routegroup v1.6.0/go.mod h1:Pmu04fhgWhRtBMIJ8HXppnnzOPjnL/IEPBIdO2zmeqg=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -49,78 +34,38 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
-github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
-github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/microcosm-cc/bluemonday v1.0.26 h1:xbqSvqzQMeEHCqMi64VAs4d8uy6Mequs3rQ0k/Khz58=
-github.com/microcosm-cc/bluemonday v1.0.26/go.mod h1:JyzOCs9gkyQyjs+6h10UEVSe02CGwkhd72Xdqh78TWs=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/jessevdk/go-flags v1.6.1 h1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=
+github.com/jessevdk/go-flags v1.6.1/go.mod h1:Mk8T1hIAWpOiJiHa9rJASDK2UGWji0EuPGBnNLMooyc=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
+github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
-go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/image v0.15.0 h1:kOELfmgrmJlw4Cdb7g/QGuB3CvDrXbqEIww/pNtNBm8=
-golang.org/x/image v0.15.0/go.mod h1:HUYqC05R2ZcZ3ejNQsIHQDQiwWM4JBqmm6MKANTp4LE=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

backend/_example/memory_store/server/admin.go

@@ -73,7 +73,7 @@ func (s *RPC) admEnabledHndl(id uint64, params json.RawMessage) (rr jrpc.Respons
 // onEvent returns nothing, callback to OnEvent
 func (s *RPC) admEventHndl(id uint64, params json.RawMessage) (rr jrpc.Response) {
 	var siteID string
-	var ps []interface{}
+	var ps []any
 	if err := json.Unmarshal(params, &ps); err != nil {
 		return jrpc.Response{Error: err.Error()}
 	}

backend/_example/memory_store/server/data_test.go

@@ -217,7 +217,7 @@ func TestRPC_listFlagsHndl(t *testing.T) {
 
 	flags, err = re.ListFlags(verifyFlagReq)
 	require.NoError(t, err)
-	assert.Equal(t, []interface{}{"u1"}, flags)
+	assert.Equal(t, []any{"u1"}, flags)
 	verifiedUsers := make([]string, 0, len(flags))
 	for _, v := range flags {
 		verifiedUsers = append(verifiedUsers, v.(string))

backend/_example/memory_store/server/rpc_test.go

@@ -21,7 +21,7 @@ import (
 )
 
 func chooseRandomUnusedPort() (port int) {
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		port = 40000 + int(rand.Int31n(10000))
 		if ln, err := net.Listen("tcp", fmt.Sprintf(":%d", port)); err == nil {
 			_ = ln.Close()
@@ -34,7 +34,7 @@ func chooseRandomUnusedPort() (port int) {
 func waitForHTTPServerStart(port int) {
 	// wait for up to 3 seconds for server to start before returning it
 	client := http.Client{Timeout: time.Second}
-	for i := 0; i < 300; i++ {
+	for range 300 {
 		time.Sleep(time.Millisecond * 10)
 		if resp, err := client.Get(fmt.Sprintf("http://localhost:%d", port)); err == nil {
 			_ = resp.Body.Close()

backend/app/cmd/avatar.go

@@ -7,7 +7,7 @@ import (
 	log "github.com/go-pkgz/lgr"
 	bolt "go.etcd.io/bbolt"
 
-	"github.com/go-pkgz/auth/avatar"
+	"github.com/go-pkgz/auth/v2/avatar"
 )
 
 // AvatarCommand set of flags and command for avatar migration

backend/app/cmd/avatar_test.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/go-pkgz/auth/avatar"
+	"github.com/go-pkgz/auth/v2/avatar"
 	"github.com/jessevdk/go-flags"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

backend/app/cmd/backup.go

@@ -47,7 +47,7 @@ func (ec *BackupCommand) Execute(_ []string) error {
 	req.SetBasicAuth("admin", ec.AdminPasswd)
 
 	// get with timeout
-	resp, err := client.Do(req.WithContext(ctx))
+	resp, err := client.Do(req.WithContext(ctx)) //nolint:gosec // exportURL is built from operator-supplied CLI flags, not user input
 	if err != nil {
 		return fmt.Errorf("request failed for %s: %w", exportURL, err)
 	}

backend/app/cmd/cleanup.go

@@ -77,7 +77,7 @@ func (cc *CleanupCommand) procSpam(comments []store.Comment) int {
 					log.Printf("[WARN] can't remove comment, %v", err)
 				}
 			}
-			comment.Text = strings.Replace(comment.Text, "\n", " ", -1)
+			comment.Text = strings.ReplaceAll(comment.Text, "\n", " ")
 			log.Printf("[SPAM] %+v [%.0f%%]", comment, score)
 		}
 	}
@@ -179,7 +179,7 @@ func (cc *CleanupCommand) listComments(postURL string) ([]store.Comment, error)
 
 	commentsWithInfo := struct {
 		Comments []store.Comment `json:"comments"`
-		Info     store.PostInfo  `json:"info,omitempty"`
+		Info     store.PostInfo  `json:"info"`
 	}{}
 
 	if err = json.NewDecoder(r.Body).Decode(&commentsWithInfo); err != nil {
@@ -199,7 +199,7 @@ func (cc *CleanupCommand) deleteComment(c store.Comment) error { //nolint:dupl /
 
 	client := http.Client{}
 	defer client.CloseIdleConnections()
-	r, err := client.Do(req)
+	r, err := client.Do(req) //nolint:gosec // RemarkURL comes from operator CLI flag, not user input
 	if err != nil {
 		return fmt.Errorf("delete request failed for comment %s, %s: %w", c.ID, c.Locator.URL, err)
 	}
@@ -221,7 +221,7 @@ func (cc *CleanupCommand) setTitle(c store.Comment) error { //nolint:dupl // not
 
 	client := http.Client{}
 	defer client.CloseIdleConnections()
-	r, err := client.Do(req)
+	r, err := client.Do(req) //nolint:gosec // RemarkURL comes from operator CLI flag, not user input
 	if err != nil {
 		return fmt.Errorf("title request failed for comment %s, %s: %w", c.ID, c.Locator.URL, err)
 	}

backend/app/cmd/cleanup_test.go

@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-chi/chi/v5"
 	"github.com/jessevdk/go-flags"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -46,7 +45,6 @@ func TestCleanup_IsSpam(t *testing.T) {
 	}
 
 	for n, tt := range tbl {
-		tt := tt
 		checkName := fmt.Sprintf("check-%d-%s", n, tt.name)
 		t.Run(checkName, func(t *testing.T) {
 			c := store.Comment{ID: checkName, Text: tt.text, Score: tt.score}
@@ -59,7 +57,7 @@ func TestCleanup_IsSpam(t *testing.T) {
 }
 
 func TestCleanup_postsInRange(t *testing.T) {
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, nil)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -82,7 +80,7 @@ func TestCleanup_postsInRange(t *testing.T) {
 }
 
 func TestCleanup_listComments(t *testing.T) {
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, nil)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -108,7 +106,7 @@ func TestCleanup_listComments(t *testing.T) {
 
 func TestCleanup_ExecuteSpam(t *testing.T) {
 	cleaned := cleanedComments{}
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, &cleaned)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -127,7 +125,7 @@ func TestCleanup_ExecuteSpam(t *testing.T) {
 
 func TestCleanup_ExecuteTitle(t *testing.T) {
 	titledComments := cleanedComments{}
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, &titledComments)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -143,7 +141,7 @@ func TestCleanup_ExecuteTitle(t *testing.T) {
 	assert.Equal(t, []string{"/api/v1/admin/title/1", "/api/v1/admin/title/2", "/api/v1/admin/title/3", "/api/v1/admin/title/11"}, titledComments.ids)
 }
 
-func cleanupRoutes(t *testing.T, r *chi.Mux, c *cleanedComments) {
+func cleanupRoutes(t *testing.T, r *http.ServeMux, c *cleanedComments) {
 	r.HandleFunc("/api/v1/list", func(w http.ResponseWriter, r *http.Request) {
 		require.Equal(t, "GET", r.Method)
 		require.Equal(t, "site=remark&limit=10000", r.URL.RawQuery)
@@ -174,7 +172,7 @@ func cleanupRoutes(t *testing.T, r *chi.Mux, c *cleanedComments) {
 
 		commentsWithInfo := struct {
 			Comments []store.Comment `json:"comments"`
-			Info     store.PostInfo  `json:"info,omitempty"`
+			Info     store.PostInfo  `json:"info"`
 		}{}
 
 		switch r.URL.Query().Get("url") {

backend/app/cmd/cmd.go

@@ -124,7 +124,7 @@ func responseError(resp *http.Response) error {
 // mkdir -p for all dirs
 func makeDirs(dirs ...string) error {
 	for _, dir := range dirs {
-		if err := os.MkdirAll(dir, 0o700); err != nil { // If path is already a directory, MkdirAll does nothing
+		if err := os.MkdirAll(dir, 0o700); err != nil { // if path is already a directory, MkdirAll does nothing
 			return fmt.Errorf("can't make directory %s: %w", dir, err)
 		}
 	}

backend/app/cmd/import.go

@@ -42,7 +42,7 @@ func (ic *ImportCommand) Execute(_ []string) error {
 	}
 	req.SetBasicAuth("admin", ic.AdminPasswd)
 
-	resp, err := client.Do(req.WithContext(ctx)) // closes request's reader
+	resp, err := client.Do(req.WithContext(ctx)) //nolint:gosec // importURL built from operator CLI flags, not user input; closes request's reader
 	if err != nil {
 		return fmt.Errorf("request failed for %s: %w", importURL, err)
 	}

backend/app/cmd/remap.go

@@ -34,13 +34,13 @@ func (rc *RemapCommand) Execute(_ []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rc.Timeout)
 	defer cancel()
 	remapURL := fmt.Sprintf("%s/api/v1/admin/remap?site=%s", rc.RemarkURL, rc.Site)
-	req, err := http.NewRequest(http.MethodPost, remapURL, rulesReader)
+	req, err := http.NewRequest(http.MethodPost, remapURL, rulesReader) //nolint:gosec // RemarkURL is operator CLI flag, not user input
 	if err != nil {
 		return fmt.Errorf("can't make remap request for %s: %w", remapURL, err)
 	}
 	req.SetBasicAuth("admin", rc.AdminPasswd)
 
-	resp, err := client.Do(req.WithContext(ctx))
+	resp, err := client.Do(req.WithContext(ctx)) //nolint:gosec // see above
 	if err != nil {
 		return fmt.Errorf("request failed for %s: %w", remapURL, err)
 	}

backend/app/cmd/server.go

@@ -2,7 +2,9 @@ package cmd
 
 import (
 	"context"
+	"crypto/sha1" //nolint:gosec // used only for stable ID hashing, not for security
 	"embed"
+	"encoding/json"
 	"fmt"
 	"net"
 	"net/http"
@@ -11,6 +13,7 @@ import (
 	"os/signal"
 	"path"
 	"regexp"
+	"slices"
 	"strings"
 	"syscall"
 	"time"
@@ -19,15 +22,16 @@ import (
 	"github.com/go-pkgz/lcw/v2/eventbus"
 	log "github.com/go-pkgz/lgr"
 	ntf "github.com/go-pkgz/notify"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/kyokomi/emoji/v2"
 	bolt "go.etcd.io/bbolt"
+	"golang.org/x/oauth2"
 
-	"github.com/go-pkgz/auth"
-	"github.com/go-pkgz/auth/avatar"
-	"github.com/go-pkgz/auth/provider"
-	"github.com/go-pkgz/auth/provider/sender"
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2"
+	"github.com/go-pkgz/auth/v2/avatar"
+	"github.com/go-pkgz/auth/v2/provider"
+	"github.com/go-pkgz/auth/v2/provider/sender"
+	"github.com/go-pkgz/auth/v2/token"
 	cache "github.com/go-pkgz/lcw/v2"
 
 	"github.com/umputun/remark42/backend/app/migrator"
@@ -35,6 +39,7 @@ import (
 	"github.com/umputun/remark42/backend/app/providers"
 	"github.com/umputun/remark42/backend/app/rest/api"
 	"github.com/umputun/remark42/backend/app/rest/proxy"
+	"github.com/umputun/remark42/backend/app/safehttp"
 	"github.com/umputun/remark42/backend/app/store"
 	"github.com/umputun/remark42/backend/app/store/admin"
 	"github.com/umputun/remark42/backend/app/store/engine"
@@ -74,18 +79,19 @@ type ServerCommand struct {
 	CriticalScore              int           `long:"critical-score" env:"CRITICAL_SCORE" default:"-10" description:"critical score threshold"`
 	PositiveScore              bool          `long:"positive-score" env:"POSITIVE_SCORE" description:"enable positive score only"`
 	ReadOnlyAge                int           `long:"read-age" env:"READONLY_AGE" default:"0" description:"read-only age of comments, days"`
-	EditDuration               time.Duration `long:"edit-time" env:"EDIT_TIME" default:"5m" description:"edit window"`
+	EditDuration               time.Duration `long:"edit-time" env:"EDIT_TIME" default:"5m" description:"edit window; set to 0 to disable comment editing and staged image cleanup"`
 	AdminEdit                  bool          `long:"admin-edit" env:"ADMIN_EDIT" description:"unlimited edit for admins"`
 	Port                       int           `long:"port" env:"REMARK_PORT" default:"8080" description:"port"`
 	Address                    string        `long:"address" env:"REMARK_ADDRESS" default:"" description:"listening address"`
 	WebRoot                    string        `long:"web-root" env:"REMARK_WEB_ROOT" default:"./web" description:"web root directory"`
 	UpdateLimit                float64       `long:"update-limit" env:"UPDATE_LIMIT" default:"0.5" description:"updates/sec limit"`
+	TrustedProxies             []string      `long:"trusted-proxy" env:"TRUSTED_PROXY" description:"reverse-proxy networks (CIDR or IP) trusted to set the client IP; if unset, trusted from any client (see docs)" env-delim:","`
 	RestrictedWords            []string      `long:"restricted-words" env:"RESTRICTED_WORDS" description:"words prohibited to use in comments" env-delim:","`
 	RestrictedNames            []string      `long:"restricted-names" env:"RESTRICTED_NAMES" description:"names prohibited to use by user" env-delim:","`
 	EnableEmoji                bool          `long:"emoji" env:"EMOJI" description:"enable emoji"`
 	SimpleView                 bool          `long:"simple-view" env:"SIMPLE_VIEW" description:"minimal comment editor mode"`
 	ProxyCORS                  bool          `long:"proxy-cors" env:"PROXY_CORS" description:"disable internal CORS and delegate it to proxy"`
-	AllowedHosts               []string      `long:"allowed-hosts" env:"ALLOWED_HOSTS" description:"limit hosts/sources allowed to embed comments" env-delim:","`
+	AllowedHosts               []string      `long:"allowed-hosts" env:"ALLOWED_HOSTS" description:"limit hosts/sources allowed to embed comments via CSP 'frame-ancestors'" env-delim:","`
 	SubscribersOnly            bool          `long:"subscribers-only" env:"SUBSCRIBERS_ONLY" description:"enable commenting only for Patreon subscribers"`
 	DisableSignature           bool          `long:"disable-signature" env:"DISABLE_SIGNATURE" description:"disable server signature in headers"`
 	DisableFancyTextFormatting bool          `long:"disable-fancy-text-formatting" env:"DISABLE_FANCY_TEXT_FORMATTING" description:"disable fancy comments text formatting (replacement of quotes, dashes, fractions, etc)"`
@@ -96,30 +102,32 @@ type ServerCommand struct {
 			Cookie time.Duration `long:"cookie" env:"COOKIE" default:"200h" description:"auth cookie TTL"`
 		} `group:"ttl" namespace:"ttl" env-namespace:"TTL"`
 
-		SendJWTHeader bool   `long:"send-jwt-header" env:"SEND_JWT_HEADER" description:"send JWT as a header instead of cookie"`
+		SendJWTHeader bool   `long:"send-jwt-header" env:"SEND_JWT_HEADER" description:"send JWT as a header instead of server-set cookie; with this enabled, frontend stores the JWT in a client-side cookie (note: increases vulnerability to XSS attacks)"`
 		SameSite      string `long:"same-site" env:"SAME_SITE" description:"set same site policy for cookies" choice:"default" choice:"none" choice:"lax" choice:"strict" default:"default"` // nolint
 
-		Apple     AppleGroup `group:"apple" namespace:"apple" env-namespace:"APPLE" description:"Apple OAuth"`
-		Google    AuthGroup  `group:"google" namespace:"google" env-namespace:"GOOGLE" description:"Google OAuth"`
-		Github    AuthGroup  `group:"github" namespace:"github" env-namespace:"GITHUB" description:"Github OAuth"`
-		Facebook  AuthGroup  `group:"facebook" namespace:"facebook" env-namespace:"FACEBOOK" description:"Facebook OAuth"`
-		Microsoft AuthGroup  `group:"microsoft" namespace:"microsoft" env-namespace:"MICROSOFT" description:"Microsoft OAuth"`
-		Yandex    AuthGroup  `group:"yandex" namespace:"yandex" env-namespace:"YANDEX" description:"Yandex OAuth"`
-		Twitter   AuthGroup  `group:"twitter" namespace:"twitter" env-namespace:"TWITTER" description:"Twitter OAuth"`
-		Patreon   AuthGroup  `group:"patreon" namespace:"patreon" env-namespace:"PATREON" description:"Patreon OAuth"`
-		Telegram  bool       `long:"telegram" env:"TELEGRAM" description:"Enable Telegram auth (using token from telegram.token)"`
-		Dev       bool       `long:"dev" env:"DEV" description:"enable dev (local) oauth2"`
-		Anonymous bool       `long:"anon" env:"ANON" description:"enable anonymous login"`
+		Apple     AppleGroup         `group:"apple" namespace:"apple" env-namespace:"APPLE" description:"Apple OAuth"`
+		Google    AuthGroup          `group:"google" namespace:"google" env-namespace:"GOOGLE" description:"Google OAuth"`
+		Github    AuthGroup          `group:"github" namespace:"github" env-namespace:"GITHUB" description:"Github OAuth"`
+		Facebook  AuthGroup          `group:"facebook" namespace:"facebook" env-namespace:"FACEBOOK" description:"Facebook OAuth"`
+		Microsoft MicrosoftAuthGroup `group:"microsoft" namespace:"microsoft" env-namespace:"MICROSOFT" description:"Microsoft OAuth"`
+		Yandex    AuthGroup          `group:"yandex" namespace:"yandex" env-namespace:"YANDEX" description:"Yandex OAuth"`
+		Twitter   AuthGroup          `group:"twitter" namespace:"twitter" env-namespace:"TWITTER" description:"[deprecated, doesn't work] Twitter OAuth"`
+		Patreon   AuthGroup          `group:"patreon" namespace:"patreon" env-namespace:"PATREON" description:"Patreon OAuth"`
+		Discord   AuthGroup          `group:"discord" namespace:"discord" env-namespace:"DISCORD" description:"Discord OAuth"`
+		Custom    CustomAuthGroup    `group:"custom" namespace:"custom" env-namespace:"CUSTOM" description:"Custom OAuth2 provider"`
+		Telegram  bool               `long:"telegram" env:"TELEGRAM" description:"Enable Telegram auth (using token from telegram.token)"`
+		Dev       bool               `long:"dev" env:"DEV" description:"enable dev (local) oauth2"`
+		Anonymous bool               `long:"anon" env:"ANON" description:"enable anonymous login"`
 		Email     struct {
 			Enable       bool          `long:"enable" env:"ENABLE" description:"enable auth via email"`
 			From         string        `long:"from" env:"FROM" description:"from email address"`
 			Subject      string        `long:"subj" env:"SUBJ" default:"remark42 confirmation" description:"email's subject"`
 			ContentType  string        `long:"content-type" env:"CONTENT_TYPE" default:"text/html" description:"content type"`
 			Host         string        `long:"host" env:"HOST" description:"[deprecated, use --smtp.host] SMTP host"`
-			Port         int           `long:"port" env:"PORT" description:"[deprecated, use --smtp.port] SMTP password"`
-			SMTPPassword string        `long:"passwd" env:"PASSWD" description:"[deprecated, use --smtp.password] SMTP port"`
-			SMTPUserName string        `long:"user" env:"USER" description:"[deprecated, use --smtp.username] enable TLS"`
-			TLS          bool          `long:"tls" env:"TLS" description:"[deprecated, use --smtp.tls] SMTP TCP connection timeout"`
+			Port         int           `long:"port" env:"PORT" description:"[deprecated, use --smtp.port] SMTP port"`
+			SMTPPassword string        `long:"passwd" env:"PASSWD" description:"[deprecated, use --smtp.password] SMTP password"`
+			SMTPUserName string        `long:"user" env:"USER" description:"[deprecated, use --smtp.username] SMTP user name"`
+			TLS          bool          `long:"tls" env:"TLS" description:"[deprecated, use --smtp.tls] enable TLS"`
 			TimeOut      time.Duration `long:"timeout" env:"TIMEOUT" default:"10s" description:"[deprecated, use --smtp.timeout] SMTP TCP connection timeout"`
 			MsgTemplate  string        `long:"template" env:"TEMPLATE" description:"[deprecated] message template file" default:"email_confirmation_login.html.tmpl"`
 		} `group:"email" namespace:"email" env-namespace:"EMAIL"`
@@ -139,7 +147,7 @@ type ImageProxyGroup struct {
 
 // AppleGroup defines options for Apple auth params
 type AppleGroup struct {
-	CID                string `long:"cid" env:"CID" description:"Apple client ID"`
+	CID                string `long:"cid" env:"CID" description:"Apple client ID (App ID or Services ID)"`
 	TID                string `long:"tid" env:"TID" description:"Apple service ID"`
 	KID                string `long:"kid" env:"KID" description:"Private key ID"`
 	PrivateKeyFilePath string `long:"private-key-filepath" env:"PRIVATE_KEY_FILEPATH" description:"Private key file location" default:"/srv/var/apple.p8"`
@@ -151,6 +159,28 @@ type AuthGroup struct {
 	CSEC string `long:"csec" env:"CSEC" description:"OAuth client secret"`
 }
 
+// MicrosoftAuthGroup defines options group for Microsoft auth params
+type MicrosoftAuthGroup struct {
+	CID    string `long:"cid" env:"CID" description:"OAuth client ID"`
+	CSEC   string `long:"csec" env:"CSEC" description:"OAuth client secret"`
+	Tenant string `long:"tenant" env:"TENANT" description:"Azure AD tenant ID, domain, or 'common' (default)" default:"common"`
+}
+
+// CustomAuthGroup defines options group for custom OAuth2 provider params
+type CustomAuthGroup struct {
+	Name         string   `long:"name" env:"NAME" description:"custom provider name used in auth route"`
+	CID          string   `long:"cid" env:"CID" description:"OAuth client ID"`
+	CSEC         string   `long:"csec" env:"CSEC" description:"OAuth client secret"`
+	AuthURL      string   `long:"auth-url" env:"AUTH_URL" description:"OAuth authorization endpoint"`
+	TokenURL     string   `long:"token-url" env:"TOKEN_URL" description:"OAuth token endpoint"`
+	InfoURL      string   `long:"info-url" env:"INFO_URL" description:"OAuth user info endpoint"`
+	Scopes       []string `long:"scopes" env:"SCOPES" env-delim:"," description:"OAuth scopes"`
+	IDField      string   `long:"id-field" env:"ID_FIELD" default:"sub" description:"user info field used as unique id"`
+	NameField    string   `long:"name-field" env:"NAME_FIELD" default:"name" description:"user info field used as display name"`
+	PictureField string   `long:"picture-field" env:"PICTURE_FIELD" default:"picture" description:"user info field used as avatar url"`
+	EmailField   string   `long:"email-field" env:"EMAIL_FIELD" default:"email" description:"user info field used as email"`
+}
+
 // StoreGroup defines options group for store params
 type StoreGroup struct {
 	Type string `long:"type" env:"TYPE" description:"type of storage" choice:"bolt" choice:"rpc" default:"bolt"` // nolint
@@ -254,8 +284,8 @@ type NotifyGroup struct {
 	} `group:"slack" namespace:"slack" env-namespace:"SLACK"`
 	Webhook struct {
 		URL      string        `long:"url" env:"URL" description:"webhook URL for admin notifications"`
-		Template string        `long:"template" env:"TEMPLATE" description:"webhook authentication template" default:"{\"text\": \"{{.Text}}\"}"`
-		Headers  []string      `long:"headers" description:"webhook authentication headers in format --notify.webhook.headers=Header1:Value1,Value2,... [$NOTIFY_WEBHOOK_HEADERS]"` // env NOTIFY_WEBHOOK_HEADERS split in code bellow to allow , inside ""
+		Template string        `long:"template" env:"TEMPLATE" description:"webhook payload template (Go text/template); falls back to {\"text\": {{.Text | escapeJSONString}}} when empty"`
+		Headers  []string      `long:"headers" description:"webhook headers in format --notify.webhook.headers=Header1:Value1,Value2,... [$NOTIFY_WEBHOOK_HEADERS]"` // env NOTIFY_WEBHOOK_HEADERS split in code below to allow , inside ""
 		Timeout  time.Duration `long:"timeout" env:"TIMEOUT" description:"webhook timeout" default:"5s"`
 	} `group:"webhook" namespace:"webhook" env-namespace:"WEBHOOK"`
 }
@@ -313,6 +343,7 @@ func (s *ServerCommand) Execute(_ []string) error {
 	log.Printf("[INFO] start server on port %s:%d", s.Address, s.Port)
 	resetEnv(
 		"SECRET",
+		"AUTH_APPLE_KID",
 		"AUTH_GOOGLE_CSEC",
 		"AUTH_GITHUB_CSEC",
 		"AUTH_FACEBOOK_CSEC",
@@ -320,6 +351,8 @@ func (s *ServerCommand) Execute(_ []string) error {
 		"AUTH_TWITTER_CSEC",
 		"AUTH_YANDEX_CSEC",
 		"AUTH_PATREON_CSEC",
+		"AUTH_DISCORD_CSEC",
+		"AUTH_CUSTOM_CSEC",
 		"TELEGRAM_TOKEN",
 		"SMTP_PASSWORD",
 		"ADMIN_PASSWD",
@@ -406,6 +439,12 @@ func (s *ServerCommand) HandleDeprecatedFlags() (result []DeprecatedFlag) {
 	if s.Notify.Telegram.API != "https://api.telegram.org/bot" {
 		result = append(result, DeprecatedFlag{Old: "notify.telegram.api", Version: "1.9"})
 	}
+	if s.Auth.Twitter.CID != "" {
+		result = append(result, DeprecatedFlag{Old: "auth.twitter.cid", Version: "1.14"})
+	}
+	if s.Auth.Twitter.CSEC != "" {
+		result = append(result, DeprecatedFlag{Old: "auth.twitter.csec", Version: "1.14"})
+	}
 	return append(result, s.findDeprecatedFlagsCollisions()...)
 }
 
@@ -463,12 +502,87 @@ func stringsSetAndDifferent(s1, s2 string) bool {
 }
 
 func contains(s string, a []string) bool {
-	for _, t := range a {
-		if t == s {
-			return true
+	return slices.Contains(a, s)
+}
+
+var reservedCustomProviderNames = map[string]struct{}{
+	"email":     {},
+	"anonymous": {},
+	"google":    {},
+	"github":    {},
+	"facebook":  {},
+	"yandex":    {},
+	"twitter":   {},
+	"microsoft": {},
+	"patreon":   {},
+	"discord":   {},
+	"telegram":  {},
+	"dev":       {},
+	"apple":     {},
+}
+
+var validCustomProviderName = regexp.MustCompile(`^[a-z0-9][a-z0-9_-]*$`)
+
+func isReservedCustomProviderName(name string) bool {
+	_, ok := reservedCustomProviderNames[name]
+	return ok
+}
+
+func isValidCustomProviderName(name string) bool {
+	return validCustomProviderName.MatchString(name)
+}
+
+func customProviderSourceID(data provider.UserData, cfg CustomAuthGroup) string {
+	sourceID := data.Value(cfg.IDField)
+	if sourceID == "" {
+		sourceID = data.Value(cfg.EmailField)
+	}
+	if sourceID == "" {
+		sourceID = data.Value(cfg.NameField)
+	}
+	if sourceID == "" {
+		sourceID = data.Value(cfg.PictureField)
+	}
+	if sourceID == "" {
+		payload, err := json.Marshal(data)
+		if err != nil {
+			log.Printf("[WARN] failed to serialize custom oauth user data for ID fallback: %v", err)
+		} else {
+			sourceID = string(payload)
 		}
 	}
-	return false
+	if sourceID == "" || sourceID == "{}" {
+		log.Printf("[WARN] custom oauth provider returned no stable user identifier fields, falling back to hashed payload")
+	}
+	return sourceID
+}
+
+func (c CustomAuthGroup) isConfigured() bool {
+	return c.Name != "" || c.CID != "" || c.CSEC != "" || c.AuthURL != "" || c.TokenURL != "" || c.InfoURL != "" ||
+		len(c.Scopes) > 0 || c.IDField != "sub" || c.NameField != "name" || c.PictureField != "picture" || c.EmailField != "email"
+}
+
+func (c CustomAuthGroup) missingRequired() []string {
+	missing := []string{}
+	if c.Name == "" {
+		missing = append(missing, "AUTH_CUSTOM_NAME")
+	}
+	if c.CID == "" {
+		missing = append(missing, "AUTH_CUSTOM_CID")
+	}
+	if c.CSEC == "" {
+		missing = append(missing, "AUTH_CUSTOM_CSEC")
+	}
+	if c.AuthURL == "" {
+		missing = append(missing, "AUTH_CUSTOM_AUTH_URL")
+	}
+	if c.TokenURL == "" {
+		missing = append(missing, "AUTH_CUSTOM_TOKEN_URL")
+	}
+	if c.InfoURL == "" {
+		missing = append(missing, "AUTH_CUSTOM_INFO_URL")
+	}
+	return missing
 }
 
 // newServerApp prepares application and return it with all active parts
@@ -483,6 +597,18 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 	}
 	log.Printf("[INFO] root url=%s", s.RemarkURL)
 
+	// parse trusted proxies up front so a bad CIDR fails before any resource is allocated
+	trustedProxies, err := api.ParseTrustedProxies(s.TrustedProxies)
+	if err != nil {
+		return nil, fmt.Errorf("invalid --trusted-proxy: %w", err)
+	}
+	switch {
+	case len(trustedProxies) == 0:
+		log.Printf("[WARN] --trusted-proxy not set: forwarding headers are trusted from any client and can be spoofed to bypass rate limiting / vote dedup; set it behind a reverse proxy (see docs)")
+	case api.TrustsAnyPeer(trustedProxies):
+		log.Printf("[WARN] --trusted-proxy has a catch-all (0.0.0.0/0 or ::/0): forwarding headers are trusted from any client, re-opening the spoofing bypass; scope it to your proxy network")
+	}
+
 	storeEngine, err := s.makeDataStore()
 	if err != nil {
 		return nil, fmt.Errorf("failed to make data store engine: %w", err)
@@ -509,7 +635,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 		MaxVotes:               s.MaxVotes,
 		PositiveScore:          s.PositiveScore,
 		ImageService:           imageService,
-		TitleExtractor:         service.NewTitleExtractor(http.Client{Timeout: time.Second * 5}, s.getAllowedDomains()),
+		TitleExtractor:         service.NewTitleExtractor(http.Client{Timeout: time.Second * 5, Transport: safehttp.Transport()}, s.getAllowedDomains()),
 		RestrictedWordsMatcher: service.NewRestrictedWordsMatcher(service.StaticRestrictedWordsLister{Words: s.RestrictedWords}),
 	}
 	dataService.RestrictSameIPVotes.Enabled = s.RestrictVoteIP
@@ -590,6 +716,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 		Migrator:                   migr,
 		ReadOnlyAge:                s.ReadOnlyAge,
 		SharedSecret:               s.SharedSecret,
+		TrustedProxies:             trustedProxies,
 		Authenticator:              authenticator,
 		Cache:                      loadingCache,
 		NotifyService:              notifyService,
@@ -608,6 +735,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 		SubscribersOnly:            s.SubscribersOnly,
 		DisableSignature:           s.DisableSignature,
 		DisableFancyTextFormatting: s.DisableFancyTextFormatting,
+		ExternalImageProxy:         s.ImageProxy.CacheExternal,
 	}
 
 	srv.ScoreThresholds.Low, srv.ScoreThresholds.Critical = s.LowScore, s.CriticalScore
@@ -668,9 +796,9 @@ func (s *ServerCommand) getAllowedDomains() []string {
 			continue
 		}
 
-		// Only for RemarkURL if domain is not IP and has more than two levels, extract second level domain.
-		// For AllowedHosts we don't do this as they are exact list of domains which can host comments, but
-		// RemarkURL might be on a subdomain and we must allow parent domain to be used for TitleExtract.
+		// only for RemarkURL if domain is not IP and has more than two levels, extract second level domain.
+		// for AllowedHosts we don't do this as they are exact list of domains which can host comments, but
+		// remarkURL might be on a subdomain and we must allow parent domain to be used for TitleExtract.
 		if rawURL == s.RemarkURL && net.ParseIP(domain) == nil && len(strings.Split(domain, ".")) > 2 {
 			domain = strings.Join(strings.Split(domain, ".")[len(strings.Split(domain, "."))-2:], ".")
 		}
@@ -680,6 +808,42 @@ func (s *ServerCommand) getAllowedDomains() []string {
 	return allowedDomains
 }
 
+// getAllowedRedirectHosts normalises s.AllowedHosts into the form that
+// go-pkgz/auth's redirect validator expects. Strips http(s) schemes and
+// paths; preserves explicit ports (the validator matches both host-only
+// and host:port, so an entry without a port accepts any port while an
+// entry with a port restricts to that port). Skips CSP sentinels
+// ('self' / "self") and wildcard entries (*, *.example.com) that are
+// valid CSP source expressions but not valid hostnames.
+func (s *ServerCommand) getAllowedRedirectHosts() []string {
+	out := make([]string, 0, len(s.AllowedHosts))
+	for _, raw := range s.AllowedHosts {
+		raw = strings.TrimSpace(raw)
+		if raw == "" || raw == "self" || raw == "'self'" || raw == `"self"` {
+			continue
+		}
+		if strings.ContainsRune(raw, '*') { // CSP wildcard, not a host
+			continue
+		}
+		// add scheme so url.Parse populates Hostname()/Host consistently for bare hosts
+		toParse := raw
+		if !strings.HasPrefix(toParse, "http://") && !strings.HasPrefix(toParse, "https://") {
+			toParse = "https://" + toParse
+		}
+		u, err := url.Parse(toParse)
+		if err != nil || u.Hostname() == "" {
+			log.Printf("[WARN] skipping invalid AllowedHosts entry %q for redirect allowlist: %v", raw, err)
+			continue
+		}
+		if u.Port() != "" {
+			out = append(out, u.Host) // preserve explicit host:port so allowlist is port-specific
+			continue
+		}
+		out = append(out, u.Hostname())
+	}
+	return out
+}
+
 // Run all application objects
 func (a *serverApp) run(ctx context.Context) error {
 	if a.AdminPasswd != "" {
@@ -905,10 +1069,9 @@ func (s *ServerCommand) addAuthProviders(authenticator *auth.Service) error {
 	if s.Auth.Apple.CID != "" && s.Auth.Apple.TID != "" && s.Auth.Apple.KID != "" {
 		err := authenticator.AddAppleProvider(
 			provider.AppleConfig{
-				ClientID:     s.Auth.Apple.CID,
-				TeamID:       s.Auth.Apple.TID,
-				KeyID:        s.Auth.Apple.KID,
-				ResponseMode: "query", // default is form_post which wouldn't work here
+				ClientID: s.Auth.Apple.CID,
+				TeamID:   s.Auth.Apple.TID,
+				KeyID:    s.Auth.Apple.KID,
 			},
 			provider.LoadApplePrivateKeyFromFile(s.Auth.Apple.PrivateKeyFilePath),
 		)
@@ -930,7 +1093,7 @@ func (s *ServerCommand) addAuthProviders(authenticator *auth.Service) error {
 		providersCount++
 	}
 	if s.Auth.Microsoft.CID != "" && s.Auth.Microsoft.CSEC != "" {
-		authenticator.AddProvider("microsoft", s.Auth.Microsoft.CID, s.Auth.Microsoft.CSEC)
+		authenticator.AddMicrosoftProvider(s.Auth.Microsoft.CID, s.Auth.Microsoft.CSEC, s.Auth.Microsoft.Tenant)
 		providersCount++
 	}
 	if s.Auth.Yandex.CID != "" && s.Auth.Yandex.CSEC != "" {
@@ -945,6 +1108,49 @@ func (s *ServerCommand) addAuthProviders(authenticator *auth.Service) error {
 		authenticator.AddProvider("patreon", s.Auth.Patreon.CID, s.Auth.Patreon.CSEC)
 		providersCount++
 	}
+	if s.Auth.Discord.CID != "" && s.Auth.Discord.CSEC != "" {
+		authenticator.AddProvider("discord", s.Auth.Discord.CID, s.Auth.Discord.CSEC)
+		providersCount++
+	}
+
+	if s.Auth.Custom.isConfigured() {
+		missing := s.Auth.Custom.missingRequired()
+		if len(missing) > 0 {
+			return fmt.Errorf("custom oauth provider configuration is incomplete, missing: %s", strings.Join(missing, ", "))
+		}
+
+		customName := strings.ToLower(strings.TrimSpace(s.Auth.Custom.Name))
+		if !isValidCustomProviderName(customName) {
+			return fmt.Errorf("custom oauth provider name %q is invalid, expected pattern %q", customName, validCustomProviderName.String())
+		}
+		if isReservedCustomProviderName(customName) {
+			return fmt.Errorf("custom oauth provider name %q is reserved", customName)
+		}
+
+		authenticator.AddCustomProvider(customName, auth.Client{Cid: s.Auth.Custom.CID, Csecret: s.Auth.Custom.CSEC}, provider.CustomHandlerOpt{
+			Endpoint: oauth2.Endpoint{
+				AuthURL:  s.Auth.Custom.AuthURL,
+				TokenURL: s.Auth.Custom.TokenURL,
+			},
+			InfoURL: s.Auth.Custom.InfoURL,
+			Scopes:  s.Auth.Custom.Scopes,
+			MapUserFn: func(data provider.UserData, _ []byte) token.User {
+				sourceID := customProviderSourceID(data, s.Auth.Custom)
+				hashID := token.HashID(sha1.New(), sourceID) //nolint:gosec // stable provider user id hash
+				user := token.User{
+					ID:      customName + "_" + hashID,
+					Name:    data.Value(s.Auth.Custom.NameField),
+					Picture: data.Value(s.Auth.Custom.PictureField),
+					Email:   data.Value(s.Auth.Custom.EmailField),
+				}
+				if user.Name == "" {
+					user.Name = "noname_" + hashID[:4]
+				}
+				return user
+			},
+		})
+		providersCount++
+	}
 
 	if s.Auth.Dev {
 		log.Print("[INFO] dev access enabled")
@@ -1007,7 +1213,7 @@ func (s *ServerCommand) addAuthProviders(authenticator *auth.Service) error {
 			}
 			return true, nil
 		}),
-			// Custom user ID generator, used to distinguish anonymous users with the same login
+			// custom user ID generator, used to distinguish anonymous users with the same login
 			// coming from different IPs
 			func(user string, r *http.Request) string {
 				return user + r.RemoteAddr
@@ -1092,14 +1298,14 @@ func (s *ServerCommand) makeNotifyDestinations(authenticator *auth.Service) ([]n
 			VerificationSubject: s.Notify.Email.VerificationSubject,
 			UnsubscribeURL:      s.RemarkURL + "/email/unsubscribe.html",
 			// TODO: uncomment after #560 frontend part is ready and URL is known
-			// SubscribeURL:        s.RemarkURL + "/subscribe.html?token=",
+			// subscribeURL:        s.RemarkURL + "/subscribe.html?token=",
 			TokenGenFn: func(userID, email, site string) (string, error) {
 				claims := token.Claims{
 					Handshake: &token.Handshake{ID: userID + "::" + email},
-					StandardClaims: jwt.StandardClaims{
-						Audience:  site,
-						ExpiresAt: time.Now().Add(100 * 365 * 24 * time.Hour).Unix(),
-						NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+					RegisteredClaims: jwt.RegisteredClaims{
+						Audience:  jwt.ClaimStrings{site},
+						ExpiresAt: jwt.NewNumericDate(time.Now().Add(100 * 365 * 24 * time.Hour)),
+						NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 						Issuer:    "remark42",
 					},
 				}
@@ -1195,6 +1401,12 @@ func (s *ServerCommand) getAuthenticator(ds *service.DataStore, avas avatar.Stor
 		SendJWTHeader:  s.Auth.SendJWTHeader,
 		SameSiteCookie: s.parseSameSite(s.Auth.SameSite),
 		SecureCookies:  strings.HasPrefix(s.RemarkURL, "https://"),
+		// enable the `from` redirect allowlist in go-pkgz/auth v2.1.2+ — limits
+		// post-auth redirects to RemarkURL's own host plus any configured
+		// AllowedHosts. Prevents the OAuth open-redirect / phishing vector.
+		AllowedRedirectHosts: token.AllowedHostsFunc(func() ([]string, error) {
+			return s.getAllowedRedirectHosts(), nil
+		}),
 		SecretReader: token.SecretFunc(func(aud string) (string, error) { // get secret per site
 			return admns.Key(aud)
 		}),
@@ -1202,10 +1414,16 @@ func (s *ServerCommand) getAuthenticator(ds *service.DataStore, avas avatar.Stor
 			if c.User == nil {
 				return c
 			}
-			c.User.SetAdmin(ds.IsAdmin(c.Audience, c.User.ID))
-			c.User.SetBoolAttr("blocked", ds.IsBlocked(c.Audience, c.User.ID))
+			// audience is a slice but we set it to a single element, and situation when there is no audience or there are more than one is unexpected
+			if len(c.Audience) != 1 {
+				return c
+			}
+			audience := c.Audience[0]
+
+			c.User.SetAdmin(ds.IsAdmin(audience, c.User.ID))
+			c.User.SetBoolAttr("blocked", ds.IsBlocked(audience, c.User.ID))
 			var err error
-			c.User.Email, err = ds.GetUserEmail(c.Audience, c.User.ID)
+			c.User.Email, err = ds.GetUserEmail(audience, c.User.ID)
 			if err != nil {
 				log.Printf("[WARN] can't read email for %s, %v", c.User.ID, err)
 			}
@@ -1337,11 +1555,11 @@ func newAuthRefreshCache() *authRefreshCache {
 }
 
 // Get implements cache getter with key converted to string
-func (c *authRefreshCache) Get(key interface{}) (interface{}, bool) {
-	return c.LoadingCache.Peek(key.(string))
+func (c *authRefreshCache) Get(key string) (token.Claims, bool) {
+	return c.Peek(key)
 }
 
 // Set implements cache setter with key converted to string
-func (c *authRefreshCache) Set(key, value interface{}) {
-	_, _ = c.LoadingCache.Get(key.(string), func() (token.Claims, error) { return value.(token.Claims), nil })
+func (c *authRefreshCache) Set(key string, value token.Claims) {
+	_, _ = c.LoadingCache.Get(key, func() (token.Claims, error) { return value, nil })
 }

backend/app/cmd/server_test.go

@@ -15,8 +15,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-pkgz/auth/token"
-	"github.com/golang-jwt/jwt"
+	"github.com/go-pkgz/auth/v2/provider"
+	"github.com/go-pkgz/auth/v2/token"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/jessevdk/go-flags"
 	"go.uber.org/goleak"
 
@@ -47,7 +48,7 @@ func TestServerApp(t *testing.T) {
 	// add comment
 	client := http.Client{Timeout: 10 * time.Second}
 	defer client.CloseIdleConnections()
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "remark"}}`))
 	require.NoError(t, err)
 	req.SetBasicAuth("admin", "password")
@@ -79,7 +80,7 @@ func TestServerApp_DevMode(t *testing.T) {
 	waitForHTTPServerStart(port)
 
 	providers := app.restSrv.Authenticator.Providers()
-	require.Equal(t, 10+1, len(providers), "extra auth provider")
+	require.Equal(t, 11+1, len(providers), "extra auth provider")
 	assert.Equal(t, "dev", providers[len(providers)-2].Name(), "dev auth provider")
 	// send ping
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%d/api/v1/ping", port))
@@ -95,6 +96,30 @@ func TestServerApp_DevMode(t *testing.T) {
 	app.Wait()
 }
 
+func TestServerApp_CustomOAuthProvider(t *testing.T) {
+	port := chooseRandomUnusedPort()
+	app, ctx, cancel := prepServerApp(t, func(o ServerCommand) ServerCommand {
+		o.Port = port
+		o.Auth.Custom.Name = "oidc"
+		o.Auth.Custom.CID = "cid"
+		o.Auth.Custom.CSEC = "csec"
+		o.Auth.Custom.AuthURL = "https://example.com/oauth2/authorize"
+		o.Auth.Custom.TokenURL = "https://example.com/oauth2/token"
+		o.Auth.Custom.InfoURL = "https://example.com/oauth2/userinfo"
+		return o
+	})
+
+	go func() { _ = app.run(ctx) }()
+	waitForHTTPServerStart(port)
+
+	providers := app.restSrv.Authenticator.Providers()
+	require.Equal(t, 11+1, len(providers), "extra auth provider")
+	assert.Equal(t, "oidc", providers[len(providers)-2].Name(), "custom auth provider")
+
+	cancel()
+	app.Wait()
+}
+
 func TestServerApp_AnonMode(t *testing.T) {
 	port := chooseRandomUnusedPort()
 	app, ctx, cancel := prepServerApp(t, func(o ServerCommand) ServerCommand {
@@ -107,7 +132,7 @@ func TestServerApp_AnonMode(t *testing.T) {
 	waitForHTTPServerStart(port)
 
 	providers := app.restSrv.Authenticator.Providers()
-	require.Equal(t, 10+1, len(providers), "extra auth provider for anon")
+	require.Equal(t, 11+1, len(providers), "extra auth provider for anon")
 	assert.Equal(t, "anonymous", providers[len(providers)-1].Name(), "anon auth provider")
 
 	client := http.Client{Timeout: 10 * time.Second}
@@ -129,7 +154,7 @@ func TestServerApp_AnonMode(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
 	// try to add a comment as good anonymous
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "remark"}}`))
 	require.NoError(t, err)
 
@@ -194,7 +219,7 @@ func TestServerApp_AnonMode(t *testing.T) {
 
 	// try to add a comment as anonymous with admin name
 	time.Sleep(time.Second)
-	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "remark"}}`))
 	require.NoError(t, err)
 
@@ -352,6 +377,16 @@ func TestServerApp_Failed(t *testing.T) {
 	assert.EqualError(t, err, "invalid remark42 url demo.remark42.com")
 	t.Log(err)
 
+	// invalid trusted proxy CIDR fails fast, before any resource is created
+	opts = ServerCommand{}
+	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
+	p = flags.NewParser(&opts, flags.Default)
+	_, err = p.ParseArgs([]string{"--backup=/tmp", "--trusted-proxy=nonsense"})
+	assert.NoError(t, err)
+	_, err = opts.newServerApp(context.Background())
+	assert.EqualError(t, err, `invalid --trusted-proxy: invalid trusted proxy "nonsense"`)
+	t.Log(err)
+
 	// wrong store type
 	opts = ServerCommand{}
 	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
@@ -389,6 +424,95 @@ func TestServerApp_Failed(t *testing.T) {
 		"failed to make authenticator: an AppleProvider creating failed: "+
 			"provided private key is not ECDSA")
 	t.Log(err)
+
+	// incomplete custom oauth config
+	opts = ServerCommand{}
+	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
+	p = flags.NewParser(&opts, flags.Default)
+	_, err = p.ParseArgs([]string{"--store.bolt.path=/tmp", "--backup=/tmp", "--image.fs.path=/tmp", "--auth.custom.name=oidc", "--auth.custom.cid=123"})
+	assert.NoError(t, err)
+	_, err = opts.newServerApp(context.Background())
+	assert.EqualError(t, err,
+		"failed to make authenticator: custom oauth provider configuration is incomplete, missing: "+
+			"AUTH_CUSTOM_CSEC, AUTH_CUSTOM_AUTH_URL, AUTH_CUSTOM_TOKEN_URL, AUTH_CUSTOM_INFO_URL")
+	t.Log(err)
+}
+
+func TestIsReservedCustomProviderName(t *testing.T) {
+	reserved := []string{
+		"email", "anonymous", "google", "github", "facebook", "yandex", "twitter",
+		"microsoft", "patreon", "discord", "telegram", "dev", "apple",
+	}
+
+	for _, name := range reserved {
+		t.Run(name, func(t *testing.T) {
+			assert.True(t, isReservedCustomProviderName(name))
+		})
+	}
+
+	assert.False(t, isReservedCustomProviderName("oidc"))
+}
+
+func TestIsValidCustomProviderName(t *testing.T) {
+	valid := []string{"oidc", "codeberg", "provider_1", "provider-1", "a1"}
+	for _, name := range valid {
+		t.Run("valid_"+name, func(t *testing.T) {
+			assert.True(t, isValidCustomProviderName(name))
+		})
+	}
+
+	invalid := []string{"", " has-space", "has space", "Uppercase", "provider!", "-provider", "_provider"}
+	for _, name := range invalid {
+		t.Run("invalid_"+strings.ReplaceAll(name, " ", "_"), func(t *testing.T) {
+			assert.False(t, isValidCustomProviderName(name))
+		})
+	}
+}
+
+func TestCustomProviderSourceID(t *testing.T) {
+	cfg := CustomAuthGroup{IDField: "sub", EmailField: "email", NameField: "name", PictureField: "picture"}
+
+	assert.Equal(t, "user-1", customProviderSourceID(provider.UserData{"sub": "user-1", "email": "a@example.com"}, cfg))
+	assert.Equal(t, "a@example.com", customProviderSourceID(provider.UserData{"email": "a@example.com"}, cfg))
+	assert.Equal(t, "alice", customProviderSourceID(provider.UserData{"name": "alice"}, cfg))
+	assert.Equal(t, "https://example.com/avatar.png", customProviderSourceID(provider.UserData{"picture": "https://example.com/avatar.png"}, cfg))
+	assert.Equal(t, `{"login":"alice"}`, customProviderSourceID(provider.UserData{"login": "alice"}, cfg))
+	assert.Equal(t, "{}", customProviderSourceID(provider.UserData{}, cfg))
+}
+
+func TestServerApp_InvalidCustomOAuthProviderName(t *testing.T) {
+	baseArgs := []string{
+		"--store.bolt.path=/tmp",
+		"--backup=/tmp",
+		"--image.fs.path=/tmp",
+		"--auth.custom.cid=123",
+		"--auth.custom.csec=456",
+		"--auth.custom.auth-url=https://example.com/oauth2/authorize",
+		"--auth.custom.token-url=https://example.com/oauth2/token",
+		"--auth.custom.info-url=https://example.com/oauth2/userinfo",
+	}
+
+	t.Run("reserved", func(t *testing.T) {
+		opts := ServerCommand{}
+		opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
+		p := flags.NewParser(&opts, flags.Default)
+		_, err := p.ParseArgs(append(baseArgs, "--auth.custom.name=twitter"))
+		require.NoError(t, err)
+
+		_, err = opts.newServerApp(context.Background())
+		assert.EqualError(t, err, `failed to make authenticator: custom oauth provider name "twitter" is reserved`)
+	})
+
+	t.Run("not_url_safe", func(t *testing.T) {
+		opts := ServerCommand{}
+		opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
+		p := flags.NewParser(&opts, flags.Default)
+		_, err := p.ParseArgs(append(baseArgs, "--auth.custom.name=bad name"))
+		require.NoError(t, err)
+
+		_, err = opts.newServerApp(context.Background())
+		assert.EqualError(t, err, `failed to make authenticator: custom oauth provider name "bad name" is invalid, expected pattern "^[a-z0-9][a-z0-9_-]*$"`)
+	})
 }
 
 func TestServerApp_Shutdown(t *testing.T) {
@@ -434,6 +558,34 @@ func TestServerApp_MainSignal(t *testing.T) {
 	assert.True(t, time.Since(st).Seconds() < 5, "should take under five sec", time.Since(st).Seconds())
 }
 
+func TestServerApp_RunCanceledBeforeRESTStart(t *testing.T) {
+	port := chooseRandomUnusedPort()
+	app, ctx, cancel := prepServerApp(t, func(o ServerCommand) ServerCommand {
+		o.Port = port
+		return o
+	})
+	cancel()
+
+	errCh := make(chan error, 1)
+	go func() { errCh <- app.run(ctx) }()
+
+	select {
+	case err := <-errCh:
+		require.NoError(t, err)
+		app.Wait()
+	case <-time.After(time.Second):
+		waitForHTTPServerStart(port)
+		app.restSrv.Shutdown()
+		select {
+		case <-errCh:
+			app.Wait()
+		case <-time.After(time.Second):
+			t.Fatal("server app did not stop after forced REST shutdown")
+		}
+		t.Fatal("server app should exit when context is canceled before REST server starts")
+	}
+}
+
 func TestServerApp_DeprecatedArgs(t *testing.T) {
 	s := ServerCommand{}
 	s.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
@@ -457,6 +609,8 @@ func TestServerApp_DeprecatedArgs(t *testing.T) {
 		"--notify.telegram.token=abcd",
 		"--notify.telegram.timeout=3m",
 		"--notify.telegram.api=http://example.org",
+		"--auth.twitter.cid=123",
+		"--auth.twitter.csec=456",
 	}
 	assert.Empty(t, s.SMTP.Host)
 	assert.Empty(t, s.SMTP.Port)
@@ -482,6 +636,8 @@ func TestServerApp_DeprecatedArgs(t *testing.T) {
 			{Old: "notify.telegram.token", New: "telegram.token", Version: "1.9"},
 			{Old: "notify.telegram.timeout", New: "telegram.timeout", Version: "1.9"},
 			{Old: "notify.telegram.api", Version: "1.9"},
+			{Old: "auth.twitter.cid", Version: "1.14"},
+			{Old: "auth.twitter.csec", Version: "1.14"},
 		},
 		deprecatedFlags)
 	assert.Equal(t, "smtp.example.org", s.SMTP.Host)
@@ -605,11 +761,11 @@ func TestServerAuthHooks(t *testing.T) {
 	tkService.TokenDuration = time.Second
 
 	claims := token.Claims{
-		StandardClaims: jwt.StandardClaims{
-			Audience:  "remark",
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark"},
 			Issuer:    "remark",
-			ExpiresAt: time.Now().Add(time.Second).Unix(),
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Second)),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 		},
 		User: &token.User{
 			ID:   "github_dev",
@@ -624,7 +780,7 @@ func TestServerAuthHooks(t *testing.T) {
 	defer client.CloseIdleConnections()
 
 	// add comment
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/p/2018/12/29/podcast-630/", "site": "remark"}}`))
 	require.NoError(t, err)
 	req.Header.Set("X-JWT", tk)
@@ -633,13 +789,13 @@ func TestServerAuthHooks(t *testing.T) {
 	require.NoError(t, resp.Body.Close())
 	assert.Equal(t, http.StatusCreated, resp.StatusCode, "non-blocked user able to post")
 
-	// add comment with no-aud claim
-	claimsNoAud := claims
-	claimsNoAud.Audience = ""
-	tkNoAud, err := tkService.Token(claimsNoAud)
+	// try to add comment with no-aud claim
+	badClaimsNoAud := claims
+	badClaimsNoAud.Audience = jwt.ClaimStrings{""}
+	tkNoAud, err := tkService.Token(badClaimsNoAud)
 	require.NoError(t, err)
 	t.Logf("no-aud claims: %s", tkNoAud)
-	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/p/2018/12/29/podcast-631/",
 	"site": "remark"}}`))
 	require.NoError(t, err)
@@ -651,6 +807,43 @@ func TestServerAuthHooks(t *testing.T) {
 	require.NoError(t, resp.Body.Close())
 	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "user without aud claim rejected, \n"+tkNoAud+"\n"+string(body))
 
+	// try to add comment with multiple auds
+	badClaimsMultipleAud := claims
+	badClaimsMultipleAud.Audience = jwt.ClaimStrings{"remark", "second_aud"}
+	tkMultipleAuds, err := tkService.Token(badClaimsMultipleAud)
+	require.NoError(t, err)
+	t.Logf("multiple aud claims: %s", tkMultipleAuds)
+	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
+		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/p/2018/12/29/podcast-631/",
+	"site": "remark"}}`))
+	require.NoError(t, err)
+	req.Header.Set("X-JWT", tkMultipleAuds)
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	body, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "user with multiple auds claim rejected, \n"+tkMultipleAuds+"\n"+string(body))
+
+	// try to add comment without user set
+	badClaimsNoUser := claims
+	badClaimsNoUser.Audience = jwt.ClaimStrings{"remark"}
+	badClaimsNoUser.User = nil
+	tkNoUser, err := tkService.Token(badClaimsNoUser)
+	require.NoError(t, err)
+	t.Logf("no user claims: %s", tkNoUser)
+	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
+		strings.NewReader(`{"text": "test 123", "locator":{"url": "https://radio-t.com/p/2018/12/29/podcast-631/",
+	"site": "remark"}}`))
+	require.NoError(t, err)
+	req.Header.Set("X-JWT", tkNoUser)
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	body, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "user without user information rejected, \n"+tkNoUser+"\n"+string(body))
+
 	// block user github_dev as admin
 	req, err = http.NewRequest(http.MethodPut,
 		fmt.Sprintf("http://localhost:%d/api/v1/admin/user/github_dev?site=remark&block=1&ttl=10d", port), http.NoBody)
@@ -665,7 +858,7 @@ func TestServerAuthHooks(t *testing.T) {
 	t.Log(string(b))
 
 	// try add a comment with blocked user
-	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment", port),
+	req, err = http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/api/v1/comment?site=remark", port),
 		strings.NewReader(`{"text": "test 123 blah", "locator":{"url": "https://radio-t.com/blah1", "site": "remark"}}`))
 	require.NoError(t, err)
 	req.Header.Set("X-JWT", tk)
@@ -697,7 +890,6 @@ func TestServerCommand_parseSameSite(t *testing.T) {
 
 	cmd := ServerCommand{}
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			assert.Equal(t, tt.res, cmd.parseSameSite(tt.inp))
 		})
@@ -748,8 +940,36 @@ func Test_getAllowedDomains(t *testing.T) {
 	}
 }
 
+func Test_getAllowedRedirectHosts(t *testing.T) {
+	tbl := []struct {
+		name  string
+		hosts []string
+		want  []string
+	}{
+		{name: "empty", hosts: nil, want: []string{}},
+		{name: "bare hostnames pass through", hosts: []string{"example.com", "admin.example.com"}, want: []string{"example.com", "admin.example.com"}},
+		{name: "https scheme stripped", hosts: []string{"https://example.com"}, want: []string{"example.com"}},
+		{name: "http scheme stripped", hosts: []string{"http://example.com"}, want: []string{"example.com"}},
+		{name: "scheme with path strips path", hosts: []string{"https://example.com/embed"}, want: []string{"example.com"}},
+		{name: "explicit port preserved as host:port", hosts: []string{"example.com:8080"}, want: []string{"example.com:8080"}},
+		{name: "scheme with explicit port preserved", hosts: []string{"https://example.com:8443"}, want: []string{"example.com:8443"}},
+		{name: "scheme without port stays bare host", hosts: []string{"https://example.com"}, want: []string{"example.com"}},
+		{name: "self sentinel filtered", hosts: []string{"'self'", "self", `"self"`, "example.com"}, want: []string{"example.com"}},
+		{name: "wildcards filtered", hosts: []string{"*", "*.example.com", "https://*.example.com", "example.com"}, want: []string{"example.com"}},
+		{name: "empty entries filtered", hosts: []string{"", "  ", "example.com"}, want: []string{"example.com"}},
+		{name: "mixed real-world", hosts: []string{"'self'", "https://blog.example.com", "admin.example.com:8443", "*.cdn.example.com"},
+			want: []string{"blog.example.com", "admin.example.com:8443"}},
+	}
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			s := ServerCommand{AllowedHosts: tt.hosts}
+			assert.Equal(t, tt.want, s.getAllowedRedirectHosts())
+		})
+	}
+}
+
 func chooseRandomUnusedPort() (port int) {
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		port = 40000 + int(rand.Int31n(10000))
 		if ln, err := net.Listen("tcp", fmt.Sprintf(":%d", port)); err == nil {
 			_ = ln.Close()
@@ -763,7 +983,7 @@ func waitForHTTPServerStart(port int) {
 	// wait for up to 3 seconds for server to start before returning it
 	client := http.Client{Timeout: time.Second}
 	defer client.CloseIdleConnections()
-	for i := 0; i < 300; i++ {
+	for range 300 {
 		time.Sleep(time.Millisecond * 10)
 		if resp, err := client.Get(fmt.Sprintf("http://localhost:%d", port)); err == nil {
 			_ = resp.Body.Close()
@@ -774,7 +994,7 @@ func waitForHTTPServerStart(port int) {
 
 func waitForHTTPSServerStart(port int) {
 	// wait for up to 3 seconds for HTTPS server to start
-	for i := 0; i < 300; i++ {
+	for range 300 {
 		time.Sleep(time.Millisecond * 10)
 		conn, _ := net.DialTimeout("tcp", fmt.Sprintf("localhost:%d", port), time.Millisecond*10)
 		if conn != nil {
@@ -793,7 +1013,6 @@ func prepServerApp(t *testing.T, fn func(o ServerCommand) ServerCommand) (*serve
 	_, err := p.ParseArgs([]string{"--admin-passwd=password", "--site=remark"})
 	require.NoError(t, err)
 	cmd.Avatar.FS.Path, cmd.Avatar.Type, cmd.BackupLocation, cmd.Image.FS.Path = "/tmp/remark42_test", "fs", "/tmp/remark42_test", "/tmp/remark42_test"
-	cmd.Store.Bolt.Path = fmt.Sprintf("/tmp/%d", cmd.Port)
 	cmd.Store.Bolt.Timeout = 10 * time.Second
 	cmd.Auth.Apple.CID, cmd.Auth.Apple.KID, cmd.Auth.Apple.TID = "cid", "kid", "tid"
 	cmd.Auth.Apple.PrivateKeyFilePath = "testdata/apple.p8"
@@ -804,6 +1023,7 @@ func prepServerApp(t *testing.T, fn func(o ServerCommand) ServerCommand) (*serve
 	cmd.Auth.Microsoft.CSEC, cmd.Auth.Microsoft.CID = "csec", "cid"
 	cmd.Auth.Twitter.CSEC, cmd.Auth.Twitter.CID = "csec", "cid"
 	cmd.Auth.Patreon.CSEC, cmd.Auth.Patreon.CID = "csec", "cid"
+	cmd.Auth.Discord.CSEC, cmd.Auth.Discord.CID = "csec", "cid"
 	cmd.Auth.Telegram = true
 	cmd.Telegram.Token = "token"
 	cmd.Auth.Email.Enable = true
@@ -824,7 +1044,10 @@ func prepServerApp(t *testing.T, fn func(o ServerCommand) ServerCommand) (*serve
 	cmd.RestrictedNames = []string{"umputun", "bobuk"}
 	cmd.emailMsgTemplatePath = "../../templates/email_reply.html.tmpl"
 	cmd.emailVerificationTemplatePath = "../../templates/email_confirmation_subscription.html.tmpl"
+
 	cmd = fn(cmd)
+	// as is uses port, call it after fn which could set it
+	cmd.Store.Bolt.Path = fmt.Sprintf("/tmp/%d", cmd.Port)
 
 	app, ctx, cancel := createAppFromCmd(t, cmd)
 

backend/app/main.go

@@ -92,10 +92,7 @@ func logDeprecatedParams(params []cmd.DeprecatedFlag) {
 func getDump() string {
 	maxSize := 5 * 1024 * 1024
 	stacktrace := make([]byte, maxSize)
-	length := runtime.Stack(stacktrace, true)
-	if length > maxSize {
-		length = maxSize
-	}
+	length := min(runtime.Stack(stacktrace, true), maxSize)
 	return string(stacktrace[:length])
 }
 

backend/app/main_test.go

@@ -98,9 +98,6 @@ func TestMain_WithWebhook(t *testing.T) {
 	finished := make(chan struct{})
 	go func() {
 		main()
-		assert.Eventually(t, func() bool {
-			return atomic.LoadInt32(&webhookSent) == int32(1)
-		}, time.Second, 100*time.Millisecond, "webhook was not sent")
 		close(finished)
 	}()
 
@@ -117,18 +114,23 @@ func TestMain_WithWebhook(t *testing.T) {
 	require.NoError(t, err)
 	defer resp.Body.Close()
 	assert.Equal(t, http.StatusCreated, resp.StatusCode)
+
+	// wait for webhook to be sent before shutting down
+	assert.Eventually(t, func() bool {
+		return atomic.LoadInt32(&webhookSent) == int32(1)
+	}, time.Second, 100*time.Millisecond, "webhook was not sent")
 }
 
 func TestGetDump(t *testing.T) {
 	dump := getDump()
-	assert.True(t, strings.Contains(dump, "goroutine"))
-	assert.True(t, strings.Contains(dump, "[running]"))
-	assert.True(t, strings.Contains(dump, "backend/app/main.go"))
+	assert.Contains(t, dump, "goroutine")
+	assert.Contains(t, dump, "[running]")
+	assert.Contains(t, dump, "backend/app/main.go")
 	t.Logf("\n dump: %s", dump)
 }
 
 func chooseRandomUnusedPort() (port int) {
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		port = 40000 + int(rand.Int31n(10000))
 		if ln, err := net.Listen("tcp", fmt.Sprintf(":%d", port)); err == nil {
 			_ = ln.Close()
@@ -142,7 +144,7 @@ func waitForHTTPServerStart(port int) {
 	// wait for up to 10 seconds for server to start before returning it
 	client := http.Client{Timeout: time.Second}
 	defer client.CloseIdleConnections()
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		time.Sleep(time.Millisecond * 100)
 		if resp, err := client.Get(fmt.Sprintf("http://localhost:%d", port)); err == nil {
 			_ = resp.Body.Close()

backend/app/migrator/backup_test.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"os"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -59,19 +60,21 @@ func TestBackup_Do(t *testing.T) {
 	defer os.RemoveAll(loc)
 	assert.NoError(t, os.MkdirAll(loc, 0o700))
 
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		time.Sleep(time.Second)
-		cancel()
-	}()
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		go func() {
+			time.Sleep(time.Second)
+			cancel()
+		}()
 
-	bk := AutoBackup{BackupLocation: loc, SiteID: "site1", KeepMax: 3, Exporter: &mockExporter{}, Duration: 600 * time.Millisecond}
-	bk.Do(ctx)
+		bk := AutoBackup{BackupLocation: loc, SiteID: "site1", KeepMax: 3, Exporter: &mockExporter{}, Duration: 600 * time.Millisecond}
+		bk.Do(ctx)
 
-	expFile := fmt.Sprintf("/tmp/remark-backups.test/backup-site1-%s.gz", time.Now().Format("20060102"))
-	fi, err := os.Lstat(expFile)
-	assert.NoError(t, err)
-	assert.Equal(t, int64(52), fi.Size())
+		expFile := fmt.Sprintf("/tmp/remark-backups.test/backup-site1-%s.gz", time.Now().Format("20060102"))
+		fi, err := os.Lstat(expFile)
+		assert.NoError(t, err)
+		assert.Equal(t, int64(52), fi.Size())
+	})
 }
 
 type mockExporter struct{}

backend/app/migrator/commento.go

@@ -48,7 +48,7 @@ type commentoCommenter struct {
 	Link         string    `json:"link"`
 	Photo        string    `json:"photo"`
 	Provider     string    `json:"provider,omitempty"`
-	JoinDate     time.Time `json:"joinDate,omitempty"`
+	JoinDate     time.Time `json:"joinDate"`
 	IsModerator  bool      `json:"isModerator"`
 }
 
@@ -101,6 +101,11 @@ func (d *Commento) convert(r io.Reader, siteID string) (ch chan store.Comment) {
 			}
 		}
 
+		usersMap["anonymous"] = store.User{
+			Name: "Anonymous",
+			ID:   "commento_" + store.EncodeID("anonymous"),
+		}
+
 		for _, comment := range exportedData.Comments {
 			u, ok := usersMap[comment.CommenterHex]
 			if !ok {

backend/app/migrator/commento_test.go

@@ -27,11 +27,11 @@ func TestCommento_Import(t *testing.T) {
 	require.NoError(t, err)
 	size, err := d.Import(fh, "test")
 	assert.NoError(t, err)
-	assert.Equal(t, 2, size)
+	assert.Equal(t, 3, size)
 
 	last, err := dataStore.Last("test", 10, time.Time{}, adminUser)
 	assert.NoError(t, err)
-	require.Equal(t, 2, len(last), "2 comments imported")
+	require.Equal(t, 3, len(last), "3 comments imported")
 
 	t.Log(last[0])
 
@@ -44,11 +44,24 @@ func TestCommento_Import(t *testing.T) {
 	assert.Equal(t, "commento_35369aeb6ac5255de30410a0f86dc71eb9c6d0ca", c.User.ID)
 	assert.True(t, c.Imported)
 
+	c = last[2] // anonymous comment
+	assert.Equal(t, "Example comment created by user.", c.Text)
+	assert.Equal(t, "e7069a7dfcfaed43caf62300a9b0edb1c124ad79d0f5887c93649c15d7f69945", c.ID)
+	assert.Equal(t, "", c.ParentID)
+	assert.Equal(t, store.Locator{SiteID: "test", URL: "https://example.com/blog/post/2"}, c.Locator)
+	assert.Equal(t, "Anonymous", c.User.Name)
+	assert.Equal(t, "commento_0a92fab3230134cca6eadd9898325b9b2ae67998", c.User.ID)
+	assert.True(t, c.Imported)
+
 	posts, err := dataStore.List("test", 0, 0)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, len(posts), "1 post")
+	assert.Equal(t, 2, len(posts), "2 posts")
 
 	count, err := dataStore.Count(store.Locator{SiteID: "test", URL: "https://example.com/blog/post/1"})
 	assert.NoError(t, err)
 	assert.Equal(t, 2, count)
+
+	count, err = dataStore.Count(store.Locator{SiteID: "test", URL: "https://example.com/blog/post/2"})
+	assert.NoError(t, err)
+	assert.Equal(t, 1, count)
 }

backend/app/migrator/disqus.go

@@ -175,7 +175,7 @@ func (d *Disqus) convert(r io.Reader, siteID string) (ch chan store.Comment) {
 
 func (*Disqus) cleanText(text string) string {
 	text = strings.TrimSpace(text)
-	text = strings.Replace(text, "\n", "", -1)
-	text = strings.Replace(text, "\t", "", -1)
+	text = strings.ReplaceAll(text, "\n", "")
+	text = strings.ReplaceAll(text, "\t", "")
 	return text
 }

backend/app/migrator/disqus_test.go

@@ -122,7 +122,7 @@ func TestDisqus_Convert(t *testing.T) {
 	require.NoError(t, err)
 	ch := d.convert(fh, "test")
 
-	res := []store.Comment{}
+	res := make([]store.Comment, 0, 4)
 	for comment := range ch {
 		res = append(res, comment)
 	}

backend/app/migrator/mapper.go

@@ -38,7 +38,7 @@ func (u *URLMapper) loadRules(reader io.Reader) error {
 
 	u.rules = make(map[string]string)
 
-	for _, row := range strings.Split(rulesText, "\n") {
+	for row := range strings.SplitSeq(rulesText, "\n") {
 		row = strings.TrimSpace(row)
 		urls := strings.Split(row, " ")
 		if len(urls) != 2 {
@@ -64,8 +64,8 @@ func (u *URLMapper) URL(url string) string {
 		}
 		oldURL = strings.TrimSuffix(oldURL, "*")
 		newURL = strings.TrimSuffix(newURL, "*")
-		if strings.HasPrefix(url, oldURL) {
-			return newURL + strings.TrimPrefix(url, oldURL)
+		if after, ok := strings.CutPrefix(url, oldURL); ok {
+			return newURL + after
 		}
 	}
 	// search failed, return given url

backend/app/migrator/migrator_test.go

@@ -77,11 +77,11 @@ func TestMigrator_ImportCommento(t *testing.T) {
 		Provider:  "commento",
 	})
 	assert.NoError(t, err)
-	assert.Equal(t, 2, size)
+	assert.Equal(t, 3, size)
 
 	last, err := dataStore.Last("test", 10, time.Time{}, store.User{})
 	assert.NoError(t, err)
-	assert.Equal(t, 2, len(last), "2 comments imported")
+	assert.Equal(t, 3, len(last), "3 comments imported")
 }
 
 func TestMigrator_ImportNative(t *testing.T) {

backend/app/migrator/native_test.go

@@ -162,7 +162,7 @@ func TestNative_ImportManyWithError(t *testing.T) {
 
 	buf := &bytes.Buffer{}
 	buf.WriteString(`{"version":1, "users":[], "posts":[]}` + "\n")
-	for i := 0; i < 100; i++ {
+	for i := range 100 {
 		fmt.Fprintf(buf, goodRec, i)
 	}
 	buf.WriteString("{}\n")

backend/app/migrator/testdata/commento.json

@@ -4,7 +4,7 @@
 	{
 	  "commentHex": "e7069a7dfcfaed43caf62300a9b0edb1c124ad79d0f5887c93649c15d7f69945",
 	  "domain": "example.com",
-	  "url": "/blog/post/1",
+	  "url": "/blog/post/2",
 	  "commenterHex": "anonymous",
 	  "markdown": "Example comment created by user.",
 	  "html": "",

backend/app/migrator/wordpress_test.go

@@ -72,7 +72,7 @@ func TestWordPress_Convert(t *testing.T) {
 	wp := WordPress{}
 	ch := wp.convert(strings.NewReader(xmlTestWP), "testWP")
 
-	comments := []store.Comment{}
+	comments := make([]store.Comment, 0, 3)
 	for c := range ch {
 		comments = append(comments, c)
 	}
@@ -100,7 +100,7 @@ func TestWP_Convert_MD(t *testing.T) {
 	wp := WordPress{}
 	ch := wp.convert(strings.NewReader(xmlTestWPmd), "siteID")
 
-	comments := []store.Comment{}
+	comments := make([]store.Comment, 0, 3)
 	for c := range ch {
 		comments = append(comments, c)
 	}

backend/app/notify/email.go

@@ -4,14 +4,15 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"html/template"
 	"net/url"
-	"text/template"
 	"time"
 
 	log "github.com/go-pkgz/lgr"
 	ntf "github.com/go-pkgz/notify"
-	"github.com/go-pkgz/repeater"
+	"github.com/go-pkgz/repeater/v2"
 	"github.com/hashicorp/go-multierror"
+	"github.com/microcosm-cc/bluemonday"
 
 	"github.com/umputun/remark42/backend/app/templates"
 )
@@ -26,7 +27,7 @@ type EmailParams struct {
 	SubscribeURL             string   // full subscribe handler URL
 	UnsubscribeURL           string   // full unsubscribe handler URL
 
-	TokenGenFn func(userID, email, site string) (string, error) // Unsubscribe token generation function
+	TokenGenFn func(userID, email, site string) (string, error) // unsubscribe token generation function
 }
 
 // Email implements notify.Destination for email
@@ -42,12 +43,12 @@ type Email struct {
 type msgTmplData struct {
 	UserName          string
 	UserPicture       string
-	CommentText       string
+	CommentText       template.HTML
 	CommentLink       string
 	CommentDate       time.Time
 	ParentUserName    string
 	ParentUserPicture string
-	ParentCommentText string
+	ParentCommentText template.HTML
 	ParentCommentLink string
 	ParentCommentDate time.Time
 	PostTitle         string
@@ -56,6 +57,30 @@ type msgTmplData struct {
 	ForAdmin          bool
 }
 
+// emailCommentPolicy sanitizes comment HTML for inclusion in notification emails.
+// It is intentionally stricter than the store-level UGC policy used for web rendering:
+// links (<a>) and images (<img>) are dropped so a comment can't smuggle phishing links
+// or remote tracking pixels into an email sent from the legitimate remark42 address,
+// while basic inline and block text formatting is preserved.
+var emailCommentPolicy = func() *bluemonday.Policy {
+	p := bluemonday.NewPolicy()
+	p.AllowElements(
+		"p", "br", "hr", "div", "span",
+		"b", "strong", "i", "em", "u", "s", "strike", "del", "ins", "sub", "sup", "mark", "small",
+		"blockquote", "q", "cite",
+		"code", "pre", "kbd", "samp", "var",
+		"ul", "ol", "li", "dl", "dt", "dd",
+		"h1", "h2", "h3", "h4", "h5", "h6",
+	)
+	return p
+}()
+
+// emailSafeHTML strips links and images from pre-rendered comment HTML and returns
+// it as template.HTML so html/template renders the remaining safe formatting as-is.
+func emailSafeHTML(commentHTML string) template.HTML {
+	return template.HTML(emailCommentPolicy.Sanitize(commentHTML)) //nolint:gosec // sanitized above: <a>/<img> dropped, only formatting tags survive
+}
+
 // verifyTmplData store data for verification message template execution
 type verifyTmplData struct {
 	User         string
@@ -161,14 +186,14 @@ func (e *Email) buildAndSendMessage(ctx context.Context, req Request, email stri
 		return err
 	}
 
-	return repeater.NewDefault(5, time.Millisecond*250).Do(
+	return repeater.NewFixed(5, time.Millisecond*250).Do(
 		ctx,
 		func() error {
 			return e.Email.Send(
 				ctx,
 				fmt.Sprintf("mailto:%s?from=%s&unsubscribeLink=%s&subject=%s",
 					email,
-					e.From,
+					url.QueryEscape(e.From),
 					url.QueryEscape(msg.unsubscribeLink),
 					url.QueryEscape(msg.subject),
 				),
@@ -196,14 +221,14 @@ func (e *Email) SendVerification(ctx context.Context, req VerificationRequest) e
 		return err
 	}
 
-	return repeater.NewDefault(5, time.Millisecond*250).Do(
+	return repeater.NewFixed(5, time.Millisecond*250).Do(
 		ctx,
 		func() error {
 			return e.Email.Send(
 				ctx,
 				fmt.Sprintf("mailto:%s?from=%s&subject=%s",
 					req.Email,
-					e.From,
+					url.QueryEscape(e.From),
 					url.QueryEscape(e.VerificationSubject),
 				),
 				msg,
@@ -257,7 +282,7 @@ func (e *Email) buildMessageFromRequest(req Request, email string, forAdmin bool
 	tmplData := msgTmplData{
 		UserName:        req.Comment.User.Name,
 		UserPicture:     req.Comment.User.Picture,
-		CommentText:     req.Comment.Text,
+		CommentText:     emailSafeHTML(req.Comment.Text),
 		CommentLink:     commentURLPrefix + req.Comment.ID,
 		CommentDate:     req.Comment.Timestamp,
 		PostTitle:       req.Comment.PostTitle,
@@ -269,7 +294,7 @@ func (e *Email) buildMessageFromRequest(req Request, email string, forAdmin bool
 	if req.Comment.ParentID != "" {
 		tmplData.ParentUserName = req.parent.User.Name
 		tmplData.ParentUserPicture = req.parent.User.Picture
-		tmplData.ParentCommentText = req.parent.Text
+		tmplData.ParentCommentText = emailSafeHTML(req.parent.Text)
 		tmplData.ParentCommentLink = commentURLPrefix + req.parent.ID
 		tmplData.ParentCommentDate = req.parent.Timestamp
 	}

backend/app/notify/email_test.go

@@ -3,8 +3,8 @@ package notify
 import (
 	"context"
 	"fmt"
+	"html/template"
 	"testing"
-	"text/template"
 
 	ntf "github.com/go-pkgz/notify"
 	"github.com/stretchr/testify/assert"
@@ -34,7 +34,7 @@ func TestEmailNew(t *testing.T) {
 	assert.NotNil(t, email, "email returned")
 
 	assert.NotNil(t, email.msgTmpl, "e.template is set")
-	assert.Equal(t, emailParams.From, email.EmailParams.From, "emailParams.From unchanged after creation")
+	assert.Equal(t, emailParams.From, email.From, "emailParams.From unchanged after creation")
 	if smtpParams.TimeOut == 0 {
 		assert.Equal(t, defaultEmailTimeout, email.TimeOut, "empty emailParams.TimeOut changed to default")
 	} else {
@@ -88,7 +88,6 @@ func Test_initTemplatesErr(t *testing.T) {
 	}
 
 	for _, d := range testSet {
-		d := d
 		t.Run(d.name, func(t *testing.T) {
 			e, err := NewEmail(d.emailParams, ntf.SMTPParams{})
 			require.Error(t, err)
@@ -165,7 +164,7 @@ User: test_user
 01.01.0001 at 00:00
 Comment: 
 test@example.org  for parent_user
-Unsubscribe link: https://remark42.com/api/v1/email/unsubscribe?site=&tkn=token
+Unsubscribe link: https://remark42.com/api/v1/email/unsubscribe?site=&tkn=token
 `, msg.body)
 	assert.Equal(t, "https://remark42.com/api/v1/email/unsubscribe?site=&tkn=token", msg.unsubscribeLink)
 	assert.Equal(t, `New reply to your comment for "test_title"`, msg.subject)
@@ -191,6 +190,50 @@ admin@example.org
 	assert.Empty(t, msg.unsubscribeLink)
 }
 
+func TestEmail_CommentTextSanitizedForEmail(t *testing.T) {
+	// comment HTML reaching the email path is sanitized by the store-level UGC policy,
+	// which permits <a> and <img>. The email must drop both so a comment can't inject
+	// phishing links or remote tracking pixels into a notification (GHSA-74pc-3r2m-ppx3).
+	email, err := NewEmail(EmailParams{
+		From:            "from@example.org",
+		MsgTemplatePath: "testdata/msg.html.tmpl",
+	}, ntf.SMTPParams{})
+	require.NoError(t, err)
+	email.TokenGenFn = TokenGenFn
+
+	malicious := `hello <a href="https://phishing.example/verify">click to verify</a>` +
+		` <img src="https://attacker.example/track.png" width="1" height="1"> <b>kept</b>`
+	req := Request{
+		Comment: store.Comment{ID: "999", User: store.User{ID: "1", Name: "test_user"}, PostTitle: "test_title", Text: malicious},
+		Emails:  []string{"test@example.org"},
+	}
+	msg, err := email.buildMessageFromRequest(req, req.Emails[0], false)
+	require.NoError(t, err)
+
+	assert.NotContains(t, msg.body, "phishing.example", "phishing link must be stripped")
+	assert.NotContains(t, msg.body, "attacker.example", "tracking pixel must be stripped")
+	assert.NotContains(t, msg.body, "<img", "no image tags in email body")
+	assert.NotContains(t, msg.body, "<a ", "no anchor tags in email body")
+	assert.Contains(t, msg.body, "click to verify", "anchor text is preserved, only the link is dropped")
+	assert.Contains(t, msg.body, "<b>kept</b>", "basic formatting is preserved")
+}
+
+// emailSafeHTML drops links/images while keeping inline/block formatting and escaping nothing extra.
+func TestEmailSafeHTML(t *testing.T) {
+	tbl := []struct{ name, in, want string }{
+		{"strips anchor keeps text", `<a href="http://evil">x</a>`, "x"},
+		{"strips image entirely", `a<img src="http://evil/t.png">b`, "ab"},
+		{"keeps bold/italic/code", `<b>b</b><i>i</i><code>c</code>`, `<b>b</b><i>i</i><code>c</code>`},
+		{"keeps blockquote and lists", `<blockquote>q</blockquote><ul><li>x</li></ul>`, `<blockquote>q</blockquote><ul><li>x</li></ul>`},
+		{"drops onclick handlers", `<span onclick="alert(1)">s</span>`, `<span>s</span>`},
+	}
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, string(emailSafeHTML(tt.in)))
+		})
+	}
+}
+
 func TestEmail_SendVerification(t *testing.T) {
 	email, err := NewEmail(EmailParams{
 		From:                     "from@example.org",

backend/app/notify/notify_mock.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"sync"
-	"time"
 
 	log "github.com/go-pkgz/lgr"
 )
@@ -22,14 +21,13 @@ type MockDest struct {
 func (m *MockDest) Send(ctx context.Context, r Request) error {
 	m.lock.Lock()
 	defer m.lock.Unlock()
-	select {
-	case <-time.After(10 * time.Millisecond):
-		m.data = append(m.data, r)
-		log.Printf("sent %s -> %d", r.Comment.ID, m.id)
-	case <-ctx.Done():
+	if err := ctx.Err(); err != nil {
 		log.Printf("ctx closed %d", m.id)
 		m.closed = true
+		return nil
 	}
+	m.data = append(m.data, r)
+	log.Printf("sent %s -> %d", r.Comment.ID, m.id)
 	return nil
 }
 
@@ -37,14 +35,13 @@ func (m *MockDest) Send(ctx context.Context, r Request) error {
 func (m *MockDest) SendVerification(ctx context.Context, v VerificationRequest) error {
 	m.lock.Lock()
 	defer m.lock.Unlock()
-	select {
-	case <-time.After(10 * time.Millisecond):
-		m.verificationData = append(m.verificationData, v)
-		log.Printf("sent verification %s -> %d", v.User, m.id)
-	case <-ctx.Done():
+	if err := ctx.Err(); err != nil {
 		log.Printf("verification ctx closed %d", m.id)
 		m.closed = true
+		return nil
 	}
+	m.verificationData = append(m.verificationData, v)
+	log.Printf("sent verification %s -> %d", v.User, m.id)
 	return nil
 }
 
@@ -66,4 +63,15 @@ func (m *MockDest) GetVerify() []VerificationRequest {
 	return res
 }
 
-func (m *MockDest) String() string { return fmt.Sprintf("mock id=%d, closed=%v", m.id, m.closed) }
+// IsClosed returns closed status safely
+func (m *MockDest) IsClosed() bool {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	return m.closed
+}
+
+func (m *MockDest) String() string {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	return fmt.Sprintf("mock id=%d, closed=%v", m.id, m.closed)
+}

backend/app/notify/notify_test.go

@@ -2,10 +2,9 @@ package notify
 
 import (
 	"fmt"
-	"math/rand"
 	"sync/atomic"
 	"testing"
-	"time"
+	"testing/synctest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -26,248 +25,256 @@ func TestService_NoDestinations(t *testing.T) {
 }
 
 func TestService_WithDestinations(t *testing.T) {
-	d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
-	s := NewService(nil, 1, d1, d2)
-	assert.NotNil(t, s)
+	synctest.Test(t, func(t *testing.T) {
+		d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
+		s := NewService(nil, 1, d1, d2)
+		assert.NotNil(t, s)
 
-	s.Submit(Request{Comment: store.Comment{ID: "100"}})
-	time.Sleep(time.Millisecond * 110)
-	s.Submit(Request{Comment: store.Comment{ID: "101"}})
-	time.Sleep(time.Millisecond * 110)
-	s.Submit(Request{Comment: store.Comment{ID: "102"}})
-	time.Sleep(time.Millisecond * 110)
-	s.Close()
+		s.Submit(Request{Comment: store.Comment{ID: "100"}})
+		synctest.Wait()
+		s.Submit(Request{Comment: store.Comment{ID: "101"}})
+		synctest.Wait()
+		s.Submit(Request{Comment: store.Comment{ID: "102"}})
+		synctest.Wait()
+		s.Close()
 
-	require.Equal(t, 3, len(d1.Get()), "got all comments to d1")
-	require.Equal(t, 3, len(d2.Get()), "got all comments to d2")
+		require.Equal(t, 3, len(d1.Get()), "got all comments to d1")
+		require.Equal(t, 3, len(d2.Get()), "got all comments to d2")
 
-	assert.Equal(t, "100", d1.Get()[0].Comment.ID)
-	assert.Equal(t, "101", d1.Get()[1].Comment.ID)
-	assert.Equal(t, "102", d1.Get()[2].Comment.ID)
+		assert.Equal(t, "100", d1.Get()[0].Comment.ID)
+		assert.Equal(t, "101", d1.Get()[1].Comment.ID)
+		assert.Equal(t, "102", d1.Get()[2].Comment.ID)
+	})
 }
 
 func TestService_WithDrops(t *testing.T) {
-	d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
-	s := NewService(nil, 1, d1, d2)
-	assert.NotNil(t, s)
+	synctest.Test(t, func(t *testing.T) {
+		d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
+		s := NewService(nil, 1, d1, d2)
+		assert.NotNil(t, s)
 
-	s.Submit(Request{Comment: store.Comment{ID: "100"}})
-	s.Submit(Request{Comment: store.Comment{ID: "101"}})
-	s.Submit(Request{Comment: store.Comment{ID: "102"}})
-	time.Sleep(time.Millisecond * 21)
-	s.Close()
+		s.Submit(Request{Comment: store.Comment{ID: "100"}})
+		s.Submit(Request{Comment: store.Comment{ID: "101"}})
+		s.Submit(Request{Comment: store.Comment{ID: "102"}})
+		synctest.Wait()
+		s.Close()
 
-	s.Submit(Request{Comment: store.Comment{ID: "111"}}) // safe to send after close
+		s.Submit(Request{Comment: store.Comment{ID: "111"}}) // safe to send after close
 
-	assert.LessOrEqual(t, len(d1.Get()), 2, "at least one comment from three dropped from d1, got: %v", d1.Get())
-	assert.LessOrEqual(t, len(d2.Get()), 2, "at least one comment from three dropped from d2, got: %v", d2.Get())
+		assert.LessOrEqual(t, len(d1.Get()), 2, "at least one comment from three dropped from d1, got: %v", d1.Get())
+		assert.LessOrEqual(t, len(d2.Get()), 2, "at least one comment from three dropped from d2, got: %v", d2.Get())
+	})
 }
 
 func TestService_SubmitVerificationWithDrops(t *testing.T) {
-	d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
-	s := NewService(nil, 1, d1, d2)
-	assert.NotNil(t, s)
+	synctest.Test(t, func(t *testing.T) {
+		d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
+		s := NewService(nil, 1, d1, d2)
+		assert.NotNil(t, s)
 
-	s.SubmitVerification(VerificationRequest{
-		SiteID: "remark",
-		User:   "testUser",
-		Email:  "test@example.org",
-		Token:  "testToken",
+		s.SubmitVerification(VerificationRequest{
+			SiteID: "remark",
+			User:   "testUser",
+			Email:  "test@example.org",
+			Token:  "testToken",
+		})
+		s.SubmitVerification(VerificationRequest{})
+		s.SubmitVerification(VerificationRequest{})
+		synctest.Wait()
+		s.Close()
+
+		s.SubmitVerification(VerificationRequest{}) // safe to send after close
+
+		assert.LessOrEqual(t, len(d2.GetVerify()), 2, "one request from three dropped from d2, got: %v", d2.GetVerify())
+
+		verifyDest := d1.GetVerify()
+		require.LessOrEqual(t, len(verifyDest), 2, "one request from three dropped from d1, got: %v", verifyDest)
+		assert.Equal(t, "remark", verifyDest[0].SiteID)
+		assert.Equal(t, "testUser", verifyDest[0].User)
+		assert.Equal(t, "test@example.org", verifyDest[0].Email)
+		assert.Equal(t, "testToken", verifyDest[0].Token)
 	})
-	s.SubmitVerification(VerificationRequest{})
-	s.SubmitVerification(VerificationRequest{})
-	time.Sleep(time.Millisecond * 21)
-	s.Close()
-
-	s.SubmitVerification(VerificationRequest{}) // safe to send after close
-
-	assert.LessOrEqual(t, len(d2.GetVerify()), 2, "one request from three dropped from d2, got: %v", d2.GetVerify())
-
-	verifyDest := d1.GetVerify()
-	require.LessOrEqual(t, len(verifyDest), 2, "one request from three dropped from d1, got: %v", verifyDest)
-	assert.Equal(t, "remark", verifyDest[0].SiteID)
-	assert.Equal(t, "testUser", verifyDest[0].User)
-	assert.Equal(t, "test@example.org", verifyDest[0].Email)
-	assert.Equal(t, "testToken", verifyDest[0].Token)
 }
 
 func TestService_Many(t *testing.T) {
-	d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
-	s := NewService(nil, 5, d1, d2)
-	assert.NotNil(t, s)
+	synctest.Test(t, func(t *testing.T) {
+		d1, d2 := &MockDest{id: 1}, &MockDest{id: 2}
+		s := NewService(nil, 5, d1, d2)
+		assert.NotNil(t, s)
 
-	for i := 0; i < 10; i++ {
-		s.Submit(Request{Comment: store.Comment{ID: fmt.Sprintf("%d", 100+i)}})
-		s.SubmitVerification(VerificationRequest{User: fmt.Sprintf("%d", 100+i)})
-		time.Sleep(time.Millisecond * time.Duration(rand.Int31n(20)))
-	}
-	s.Close()
-	time.Sleep(time.Millisecond * 10)
+		for i := range 10 {
+			s.Submit(Request{Comment: store.Comment{ID: fmt.Sprintf("%d", 100+i)}})
+			s.SubmitVerification(VerificationRequest{User: fmt.Sprintf("%d", 100+i)})
+		}
+		s.Close()
 
-	assert.NotEqual(t, 10, len(d1.Get()), "some comments dropped from d1")
-	assert.NotEqual(t, 10, len(d1.GetVerify()), "some verifications dropped from d1")
-	assert.NotEqual(t, 10, len(d2.Get()), "some comments dropped from d2")
-	assert.NotEqual(t, 10, len(d2.GetVerify()), "some verifications dropped from d2")
-
-	assert.True(t, d1.closed)
-	assert.True(t, d2.closed)
-	assert.Equal(t, "mock id=1, closed=true", d1.String())
+		assert.NotEqual(t, 10, len(d1.Get()), "some comments dropped from d1")
+		assert.NotEqual(t, 10, len(d1.GetVerify()), "some verifications dropped from d1")
+		assert.NotEqual(t, 10, len(d2.Get()), "some comments dropped from d2")
+		assert.NotEqual(t, 10, len(d2.GetVerify()), "some verifications dropped from d2")
+	})
 }
 
 func TestService_WithParent(t *testing.T) {
-	dest := &MockDest{id: 1}
-	dataStore := &mockStore{data: map[string]store.Comment{}}
+	synctest.Test(t, func(t *testing.T) {
+		dest := &MockDest{id: 1}
+		dataStore := &mockStore{data: map[string]store.Comment{}}
 
-	dataStore.data["p1"] = store.Comment{ID: "p1"}
-	dataStore.data["p2"] = store.Comment{ID: "p2"}
+		dataStore.data["p1"] = store.Comment{ID: "p1"}
+		dataStore.data["p2"] = store.Comment{ID: "p2"}
 
-	s := NewService(dataStore, 1, dest)
-	assert.NotNil(t, s)
+		s := NewService(dataStore, 1, dest)
+		assert.NotNil(t, s)
 
-	s.Submit(Request{Comment: store.Comment{ID: "c1", ParentID: "p1"}})
-	time.Sleep(time.Millisecond * 110)
-	s.Submit(Request{Comment: store.Comment{ID: "c11", ParentID: "p11"}})
-	time.Sleep(time.Millisecond * 110)
-	s.Close()
+		s.Submit(Request{Comment: store.Comment{ID: "c1", ParentID: "p1"}})
+		synctest.Wait()
+		s.Submit(Request{Comment: store.Comment{ID: "c11", ParentID: "p11"}})
+		synctest.Wait()
+		s.Close()
 
-	destRes := dest.Get()
-	require.Equal(t, 2, len(destRes), "two comment notified")
-	assert.Equal(t, "p1", destRes[0].Comment.ParentID)
-	assert.Equal(t, "p1", destRes[0].parent.ID)
-	assert.Equal(t, "p11", destRes[1].Comment.ParentID)
-	assert.Equal(t, "", destRes[1].parent.ID)
+		destRes := dest.Get()
+		require.Equal(t, 2, len(destRes), "two comment notified")
+		assert.Equal(t, "p1", destRes[0].Comment.ParentID)
+		assert.Equal(t, "p1", destRes[0].parent.ID)
+		assert.Equal(t, "p11", destRes[1].Comment.ParentID)
+		assert.Equal(t, "", destRes[1].parent.ID)
+	})
 }
 
 func TestService_EmailRetrieval(t *testing.T) {
-	dest := &MockDest{id: 1}
-	dataStore := &mockStore{data: map[string]store.Comment{}, userDetails: map[string]string{}}
+	synctest.Test(t, func(t *testing.T) {
+		dest := &MockDest{id: 1}
+		dataStore := &mockStore{data: map[string]store.Comment{}, userDetails: map[string]string{}}
 
-	dataStore.data["p1"] = store.Comment{ID: "p1", User: store.User{ID: "u1"}}
-	dataStore.data["p2"] = store.Comment{ID: "p2", ParentID: "p1", User: store.User{ID: "u1"}}
-	dataStore.data["p3"] = store.Comment{ID: "p3", ParentID: "p1", User: store.User{ID: "u2"}}
-	dataStore.data["p4"] = store.Comment{ID: "p4", ParentID: "p3", User: store.User{ID: "u1"}}
-	dataStore.userDetails["u1"] = "u1@example.com"
+		dataStore.data["p1"] = store.Comment{ID: "p1", User: store.User{ID: "u1"}}
+		dataStore.data["p2"] = store.Comment{ID: "p2", ParentID: "p1", User: store.User{ID: "u1"}}
+		dataStore.data["p3"] = store.Comment{ID: "p3", ParentID: "p1", User: store.User{ID: "u2"}}
+		dataStore.data["p4"] = store.Comment{ID: "p4", ParentID: "p3", User: store.User{ID: "u1"}}
+		dataStore.userDetails["u1"] = "u1@example.com"
 
-	s := NewService(dataStore, 1, dest)
-	assert.NotNil(t, s)
+		s := NewService(dataStore, 1, dest)
+		assert.NotNil(t, s)
 
-	// one comment, one notification
-	s.Submit(Request{Comment: dataStore.data["p1"]})
-	time.Sleep(time.Millisecond * 110)
+		// one comment, one notification
+		s.Submit(Request{Comment: dataStore.data["p1"]})
+		synctest.Wait()
 
-	destRes := dest.Get()
-	require.Equal(t, 1, len(destRes), "one comment notified")
-	assert.Equal(t, "p1", destRes[0].Comment.ID)
-	assert.Empty(t, destRes[0].parent)
-	assert.Empty(t, destRes[0].Emails)
+		destRes := dest.Get()
+		require.Equal(t, 1, len(destRes), "one comment notified")
+		assert.Equal(t, "p1", destRes[0].Comment.ID)
+		assert.Empty(t, destRes[0].parent)
+		assert.Empty(t, destRes[0].Emails)
 
-	// reply to the first comment, same comment as one in original comment
-	s.Submit(Request{Comment: dataStore.data["p2"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the first comment, same comment as one in original comment
+		s.Submit(Request{Comment: dataStore.data["p2"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 2, len(destRes), "two comment notified")
-	assert.Equal(t, "p2", destRes[1].Comment.ID)
-	assert.Equal(t, "p1", destRes[1].parent.ID)
-	assert.Equal(t, "u1", destRes[1].parent.User.ID)
-	assert.Empty(t, destRes[1].Emails, "u1 is not notified they are the one who left the comment")
+		destRes = dest.Get()
+		require.Equal(t, 2, len(destRes), "two comment notified")
+		assert.Equal(t, "p2", destRes[1].Comment.ID)
+		assert.Equal(t, "p1", destRes[1].parent.ID)
+		assert.Equal(t, "u1", destRes[1].parent.User.ID)
+		assert.Empty(t, destRes[1].Emails, "u1 is not notified they are the one who left the comment")
 
-	// another reply to the first comment, another user
-	s.Submit(Request{Comment: dataStore.data["p3"]})
-	time.Sleep(time.Millisecond * 110)
+		// another reply to the first comment, another user
+		s.Submit(Request{Comment: dataStore.data["p3"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 3, len(destRes), "three comment notified")
-	assert.Equal(t, "p3", destRes[2].Comment.ID)
-	assert.Equal(t, "p1", destRes[2].parent.ID)
-	assert.Equal(t, "u1", destRes[2].parent.User.ID)
-	assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[2].Emails)
+		destRes = dest.Get()
+		require.Equal(t, 3, len(destRes), "three comment notified")
+		assert.Equal(t, "p3", destRes[2].Comment.ID)
+		assert.Equal(t, "p1", destRes[2].parent.ID)
+		assert.Equal(t, "u1", destRes[2].parent.User.ID)
+		assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[2].Emails)
 
-	// reply to the last comment by another user, should trigger email retrieval error
-	s.Submit(Request{Comment: dataStore.data["p4"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the last comment by another user, should trigger email retrieval error
+		s.Submit(Request{Comment: dataStore.data["p4"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 4, len(destRes), "four comment notified")
-	assert.Equal(t, "p4", destRes[3].Comment.ID)
-	assert.Equal(t, "p3", destRes[3].parent.ID)
-	assert.Equal(t, "u2", destRes[3].parent.User.ID)
-	assert.Empty(t, destRes[3].Emails, "no email can be retrieved for u2")
+		destRes = dest.Get()
+		require.Equal(t, 4, len(destRes), "four comment notified")
+		assert.Equal(t, "p4", destRes[3].Comment.ID)
+		assert.Equal(t, "p3", destRes[3].parent.ID)
+		assert.Equal(t, "u2", destRes[3].parent.User.ID)
+		assert.Empty(t, destRes[3].Emails, "no email can be retrieved for u2")
 
-	s.Close()
+		s.Close()
+	})
 }
 
 func TestService_Recursive(t *testing.T) {
-	dest := &MockDest{id: 1}
-	dataStore := &mockStore{data: map[string]store.Comment{}, userDetails: map[string]string{}}
+	synctest.Test(t, func(t *testing.T) {
+		dest := &MockDest{id: 1}
+		dataStore := &mockStore{data: map[string]store.Comment{}, userDetails: map[string]string{}}
 
-	dataStore.data["p1"] = store.Comment{ID: "p1", User: store.User{ID: "u1"}}
-	dataStore.data["p2"] = store.Comment{ID: "p2", ParentID: "p1", User: store.User{ID: "u2"}}
-	dataStore.data["p3"] = store.Comment{ID: "p3", ParentID: "p2", User: store.User{ID: "u3"}}
-	dataStore.data["p4"] = store.Comment{ID: "p4", ParentID: "p3", User: store.User{ID: "u1"}}
-	dataStore.data["p5"] = store.Comment{ID: "p5", ParentID: "p4", User: store.User{ID: "u4"}}
-	dataStore.userDetails["u1"] = "u1@example.com"
-	// second comment goes without email address for notification
-	dataStore.userDetails["u3"] = "u3@example.com"
+		dataStore.data["p1"] = store.Comment{ID: "p1", User: store.User{ID: "u1"}}
+		dataStore.data["p2"] = store.Comment{ID: "p2", ParentID: "p1", User: store.User{ID: "u2"}}
+		dataStore.data["p3"] = store.Comment{ID: "p3", ParentID: "p2", User: store.User{ID: "u3"}}
+		dataStore.data["p4"] = store.Comment{ID: "p4", ParentID: "p3", User: store.User{ID: "u1"}}
+		dataStore.data["p5"] = store.Comment{ID: "p5", ParentID: "p4", User: store.User{ID: "u4"}}
+		dataStore.userDetails["u1"] = "u1@example.com"
+		// second comment goes without email address for notification
+		dataStore.userDetails["u3"] = "u3@example.com"
 
-	s := NewService(dataStore, 1, dest)
-	assert.NotNil(t, s)
+		s := NewService(dataStore, 1, dest)
+		assert.NotNil(t, s)
 
-	// one comment from u1 with email set
-	s.Submit(Request{Comment: dataStore.data["p1"]})
-	time.Sleep(time.Millisecond * 110)
+		// one comment from u1 with email set
+		s.Submit(Request{Comment: dataStore.data["p1"]})
+		synctest.Wait()
 
-	destRes := dest.Get()
-	require.Equal(t, 1, len(destRes), "one comment notified")
-	assert.Equal(t, "p1", destRes[0].Comment.ID)
-	assert.Empty(t, destRes[0].parent)
-	assert.Empty(t, destRes[0].Emails)
+		destRes := dest.Get()
+		require.Equal(t, 1, len(destRes), "one comment notified")
+		assert.Equal(t, "p1", destRes[0].Comment.ID)
+		assert.Empty(t, destRes[0].parent)
+		assert.Empty(t, destRes[0].Emails)
 
-	// reply to the first comment from u2 without email set
-	s.Submit(Request{Comment: dataStore.data["p2"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the first comment from u2 without email set
+		s.Submit(Request{Comment: dataStore.data["p2"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 2, len(destRes), "two comment notified")
-	assert.Equal(t, "p2", destRes[1].Comment.ID)
-	assert.Equal(t, "p1", destRes[1].parent.ID)
-	assert.Equal(t, "u1", destRes[1].parent.User.ID)
-	assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[1].Emails)
+		destRes = dest.Get()
+		require.Equal(t, 2, len(destRes), "two comment notified")
+		assert.Equal(t, "p2", destRes[1].Comment.ID)
+		assert.Equal(t, "p1", destRes[1].parent.ID)
+		assert.Equal(t, "u1", destRes[1].parent.User.ID)
+		assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[1].Emails)
 
-	// reply to the second comment from u3 with email set
-	s.Submit(Request{Comment: dataStore.data["p3"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the second comment from u3 with email set
+		s.Submit(Request{Comment: dataStore.data["p3"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 3, len(destRes), "three comment notified")
-	assert.Equal(t, "p3", destRes[2].Comment.ID)
-	assert.Equal(t, "p2", destRes[2].parent.ID)
-	assert.Equal(t, "u2", destRes[2].parent.User.ID)
-	assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[2].Emails)
+		destRes = dest.Get()
+		require.Equal(t, 3, len(destRes), "three comment notified")
+		assert.Equal(t, "p3", destRes[2].Comment.ID)
+		assert.Equal(t, "p2", destRes[2].parent.ID)
+		assert.Equal(t, "u2", destRes[2].parent.User.ID)
+		assert.ElementsMatch(t, []string{"u1@example.com"}, destRes[2].Emails)
 
-	// reply to the third comment from u1 (author of the first comment), only u3 should be notified
-	s.Submit(Request{Comment: dataStore.data["p4"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the third comment from u1 (author of the first comment), only u3 should be notified
+		s.Submit(Request{Comment: dataStore.data["p4"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 4, len(destRes), "four comment notified once each")
-	assert.Equal(t, "p4", destRes[3].Comment.ID)
-	assert.Equal(t, "p3", destRes[3].parent.ID)
-	assert.Equal(t, "u3", destRes[3].parent.User.ID)
-	assert.ElementsMatch(t, []string{"u3@example.com"}, destRes[3].Emails, "u1 is not notified they are the one who left the comment")
+		destRes = dest.Get()
+		require.Equal(t, 4, len(destRes), "four comment notified once each")
+		assert.Equal(t, "p4", destRes[3].Comment.ID)
+		assert.Equal(t, "p3", destRes[3].parent.ID)
+		assert.Equal(t, "u3", destRes[3].parent.User.ID)
+		assert.ElementsMatch(t, []string{"u3@example.com"}, destRes[3].Emails, "u1 is not notified they are the one who left the comment")
 
-	// reply to the fourth comment from u4, u1 and u3 should be notified once as a result
-	s.Submit(Request{Comment: dataStore.data["p5"]})
-	time.Sleep(time.Millisecond * 110)
+		// reply to the fourth comment from u4, u1 and u3 should be notified once as a result
+		s.Submit(Request{Comment: dataStore.data["p5"]})
+		synctest.Wait()
 
-	destRes = dest.Get()
-	require.Equal(t, 5, len(destRes), "four comment notified once each")
-	assert.Equal(t, "p5", destRes[4].Comment.ID)
-	assert.Equal(t, "p4", destRes[4].parent.ID)
-	assert.Equal(t, "u1", destRes[4].parent.User.ID)
-	assert.ElementsMatch(t, []string{"u1@example.com", "u3@example.com"}, destRes[4].Emails, "u3 and u1 notified once")
+		destRes = dest.Get()
+		require.Equal(t, 5, len(destRes), "four comment notified once each")
+		assert.Equal(t, "p5", destRes[4].Comment.ID)
+		assert.Equal(t, "p4", destRes[4].parent.ID)
+		assert.Equal(t, "u1", destRes[4].parent.User.ID)
+		assert.ElementsMatch(t, []string{"u1@example.com", "u3@example.com"}, destRes[4].Emails, "u3 and u1 notified once")
 
-	s.Close()
+		s.Close()
+	})
 }
 
 func TestService_Nop(t *testing.T) {

backend/app/notify/prune_html.go

@@ -0,0 +1,77 @@
+package notify
+
+import (
+	"fmt"
+	"strings"
+
+	"golang.org/x/net/html"
+)
+
+// pruneHTML prunes string keeping HTML closing tags.
+// maxLength applies to visible text only, not HTML tags.
+func pruneHTML(htmlText string, maxLength int) string {
+	var result strings.Builder
+	var endTokens []string
+	visibleLen := 0
+
+	suffix := "..."
+	suffixLen := len(suffix)
+
+	tokenizer := html.NewTokenizer(strings.NewReader(htmlText))
+	for {
+		if tokenizer.Next() == html.ErrorToken {
+			return result.String()
+		}
+		token := tokenizer.Token()
+
+		switch token.Type {
+		case html.CommentToken, html.DoctypeToken:
+			continue
+
+		case html.StartTagToken:
+			endTokens = append([]string{fmt.Sprintf("</%s>", token.Data)}, endTokens...)
+			result.WriteString(token.String())
+
+		case html.EndTagToken:
+			if len(endTokens) > 0 {
+				endTokens = endTokens[1:]
+			}
+			result.WriteString(token.String())
+
+		case html.SelfClosingTagToken:
+			result.WriteString(token.String())
+
+		case html.TextToken:
+			text := token.String()
+			if visibleLen+len(text)+suffixLen > maxLength {
+				remaining := maxLength - visibleLen - suffixLen
+				text = pruneStringToWord(text, remaining)
+				result.WriteString(text)
+				result.WriteString(suffix)
+				for _, endTag := range endTokens {
+					result.WriteString(endTag)
+				}
+				return result.String()
+			}
+			visibleLen += len(text)
+			result.WriteString(text)
+		}
+	}
+}
+
+// pruneStringToWord prunes string to specified length respecting word boundaries
+func pruneStringToWord(text string, maxLength int) string {
+	if maxLength <= 0 {
+		return ""
+	}
+	if len(text) <= maxLength {
+		return text
+	}
+
+	// find last space at or before maxLength to cut at word boundary
+	lastSpace := strings.LastIndex(text[:maxLength+1], " ")
+	if lastSpace <= 0 {
+		return ""
+	}
+	return text[:lastSpace]
+}

backend/app/notify/prune_html_test.go

@@ -0,0 +1,47 @@
+package notify
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPruneHTML(t *testing.T) {
+	tests := []struct {
+		name      string
+		html      string
+		maxLength int
+		expected  string
+	}{
+		{"within limit", "<p>Hello</p>", 20, "<p>Hello</p>"},
+		{"exceeds limit", "<p>Hello world, this is a long text</p>", 15, "<p>Hello world,...</p>"},
+		{"nested tags", "<div><p>Hello world</p><p>More text</p></div>", 20, "<div><p>Hello world</p><p>More...</p></div>"},
+		{"html comment stripped", "<!-- comment --><p>Hello</p>", 20, "<p>Hello</p>"},
+		{"self-closing tag", "<p>Hello<br/>World</p>", 8, "<p>Hello<br/>...</p>"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, pruneHTML(tt.html, tt.maxLength))
+		})
+	}
+}
+
+func TestPruneStringToWord(t *testing.T) {
+	tests := []struct {
+		name      string
+		text      string
+		maxLength int
+		expected  string
+	}{
+		{"within limit", "hello world", 15, "hello world"},
+		{"cut at word boundary", "hello world and more", 11, "hello world"},
+		{"zero length", "hello", 0, ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, pruneStringToWord(tt.text, tt.maxLength))
+		})
+	}
+}

backend/app/notify/telegram.go

@@ -10,6 +10,8 @@ import (
 	"github.com/hashicorp/go-multierror"
 )
 
+const commentTextLengthLimit = 100
+
 // TelegramParams contain settings for telegram notifications
 type TelegramParams struct {
 	AdminChannelID       string        // unique identifier for the target chat or username of the target channel (in the format @channelusername)
@@ -85,10 +87,10 @@ func (t *Telegram) buildMessage(req Request) string {
 		msg += fmt.Sprintf(" -> <a href=%q>%s</a>", commentURLPrefix+req.parent.ID, ntf.EscapeTelegramText(req.parent.User.Name))
 	}
 
-	msg += fmt.Sprintf("\n\n%s", ntf.TelegramSupportedHTML(req.Comment.Text))
+	msg += fmt.Sprintf("\n\n%s", pruneHTML(ntf.TelegramSupportedHTML(req.Comment.Text), commentTextLengthLimit))
 
 	if req.Comment.ParentID != "" {
-		msg += fmt.Sprintf("\n\n\"<i>%s</i>\"", ntf.TelegramSupportedHTML(req.parent.Text))
+		msg += fmt.Sprintf("\n\n\"<i>%s</i>\"", pruneHTML(ntf.TelegramSupportedHTML(req.parent.Text), commentTextLengthLimit))
 	}
 
 	if req.Comment.PostTitle != "" {

backend/app/notify/telegram_test.go

@@ -53,6 +53,15 @@ some text
 
 <b>Hello</b><i><b>World</b></i>`,
 		res)
+
+	// prune string keeping HTML closing tags
+	c = store.Comment{
+		Text: "<b>Lorem ipsum <i>dolor sit amet</i>, consectetur adipiscing <code>elit, sed do eiusmod tempor incididunt</code> ut labore et dolore magna aliqua.</b>",
+	}
+	res = tb.buildMessage(Request{Comment: c})
+	assert.Equal(t, `<a href="#remark42__comment-"></a>
+
+<b>Lorem ipsum <i>dolor sit amet</i>, consectetur adipiscing <code>elit, sed do eiusmod tempor incididunt</code> ut...</b>`, res)
 }
 
 func TestTelegram_SendVerification(t *testing.T) {

backend/app/providers/telegram.go

@@ -15,7 +15,7 @@ import (
 )
 
 type tgRequester interface {
-	Request(ctx context.Context, method string, b []byte, data interface{}) error
+	Request(ctx context.Context, method string, b []byte, data any) error
 }
 
 // TGUpdatesReceiver used to dispatch telegram updates to multiple receivers
@@ -27,8 +27,8 @@ type TGUpdatesReceiver interface {
 // DispatchTelegramUpdates dispatches telegram updates to provided list of receivers
 // Blocks caller
 func DispatchTelegramUpdates(ctx context.Context, requester tgRequester, receivers []TGUpdatesReceiver, period time.Duration) {
-	// Identifier of the first update to be requested.
-	// Should be equal to LastSeenUpdateID + 1
+	// identifier of the first update to be requested.
+	// should be equal to LastSeenUpdateID + 1
 	// See https://core.telegram.org/bots/api#getupdates
 	var updateOffset int
 

backend/app/providers/telegram_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	ntf "github.com/go-pkgz/notify"
@@ -12,12 +13,14 @@ import (
 )
 
 func TestDispatchTelegramUpdates(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	poolPeriod := time.Millisecond * 100
-	go DispatchTelegramUpdates(ctx, &mockTGRequester{t: t}, []TGUpdatesReceiver{&mockTGUpdatesReceiver{t: t}}, poolPeriod)
-	time.Sleep(poolPeriod * 3)
-	cancel()
-	time.Sleep(poolPeriod)
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		poolPeriod := time.Millisecond * 100
+		go DispatchTelegramUpdates(ctx, &mockTGRequester{t: t}, []TGUpdatesReceiver{&mockTGUpdatesReceiver{t: t}}, poolPeriod)
+		time.Sleep(poolPeriod * 3)
+		cancel()
+		synctest.Wait()
+	})
 }
 
 const getUpdatesResp = `{
@@ -39,7 +42,7 @@ type mockTGRequester struct {
 	t   *testing.T
 }
 
-func (m *mockTGRequester) Request(_ context.Context, _ string, _ []byte, data interface{}) error {
+func (m *mockTGRequester) Request(_ context.Context, _ string, _ []byte, data any) error {
 	if m.hit < 2 {
 		m.hit++
 		assert.NoError(m.t, json.Unmarshal([]byte(getUpdatesResp), data))

backend/app/rest/api/admin.go

@@ -1,14 +1,15 @@
 package api
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"path"
+	"strings"
 	"time"
 
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/render"
-	"github.com/go-pkgz/auth"
+	"github.com/go-pkgz/auth/v2"
+	"github.com/go-pkgz/auth/v2/avatar"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
@@ -44,7 +45,7 @@ type adminStore interface {
 
 // DELETE /comment/{id}?site=siteID&url=post-url - removes comment
 func (a *admin) deleteCommentCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 	log.Printf("[INFO] delete comment %s", id)
 
@@ -54,13 +55,12 @@ func (a *admin) deleteCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	a.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.SiteID, locator.URL, lastCommentsScope))
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, R.JSON{"id": id, "locator": locator})
+	R.RenderJSON(w, R.JSON{"id": id, "locator": locator})
 }
 
 // DELETE /user/{userid}?site=side-id - delete all user comments for requested userid
 func (a *admin) deleteUserCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[INFO] delete all user comments for %s, site %s", userID, siteID)
 
@@ -69,13 +69,12 @@ func (a *admin) deleteUserCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	a.cache.Flush(cache.Flusher(siteID).Scopes(userID, siteID, lastCommentsScope))
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, R.JSON{"user_id": userID, "site_id": siteID})
+	R.RenderJSON(w, R.JSON{"user_id": userID, "site_id": siteID})
 }
 
 // GET /user/{userid}?site=side-id - get user info for requested userid
 func (a *admin) getUserInfoCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[INFO] get user info for %s, site %s", userID, siteID)
 
@@ -84,8 +83,7 @@ func (a *admin) getUserInfoCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get user info", rest.ErrInternal)
 		return
 	}
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, ucomments[0].User)
+	R.RenderJSON(w, ucomments[0].User)
 }
 
 // GET /deleteme?token=jwt - delete all user comments and details by user's request. Gets info about deleted used from provided token
@@ -107,33 +105,56 @@ func (a *admin) deleteMeRequestCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = a.dataService.DeleteUserDetail(claims.Audience, claims.User.ID, engine.AllUserDetails); err != nil {
+	// audience is a slice but we set it to a single element, and situation when there is no audience or there are more than one is unexpected
+	if len(claims.Audience) != 1 {
+		rest.SendErrorJSON(w, r, http.StatusBadRequest, fmt.Errorf("bad request"), "can't process token, claims.Audience expected to be a single element but it's not", rest.ErrActionRejected)
+		return
+	}
+
+	audience := claims.Audience[0]
+
+	if err = a.dataService.DeleteUserDetail(audience, claims.User.ID, engine.AllUserDetails); err != nil {
 		code := parseError(err, rest.ErrInternal)
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't delete user details for user", code)
 		return
 	}
 
-	if err = a.dataService.DeleteUser(claims.Audience, claims.User.ID, store.HardDelete); err != nil {
+	if err = a.dataService.DeleteUser(audience, claims.User.ID, store.HardDelete); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't delete user", rest.ErrNoAccess)
 		return
 	}
 
 	if claims.User.Picture != "" && a.authenticator.AvatarProxy() != nil {
-		avatarStore := a.authenticator.AvatarProxy().Store
-		if err = avatarStore.Remove(path.Base(claims.User.Picture)); err != nil {
-			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't delete user's avatar", rest.ErrInternal)
-			return
+		if avatarID := avatarIDFromPicture(claims.User.Picture); avatarID != "" {
+			// an already-removed avatar is fine (a repeated request stays idempotent), but a genuine
+			// store failure is surfaced now that avatar.ErrNotFound lets us tell the two apart
+			if err = a.authenticator.AvatarProxy().Store.Remove(avatarID); err != nil && !errors.Is(err, avatar.ErrNotFound) {
+				rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't delete user's avatar", rest.ErrInternal)
+				return
+			}
+		} else {
+			log.Printf("[WARN] unexpected avatar picture %q for user %s on site %s, skipping removal", claims.User.Picture, claims.User.ID, audience)
 		}
 	}
 
-	a.cache.Flush(cache.Flusher(claims.Audience).Scopes(claims.Audience, claims.User.ID, lastCommentsScope))
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, R.JSON{"user_id": claims.User.ID, "site_id": claims.Audience})
+	a.cache.Flush(cache.Flusher(audience).Scopes(audience, claims.User.ID, lastCommentsScope))
+	R.RenderJSON(w, R.JSON{"user_id": claims.User.ID, "site_id": claims.Audience})
+}
+
+// avatarIDFromPicture returns the avatar-store object id for a user picture, or "" if the picture
+// does not resolve to a well-formed id (the store names its objects "<hash>.image"). Guarding on the
+// id shape keeps a malformed picture, e.g. a path sentinel, from making a filesystem-backed store
+// target an unexpected path.
+func avatarIDFromPicture(picture string) string {
+	if id := path.Base(picture); strings.HasSuffix(id, ".image") {
+		return id
+	}
+	return ""
 }
 
 // PUT /user/{userid}?site=side-id&block=1&ttl=7d - block or unblock user
 func (a *admin) setBlockCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	blockStatus := r.URL.Query().Get("block") == "1"
 
@@ -156,7 +177,7 @@ func (a *admin) setBlockCtrl(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	a.cache.Flush(cache.Flusher(siteID).Scopes(userID, siteID, lastCommentsScope))
-	render.JSON(w, r, R.JSON{"user_id": userID, "site_id": siteID, "block": blockStatus})
+	R.RenderJSON(w, R.JSON{"user_id": userID, "site_id": siteID, "block": blockStatus})
 }
 
 // GET /blocked?site=siteID - list blocked users
@@ -167,7 +188,7 @@ func (a *admin) blockedUsersCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get blocked users", rest.ErrSiteNotFound)
 		return
 	}
-	render.JSON(w, r, users)
+	R.RenderJSON(w, users)
 }
 
 // PUT /readonly?site=siteID&url=post-url&ro=1 - set or reset read-only status for the post
@@ -194,12 +215,12 @@ func (a *admin) setReadOnlyCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	a.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.URL, locator.SiteID))
-	render.JSON(w, r, R.JSON{"locator": locator, "read-only": roStatus})
+	R.RenderJSON(w, R.JSON{"locator": locator, "read-only": roStatus})
 }
 
 // PUT /title/{id}?site=siteID&url=post-url - set comment PostTitle to page's title
 func (a *admin) setTitleCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 
 	c, err := a.dataService.SetTitle(locator, id)
@@ -210,13 +231,12 @@ func (a *admin) setTitleCtrl(w http.ResponseWriter, r *http.Request) {
 	log.Printf("[INFO] set comment's title %s to %q", id, c.PostTitle)
 
 	a.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.URL, lastCommentsScope))
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, R.JSON{"id": id, "locator": locator})
+	R.RenderJSON(w, R.JSON{"id": id, "locator": locator})
 }
 
-// PUT /verify?site=siteID&url=post-url&ro=1 - set or reset read-only status for the post
+// PUT /verify/{userid}?site=siteID&verified=1 - set or reset verified status for the user
 func (a *admin) setVerifyCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	verifyStatus := r.URL.Query().Get("verified") == "1"
 
@@ -225,13 +245,13 @@ func (a *admin) setVerifyCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	a.cache.Flush(cache.Flusher(siteID).Scopes(siteID, userID))
-	render.JSON(w, r, R.JSON{"user": userID, "verified": verifyStatus})
+	R.RenderJSON(w, R.JSON{"user": userID, "verified": verifyStatus})
 }
 
 // PUT /pin/{id}?site=siteID&url=post-url&pin=1
 // mark/unmark comment as a special
 func (a *admin) setPinCtrl(w http.ResponseWriter, r *http.Request) {
-	commentID := chi.URLParam(r, "id")
+	commentID := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 	pinStatus := r.URL.Query().Get("pin") == "1"
 
@@ -240,5 +260,5 @@ func (a *admin) setPinCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	a.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.URL))
-	render.JSON(w, r, R.JSON{"id": commentID, "locator": locator, "pin": pinStatus})
+	R.RenderJSON(w, R.JSON{"id": commentID, "locator": locator, "pin": pinStatus})
 }

backend/app/rest/api/admin_test.go

@@ -13,10 +13,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2/token"
 	cache "github.com/go-pkgz/lcw/v2"
 	R "github.com/go-pkgz/rest"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -87,7 +87,7 @@ func TestAdmin_Delete(t *testing.T) {
 	// check count updated
 	res, code = get(t, ts.URL+"/api/v1/count?site=remark42&url=https://radio-t.com/blah")
 	assert.Equal(t, http.StatusOK, code)
-	b := map[string]interface{}{}
+	b := map[string]any{}
 	err = json.Unmarshal([]byte(res), &b)
 	assert.NoError(t, err)
 	t.Logf("%#v", b)
@@ -465,7 +465,7 @@ func TestAdmin_ReadOnly(t *testing.T) {
 		Locator: store.Locator{SiteID: "remark42", URL: "https://radio-t.com/blah"}}
 	b, err := json.Marshal(c)
 	assert.NoError(t, err, "can't marshal comment %+v", c)
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", bytes.NewBuffer(b))
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", bytes.NewBuffer(b))
 	require.NoError(t, err)
 	resp, err = sendReq(t, req, adminUmputunToken)
 	require.NoError(t, err)
@@ -489,7 +489,7 @@ func TestAdmin_ReadOnly(t *testing.T) {
 		Locator: store.Locator{SiteID: "remark42", URL: "https://radio-t.com/blah"}}
 	b, err = json.Marshal(c)
 	assert.NoError(t, err, "can't marshal comment %+v", c)
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", bytes.NewBuffer(b))
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site="+c.Locator.SiteID, bytes.NewBuffer(b))
 	require.NoError(t, err)
 	resp, err = sendReq(t, req, adminUmputunToken)
 	require.NoError(t, err)
@@ -708,17 +708,17 @@ func TestAdmin_DeleteMeRequest(t *testing.T) {
 
 	claims := token.Claims{
 		SessionOnly: true,
-		StandardClaims: jwt.StandardClaims{
-			Audience:  "remark42",
-			Id:        "1234567",
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "1234567",
 			Issuer:    "remark42",
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
-			ExpiresAt: time.Now().Add(30 * time.Minute).Unix(),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
 		},
 		User: &token.User{
 			ID:      "user1",
-			Picture: "pic.image",
-			Attributes: map[string]interface{}{
+			Picture: "https://demo.remark42.com/api/v1/avatar/pic.image", // production-shaped URL: removal must path.Base it to the avatar id
+			Attributes: map[string]any{
 				"delete_me": true,
 			},
 		},
@@ -747,6 +747,124 @@ func TestAdmin_DeleteMeRequest(t *testing.T) {
 	email, err = srv.DataService.GetUserEmail("remark42", "user1")
 	assert.NoError(t, err)
 	assert.Empty(t, email, "user1 email was deleted")
+
+	assert.NoFileExists(t, os.TempDir()+"/ava-remark42/42/pic.image", "user's avatar should be removed on deleteme")
+}
+
+// a delete_me request whose token carries a picture must still succeed when the avatar is
+// already gone from the store: the user data is deleted and a missing avatar is tolerated
+func TestAdmin_DeleteMeRequestMissingAvatar(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	c1 := store.Comment{Text: "test test #1", Locator: store.Locator{SiteID: "remark42",
+		URL: "https://radio-t.com/blah"}, User: store.User{Name: "user3 name", ID: "user3"}}
+	_, err := srv.DataService.Create(c1)
+	require.NoError(t, err)
+
+	claims := token.Claims{
+		SessionOnly: true,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "2345678",
+			Issuer:    "remark42",
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+		},
+		User: &token.User{
+			ID:      "user3",
+			Picture: "missing.image", // no avatar file exists for this picture in the store
+			Attributes: map[string]any{
+				"delete_me": true,
+			},
+		},
+	}
+
+	tkn, err := srv.Authenticator.TokenService().Token(claims)
+	require.NoError(t, err)
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
+	require.NoError(t, err)
+	req.SetBasicAuth("admin", "password")
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "a missing avatar must not fail the deletion")
+
+	_, err = srv.DataService.User("remark42", "user3", 0, 0, store.User{})
+	assert.EqualError(t, err, "no comments for user user3 in store", "user3 comments should be deleted")
+}
+
+// a genuine (non not-found) avatar-store failure must now surface, not be silently swallowed:
+// avatar.ErrNotFound lets deleteMeRequestCtrl tell an already-gone avatar from a real error
+func TestAdmin_DeleteMeRequestAvatarRemoveError(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	c1 := store.Comment{Text: "test test #1", Locator: store.Locator{SiteID: "remark42",
+		URL: "https://radio-t.com/blah"}, User: store.User{Name: "user5 name", ID: "user5"}}
+	_, err := srv.DataService.Create(c1)
+	require.NoError(t, err)
+
+	// put a non-empty directory where the avatar file is expected, so Store.Remove fails with a real
+	// error (directory not empty), not os.ErrNotExist - "pic" hashes to partition 42
+	require.NoError(t, os.MkdirAll(os.TempDir()+"/ava-remark42/42/pic.image", 0o700))
+	require.NoError(t, os.WriteFile(os.TempDir()+"/ava-remark42/42/pic.image/child", []byte("x"), 0o600))
+
+	claims := token.Claims{
+		SessionOnly: true,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "4567890",
+			Issuer:    "remark42",
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+		},
+		User: &token.User{
+			ID:      "user5",
+			Picture: "https://demo.remark42.com/api/v1/avatar/pic.image",
+			Attributes: map[string]any{
+				"delete_me": true,
+			},
+		},
+	}
+
+	tkn, err := srv.Authenticator.TokenService().Token(claims)
+	require.NoError(t, err)
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
+	require.NoError(t, err)
+	req.SetBasicAuth("admin", "password")
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode, "a real avatar-store failure must surface, not be swallowed")
+}
+
+func TestAvatarIDFromPicture(t *testing.T) {
+	tbl := []struct {
+		name    string
+		picture string
+		want    string
+	}{
+		{"local avatar url", "https://demo.remark42.com/api/v1/avatar/cb42ff493ade696d88a3a590f136ae9e34de7c1b.image", "cb42ff493ade696d88a3a590f136ae9e34de7c1b.image"},
+		{"bare avatar id", "pic.image", "pic.image"},
+		{"parent sentinel", "https://demo.remark42.com/api/v1/avatar/..", ""},
+		{"trailing slash", "https://demo.remark42.com/api/v1/avatar/", ""},
+		{"root", "/", ""},
+		{"dotdot", "..", ""},
+		{"empty", "", ""},
+		{"provider url without image suffix", "https://example.com/pic.png", ""},
+	}
+	for _, tc := range tbl {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, avatarIDFromPicture(tc.picture))
+		})
+	}
 }
 
 func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
@@ -777,16 +895,16 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	// try with bad auth
 	claims := token.Claims{
 		SessionOnly: true,
-		StandardClaims: jwt.StandardClaims{
-			Audience:  "remark42",
-			Id:        "provider1_1234567",
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "provider1_1234567",
 			Issuer:    "remark42",
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
-			ExpiresAt: time.Now().Add(30 * time.Minute).Unix(),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
 		},
 		User: &token.User{
 			ID: "provider1_user1",
-			Attributes: map[string]interface{}{
+			Attributes: map[string]any{
 				"delete_me": true,
 			},
 		},
@@ -802,10 +920,11 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	assert.NoError(t, resp.Body.Close())
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
 
-	// try bad user
-	badClaims := claims
-	badClaims.User.ID = "no-such-id"
-	tkn, err = srv.Authenticator.TokenService().Token(badClaims)
+	// unknown user: deletion is idempotent, so a valid (signed) delete_me token for a user with
+	// no stored data is a no-op success rather than an error
+	badClaimsUser := claims
+	badClaimsUser.User.ID = "no-such-id"
+	tkn, err = srv.Authenticator.TokenService().Token(badClaimsUser)
 	assert.NoError(t, err)
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
 	assert.NoError(t, err)
@@ -813,12 +932,13 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	resp, err = client.Do(req)
 	assert.NoError(t, err)
 	assert.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusBadRequest, resp.StatusCode, resp.Status)
+	assert.Equal(t, http.StatusOK, resp.StatusCode, resp.Status)
+	badClaimsUser.User.ID = "provider1_user1"
 
 	// try without deleteme flag
-	badClaims2 := claims
-	badClaims2.User.SetBoolAttr("delete_me", false)
-	tkn, err = srv.Authenticator.TokenService().Token(badClaims2)
+	badClaimsWithoutDeleteMe := claims
+	badClaimsWithoutDeleteMe.User.SetBoolAttr("delete_me", false)
+	tkn, err = srv.Authenticator.TokenService().Token(badClaimsWithoutDeleteMe)
 	assert.NoError(t, err)
 	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
 	assert.NoError(t, err)
@@ -829,7 +949,25 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	b, err := io.ReadAll(resp.Body)
 	assert.NoError(t, err)
 	assert.NoError(t, resp.Body.Close())
-	assert.True(t, strings.Contains(string(b), "can't use provided token"))
+	assert.Contains(t, string(b), "can't use provided token")
+	badClaimsWithoutDeleteMe.User.SetBoolAttr("delete_me", true)
+
+	// try with wrong audience
+	badClaimsMultipleAudience := claims
+	badClaimsMultipleAudience.Audience = jwt.ClaimStrings{"remark42", "something else"}
+	tkn, err = srv.Authenticator.TokenService().Token(badClaimsMultipleAudience)
+	assert.NoError(t, err)
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
+	assert.NoError(t, err)
+	req.SetBasicAuth("admin", "password")
+	resp, err = client.Do(req)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+	b, err = io.ReadAll(resp.Body)
+	assert.NoError(t, err)
+	assert.NoError(t, resp.Body.Close())
+	assert.Contains(t, string(b), "can't process token, claims.Audience expected to be a single element but it's not")
+	badClaimsMultipleAudience.Audience = jwt.ClaimStrings{"remark42"}
 }
 
 func TestAdmin_GetUserInfo(t *testing.T) {

backend/app/rest/api/middleware.go

@@ -0,0 +1,353 @@
+// Package api middleware: request-scoped HTTP middlewares used by the REST router.
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/mail"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/didip/tollbooth/v8"
+	"github.com/didip/tollbooth/v8/limiter"
+	log "github.com/go-pkgz/lgr"
+	R "github.com/go-pkgz/rest"
+	"github.com/umputun/remark42/backend/app/rest"
+	"github.com/umputun/remark42/backend/app/store"
+)
+
+// ipForwardingHeaders are the request headers R.RealIP derives the client IP from.
+var ipForwardingHeaders = []string{"X-Real-IP", "X-Forwarded-For", "CF-Connecting-IP"}
+
+// realIPMiddleware derives the client IP from forwarding headers (X-Real-IP / X-Forwarded-For /
+// CF-Connecting-IP) via R.RealIP, but honors those headers only for requests whose direct peer
+// is one of the trusted proxies. For any other peer it drops those headers and pins RemoteAddr to
+// the real socket IP, so an untrusted client can't spoof the IP that per-IP controls (rate limiting,
+// vote dedup, comment IP, anonymous id) and the request log key on.
+//
+// With no trusted proxies configured it falls back to trusting the headers from any client (the
+// historical behavior). That is spoofable by design, so operators running behind a reverse proxy
+// should set --trusted-proxy to the proxy's network — see the "trusted proxy" docs.
+func realIPMiddleware(trustedProxies []*net.IPNet) func(http.Handler) http.Handler {
+	if len(trustedProxies) == 0 {
+		return R.RealIP
+	}
+	return func(next http.Handler) http.Handler {
+		fromTrusted := R.RealIP(next) // rewrites RemoteAddr from the forwarding headers
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			peer := directPeerIP(r.RemoteAddr)
+			if peer != nil && cidrsContain(trustedProxies, peer) {
+				fromTrusted.ServeHTTP(w, r) // trusted proxy: honor the forwarding headers
+				return
+			}
+			// untrusted peer: drop the forwarding headers and pin RemoteAddr to the real socket IP,
+			// so nothing downstream can be fooled by a spoofed header (R.RealIP normalizes
+			// RemoteAddr to a bare IP for trusted peers; do the same here for consistency)
+			for _, h := range ipForwardingHeaders {
+				r.Header.Del(h)
+			}
+			if peer != nil {
+				r.RemoteAddr = peer.String()
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// directPeerIP extracts the IP from a "host:port" (or bare host) RemoteAddr, or nil if unparseable.
+func directPeerIP(remoteAddr string) net.IP {
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		host = remoteAddr // may already be a bare IP with no port
+	}
+	return net.ParseIP(host)
+}
+
+// TrustsAnyPeer reports whether the trusted-proxy list contains a catch-all (0.0.0.0/0 or ::/0),
+// which trusts forwarding headers from every client and re-opens the IP-spoofing bypass.
+func TrustsAnyPeer(cidrs []*net.IPNet) bool {
+	for _, c := range cidrs {
+		if ones, _ := c.Mask.Size(); ones == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// cidrsContain reports whether ip falls within any of the CIDRs.
+func cidrsContain(cidrs []*net.IPNet, ip net.IP) bool {
+	for _, c := range cidrs {
+		if c.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseTrustedProxies parses a list of trusted-proxy entries into CIDRs. Each entry may be a CIDR
+// (e.g. 172.16.0.0/12) or a bare IP (treated as a single host). Blank entries are skipped; a
+// malformed entry is a hard error so a typo can't silently disable proxy trust.
+func ParseTrustedProxies(entries []string) ([]*net.IPNet, error) {
+	var out []*net.IPNet
+	for _, e := range entries {
+		e = strings.TrimSpace(e)
+		if e == "" {
+			continue
+		}
+		if !strings.Contains(e, "/") { // bare IP -> single-host CIDR
+			ip := net.ParseIP(e)
+			if ip == nil {
+				return nil, fmt.Errorf("invalid trusted proxy %q", e)
+			}
+			// build the network from the normalized IP so a v4-mapped IPv6 (e.g. ::ffff:10.0.0.1)
+			// yields the intended /32 host, not a huge ::/32 range
+			bits := 128
+			if v4 := ip.To4(); v4 != nil {
+				ip, bits = v4, 32
+			}
+			out = append(out, &net.IPNet{IP: ip, Mask: net.CIDRMask(bits, bits)})
+			continue
+		}
+		_, network, err := net.ParseCIDR(e)
+		if err != nil {
+			return nil, fmt.Errorf("invalid trusted proxy CIDR %q: %w", e, err)
+		}
+		out = append(out, network)
+	}
+	return out, nil
+}
+
+// corsMiddleware builds the CORS middleware for the public API. With AllowedOrigins
+// "*" and credentials enabled, rest.CORS reflects the request Origin into
+// Access-Control-Allow-Origin (rather than a literal "*"), which browsers require
+// for credentialed cross-origin requests.
+func corsMiddleware() func(http.Handler) http.Handler {
+	return R.CORS(
+		R.CorsAllowedOrigins("*"),
+		R.CorsAllowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS"),
+		R.CorsAllowedHeaders("Accept", "Authorization", "Content-Type", "X-XSRF-Token", "X-JWT"),
+		R.CorsExposedHeaders("Authorization"),
+		R.CorsAllowCredentials(true),
+		R.CorsMaxAge(300),
+	)
+}
+
+// rejectHead rejects HEAD requests with 405, advertising the given allowed methods in
+// the Allow header. net/http.ServeMux routes HEAD to a "GET ..." handler, but per RFC
+// 9110 GET/HEAD are safe methods; this guard is applied to the few GET routes whose
+// handlers mutate state so they cannot be triggered by a (nominally side-effect-free)
+// HEAD, preserving the pre-routegroup behavior. allow lists every method the resource
+// supports (e.g. "GET" or "GET, POST") so the 405 Allow header is accurate.
+func rejectHead(allow string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodHead {
+				w.Header().Set("Allow", allow)
+				http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// rejectAnonUser is a middleware rejecting anonymous users
+func rejectAnonUser(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		user, err := rest.GetUserInfo(r)
+		if err != nil {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		if strings.HasPrefix(user.ID, "anonymous_") {
+			http.Error(w, "Access denied", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	}
+	return http.HandlerFunc(fn)
+}
+
+// matchSiteID is a middleware rejecting users with mismatch between site param and and User.SiteID
+func matchSiteID(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		user, err := rest.GetUserInfo(r)
+		if err != nil {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		// skip for basic auth user
+		if user.Name == "admin" && user.ID == "admin" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		siteID := r.URL.Query().Get("site")
+		// require an explicit site so the user.SiteID check below cannot be bypassed
+		// by simply omitting the query parameter
+		if siteID == "" || user.SiteID != siteID {
+			http.Error(w, "Access denied", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	}
+	return http.HandlerFunc(fn)
+}
+
+// cacheControl is a middleware setting cache expiration. Using url+version as etag
+func cacheControl(expiration time.Duration, version string) func(http.Handler) http.Handler {
+	etag := func(r *http.Request, version string) string {
+		s := version + ":" + r.URL.String()
+		return store.EncodeID(s)
+	}
+
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			e := `"` + etag(r, version) + `"`
+			w.Header().Set("Etag", e)
+			w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, no-cache", int(expiration.Seconds())))
+
+			if match := r.Header.Get("If-None-Match"); match != "" {
+				if strings.Contains(match, e) {
+					w.WriteHeader(http.StatusNotModified)
+					return
+				}
+			}
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// apiCSPMiddleware overrides the global Content-Security-Policy on /api/v1 routes
+// with a strict, default-deny policy. The global CSP (securityHeadersMiddleware) keeps
+// 'self' 'unsafe-inline' for script-src/style-src because the widget HTML pages
+// (/web/*.html) need inline bootstrap blocks. API responses serve JSON, XML/RSS, or
+// images — none of those should ever execute scripts when rendered, so they get the
+// strictest policy available as defense-in-depth against future trust-boundary bugs.
+//
+// Image-serving handlers (/api/v1/img, /api/v1/picture/{user}/{id}) re-apply the same
+// rest.StrictImageCSP value at the handler level and additionally set Content-Disposition:
+// inline; filename="image" (framing the response as a file rather than a renderable
+// document) and X-Content-Type-Options: nosniff. The CSP re-apply is intentional belt-and-
+// braces: if a future route refactor bypasses this middleware, the image handlers still
+// emit the policy.
+func apiCSPMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Security-Policy", rest.StrictImageCSP)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// securityHeadersMiddleware sets security-related headers:
+//   - Content-Security-Policy: controls which resources the browser is allowed to load
+//   - Permissions-Policy: disables browser features (camera, mic, etc.) not needed by a comment widget
+//   - X-Content-Type-Options: prevents browsers from MIME-sniffing responses away from the declared type,
+//     stopping e.g. a user-uploaded image from being reinterpreted as executable HTML/JS
+//   - Referrer-Policy: controls how much URL information leaks in the Referer header on cross-origin
+//     requests; "strict-origin-when-cross-origin" sends only the origin (no path) to other domains
+//     and nothing at all on HTTPS→HTTP downgrades
+func securityHeadersMiddleware(imageProxyEnabled bool, allowedAncestors []string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			imgSrc := "*"
+			if imageProxyEnabled {
+				imgSrc = "'self'"
+			}
+			frameAncestors := "*"
+			if len(allowedAncestors) > 0 {
+				frameAncestors = strings.Join(allowedAncestors, " ")
+			}
+			// font-src is set to 'none' (no @font-face / no base64 fonts in the bundle).
+			w.Header().Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; base-uri 'none'; form-action 'none'; connect-src 'self'; frame-src 'self' mailto:; img-src %s; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'none'; object-src 'none'; frame-ancestors %s;", imgSrc, frameAncestors))
+			w.Header().Set("Permissions-Policy", "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=(), window-management=()")
+			w.Header().Set("X-Content-Type-Options", "nosniff")
+			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// subscribersOnly is a middleware rejecting non-paid_sub users
+func subscribersOnly(enable bool) func(http.Handler) http.Handler {
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			if enable {
+				user, err := rest.GetUserInfo(r)
+				if err != nil {
+					http.Error(w, "Unauthorized", http.StatusUnauthorized)
+					return
+				}
+				if !user.PaidSub {
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// validEmailAuth is a middleware for auth endpoints for email method.
+// it rejects login request if user, site or email are suspicious
+func validEmailAuth() func(http.Handler) http.Handler {
+
+	reUser := regexp.MustCompile(`^[\p{L}\d\s_]{4,64}$`) // matches ui side validation, adding min/max limitation
+	reSite := regexp.MustCompile(`^[a-zA-Z\d\s_.-]{1,64}$`)
+
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+
+			if r.URL.Path != "/auth/email/login" {
+				// not email login, skip the check
+				h.ServeHTTP(w, r)
+				return
+			}
+
+			if u := r.URL.Query().Get("user"); u != "" {
+				if !reUser.MatchString(u) {
+					log.Printf("[WARN] suspicious user rejected: %s", u)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			if a := r.URL.Query().Get("address"); a != "" {
+				if _, err := mail.ParseAddress(a); err != nil {
+					log.Printf("[WARN] suspicious address rejected: %s", a)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			if s := r.URL.Query().Get("site"); s != "" {
+				if !reSite.MatchString(s) {
+					log.Printf("[WARN] suspicious site rejected: %s", s)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// rateLimiter creates a rate limiting middleware with proper IP lookup configuration.
+// tollbooth v8 requires explicit IP lookup method to be set.
+// keys on RemoteAddr, which realIPMiddleware sets to the client IP (from the forwarding
+// headers for trusted proxies, otherwise the real socket IP).
+func rateLimiter(maxReq float64) func(http.Handler) http.Handler {
+	lmt := tollbooth.NewLimiter(maxReq, nil)
+	lmt.SetIPLookup(limiter.IPLookup{
+		Name:           "RemoteAddr",
+		IndexFromRight: 0,
+	})
+	return tollbooth.HTTPMiddleware(lmt)
+}

backend/app/rest/api/middleware_test.go

@@ -0,0 +1,406 @@
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/go-pkgz/auth/v2/token"
+	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/umputun/remark42/backend/app/rest"
+	"github.com/umputun/remark42/backend/app/store"
+)
+
+// routes() wraps bounded routes with the enforcing rest.Timeout and deliberately leaves the
+// streaming/long-polling routes (GET /export, /userdata, /wait) without it. This checks that
+// contract holds against the vendored middleware: a slow handler under R.Timeout is aborted with
+// 504 at the deadline, while a route left without it runs to completion.
+func TestRouteTimeout(t *testing.T) {
+	slow := func(d time.Duration) http.HandlerFunc {
+		return func(w http.ResponseWriter, r *http.Request) {
+			select {
+			case <-r.Context().Done(): // return promptly once the enforcing timeout cancels the context
+			case <-time.After(d):
+			}
+			w.WriteHeader(http.StatusOK)
+		}
+	}
+
+	router := routegroup.New(http.NewServeMux())
+	router.With(R.Timeout(20*time.Millisecond)).HandleFunc("GET /bounded", slow(time.Second))
+	router.HandleFunc("GET /streaming", slow(30*time.Millisecond)) // no timeout, like /export and /wait
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/bounded")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusGatewayTimeout, resp.StatusCode, "route under R.Timeout is aborted at the deadline")
+
+	resp, err = http.Get(ts.URL + "/streaming")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "route without R.Timeout runs to completion")
+}
+
+func TestRealIPMiddleware(t *testing.T) {
+	// call runs mw with the given peer and (optional) X-Real-IP header and returns what the
+	// downstream handler observes; state is per-call, so subtests don't share closure locals.
+	call := func(mw func(http.Handler) http.Handler, remoteAddr, xRealIP string) (addr, hdr string) {
+		next := http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+			addr, hdr = r.RemoteAddr, r.Header.Get("X-Real-IP")
+		})
+		req := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+		req.RemoteAddr = remoteAddr
+		if xRealIP != "" {
+			req.Header.Set("X-Real-IP", xRealIP)
+		}
+		mw(next).ServeHTTP(httptest.NewRecorder(), req)
+		return addr, hdr
+	}
+
+	trusted, err := ParseTrustedProxies([]string{"172.16.0.0/12", "2001:db8::/32"})
+	require.NoError(t, err)
+
+	t.Run("no trusted proxies trusts the header from anyone (legacy)", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(nil), "203.0.113.9:1234", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted v4 peer: forwarding header sets the client IP", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "172.18.0.5:5555", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted v6 peer: forwarding header honored", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "[2001:db8::5]:5555", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted peer without a forwarding header falls back to the socket IP", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "172.18.0.5:5555", "")
+		assert.Equal(t, "172.18.0.5", addr, "no header to honor, so the bare socket IP is used")
+	})
+	t.Run("untrusted peer: header stripped, RemoteAddr pinned to bare socket IP", func(t *testing.T) {
+		addr, hdr := call(realIPMiddleware(trusted), "203.0.113.9:1234", "8.8.8.8")
+		assert.Equal(t, "203.0.113.9", addr, "real socket IP with the port stripped")
+		assert.Empty(t, hdr, "spoofed forwarding header removed so nothing downstream can read it")
+	})
+	t.Run("unparseable RemoteAddr is treated as untrusted, header stripped", func(t *testing.T) {
+		addr, hdr := call(realIPMiddleware(trusted), "garbage", "8.8.8.8")
+		assert.Equal(t, "garbage", addr, "unparseable peer left as-is, not overwritten")
+		assert.Empty(t, hdr, "forwarding header still stripped for a non-trusted peer")
+	})
+}
+
+func TestParseTrustedProxies(t *testing.T) {
+	t.Run("cidr, bare v4, bare v6, blanks", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"172.16.0.0/12", " 10.0.0.1 ", "", "2001:db8::/32"})
+		require.NoError(t, err)
+		require.Len(t, got, 3)
+		assert.True(t, got[0].Contains(net.ParseIP("172.18.0.5")))
+		assert.True(t, got[1].Contains(net.ParseIP("10.0.0.1")))
+		assert.False(t, got[1].Contains(net.ParseIP("10.0.0.2")), "a bare IP is a single host")
+		assert.True(t, got[2].Contains(net.ParseIP("2001:db8::1")))
+	})
+	t.Run("v4-mapped IPv6 bare entry resolves to the v4 host", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"::ffff:10.0.0.1"})
+		require.NoError(t, err)
+		require.Len(t, got, 1)
+		assert.True(t, got[0].Contains(net.ParseIP("10.0.0.1")), "the intended /32 host")
+		assert.False(t, got[0].Contains(net.ParseIP("10.0.0.2")), "not a wider range")
+	})
+	t.Run("malformed entry is a hard error", func(t *testing.T) {
+		_, err := ParseTrustedProxies([]string{"172.16.0.0/12", "nonsense"})
+		require.Error(t, err)
+		_, err = ParseTrustedProxies([]string{"10.0.0.0/999"})
+		require.Error(t, err)
+	})
+	t.Run("all blank yields nil", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"", "  "})
+		require.NoError(t, err)
+		assert.Empty(t, got)
+	})
+}
+
+func TestTrustsAnyPeer(t *testing.T) {
+	catchAll := func(entries ...string) bool {
+		cidrs, err := ParseTrustedProxies(entries)
+		require.NoError(t, err)
+		return TrustsAnyPeer(cidrs)
+	}
+	assert.True(t, catchAll("10.0.0.0/8", "0.0.0.0/0"), "v4 catch-all")
+	assert.True(t, catchAll("::/0"), "v6 catch-all")
+	assert.False(t, catchAll("172.16.0.0/12", "10.0.0.5"), "scoped ranges are not catch-all")
+	assert.False(t, catchAll(), "empty is not catch-all")
+}
+
+func TestRest_rejectAnonUser(t *testing.T) {
+	ts := httptest.NewServer(fakeAuth(rejectAnonUser(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		fmt.Fprintln(w, "Hello")
+	}))))
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "use not logged in")
+
+	resp, err = http.Get(ts.URL + "?fake_id=anonymous_user123&fake_name=test")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "anon rejected")
+
+	resp, err = http.Get(ts.URL + "?fake_id=real_user123&fake_name=test")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "real user")
+}
+
+func TestRest_cacheControl(t *testing.T) {
+	tbl := []struct {
+		url     string
+		version string
+		exp     time.Duration
+		etag    string
+		maxAge  int
+	}{
+		{"http://example.com/foo", "v1", time.Hour, "b433be1ea19edaee9dc92ca4b895b6bdf3c058cb", 3600},
+		{"http://example.com/foo2", "v1", 10 * time.Hour, "6d8466aef3246c1057452561acddf7ad9d0d99e0", 36000},
+		{"http://example.com/foo", "v2", time.Hour, "481700c52aab0dfbca99f3ffc2a4fbb27884c114", 3600},
+		{"https://example.com/foo", "v2", time.Hour, "bebd4f1b87f474792c4e75e5affe31fbf67f5778", 3600},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, http.NoBody)
+			w := httptest.NewRecorder()
+
+			h := cacheControl(tt.exp, tt.version)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+			t.Logf("%+v", resp.Header)
+			assert.Equal(t, `"`+tt.etag+`"`, resp.Header.Get("Etag"))
+			assert.Equal(t, `max-age=`+strconv.Itoa(int(tt.exp.Seconds()))+", no-cache", resp.Header.Get("Cache-Control"))
+		})
+	}
+}
+
+// TestRest_apiCSP locks in that /api/v1/* responses get a strict default-src 'none'
+// override regardless of what the global CSP allows. The widget HTML pages
+// (/web/*.html) still get the global CSP (with 'unsafe-inline' for bootstrap),
+// so the test asserts the two policies diverge across origins.
+func TestRest_apiCSP(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+	client := http.Client{}
+
+	// JSON API endpoint — must carry the strict policy
+	resp, err := client.Get(ts.URL + "/api/v1/config")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	csp := resp.Header.Get("Content-Security-Policy")
+	assert.Contains(t, csp, "default-src 'none'",
+		"API responses must override the global CSP with default-src 'none'; got %q", csp)
+	assert.Contains(t, csp, "sandbox", "API CSP must include sandbox; got %q", csp)
+	assert.NotContains(t, csp, "'unsafe-inline'",
+		"API CSP must not allow inline scripts/styles; got %q", csp)
+
+	// RSS/XML endpoint — same strict policy, and the XML response itself must still be served
+	respRSS, err := client.Get(ts.URL + "/api/v1/rss/site?site=remark42")
+	require.NoError(t, err)
+	defer respRSS.Body.Close()
+	assert.Equal(t, http.StatusOK, respRSS.StatusCode, "RSS must still respond OK under strict CSP")
+	cspRSS := respRSS.Header.Get("Content-Security-Policy")
+	assert.Contains(t, cspRSS, "default-src 'none'", "RSS responses must carry the strict API CSP")
+	assert.Contains(t, cspRSS, "sandbox", "RSS CSP must include sandbox")
+
+	// widget HTML — must keep the global CSP (unchanged, lax to support inline bootstrap)
+	resp2, err := client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp2.Body.Close()
+	csp2 := resp2.Header.Get("Content-Security-Policy")
+	assert.Contains(t, csp2, "'unsafe-inline'",
+		"widget HTML CSP must keep unsafe-inline for bootstrap; got %q", csp2)
+}
+
+// check CSP, img-src should be 'self' with proxy enabled and * without it
+func TestRest_securityHeaders(t *testing.T) {
+	ts, _, teardown := startupT(t)
+
+	// with proxy disabled
+	client := http.Client{}
+	resp, err := client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src *;")
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
+	teardown()
+
+	// check CSP with proxy enabled
+	ts, _, teardown = startupT(t, func(srv *Rest) {
+		srv.ExternalImageProxy = true
+	})
+	defer teardown()
+	resp, err = client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src 'self';")
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
+}
+
+func TestRest_subscribersOnly(t *testing.T) {
+	paidSubUser := &token.User{}
+	paidSubUser.SetPaidSub(true)
+
+	tbl := []struct {
+		subsOnly bool
+		user     token.User
+		setUser  bool
+		status   int
+	}{
+		{true, token.User{}, false, http.StatusUnauthorized},
+		{true, token.User{}, true, http.StatusForbidden},
+		{false, token.User{}, false, http.StatusOK},
+		{false, token.User{}, true, http.StatusOK},
+		{true, *paidSubUser, true, http.StatusOK},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com", http.NoBody)
+			if tt.setUser {
+				req = token.SetUserInfo(req, tt.user)
+			}
+			w := httptest.NewRecorder()
+			h := subscribersOnly(tt.subsOnly)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, tt.status, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+		})
+	}
+}
+
+func Test_validEmailAuth(t *testing.T) {
+	tbl := []struct {
+		req    string
+		status int
+	}{
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone", http.StatusOK},
+		{"/auth/email/login?site=site-with-dash_and_underscore-and.dot&address=umputun%example.com&user=someone", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone+blah", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=Евгений+Умпутун", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=12", http.StatusForbidden},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusForbidden},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someonelooong+loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong", http.StatusForbidden},
+		{"/auth/twitter/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun+example.com&user=someone", http.StatusForbidden},
+		{"/auth/email/login?site=bad!site&address=umputun%example.com&user=someone", http.StatusForbidden},
+		{"/auth/email/login?site=loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongsite&address=umputun%example.com&user=someone", http.StatusForbidden},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com"+tt.req, http.NoBody)
+			w := httptest.NewRecorder()
+			h := validEmailAuth()(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, tt.status, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+		})
+	}
+}
+
+// TestRest_matchSiteID reproduces the multi-tenant isolation gap in the matchSiteID
+// middleware. Before the fix, the check `if siteID != "" && user.SiteID != siteID`
+// silently allowed any authenticated request that omitted the ?site= query param.
+// On admin and user-mutation routes this meant the cross-site check was bypassable
+// just by dropping the parameter. The fix requires ?site= to be present and to match
+// the user's bound site.
+func TestRest_matchSiteID(t *testing.T) {
+	wrapped := matchSiteID(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	}))
+
+	cases := []struct {
+		name     string
+		userSite string
+		query    string
+		want     int
+	}{
+		{name: "matching site allowed", userSite: "site-a", query: "?site=site-a", want: http.StatusOK},
+		{name: "mismatched site forbidden", userSite: "site-a", query: "?site=site-b", want: http.StatusForbidden},
+		{name: "missing site param rejected", userSite: "site-a", query: "", want: http.StatusForbidden},
+		{name: "empty site param rejected", userSite: "site-a", query: "?site=", want: http.StatusForbidden},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				r = rest.SetUserInfo(r, store.User{ID: "u", Name: "u", SiteID: c.userSite})
+				wrapped.ServeHTTP(w, r)
+			})
+			ts := httptest.NewServer(h)
+			defer ts.Close()
+			resp, err := http.Get(ts.URL + c.query)
+			require.NoError(t, err)
+			require.NoError(t, resp.Body.Close())
+			assert.Equal(t, c.want, resp.StatusCode)
+		})
+	}
+}
+
+func TestCorsMiddleware(t *testing.T) {
+	h := corsMiddleware()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	t.Run("credentialed cross-origin reflects the request origin", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+		req.Header.Set("Origin", "https://example.com")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		// AllowedOrigins "*" with credentials must reflect the origin, never a literal "*"
+		assert.Equal(t, "https://example.com", rec.Header().Get("Access-Control-Allow-Origin"))
+		assert.Equal(t, "true", rec.Header().Get("Access-Control-Allow-Credentials"))
+		assert.Equal(t, "Authorization", rec.Header().Get("Access-Control-Expose-Headers"))
+	})
+
+	t.Run("preflight advertises configured methods, headers and max-age", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodOptions, "/", http.NoBody)
+		req.Header.Set("Origin", "https://example.com")
+		req.Header.Set("Access-Control-Request-Method", "POST")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusNoContent, rec.Code)
+		assert.Contains(t, rec.Header().Get("Access-Control-Allow-Methods"), "POST")
+		assert.Contains(t, rec.Header().Get("Access-Control-Allow-Headers"), "X-JWT")
+		assert.Equal(t, "300", rec.Header().Get("Access-Control-Max-Age"))
+		// preflight responses must vary on origin and the request method/headers so caches
+		// don't reuse one preflight across different requests
+		vary := rec.Header().Values("Vary")
+		assert.Contains(t, vary, "Origin")
+		assert.Contains(t, vary, "Access-Control-Request-Method")
+		assert.Contains(t, vary, "Access-Control-Request-Headers")
+	})
+
+	t.Run("same-origin request (no Origin) gets no CORS headers", func(t *testing.T) {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/", http.NoBody))
+		assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"))
+	})
+}

backend/app/rest/api/migrator.go

@@ -1,16 +1,17 @@
 package api
 
 import (
+	"bytes"
 	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
+	"strconv"
 	"sync"
 	"time"
 
-	"github.com/go-chi/render"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
@@ -58,8 +59,7 @@ func (m *Migrator) importCtrl(w http.ResponseWriter, r *http.Request) {
 
 	go m.runImport(siteID, r.URL.Query().Get("provider"), tmpfile) // import runs in background and sets busy flag for site
 
-	render.Status(r, http.StatusAccepted)
-	render.JSON(w, r, R.JSON{"status": "import request accepted"})
+	_ = R.EncodeJSON(w, http.StatusAccepted, R.JSON{"status": "import request accepted"})
 }
 
 // POST /import/form?secret=key&site=site-id&provider=disqus|remark|wordpress
@@ -73,28 +73,47 @@ func (m *Migrator) importFormCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := r.ParseMultipartForm(20 * 1024 * 1024); err != nil { // 20M max memory, if bigger will make a file
+	r.Body = http.MaxBytesReader(w, r.Body, 256*1024*1024) // hard cap on upload to prevent memory exhaustion
+	reader, err := r.MultipartReader()
+	if err != nil {
 		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't parse multipart form", rest.ErrDecode)
 		return
 	}
 
-	file, _, err := r.FormFile("file")
-	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't get import file from the request", rest.ErrInternal)
-		return
-	}
-	defer func() { _ = file.Close() }()
+	tmpfile := ""
+	for {
+		part, err := reader.NextPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't parse multipart form", rest.ErrDecode)
+			return
+		}
+		if part.FormName() != "file" {
+			_ = part.Close()
+			continue
+		}
 
-	tmpfile, err := m.saveTemp(file)
-	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't save request to temp file", rest.ErrInternal)
+		tmpfile, err = m.saveTemp(part)
+		if closeErr := part.Close(); err == nil && closeErr != nil {
+			err = closeErr
+		}
+		if err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't save request to temp file", rest.ErrInternal)
+			return
+		}
+		break
+	}
+	if tmpfile == "" {
+		rest.SendErrorJSON(w, r, http.StatusInternalServerError, fmt.Errorf("file field missing"),
+			"can't get import file from the request", rest.ErrInternal)
 		return
 	}
 
 	go m.runImport(siteID, r.URL.Query().Get("provider"), tmpfile) // import runs in background and sets busy flag for site
 
-	render.Status(r, http.StatusAccepted)
-	render.JSON(w, r, R.JSON{"status": "import request accepted"})
+	_ = R.EncodeJSON(w, http.StatusAccepted, R.JSON{"status": "import request accepted"})
 }
 
 // GET /wait?site=site-id
@@ -110,20 +129,16 @@ func (m *Migrator) waitCtrl(w http.ResponseWriter, r *http.Request) {
 
 	ctx, cancel := context.WithTimeout(context.Background(), timeOut)
 	defer cancel()
-	for {
-		if !m.isBusy(siteID) {
-			break
-		}
+	for m.isBusy(siteID) {
+
 		select {
 		case <-ctx.Done():
-			render.Status(r, http.StatusGatewayTimeout)
-			render.JSON(w, r, R.JSON{"status": "timeout expired", "site_id": siteID})
+			_ = R.EncodeJSON(w, http.StatusGatewayTimeout, R.JSON{"status": "timeout expired", "site_id": siteID})
 			return
 		case <-time.After(100 * time.Millisecond):
 		}
 	}
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, R.JSON{"status": "completed", "site_id": siteID})
+	R.RenderJSON(w, R.JSON{"status": "completed", "site_id": siteID})
 }
 
 // GET /export?site=site-id&secret=12345&?mode=file|stream
@@ -131,23 +146,32 @@ func (m *Migrator) waitCtrl(w http.ResponseWriter, r *http.Request) {
 func (m *Migrator) exportCtrl(w http.ResponseWriter, r *http.Request) {
 	siteID := r.URL.Query().Get("site")
 
-	var writer io.Writer = w
 	if r.URL.Query().Get("mode") == "file" {
+		// buffer to memory to handle errors before committing to response
+		var buf bytes.Buffer
+		gzWriter := gzip.NewWriter(&buf)
+		if _, err := m.NativeExporter.Export(gzWriter, siteID); err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "export failed", rest.ErrInternal)
+			return
+		}
+		if err := gzWriter.Close(); err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "export failed", rest.ErrInternal)
+			return
+		}
+
 		exportFile := fmt.Sprintf("%s-%s.json.gz", siteID, time.Now().Format("20060102"))
 		w.Header().Set("Content-Type", "application/gzip")
 		w.Header().Set("Content-Disposition", "attachment;filename="+exportFile)
-		gzWriter := gzip.NewWriter(w)
-		defer func() {
-			if e := gzWriter.Close(); e != nil {
-				log.Printf("[WARN] can't close gzip writer, %s", e)
-			}
-		}()
-		writer = gzWriter
+		w.Header().Set("Content-Length", strconv.Itoa(buf.Len()))
+		if _, err := io.Copy(w, &buf); err != nil {
+			log.Printf("[WARN] failed to write export response: %v", err)
+		}
+		return
 	}
 
-	if _, err := m.NativeExporter.Export(writer, siteID); err != nil {
+	// stream mode - write directly to response
+	if _, err := m.NativeExporter.Export(w, siteID); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "export failed", rest.ErrInternal)
-		return
 	}
 }
 
@@ -176,7 +200,7 @@ func (m *Migrator) remapCtrl(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		defer func() {
-			if e = os.Remove(fh.Name()); e != nil {
+			if e = os.Remove(fh.Name()); e != nil { //nolint:gosec // fh.Name() is from os.CreateTemp, server-controlled
 				log.Printf("[WARN] failed to remove temp file %+v", e)
 			}
 		}()
@@ -203,8 +227,7 @@ func (m *Migrator) remapCtrl(w http.ResponseWriter, r *http.Request) {
 		log.Printf("[DEBUG] convert request completed. site=%s, comments=%d", siteID, size)
 	}()
 
-	render.Status(r, http.StatusAccepted)
-	render.JSON(w, r, R.JSON{"status": "convert request accepted"})
+	_ = R.EncodeJSON(w, http.StatusAccepted, R.JSON{"status": "convert request accepted"})
 }
 
 // runImport reads from tmpfile and import for given siteID and provider

backend/app/rest/api/migrator_test.go

@@ -123,7 +123,7 @@ func TestMigrator_ImportFromWP(t *testing.T) {
 	ts, _, teardown := startupT(t)
 	defer teardown()
 
-	r := strings.NewReader(strings.Replace(xmlTestWP, "'", "`", -1))
+	r := strings.NewReader(strings.ReplaceAll(xmlTestWP, "'", "`"))
 
 	client := &http.Client{Timeout: 1 * time.Second}
 	defer client.CloseIdleConnections()
@@ -276,8 +276,8 @@ func TestMigrator_ImportDouble(t *testing.T) {
 "picture":"/api/v1/avatar/remark.image","profile":"https://remark42.com","admin":true,
 "ip":"ae12fe3b5f129b5cc4cdd2b136b7b7947c4d2741"},"locator":{"site":"remark42","url":"https://radio-t.com/blah1"},"score":0,
 "votes":{},"time":"2018-04-30T01:37:00.849053725-05:00"}`
-	recs := []string{}
-	for i := 0; i < 50; i++ {
+	recs := make([]string, 0, 50)
+	for i := range 50 {
 		recs = append(recs, fmt.Sprintf(tmpl, i))
 	}
 	r := strings.NewReader(`{"version":1}` + strings.Join(recs, "\n")) // reader with 10k records
@@ -329,7 +329,7 @@ func TestMigrator_ImportWaitExpired(t *testing.T) {
 "votes":{},"time":"2018-04-30T01:37:00.849053725-05:00"}`
 	nRecs := 50
 	recs := make([]string, 0, nRecs)
-	for i := 0; i < nRecs; i++ {
+	for i := range nRecs {
 		recs = append(recs, fmt.Sprintf(tmpl, i))
 	}
 	r := strings.NewReader(`{"version":1}` + strings.Join(recs, "\n")) // reader with `nRecs` records

backend/app/rest/api/rest.go

@@ -7,25 +7,19 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/fs"
+	"net"
 	"net/http"
-	"net/mail"
 	"os"
-	"regexp"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/didip/tollbooth/v7"
-	"github.com/didip/tollbooth_chi"
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/go-chi/cors"
-	"github.com/go-chi/render"
-	"github.com/go-pkgz/auth"
+	"github.com/go-pkgz/auth/v2"
 	"github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
 	"github.com/go-pkgz/rest/logger"
+	"github.com/go-pkgz/routegroup"
 
 	"github.com/umputun/remark42/backend/app/notify"
 	"github.com/umputun/remark42/backend/app/rest"
@@ -55,6 +49,7 @@ type Rest struct {
 	RemarkURL       string
 	ReadOnlyAge     int
 	SharedSecret    string
+	TrustedProxies  []*net.IPNet // reverse-proxy networks whose forwarding headers (X-Real-IP, X-Forwarded-For, ...) are trusted
 	ScoreThresholds struct {
 		Low      int
 		Critical int
@@ -70,11 +65,13 @@ type Rest struct {
 	SubscribersOnly            bool
 	DisableSignature           bool // prevent signature from being added to headers
 	DisableFancyTextFormatting bool // disables SmartyPants in the comment text rendering of the posted comments
+	ExternalImageProxy         bool
 
-	SSLConfig   SSLConfig
-	httpsServer *http.Server
-	httpServer  *http.Server
-	lock        sync.Mutex
+	SSLConfig         SSLConfig
+	httpsServer       *http.Server
+	httpServer        *http.Server
+	shutdownRequested bool
+	lock              sync.Mutex
 
 	pubRest          public
 	privRest         private
@@ -96,12 +93,12 @@ const lastCommentsScope = "last"
 
 type commentsWithInfo struct {
 	Comments []store.Comment `json:"comments"`
-	Info     store.PostInfo  `json:"info,omitempty"`
+	Info     store.PostInfo  `json:"info"`
 }
 
 type treeWithInfo struct {
 	*service.Tree
-	Info store.PostInfo `json:"info,omitempty"`
+	Info store.PostInfo `json:"info"`
 }
 
 // Run the lister and request's router, activate rest server
@@ -117,6 +114,11 @@ func (s *Rest) Run(address string, port int) {
 		s.lock.Lock()
 		s.httpServer = s.makeHTTPServer(address, port, s.routes())
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}
 		s.lock.Unlock()
 
 		err := s.httpServer.ListenAndServe()
@@ -130,6 +132,11 @@ func (s *Rest) Run(address string, port int) {
 
 		s.httpServer = s.makeHTTPServer(address, port, s.httpToHTTPSRouter())
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}
 		s.lock.Unlock()
 
 		go func() {
@@ -150,6 +157,11 @@ func (s *Rest) Run(address string, port int) {
 
 		s.httpServer = s.makeHTTPServer(address, port, s.httpChallengeRouter(m))
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}
 
 		s.lock.Unlock()
 
@@ -171,6 +183,7 @@ func (s *Rest) Shutdown() {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 	s.lock.Lock()
+	s.shutdownRequested = true
 	if s.httpServer != nil {
 		if err := s.httpServer.Shutdown(ctx); err != nil {
 			log.Printf("[DEBUG] http shutdown error, %s", err)
@@ -198,13 +211,14 @@ func (s *Rest) makeHTTPServer(address string, port int, router http.Handler) *ht
 	}
 }
 
-func (s *Rest) routes() chi.Router {
+func (s *Rest) routes() http.Handler {
 	if s.openRouteLimiter == 0 {
 		// set the default open route limiter. Just a safety measure as it should be set by Run method anyway
 		s.openRouteLimiter = openRouteLimiter
 	}
-	router := chi.NewRouter()
-	router.Use(middleware.Throttle(1000), middleware.RealIP, R.Recoverer(log.Default()))
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Throttle(1000), realIPMiddleware(s.TrustedProxies), R.Recoverer(log.Default()))
+	router.Use(securityHeadersMiddleware(s.ExternalImageProxy, s.AllowedAncestors))
 	if !s.DisableSignature {
 		router.Use(R.AppInfo("remark42", "umputun", s.Version))
 	}
@@ -215,20 +229,7 @@ func (s *Rest) routes() chi.Router {
 	if s.ProxyCORS {
 		log.Printf("[WARN] internal CORS disabled")
 	} else {
-		corsMiddleware := cors.New(cors.Options{
-			AllowedOrigins:   []string{"*"},
-			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-XSRF-Token", "X-JWT"},
-			ExposedHeaders:   []string{"Authorization"},
-			AllowCredentials: true,
-			MaxAge:           300,
-		})
-		router.Use(corsMiddleware.Handler)
-	}
-
-	if len(s.AllowedAncestors) > 0 {
-		log.Printf("[INFO] allowed from %+v only", s.AllowedAncestors)
-		router.Use(frameAncestors(s.AllowedAncestors))
+		router.Use(corsMiddleware())
 	}
 
 	ipFn := func(ip string) string { return store.HashValue(ip, s.SharedSecret)[:12] } // logger uses it for anonymization
@@ -236,133 +237,152 @@ func (s *Rest) routes() chi.Router {
 
 	authHandler, avatarHandler := s.Authenticator.Handlers()
 
-	router.Group(func(r chi.Router) {
-		r.Use(middleware.Timeout(5 * time.Second))
-		r.Use(logInfoWithBody, tollbooth_chi.LimitHandler(tollbooth.NewLimiter(2, nil)), middleware.NoCache)
+	router.Route(func(r *routegroup.Bundle) {
+		r.Use(R.Timeout(5 * time.Second))
+		r.Use(logInfoWithBody, rateLimiter(2), R.NoCache)
 		r.Use(validEmailAuth()) // reject suspicious email logins
-		r.Mount("/auth", authHandler)
+		r.Handle("/auth/", authHandler)
 	})
 
-	router.Group(func(r chi.Router) {
-		r.Use(middleware.Timeout(5 * time.Second))
-		r.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)))
-		r.Mount("/avatar", avatarHandler)
+	router.Route(func(r *routegroup.Bundle) {
+		r.Use(R.Timeout(5 * time.Second))
+		r.Use(rateLimiter(100))
+		r.Handle("/avatar/", avatarHandler)
 	})
 
 	authMiddleware := s.Authenticator.Middleware()
 
 	// api routes
-	router.Route("/api/v1", func(rapi chi.Router) {
-		rapi.Group(func(rava chi.Router) {
-			rava.Use(middleware.Timeout(5 * time.Second))
-			rava.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(100, nil)))
-			rava.Mount("/avatar", avatarHandler)
-		})
+	rapi := router.Mount("/api/v1")
+	rapi.Use(apiCSPMiddleware)
 
-		// open routes
-		rapi.Group(func(ropen chi.Router) {
-			ropen.Use(middleware.Timeout(30 * time.Second))
-			ropen.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.openRouteLimiter, nil)))
-			ropen.Use(authMiddleware.Trace, middleware.NoCache, logInfoWithBody)
-			ropen.Get("/config", s.configCtrl)
-			ropen.Get("/find", s.pubRest.findCommentsCtrl)
-			ropen.Get("/id/{id}", s.pubRest.commentByIDCtrl)
-			ropen.Get("/comments", s.pubRest.findUserCommentsCtrl)
-			ropen.Get("/last/{limit}", s.pubRest.lastCommentsCtrl)
-			ropen.Get("/count", s.pubRest.countCtrl)
-			ropen.Post("/counts", s.pubRest.countMultiCtrl)
-			ropen.Get("/list", s.pubRest.listCtrl)
-			ropen.Get("/info", s.pubRest.infoCtrl)
-			ropen.Get("/img", s.ImageProxy.Handler)
+	rapi.Group().Route(func(rava *routegroup.Bundle) {
+		rava.Use(R.Timeout(5 * time.Second))
+		rava.Use(rateLimiter(100))
+		rava.Handle("/avatar/", avatarHandler)
+	})
 
-			ropen.Route("/rss", func(rrss chi.Router) {
-				rrss.Get("/post", s.rssRest.postCommentsCtrl)
-				rrss.Get("/site", s.rssRest.siteCommentsCtrl)
-				rrss.Get("/reply", s.rssRest.repliesCtrl)
-			})
-		})
+	// open routes
+	rapi.Group().Route(func(ropen *routegroup.Bundle) {
+		ropen.Use(R.Timeout(30 * time.Second))
+		ropen.Use(rateLimiter(s.openRouteLimiter))
+		ropen.Use(authMiddleware.Trace, R.NoCache, logInfoWithBody)
+		ropen.HandleFunc("GET /config", s.configCtrl)
+		ropen.HandleFunc("GET /find", s.pubRest.findCommentsCtrl)
+		ropen.HandleFunc("GET /id/{id}", s.pubRest.commentByIDCtrl)
+		ropen.HandleFunc("GET /comments", s.pubRest.findUserCommentsCtrl)
+		ropen.HandleFunc("GET /last/{limit}", s.pubRest.lastCommentsCtrl)
+		ropen.HandleFunc("GET /count", s.pubRest.countCtrl)
+		ropen.HandleFunc("POST /counts", s.pubRest.countMultiCtrl)
+		ropen.HandleFunc("GET /list", s.pubRest.listCtrl)
+		ropen.HandleFunc("GET /info", s.pubRest.infoCtrl)
 
-		// open routes, cached
-		rapi.Group(func(ropen chi.Router) {
-			ropen.Use(middleware.Timeout(30 * time.Second))
-			ropen.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
-			ropen.Use(authMiddleware.Trace, logInfoWithBody)
-			ropen.Get("/picture/{user}/{id}", s.pubRest.loadPictureCtrl)
-			ropen.Get("/qr/telegram", s.pubRest.telegramQrCtrl)
-		})
-
-		// protected routes, require auth
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(30 * time.Second))
-			rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
-			rauth.Use(authMiddleware.Auth, matchSiteID, middleware.NoCache, logInfoWithBody)
-			rauth.Get("/user", s.privRest.userInfoCtrl)
-			rauth.Get("/userdata", s.privRest.userAllDataCtrl)
-		})
-
-		// admin routes, require auth and admin users only
-		rapi.Route("/admin", func(radmin chi.Router) {
-			radmin.Use(middleware.Timeout(30 * time.Second))
-			radmin.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(10, nil)))
-			radmin.Use(authMiddleware.Auth, authMiddleware.AdminOnly, matchSiteID)
-			radmin.Use(middleware.NoCache, logInfoWithBody)
-
-			radmin.Delete("/comment/{id}", s.adminRest.deleteCommentCtrl)
-			radmin.Put("/user/{userid}", s.adminRest.setBlockCtrl)
-			radmin.Delete("/user/{userid}", s.adminRest.deleteUserCtrl)
-			radmin.Get("/user/{userid}", s.adminRest.getUserInfoCtrl)
-			radmin.Get("/deleteme", s.adminRest.deleteMeRequestCtrl)
-			radmin.Put("/verify/{userid}", s.adminRest.setVerifyCtrl)
-			radmin.Put("/pin/{id}", s.adminRest.setPinCtrl)
-			radmin.Get("/blocked", s.adminRest.blockedUsersCtrl)
-			radmin.Put("/readonly", s.adminRest.setReadOnlyCtrl)
-			radmin.Put("/title/{id}", s.adminRest.setTitleCtrl)
-
-			// migrator
-			radmin.Get("/export", s.adminRest.migrator.exportCtrl)
-			radmin.Post("/import", s.adminRest.migrator.importCtrl)
-			radmin.Post("/import/form", s.adminRest.migrator.importFormCtrl)
-			radmin.Post("/remap", s.adminRest.migrator.remapCtrl)
-			radmin.Get("/wait", s.adminRest.migrator.waitCtrl)
-		})
-
-		// protected routes, throttled to 10/s by default, controlled by external UpdateLimiter param
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(10 * time.Second))
-			rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.updateLimiter(), nil)))
-			rauth.Use(authMiddleware.Auth, matchSiteID, subscribersOnly(s.SubscribersOnly))
-			rauth.Use(middleware.NoCache, logInfoWithBody)
-
-			rauth.Put("/comment/{id}", s.privRest.updateCommentCtrl)
-			rauth.Post("/preview", s.privRest.previewCommentCtrl)
-			rauth.Post("/comment", s.privRest.createCommentCtrl)
-			rauth.Put("/vote/{id}", s.privRest.voteCtrl)
-			rauth.With(rejectAnonUser).Post("/deleteme", s.privRest.deleteMeCtrl)
-			rauth.With(rejectAnonUser).Get("/email", s.privRest.getEmailCtrl)
-			rauth.With(rejectAnonUser).Post("/email/subscribe", s.privRest.sendEmailConfirmationCtrl)
-			rauth.With(rejectAnonUser).Post("/email/confirm", s.privRest.setConfirmedEmailCtrl)
-			rauth.With(rejectAnonUser).Delete("/email", s.privRest.deleteEmailCtrl)
-			rauth.With(rejectAnonUser).Get("/telegram/subscribe", s.privRest.telegramSubscribeCtrl)
-			rauth.With(rejectAnonUser).Delete("/telegram", s.privRest.deleteTelegramCtrl)
-		})
-
-		// protected routes, anonymous rejected
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(10 * time.Second))
-			rauth.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(s.updateLimiter(), nil)))
-			rauth.Use(authMiddleware.Auth, rejectAnonUser, matchSiteID)
-			rauth.Use(logger.New(logger.Log(log.Default()), logger.Prefix("[DEBUG]"), logger.IPfn(ipFn)).Handler)
-			rauth.Post("/picture", s.privRest.savePictureCtrl)
+		ropen.Mount("/rss").Route(func(rrss *routegroup.Bundle) {
+			rrss.HandleFunc("GET /post", s.rssRest.postCommentsCtrl)
+			rrss.HandleFunc("GET /site", s.rssRest.siteCommentsCtrl)
+			rrss.HandleFunc("GET /reply", s.rssRest.repliesCtrl)
 		})
 	})
 
+	// open routes, cached. /img lives here (not in the NoCache group above) because
+	// R.NoCache strips If-None-Match from incoming requests, which would
+	// defeat the proxy handler's 304 short-circuit. The handler sets a 30-day
+	// max-age on validated success responses (with a versioned etag for cache
+	// invalidation on revalidation); error responses get Cache-Control: no-store
+	// so transient failures aren't pinned in the cache.
+	rapi.Group().Route(func(ropen *routegroup.Bundle) {
+		ropen.Use(R.Timeout(30 * time.Second))
+		ropen.Use(rateLimiter(10))
+		ropen.Use(authMiddleware.Trace, logInfoWithBody)
+		ropen.HandleFunc("GET /img", s.ImageProxy.Handler)
+		ropen.HandleFunc("GET /picture/{user}/{id}", s.pubRest.loadPictureCtrl)
+		ropen.HandleFunc("GET /qr/telegram", s.pubRest.telegramQrCtrl)
+	})
+
+	// protected routes, require auth
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(rateLimiter(10))
+		rauth.Use(authMiddleware.Auth, matchSiteID, R.NoCache, logInfoWithBody)
+
+		// GET /userdata streams a gzipped export of the user's data straight to the client, so it
+		// deliberately runs without R.Timeout: that middleware buffers the whole response in memory
+		// before sending and aborts at the deadline, which would hold a full export in RAM and truncate it.
+		rauth.HandleFunc("GET /userdata", s.privRest.userAllDataCtrl)
+
+		rauth.Group().Route(func(r *routegroup.Bundle) {
+			r.Use(R.Timeout(30 * time.Second))
+			r.HandleFunc("GET /user", s.privRest.userInfoCtrl)
+		})
+	})
+
+	// admin routes, require auth and admin users only
+	rapi.Mount("/admin").Route(func(radmin *routegroup.Bundle) {
+		radmin.Use(rateLimiter(10))
+		radmin.Use(authMiddleware.Auth, authMiddleware.AdminOnly, matchSiteID)
+		radmin.Use(R.NoCache, logInfoWithBody)
+
+		// bounded admin operations return small responses and get the enforcing request timeout
+		radmin.Group().Route(func(r *routegroup.Bundle) {
+			r.Use(R.Timeout(30 * time.Second))
+			r.HandleFunc("DELETE /comment/{id}", s.adminRest.deleteCommentCtrl)
+			r.HandleFunc("PUT /user/{userid}", s.adminRest.setBlockCtrl)
+			r.HandleFunc("DELETE /user/{userid}", s.adminRest.deleteUserCtrl)
+			r.HandleFunc("GET /user/{userid}", s.adminRest.getUserInfoCtrl)
+			r.With(rejectHead("GET")).HandleFunc("GET /deleteme", s.adminRest.deleteMeRequestCtrl)
+			r.HandleFunc("PUT /verify/{userid}", s.adminRest.setVerifyCtrl)
+			r.HandleFunc("PUT /pin/{id}", s.adminRest.setPinCtrl)
+			r.HandleFunc("GET /blocked", s.adminRest.blockedUsersCtrl)
+			r.HandleFunc("PUT /readonly", s.adminRest.setReadOnlyCtrl)
+			r.HandleFunc("PUT /title/{id}", s.adminRest.setTitleCtrl)
+		})
+
+		// migrator routes deliberately run without R.Timeout: GET /export streams a full-site
+		// backup, GET /wait long-polls for up to 15m, and import/remap ingest large uploads. The
+		// enforcing timeout buffers the whole response and aborts at the deadline, which would
+		// truncate backups, break waiting, and reject large imports.
+		radmin.HandleFunc("GET /export", s.adminRest.migrator.exportCtrl)
+		radmin.HandleFunc("POST /import", s.adminRest.migrator.importCtrl)
+		radmin.HandleFunc("POST /import/form", s.adminRest.migrator.importFormCtrl)
+		radmin.HandleFunc("POST /remap", s.adminRest.migrator.remapCtrl)
+		radmin.HandleFunc("GET /wait", s.adminRest.migrator.waitCtrl)
+	})
+
+	// protected routes, throttled to 10/s by default, controlled by external UpdateLimiter param
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(R.Timeout(10 * time.Second))
+		rauth.Use(rateLimiter(s.updateLimiter()))
+		rauth.Use(authMiddleware.Auth, matchSiteID, subscribersOnly(s.SubscribersOnly))
+		rauth.Use(R.NoCache, logInfoWithBody)
+
+		rauth.HandleFunc("PUT /comment/{id}", s.privRest.updateCommentCtrl)
+		rauth.HandleFunc("POST /preview", s.privRest.previewCommentCtrl)
+		rauth.HandleFunc("POST /comment", s.privRest.createCommentCtrl)
+		rauth.HandleFunc("PUT /vote/{id}", s.privRest.voteCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /deleteme", s.privRest.deleteMeCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("GET /email", s.privRest.getEmailCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /email/subscribe", s.privRest.sendEmailConfirmationCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /email/confirm", s.privRest.setConfirmedEmailCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("DELETE /email", s.privRest.deleteEmailCtrl)
+		rauth.With(rejectAnonUser, rejectHead("GET")).HandleFunc("GET /telegram/subscribe", s.privRest.telegramSubscribeCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("DELETE /telegram", s.privRest.deleteTelegramCtrl)
+	})
+
+	// protected routes, anonymous rejected
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(R.Timeout(10 * time.Second))
+		rauth.Use(rateLimiter(s.updateLimiter()))
+		rauth.Use(authMiddleware.Auth, rejectAnonUser, matchSiteID)
+		rauth.Use(logger.New(logger.Log(log.Default()), logger.Prefix("[DEBUG]"), logger.IPfn(ipFn)).Handler)
+		rauth.HandleFunc("POST /picture", s.privRest.savePictureCtrl)
+	})
+
 	// open routes on root level
-	router.Group(func(rroot chi.Router) {
-		rroot.Use(middleware.Timeout(10 * time.Second))
-		rroot.Use(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(50, nil)))
-		rroot.Get("/robots.txt", s.pubRest.robotsCtrl)
-		rroot.Get("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
-		rroot.Post("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
+	router.Route(func(rroot *routegroup.Bundle) {
+		rroot.Use(R.Timeout(10 * time.Second))
+		rroot.Use(rateLimiter(50))
+		rroot.HandleFunc("GET /robots.txt", s.pubRest.robotsCtrl)
+		rroot.With(rejectHead("GET, POST")).HandleFunc("GET /email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
+		rroot.HandleFunc("POST /email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
 	})
 
 	// file server for static content from s.WebRoot on path /web
@@ -476,12 +496,11 @@ func (s *Rest) configCtrl(w http.ResponseWriter, r *http.Request) {
 	if cnf.Admins == nil { // prevent json serialization to nil
 		cnf.Admins = []string{}
 	}
-	render.Status(r, http.StatusOK)
-	render.JSON(w, r, cnf)
+	R.RenderJSON(w, cnf)
 }
 
 // serves static files from the webRoot directory or files embedded into the compiled binary if that directory is absent
-func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
+func addFileServer(r *routegroup.Bundle, embedFS embed.FS, webRoot, version string) {
 	var webFS http.Handler
 
 	if _, err := os.Stat(webRoot); err == nil {
@@ -494,12 +513,12 @@ func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
 	}
 
 	webFS = http.StripPrefix("/web", webFS)
-	r.Get("/web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)
+	r.HandleFunc("GET /web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)
 
-	r.With(tollbooth_chi.LimitHandler(tollbooth.NewLimiter(20, nil)),
-		middleware.Timeout(10*time.Second),
+	r.With(rateLimiter(20),
+		R.Timeout(10*time.Second),
 		cacheControl(time.Hour, version),
-	).Get("/web/*", func(w http.ResponseWriter, r *http.Request) {
+	).HandleFunc("GET /web/", func(w http.ResponseWriter, r *http.Request) {
 		// don't show dirs, just serve files
 		if strings.HasSuffix(r.URL.Path, "/") && len(r.URL.Path) > 1 && r.URL.Path != ("/web/") {
 			http.NotFound(w, r)
@@ -509,7 +528,7 @@ func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
 	})
 }
 
-func encodeJSONWithHTML(v interface{}) ([]byte, error) {
+func encodeJSONWithHTML(v any) ([]byte, error) {
 	buf := &bytes.Buffer{}
 	enc := json.NewEncoder(buf)
 	enc.SetEscapeHTML(false)
@@ -555,157 +574,6 @@ func URLKeyWithUser(r *http.Request) string {
 	return key
 }
 
-// rejectAnonUser is a middleware rejecting anonymous users
-func rejectAnonUser(next http.Handler) http.Handler {
-	fn := func(w http.ResponseWriter, r *http.Request) {
-		user, err := rest.GetUserInfo(r)
-		if err != nil {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-
-		if strings.HasPrefix(user.ID, "anonymous_") {
-			http.Error(w, "Access denied", http.StatusForbidden)
-			return
-		}
-		next.ServeHTTP(w, r)
-	}
-	return http.HandlerFunc(fn)
-}
-
-// matchSiteID is a middleware rejecting users with mismatch between site param and and User.SiteID
-func matchSiteID(next http.Handler) http.Handler {
-	fn := func(w http.ResponseWriter, r *http.Request) {
-		user, err := rest.GetUserInfo(r)
-		if err != nil {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-
-		// skip for basic auth user
-		if user.Name == "admin" && user.ID == "admin" {
-			next.ServeHTTP(w, r)
-			return
-		}
-
-		siteID := r.URL.Query().Get("site")
-		if siteID != "" && user.SiteID != siteID {
-			http.Error(w, "Access denied", http.StatusForbidden)
-			return
-		}
-		next.ServeHTTP(w, r)
-	}
-	return http.HandlerFunc(fn)
-}
-
-// cacheControl is a middleware setting cache expiration. Using url+version as etag
-func cacheControl(expiration time.Duration, version string) func(http.Handler) http.Handler {
-	etag := func(r *http.Request, version string) string {
-		s := version + ":" + r.URL.String()
-		return store.EncodeID(s)
-	}
-
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			e := `"` + etag(r, version) + `"`
-			w.Header().Set("Etag", e)
-			w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, no-cache", int(expiration.Seconds())))
-
-			if match := r.Header.Get("If-None-Match"); match != "" {
-				if strings.Contains(match, e) {
-					w.WriteHeader(http.StatusNotModified)
-					return
-				}
-			}
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
-// frameAncestors is a middleware setting Content-Security-Policy "frame-ancestors host1 host2 ..."
-// prevents loading of comments widgets from any other origins. In case if the list of allowed empty, ignored.
-func frameAncestors(hosts []string) func(http.Handler) http.Handler {
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			if len(hosts) == 0 {
-				h.ServeHTTP(w, r)
-				return
-			}
-			w.Header().Set("Content-Security-Policy", "frame-ancestors "+strings.Join(hosts, " ")+";")
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
-// subscribersOnly is a middleware rejecting non-paid_sub users
-func subscribersOnly(enable bool) func(http.Handler) http.Handler {
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			if enable {
-				user, err := rest.GetUserInfo(r)
-				if err != nil {
-					http.Error(w, "Unauthorized", http.StatusUnauthorized)
-					return
-				}
-				if !user.PaidSub {
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
-// validEmailAuth is a middleware for auth endpoints for email method.
-// it rejects login request if user, site or email are suspicious
-func validEmailAuth() func(http.Handler) http.Handler {
-
-	reUser := regexp.MustCompile(`^[\p{L}\d\s_]{4,64}$`) // matches ui side validation, adding min/max limitation
-	reSite := regexp.MustCompile(`^[a-zA-Z\d\s_.-]{1,64}$`)
-
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-
-			if r.URL.Path != "/auth/email/login" {
-				// not email login, skip the check
-				h.ServeHTTP(w, r)
-				return
-			}
-
-			if u := r.URL.Query().Get("user"); u != "" {
-				if !reUser.MatchString(u) {
-					log.Printf("[WARN] suspicious user rejected: %s", u)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			if a := r.URL.Query().Get("address"); a != "" {
-				if _, err := mail.ParseAddress(a); err != nil {
-					log.Printf("[WARN] suspicious address rejected: %s", a)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			if s := r.URL.Query().Get("site"); s != "" {
-				if !reSite.MatchString(s) {
-					log.Printf("[WARN] suspicious site rejected: %s", s)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
 func parseError(err error, defaultCode int) (code int) {
 	code = defaultCode
 

backend/app/rest/api/rest_private.go

@@ -10,18 +10,17 @@ import (
 	"fmt"
 	"html/template"
 	"io"
+	"net"
 	"net/http"
 	"strings"
 	"time"
 
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/render"
-	"github.com/go-pkgz/auth"
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2"
+	"github.com/go-pkgz/auth/v2/token"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/hashicorp/go-multierror"
 
 	"github.com/umputun/remark42/backend/app/notify"
@@ -77,7 +76,7 @@ func (s *private) previewCommentCtrl(w http.ResponseWriter, r *http.Request) {
 	user := rest.MustGetUserInfo(r)
 
 	comment := store.Comment{}
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, hardBodyLimit), &comment); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, hardBodyLimit)).Decode(&comment); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't bind comment", rest.ErrDecode)
 		return
 	}
@@ -100,14 +99,13 @@ func (s *private) previewCommentCtrl(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-
-	render.HTML(w, r, comment.Text)
+	rest.HTMLResponse(w, http.StatusOK, comment.Text)
 }
 
 // POST /comment - adds comment, resets all immutable fields
 func (s *private) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 	comment := store.Comment{}
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, hardBodyLimit), &comment); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, hardBodyLimit)).Decode(&comment); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't bind comment", rest.ErrDecode)
 		return
 	}
@@ -122,7 +120,7 @@ func (s *private) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 
 	comment.PrepareUntrusted() // clean all fields user not supposed to set
 	comment.User = user
-	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
+	comment.User.IP = extractIP(r.RemoteAddr)
 
 	comment.Orig = comment.Text // original comment text, prior to md render
 	if err := s.dataService.ValidateComment(&comment); err != nil {
@@ -176,8 +174,7 @@ func (s *private) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 
 	log.Printf("[DEBUG] created comment %+v", finalComment)
 
-	render.Status(r, http.StatusCreated)
-	render.JSON(w, r, &finalComment)
+	_ = R.EncodeJSON(w, http.StatusCreated, &finalComment)
 }
 
 // PUT /comment/{id}?site=siteID&url=post-url - update comment
@@ -188,14 +185,14 @@ func (s *private) updateCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		Delete  bool
 	}{}
 
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, hardBodyLimit), &edit); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, hardBodyLimit)).Decode(&edit); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't read comment details from body", rest.ErrDecode)
 		return
 	}
 
 	user := rest.MustGetUserInfo(r)
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 
 	log.Printf("[DEBUG] update comment %s", id)
 
@@ -233,7 +230,7 @@ func (s *private) updateCommentCtrl(w http.ResponseWriter, r *http.Request) {
 	}
 
 	s.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.SiteID, locator.URL, lastCommentsScope, user.ID))
-	render.JSON(w, r, res)
+	R.RenderJSON(w, res)
 }
 
 // GET /user?site=siteID - returns user info
@@ -251,7 +248,7 @@ func (s *private) userInfoCtrl(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	render.JSON(w, r, user)
+	R.RenderJSON(w, user)
 }
 
 // PUT /vote/{id}?site=siteID&url=post-url&vote=1 - vote for/against comment
@@ -262,7 +259,7 @@ func (s *private) voteCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	log.Printf("[DEBUG] vote for comment %s", id)
 
 	vote := r.URL.Query().Get("vote") == "1"
@@ -282,7 +279,7 @@ func (s *private) voteCtrl(w http.ResponseWriter, r *http.Request) {
 		Locator:   locator,
 		CommentID: id,
 		UserID:    user.ID,
-		UserIP:    strings.Split(r.RemoteAddr, ":")[0],
+		UserIP:    extractIP(r.RemoteAddr),
 		Val:       vote,
 	}
 	comment, err := s.dataService.Vote(req)
@@ -292,7 +289,7 @@ func (s *private) voteCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.cache.Flush(cache.Flusher(locator.SiteID).Scopes(locator.URL, comment.User.ID))
-	render.JSON(w, r, R.JSON{"id": comment.ID, "score": comment.Score})
+	R.RenderJSON(w, R.JSON{"id": comment.ID, "score": comment.Score})
 }
 
 // getEmailCtrl gets email address for authenticated user.
@@ -305,7 +302,7 @@ func (s *private) getEmailCtrl(w http.ResponseWriter, r *http.Request) {
 		log.Printf("[WARN] can't read email for %s, %v", user.ID, err)
 	}
 
-	render.JSON(w, r, R.JSON{"user": user, "address": address})
+	R.RenderJSON(w, R.JSON{"user": user, "address": address})
 }
 
 // sendEmailConfirmationCtrl gets address and siteID from query, makes confirmation token and sends it to user.
@@ -322,7 +319,7 @@ func (s *private) sendEmailConfirmationCtrl(w http.ResponseWriter, r *http.Reque
 		Address     string
 		autoConfirm bool
 	}{autoConfirm: true}
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, hardBodyLimit), &subscribe); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, hardBodyLimit)).Decode(&subscribe); err != nil {
 		if err != io.EOF {
 			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't parse request body", rest.ErrDecode)
 			return
@@ -362,10 +359,10 @@ func (s *private) sendEmailConfirmationCtrl(w http.ResponseWriter, r *http.Reque
 
 	claims := token.Claims{
 		Handshake: &token.Handshake{ID: user.ID + "::" + subscribe.Address},
-		StandardClaims: jwt.StandardClaims{
-			Audience:  r.URL.Query().Get("site"),
-			ExpiresAt: time.Now().Add(30 * time.Minute).Unix(),
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{r.URL.Query().Get("site")},
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 			Issuer:    "remark42",
 		},
 	}
@@ -385,7 +382,7 @@ func (s *private) sendEmailConfirmationCtrl(w http.ResponseWriter, r *http.Reque
 		},
 	)
 
-	render.JSON(w, r, R.JSON{"user": user, "address": subscribe.Address, "updated": false})
+	R.RenderJSON(w, R.JSON{"user": user, "address": subscribe.Address, "updated": false})
 }
 
 // telegramSubscribeCtrl generates and verifies telegram notification request
@@ -413,7 +410,7 @@ func (s *private) telegramSubscribeCtrl(w http.ResponseWriter, r *http.Request)
 				fmt.Errorf("already subscribed"), "telegram subscription is already set for this user, delete if first to re-subscribe", rest.ErrActionRejected)
 			return
 		}
-		// Generate and send token
+		// generate and send token
 		tkn, err := randToken()
 		if err != nil {
 			rest.SendErrorJSON(w, r, http.StatusForbidden, err, "failed to generate verification token", rest.ErrInternal)
@@ -423,7 +420,7 @@ func (s *private) telegramSubscribeCtrl(w http.ResponseWriter, r *http.Request)
 
 		s.telegramService.AddToken(tkn, user.ID, siteID, expires)
 
-		render.JSON(w, r, R.JSON{"token": tkn, "bot": s.telegramService.GetBotUsername()})
+		R.RenderJSON(w, R.JSON{"token": tkn, "bot": s.telegramService.GetBotUsername()})
 
 		return
 	}
@@ -445,7 +442,7 @@ func (s *private) telegramSubscribeCtrl(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	render.JSON(w, r, R.JSON{"updated": true, "address": val})
+	R.RenderJSON(w, R.JSON{"updated": true, "address": val})
 }
 
 // setConfirmedEmailCtrl uses provided token parameter (generated by sendEmailConfirmationCtrl) to set email and add it to user token
@@ -457,7 +454,7 @@ func (s *private) setConfirmedEmailCtrl(w http.ResponseWriter, r *http.Request)
 		Site  string
 		Token string
 	}{}
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, hardBodyLimit), &confirm); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, hardBodyLimit)).Decode(&confirm); err != nil {
 		if err != io.EOF {
 			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't parse request body", rest.ErrDecode)
 			return
@@ -482,7 +479,7 @@ func (s *private) setConfirmedEmailCtrl(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	// Handshake.ID is user.ID + "::" + address
+	// handshake.ID is user.ID + "::" + address
 	elems := strings.Split(confClaims.Handshake.ID, "::")
 	if len(elems) != 2 || elems[0] != user.ID {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, fmt.Errorf("%s", confClaims.Handshake.ID), "invalid handshake token", rest.ErrInternal)
@@ -513,7 +510,7 @@ func (s *private) setEmail(w http.ResponseWriter, r *http.Request, userID, siteI
 		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "failed to set token", rest.ErrInternal)
 		return
 	}
-	render.JSON(w, r, R.JSON{"updated": true, "address": val})
+	R.RenderJSON(w, R.JSON{"updated": true, "address": val})
 }
 
 // POST/GET /email/unsubscribe.html?site=siteID&tkn=jwt - unsubscribe the user in token from email notifications
@@ -536,7 +533,7 @@ func (s *private) emailUnsubscribeCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Handshake.ID is user.ID + "::" + address
+	// handshake.ID is user.ID + "::" + address
 	elems := strings.Split(confClaims.Handshake.ID, "::")
 	if len(elems) != 2 {
 		rest.SendErrorHTML(w, r, http.StatusBadRequest, fmt.Errorf("%s", confClaims.Handshake.ID), "invalid handshake token", rest.ErrInternal)
@@ -581,7 +578,7 @@ func (s *private) emailUnsubscribeCtrl(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// MustExecute behaves like template.Execute, but panics if an error occurs.
-	MustExecute := func(tmpl *template.Template, wr io.Writer, data interface{}) {
+	MustExecute := func(tmpl *template.Template, wr io.Writer, data any) {
 		if err := tmpl.Execute(wr, data); err != nil {
 			panic(err)
 		}
@@ -597,7 +594,7 @@ func (s *private) emailUnsubscribeCtrl(w http.ResponseWriter, r *http.Request) {
 	tmpl := template.Must(template.New("unsubscribe").Parse(tmplstr))
 	msg := bytes.Buffer{}
 	MustExecute(tmpl, &msg, nil)
-	render.HTML(w, r, msg.String())
+	rest.HTMLResponse(w, http.StatusOK, msg.String())
 }
 
 // DELETE /email?site=siteID - removes user's email
@@ -624,7 +621,7 @@ func (s *private) deleteEmailCtrl(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	render.JSON(w, r, R.JSON{"deleted": true})
+	R.RenderJSON(w, R.JSON{"deleted": true})
 }
 
 // DELETE /telegram?site=siteID - removes user's telegram
@@ -638,7 +635,7 @@ func (s *private) deleteTelegramCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't delete telegram for user", code)
 		return
 	}
-	render.JSON(w, r, R.JSON{"deleted": true})
+	R.RenderJSON(w, R.JSON{"deleted": true})
 }
 
 // GET /userdata?site=siteID - exports all data about the user as a json with user info and list of all comments
@@ -672,7 +669,7 @@ func (s *private) userAllDataCtrl(w http.ResponseWriter, r *http.Request) {
 	merr = multierror.Append(merr, write([]byte(`, "comments":`))) // send comments prefix
 
 	// get comments in 100 in each paginated request
-	for i := 0; i < 100; i++ {
+	for i := range 100 {
 		comments, errUser := s.dataService.User(siteID, user.ID, 100, i*100, rest.GetUserOrEmpty(r))
 		if errUser != nil {
 			rest.SendErrorJSON(w, r, http.StatusInternalServerError, errUser, "can't get user comments", rest.ErrInternal)
@@ -704,16 +701,17 @@ func (s *private) deleteMeCtrl(w http.ResponseWriter, r *http.Request) {
 	siteID := r.URL.Query().Get("site")
 
 	claims := token.Claims{
-		StandardClaims: jwt.StandardClaims{
-			Audience:  siteID,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{siteID},
 			Issuer:    "remark42",
-			ExpiresAt: time.Now().AddDate(0, 3, 0).Unix(),
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+			ExpiresAt: jwt.NewNumericDate(time.Now().AddDate(0, 3, 0)),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 		},
 		User: &token.User{
-			ID:   user.ID,
-			Name: user.Name,
-			Attributes: map[string]interface{}{
+			ID:      user.ID,
+			Name:    user.Name,
+			Picture: user.Picture, // carried so the avatar can be removed when the request is processed
+			Attributes: map[string]any{
 				"delete_me": true, // prevents this token from being used for login
 			},
 		},
@@ -726,14 +724,18 @@ func (s *private) deleteMeCtrl(w http.ResponseWriter, r *http.Request) {
 	}
 
 	link := fmt.Sprintf("%s/web/deleteme.html?token=%s", s.remarkURL, tokenStr)
-	render.JSON(w, r, R.JSON{"site": siteID, "user_id": user.ID, "token": tokenStr, "link": link})
+	R.RenderJSON(w, R.JSON{"site": siteID, "user_id": user.ID, "token": tokenStr, "link": link})
 }
 
 // POST /image - save image with form request
 func (s *private) savePictureCtrl(w http.ResponseWriter, r *http.Request) {
 	user := rest.MustGetUserInfo(r)
 
-	if err := r.ParseMultipartForm(5 * 1024 * 1024); err != nil { // 5M max memory, if bigger will make a file
+	r.Body = http.MaxBytesReader(w, r.Body, 32*1024*1024) // hard cap on upload to prevent memory exhaustion
+	// gosec G120: r.Body is already bounded by MaxBytesReader on the line above (32 MB),
+	// so ParseMultipartForm cannot read more than that regardless of the in-memory threshold.
+	// The 5 MB argument is the soft threshold above which the form is spilled to disk.
+	if err := r.ParseMultipartForm(5 * 1024 * 1024); err != nil { //nolint:gosec // bounded by MaxBytesReader above
 		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't parse multipart form", rest.ErrDecode)
 		return
 	}
@@ -751,7 +753,7 @@ func (s *private) savePictureCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	render.JSON(w, r, R.JSON{"id": id})
+	R.RenderJSON(w, R.JSON{"id": id})
 }
 
 func (s *private) isReadOnly(locator store.Locator) bool {
@@ -775,3 +777,13 @@ func randToken() (string, error) {
 	}
 	return fmt.Sprintf("%x", s.Sum(nil)), nil
 }
+
+// extractIP returns the IP portion of the remote address, handling both IPv4 and IPv6 formats.
+// supports "ip:port", "[ip]:port", and bare "ip" formats.
+func extractIP(remoteAddr string) string {
+	ip, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		return remoteAddr // already a bare IP (no port)
+	}
+	return ip
+}

backend/app/rest/api/rest_private_test.go

@@ -16,11 +16,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-chi/render"
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2/token"
 	"github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -39,7 +38,7 @@ func TestRest_Create(t *testing.T) {
 	ts, _, teardown := startupT(t)
 	defer teardown()
 
-	resp, err := post(t, ts.URL+"/api/v1/comment",
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 	assert.NoError(t, err)
 	b, err := io.ReadAll(resp.Body)
@@ -50,7 +49,7 @@ func TestRest_Create(t *testing.T) {
 	c := R.JSON{}
 	err = json.Unmarshal(b, &c)
 	assert.NoError(t, err)
-	loc := c["locator"].(map[string]interface{})
+	loc := c["locator"].(map[string]any)
 	assert.Equal(t, "remark42", loc["site"])
 	assert.Equal(t, "https://radio-t.com/blah1", loc["url"])
 	assert.True(t, len(c["id"].(string)) > 8)
@@ -61,7 +60,7 @@ func TestRest_CreateFilteredCode(t *testing.T) {
 	ts, _, teardown := startupT(t)
 	defer teardown()
 
-	resp, err := post(t, ts.URL+"/api/v1/comment",
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "`+"`foo<bar>`"+`", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 	assert.NoError(t, err)
 	b, err := io.ReadAll(resp.Body)
@@ -72,7 +71,7 @@ func TestRest_CreateFilteredCode(t *testing.T) {
 	c := R.JSON{}
 	err = json.Unmarshal(b, &c)
 	require.NoError(t, err, string(b))
-	loc := c["locator"].(map[string]interface{})
+	loc := c["locator"].(map[string]any)
 	assert.Equal(t, "remark42", loc["site"])
 	assert.Equal(t, "https://radio-t.com/blah1", loc["url"])
 	assert.Equal(t, "`foo<bar>`", c["orig"])
@@ -94,6 +93,7 @@ func TestRest_CreateAndPreviewWithImage(t *testing.T) {
 		RoutePath:     "/api/v1/img",
 		RemarkURL:     srv.RemarkURL,
 		ImageService:  srv.ImageService,
+		Transport:     http.DefaultTransport,
 	}
 	srv.CommentFormatter = store.NewCommentFormatter(srv.ImageProxy)
 	// need to recreate the server with new ImageProxy, otherwise old one will be used
@@ -110,7 +110,7 @@ func TestRest_CreateAndPreviewWithImage(t *testing.T) {
 	defer pngServer.Close()
 
 	t.Run("create", func(t *testing.T) {
-		resp, err := post(t, ts.URL+"/api/v1/comment",
+		resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 			`{"text": "![](`+pngServer.URL+`/gopher.png)", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 		assert.NoError(t, err)
 		b, err := io.ReadAll(resp.Body)
@@ -123,7 +123,7 @@ func TestRest_CreateAndPreviewWithImage(t *testing.T) {
 		require.NoError(t, err, string(b))
 		assert.NotContains(t, c["text"], pngServer.URL)
 		assert.Contains(t, c["text"], srv.RemarkURL)
-		loc := c["locator"].(map[string]interface{})
+		loc := c["locator"].(map[string]any)
 		assert.Equal(t, "remark42", loc["site"])
 		assert.Equal(t, "https://radio-t.com/blah1", loc["url"])
 		assert.True(t, len(c["id"].(string)) > 8)
@@ -176,7 +176,7 @@ func TestRest_CreateOldPost(t *testing.T) {
 	assert.Equal(t, 1, len(comments))
 
 	// try to add new comment to the same old post
-	resp, err := post(t, ts.URL+"/api/v1/comment",
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "test 123", "locator":{"site": "remark42","url": "https://radio-t.com/blah1"}}`)
 	assert.NoError(t, err)
 	assert.NoError(t, resp.Body.Close())
@@ -189,7 +189,7 @@ func TestRest_CreateOldPost(t *testing.T) {
 	_, err = srv.DataService.Create(old)
 	assert.NoError(t, err)
 
-	resp, err = post(t, ts.URL+"/api/v1/comment",
+	resp, err = post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "test 123", "locator":{"site": "remark42","url": "https://radio-t.com/blah1"}}`)
 	assert.NoError(t, err)
 	assert.NoError(t, resp.Body.Close())
@@ -202,7 +202,7 @@ func TestRest_CreateTooBig(t *testing.T) {
 
 	longComment := fmt.Sprintf(`{"text": "%4001s", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`, "Щ")
 
-	resp, err := post(t, ts.URL+"/api/v1/comment", longComment)
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", longComment)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
@@ -215,7 +215,7 @@ func TestRest_CreateTooBig(t *testing.T) {
 	assert.Equal(t, "invalid comment", c["details"])
 
 	veryLongComment := fmt.Sprintf(`{"text": "%70000s", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`, "Щ")
-	resp, err = post(t, ts.URL+"/api/v1/comment", veryLongComment)
+	resp, err = post(t, ts.URL+"/api/v1/comment?site=remark42", veryLongComment)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	b, err = io.ReadAll(resp.Body)
@@ -235,7 +235,7 @@ func TestRest_CreateWithRestrictedWord(t *testing.T) {
 	badComment := `{"text": "What the duck is that?", "locator":{"url": "https://radio-t.com/blah1",
 "site": "remark42"}}`
 
-	resp, err := post(t, ts.URL+"/api/v1/comment", badComment)
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", badComment)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
@@ -254,7 +254,7 @@ func TestRest_CreateRelativeURL(t *testing.T) {
 
 	// check that it's not possible to click insert URL button and not alter the URL in it (which is `url` by default)
 	relativeURLText := `{"text": "here is a link with relative URL: [google.com](url)", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`
-	resp, err := post(t, ts.URL+"/api/v1/comment", relativeURLText)
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", relativeURLText)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
@@ -273,7 +273,7 @@ func TestRest_CreateRejected(t *testing.T) {
 	body := `{"text": "test 123", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`
 
 	// try to create without auth
-	resp, err := http.Post(ts.URL+"/api/v1/comment", "", strings.NewReader(body))
+	resp, err := http.Post(ts.URL+"/api/v1/comment?site=remark42", "", strings.NewReader(body))
 	require.NoError(t, err)
 	require.NoError(t, resp.Body.Close())
 	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
@@ -281,7 +281,7 @@ func TestRest_CreateRejected(t *testing.T) {
 	// try with wrong aud
 	client := &http.Client{Timeout: 5 * time.Second}
 	defer client.CloseIdleConnections()
-	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(body))
+	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(body))
 	require.NoError(t, err)
 	req.Header.Add("X-JWT", devTokenBadAud)
 	resp, err = client.Do(req)
@@ -295,7 +295,7 @@ func TestRest_CreateWithWrongImage(t *testing.T) {
 	defer teardown()
 
 	// create comment
-	resp, err := post(t, ts.URL+"/api/v1/comment", fmt.Sprintf(`{"text": "![non-existent.jpg](%s/api/v1/picture/dev_user/bad_picture)", "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`, srv.RemarkURL))
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", fmt.Sprintf(`{"text": "![non-existent.jpg](%s/api/v1/picture/dev_user/bad_picture)", "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`, srv.RemarkURL))
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
@@ -317,7 +317,7 @@ func TestRest_CreateWithLazyImage(t *testing.T) {
 	defer teardown()
 	body := `{"text": "test 123 ![](http://example.com/image.png)", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`
 	// create comment
-	resp, err := post(t, ts.URL+"/api/v1/comment", body)
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", body)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
@@ -334,7 +334,7 @@ func TestRest_CreateAndGet(t *testing.T) {
 	defer teardown()
 
 	// create comment
-	resp, err := post(t, ts.URL+"/api/v1/comment",
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "**test** *123*\n\n http://radio-t.com", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
@@ -373,7 +373,7 @@ func TestRest_CreateWithQuotes(t *testing.T) {
 	defer teardown()
 
 	// create comment with quotes with smartypants
-	resp, err := post(t, ts.URL+"/api/v1/comment",
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "smartpants \"quoted\" text", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
@@ -396,7 +396,7 @@ func TestRest_CreateWithQuotes(t *testing.T) {
 
 	// create comment with quotes without smartypants
 	srv.privRest.disableFancyTextFormatting = true
-	resp, err = post(t, ts.URL+"/api/v1/comment",
+	resp, err = post(t, ts.URL+"/api/v1/comment?site=remark42",
 		`{"text": "no_smartpants \"quoted\" text", "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`)
 	require.NoError(t, err)
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
@@ -861,10 +861,10 @@ func TestRest_EmailAndTelegram(t *testing.T) {
 	// issue good token
 	claims := token.Claims{
 		Handshake: &token.Handshake{ID: "provider1_dev::good@example.com"},
-		StandardClaims: jwt.StandardClaims{
-			Audience:  "remark42",
-			ExpiresAt: time.Now().Add(10 * time.Minute).Unix(),
-			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(10 * time.Minute)),
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 			Issuer:    "remark42",
 		},
 	}
@@ -882,41 +882,43 @@ func TestRest_EmailAndTelegram(t *testing.T) {
 		body         string
 	}{
 		{description: "issue delete request without auth", url: "/api/v1/email", method: http.MethodDelete, responseCode: http.StatusUnauthorized, noAuth: true},
-		{description: "issue delete request without site_id", url: "/api/v1/email", method: http.MethodDelete, responseCode: http.StatusBadRequest},
+		{description: "issue delete request without site_id", url: "/api/v1/email", method: http.MethodDelete, responseCode: http.StatusForbidden},
 		{description: "delete non-existent user email", url: "/api/v1/email?site=remark42", method: http.MethodDelete, responseCode: http.StatusOK},
-		{description: "set user email, token not set", url: "/api/v1/email/confirm", method: http.MethodPost, responseCode: http.StatusBadRequest, body: `{"site":"remark42"}`},
+		{description: "set user email, token not set", url: "/api/v1/email/confirm?site=remark42", method: http.MethodPost, responseCode: http.StatusBadRequest, body: `{"site":"remark42"}`},
 		{description: "set user email, token not set, old query param", url: "/api/v1/email/confirm?site=remark42", method: http.MethodPost, responseCode: http.StatusBadRequest},
-		{description: "send email confirmation without address", url: "/api/v1/email/subscribe", method: http.MethodPost, responseCode: http.StatusBadRequest, body: `{"site":"remark42"}`},
+		{description: "send email confirmation without address", url: "/api/v1/email/subscribe?site=remark42", method: http.MethodPost, responseCode: http.StatusBadRequest, body: `{"site":"remark42"}`},
 		{description: "send email confirmation without address, old query param", url: "/api/v1/email/subscribe?site=remark42", method: http.MethodPost, responseCode: http.StatusBadRequest},
-		{description: "send email confirmation", url: "/api/v1/email/subscribe", method: http.MethodPost, responseCode: http.StatusOK, body: `{"site":"remark42","address":"good@example.com"}`},
+		{description: "send email confirmation", url: "/api/v1/email/subscribe?site=remark42", method: http.MethodPost, responseCode: http.StatusOK, body: `{"site":"remark42","address":"good@example.com"}`},
 		{description: "send email confirmation, old query param", url: "/api/v1/email/subscribe?site=remark42&address=good@example.com", method: http.MethodPost, responseCode: http.StatusOK},
-		{description: "set user email, token is good", url: "/api/v1/email/confirm", method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com", body: fmt.Sprintf(`{"site":"remark42","token":%q}`, goodToken)},
+		{description: "set user email, token is good", url: "/api/v1/email/confirm?site=remark42", method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com", body: fmt.Sprintf(`{"site":"remark42","token":%q}`, goodToken)},
 		{description: "set user email, token is good, old query param", url: fmt.Sprintf("/api/v1/email/confirm?site=remark42&tkn=%s", goodToken), method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com"},
 		{description: "send confirmation with same address", url: "/api/v1/email/subscribe?site=remark42&address=good@example.com", method: http.MethodPost, responseCode: http.StatusConflict},
 		{description: "get user email", url: "/api/v1/email?site=remark42", method: http.MethodGet, responseCode: http.StatusOK},
 		{description: "delete user email", url: "/api/v1/email?site=remark42", method: http.MethodDelete, responseCode: http.StatusOK},
 		{description: "send another confirmation", url: "/api/v1/email/subscribe?site=remark42&address=good@example.com", method: http.MethodPost, responseCode: http.StatusOK},
-		{description: "set user email, token is good", url: "/api/v1/email/confirm", method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com", body: fmt.Sprintf(`{"site":"remark42","token":%q}`, goodToken)},
+		{description: "set user email, token is good", url: "/api/v1/email/confirm?site=remark42", method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com", body: fmt.Sprintf(`{"site":"remark42","token":%q}`, goodToken)},
 		{description: "set user email, token is good, old query param", url: fmt.Sprintf("/api/v1/email/confirm?site=remark42&tkn=%s", goodToken), method: http.MethodPost, responseCode: http.StatusOK, cookieEmail: "good@example.com"},
 		{description: "unsubscribe user, no token", url: "/email/unsubscribe.html?site=remark42", method: http.MethodPost, responseCode: http.StatusBadRequest},
 		{description: "unsubscribe user, wrong token", url: "/email/unsubscribe.html?site=remark42&tkn=jwt", method: http.MethodGet, responseCode: http.StatusForbidden},
 		{description: "unsubscribe user, good token", url: fmt.Sprintf("/email/unsubscribe.html?site=remark42&tkn=%s", goodToken), method: http.MethodPost, responseCode: http.StatusOK},
 		{description: "unsubscribe user second time, good token", url: fmt.Sprintf("/email/unsubscribe.html?site=remark42&tkn=%s", goodToken), method: http.MethodPost, responseCode: http.StatusConflict},
 		{description: "issue delete request without auth", url: "/api/v1/telegram", method: http.MethodDelete, responseCode: http.StatusUnauthorized, noAuth: true},
-		{description: "issue delete request without site_id", url: "/api/v1/telegram", method: http.MethodDelete, responseCode: http.StatusBadRequest},
+		{description: "issue delete request without site_id", url: "/api/v1/telegram", method: http.MethodDelete, responseCode: http.StatusForbidden},
 		{description: "delete non-existent user telegram", url: "/api/v1/telegram?site=remark42", method: http.MethodDelete, responseCode: http.StatusOK},
-		{description: "send telegram confirmation, no siteID", url: "/api/v1/telegram/subscribe", method: http.MethodGet, responseCode: http.StatusBadRequest},
+		{description: "send telegram confirmation, no siteID", url: "/api/v1/telegram/subscribe", method: http.MethodGet, responseCode: http.StatusForbidden},
 		{description: "send telegram confirmation", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodGet, responseCode: http.StatusOK},
 		{description: "set user telegram, token is good", url: "/api/v1/telegram/subscribe?site=remark42&tkn=good_token", method: http.MethodGet, responseCode: http.StatusOK},
 		{description: "send confirmation with same address", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodGet, responseCode: http.StatusConflict},
 		{description: "delete user telegram", url: "/api/v1/telegram?site=remark42", method: http.MethodDelete, responseCode: http.StatusOK},
 		{description: "send another confirmation", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodGet, responseCode: http.StatusOK},
 		{description: "set user telegram, token is good", url: "/api/v1/telegram/subscribe?site=remark42&tkn=good_token", method: http.MethodGet, responseCode: http.StatusOK},
+		// telegramSubscribeCtrl mutates state, so HEAD (which stdlib ServeMux would route to the
+		// GET handler) must be rejected by rejectHead before it runs
+		{description: "HEAD is rejected on telegram subscribe", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodHead, responseCode: http.StatusMethodNotAllowed},
 	}
 	client := http.Client{}
 	defer client.CloseIdleConnections()
 	for _, x := range testData {
-		x := x
 		t.Run(x.description, func(t *testing.T) {
 			reqBody := io.NopCloser(strings.NewReader(x.body))
 			if x.body == "" {
@@ -957,7 +959,7 @@ func TestRest_EmailNotification(t *testing.T) {
 	defer client.CloseIdleConnections()
 
 	// create new comment from dev user
-	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(
+	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(
 		`{"text": "test 123",
 "user": {"name": "provider1_dev::good@example.com"},
 "locator":{"url": "https://radio-t.com/blah1",
@@ -971,14 +973,14 @@ func TestRest_EmailNotification(t *testing.T) {
 	require.NoError(t, resp.Body.Close())
 	require.Equal(t, http.StatusCreated, resp.StatusCode, string(body))
 	parentComment := store.Comment{}
-	require.NoError(t, render.DecodeJSON(strings.NewReader(string(body)), &parentComment))
+	require.NoError(t, json.Unmarshal(body, &parentComment))
 	// wait for mock notification Submit to kick off
 	time.Sleep(time.Millisecond * 30)
 	require.Equal(t, 1, len(mockDestination.Get()))
 	assert.Empty(t, mockDestination.Get()[0].Emails)
 
 	// create child comment from another user, email notification only to admin expected
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(fmt.Sprintf(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(fmt.Sprintf(
 		`{"text": "test 456",
 	"pid": %q,
 	"user": {"name": "other_user"},
@@ -1000,7 +1002,7 @@ func TestRest_EmailNotification(t *testing.T) {
 	// send confirmation token for email
 	req, err = http.NewRequest(
 		http.MethodPost,
-		ts.URL+"/api/v1/email/subscribe",
+		ts.URL+"/api/v1/email/subscribe?site=remark42",
 		io.NopCloser(strings.NewReader(`{"site": "remark42", "address": "good@example.com"}`)),
 	)
 	require.NoError(t, err)
@@ -1039,7 +1041,7 @@ func TestRest_EmailNotification(t *testing.T) {
 	// verify email
 	req, err = http.NewRequest(
 		http.MethodPost,
-		ts.URL+"/api/v1/email/confirm",
+		ts.URL+"/api/v1/email/confirm?site=remark42",
 		io.NopCloser(strings.NewReader(fmt.Sprintf(`{"site": "remark42", "token": %q}`, verificationToken))),
 	)
 	require.NoError(t, err)
@@ -1071,7 +1073,7 @@ func TestRest_EmailNotification(t *testing.T) {
 		Picture: "http://example.com/pic.png", IP: "127.0.0.1", SiteID: "remark42"}, subscribedUser)
 
 	// create child comment from another user, email notification expected
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(fmt.Sprintf(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(fmt.Sprintf(
 		`{"text": "test 789",
 	"pid": %q,
 	"user": {"name": "other_user"},
@@ -1102,7 +1104,7 @@ func TestRest_EmailNotification(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode, string(body))
 
 	// create child comment from another user, no email notification
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(
 		`{"text": "test 321",
 	"user": {"name": "other_user"},
 	"locator":{"url": "https://radio-t.com/blah1",
@@ -1160,7 +1162,7 @@ func TestRest_EmailNotification(t *testing.T) {
 	// confirm email via subscribe call, no email notification is expected
 	req, err = http.NewRequest(
 		http.MethodPost,
-		ts.URL+"/api/v1/email/subscribe",
+		ts.URL+"/api/v1/email/subscribe?site=remark42",
 		io.NopCloser(strings.NewReader(`{"site": "remark42", "address": "good@example.com"}`)),
 	)
 	require.NoError(t, err)
@@ -1207,7 +1209,7 @@ func TestRest_TelegramNotification(t *testing.T) {
 	defer client.CloseIdleConnections()
 
 	// create new comment from dev user
-	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(
+	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(
 		`{"text": "test 123",
 "user": {"name": "provider1_dev::good@example.com"},
 "locator":{"url": "https://radio-t.com/blah1",
@@ -1221,14 +1223,14 @@ func TestRest_TelegramNotification(t *testing.T) {
 	require.NoError(t, resp.Body.Close())
 	require.Equal(t, http.StatusCreated, resp.StatusCode, string(body))
 	parentComment := store.Comment{}
-	require.NoError(t, render.DecodeJSON(strings.NewReader(string(body)), &parentComment))
+	require.NoError(t, json.Unmarshal(body, &parentComment))
 	// wait for mock notification Submit to kick off
 	time.Sleep(time.Millisecond * 30)
 	require.Equal(t, 1, len(mockDestination.Get()))
 	assert.Empty(t, mockDestination.Get()[0].Telegrams)
 
 	// create child comment from another user, telegram notification only to admin expected
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(fmt.Sprintf(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(fmt.Sprintf(
 		`{"text": "test 456",
 	"pid": %q,
 	"user": {"name": "other_user"},
@@ -1341,7 +1343,7 @@ func TestRest_TelegramNotification(t *testing.T) {
 		Picture: "http://example.com/pic.png", IP: "127.0.0.1", SiteID: "remark42"}, user)
 
 	// create child comment from another user, telegram notification expected
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(fmt.Sprintf(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(fmt.Sprintf(
 		`{"text": "test 789",
 	"pid": %q,
 	"user": {"name": "other_user"},
@@ -1372,7 +1374,7 @@ func TestRest_TelegramNotification(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode, string(body))
 
 	// create child comment from another user, no telegram notification
-	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", strings.NewReader(
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment?site=remark42", strings.NewReader(
 		`{"text": "test 321",
 	"user": {"name": "other_user"},
 	"locator":{"url": "https://radio-t.com/blah1",
@@ -1457,7 +1459,7 @@ func TestRest_UserAllDataManyComments(t *testing.T) {
 	c := store.Comment{User: user, Text: "test test #1", Locator: store.Locator{SiteID: "remark42",
 		URL: "https://radio-t.com/blah1"}, Timestamp: time.Date(2018, 5, 27, 1, 14, 10, 0, time.Local)}
 
-	for i := 0; i < 51; i++ {
+	for i := range 51 {
 		c.ID = fmt.Sprintf("id-%03d", i)
 		c.Timestamp = c.Timestamp.Add(time.Second)
 		_, err := srv.DataService.Create(c)
@@ -1510,6 +1512,8 @@ func TestRest_DeleteMe(t *testing.T) {
 	claims, err := srv.Authenticator.TokenService().Parse(tkn)
 	assert.NoError(t, err)
 	assert.Equal(t, "provider1_dev", claims.User.ID)
+	assert.Equal(t, "http://example.com/pic.png", claims.User.Picture,
+		"delete_me token must carry the user's picture so the avatar can be removed when the request is processed")
 	assert.Equal(t, "https://demo.remark42.com/web/deleteme.html?token="+tkn, m["link"])
 
 	req, err = http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/deleteme?site=remark42", ts.URL), http.NoBody)
@@ -1537,7 +1541,7 @@ func TestRest_SavePictureCtrl(t *testing.T) {
 
 		client := http.Client{}
 		defer client.CloseIdleConnections()
-		req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/picture", ts.URL), bodyBuf)
+		req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/picture?site=remark42", ts.URL), bodyBuf)
 		require.NoError(t, err)
 		req.Header.Add("Content-Type", contentType)
 		req.Header.Add("X-JWT", devToken)
@@ -1629,7 +1633,7 @@ func TestRest_CreateWithPictures(t *testing.T) {
 		require.NoError(t, bodyWriter.Close())
 		client := http.Client{}
 		defer client.CloseIdleConnections()
-		req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/picture", ts.URL), bodyBuf)
+		req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/picture?site=remark42", ts.URL), bodyBuf)
 		require.NoError(t, err)
 		req.Header.Add("Content-Type", contentType)
 		req.Header.Add("X-JWT", devToken)
@@ -1655,7 +1659,7 @@ func TestRest_CreateWithPictures(t *testing.T) {
 	text := fmt.Sprintf(`text 123  ![](%s/api/v1/picture/%s) *xxx* ![](%s/api/v1/picture/%s) ![](%s/api/v1/picture/%s)`, svc.RemarkURL, ids[0], svc.RemarkURL, ids[1], svc.RemarkURL, ids[2])
 	body := fmt.Sprintf(`{"text": %q, "locator":{"url": "https://radio-t.com/blah1", "site": "remark42"}}`, text)
 
-	resp, err := post(t, ts.URL+"/api/v1/comment", body)
+	resp, err := post(t, ts.URL+"/api/v1/comment?site=remark42", body)
 	assert.NoError(t, err)
 	b, err := io.ReadAll(resp.Body)
 	assert.NoError(t, err)
@@ -1692,3 +1696,26 @@ func (m *mockTelegram) CheckToken(string, string) (telegram, site string, err er
 	}
 	return "good_telegram", m.site, nil
 }
+
+func TestExtractIP(t *testing.T) {
+	tbl := []struct {
+		addr string
+		exp  string
+	}{
+		{"127.0.0.1:8080", "127.0.0.1"},
+		{"127.0.0.1", "127.0.0.1"},
+		{"192.168.1.1:443", "192.168.1.1"},
+		{"[::1]:8080", "::1"},
+		{"::1", "::1"},
+		{"[2001:db8::1]:8080", "2001:db8::1"},
+		{"2001:db8::1", "2001:db8::1"},
+		{"[fe80::1%25eth0]:80", "fe80::1%25eth0"},
+		{"", ""},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.addr, func(t *testing.T) {
+			assert.Equal(t, tt.exp, extractIP(tt.addr))
+		})
+	}
+}

backend/app/rest/api/rest_public.go

@@ -4,18 +4,19 @@ import (
 	"bytes"
 	"crypto/sha1" // nolint
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
 
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/render"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
+	"github.com/google/uuid"
 	"github.com/skip2/go-qrcode"
 
 	"github.com/umputun/remark42/backend/app/rest"
@@ -48,10 +49,18 @@ type pubStore interface {
 	Counts(siteID string, postIDs []string) ([]store.PostInfo, error)
 }
 
-// GET /find?site=siteID&url=post-url&format=[tree|plain]&sort=[+/-time|+/-score|+/-controversy]&view=[user|all]&since=unix_ts_msec
-// find comments for given post. Returns in tree or plain formats, sorted
+// GET /find?site=siteID&url=post-url&format=[tree|plain]&sort=[+/-time|+/-score|+/-controversy]&view=[user|all]&since=unix_ts_msec&limit=100&offset_id={id}
+// find comments for given post. Returns in tree or plain formats, sorted.
 //
 // When `url` parameter is not set (e.g. request is for site-wide comments), does not return deleted comments.
+//
+// When `limit` is set, first {limit} comments are returned. When `offset_id` is set, comments are returned starting
+// after the comment with the given id.
+// format="tree" limits comments by top-level comments and all their replies,
+// and never returns parent comment with only part of replies.
+//
+// `count` in the response refers to total number of non-deleted comments,
+// `count_left` to amount of comments left to be returned _including deleted_.
 func (s *public) findCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 	sort := r.URL.Query().Get("sort")
@@ -70,7 +79,24 @@ func (s *public) findCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 		since = time.Time{} // since doesn't make sense for tree
 	}
 
-	log.Printf("[DEBUG] get comments for %+v, sort %s, format %s, since %v", locator, sort, format, since)
+	limitParam := r.URL.Query().Get("limit")
+	var limit int
+	if limitParam != "" {
+		if limit, err = strconv.Atoi(limitParam); err != nil {
+			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "bad limit value", rest.ErrCommentNotFound)
+			return
+		}
+	}
+
+	offsetID := r.URL.Query().Get("offset_id")
+	if offsetID != "" {
+		if _, err = uuid.Parse(offsetID); err != nil {
+			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "bad offset_id value", rest.ErrCommentNotFound)
+			return
+		}
+	}
+
+	log.Printf("[DEBUG] get comments for %+v, sort %s, format %s, since %v, limit %d, offset %s", locator, sort, format, since, limit, offsetID)
 
 	key := cache.NewKey(locator.SiteID).ID(URLKeyWithUser(r)).Scopes(locator.SiteID, locator.URL)
 	data, err := s.cache.Get(key, func() ([]byte, error) {
@@ -102,12 +128,20 @@ func (s *public) findCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 		var b []byte
 		switch format {
 		case "tree":
-			withInfo := treeWithInfo{Tree: service.MakeTree(comments, sort), Info: commentsInfo}
+			withInfo := treeWithInfo{Tree: service.MakeTree(comments, sort, limit, offsetID), Info: commentsInfo}
+			withInfo.Info.CountLeft = withInfo.CountLeft()
+			withInfo.Info.LastComment = withInfo.LastComment()
 			if withInfo.Nodes == nil { // eliminate json nil serialization
 				withInfo.Nodes = []*service.Node{}
 			}
 			b, e = encodeJSONWithHTML(withInfo)
 		default:
+			if limit > 0 || offsetID != "" {
+				comments, commentsInfo.CountLeft = limitComments(comments, limit, offsetID)
+			}
+			if limit > 0 && len(comments) > 0 {
+				commentsInfo.LastComment = comments[len(comments)-1].ID
+			}
 			withInfo := commentsWithInfo{Comments: comments, Info: commentsInfo}
 			b, e = encodeJSONWithHTML(withInfo)
 		}
@@ -153,7 +187,7 @@ func (s *public) lastCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[DEBUG] get last comments for %s", siteID)
 
-	limit, err := strconv.Atoi(chi.URLParam(r, "limit"))
+	limit, err := strconv.Atoi(r.PathValue("limit"))
 	if err != nil {
 		limit = 0
 	}
@@ -187,7 +221,7 @@ func (s *public) lastCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 
 // GET /id/{id}?site=siteID&url=post-url - gets a comment by id
 func (s *public) commentByIDCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	siteID := r.URL.Query().Get("site")
 	url := r.URL.Query().Get("url")
 
@@ -198,7 +232,6 @@ func (s *public) commentByIDCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get comment by id", rest.ErrCommentNotFound)
 		return
 	}
-	render.Status(r, http.StatusOK)
 
 	if err = R.RenderJSONWithHTML(w, r, comment); err != nil {
 		log.Printf("[WARN] can't render last comments for url=%s, id=%s", url, id)
@@ -263,7 +296,7 @@ func (s *public) countCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get count", rest.ErrPostNotFound)
 		return
 	}
-	render.JSON(w, r, R.JSON{"count": count, "locator": locator})
+	R.RenderJSON(w, R.JSON{"count": count, "locator": locator})
 }
 
 // POST /counts?site=siteID - get number of comments for posts from post body
@@ -271,7 +304,7 @@ func (s *public) countMultiCtrl(w http.ResponseWriter, r *http.Request) {
 	const countBodyLimit int64 = 1024 * 128 // count request can be big for some site because it lists all urls
 	siteID := r.URL.Query().Get("site")
 	posts := []string{}
-	if err := render.DecodeJSON(http.MaxBytesReader(w, r.Body, countBodyLimit), &posts); err != nil {
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, countBodyLimit)).Decode(&posts); err != nil {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get list of posts from request", rest.ErrSiteNotFound)
 		return
 	}
@@ -331,26 +364,81 @@ func (s *public) listCtrl(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// safePictureSegment reports whether seg is acceptable as a path segment in
+// the picture URL (no traversal markers, no path separators, no control
+// characters). Picture IDs are server-generated hashes plus a known
+// extension, so any value carrying these characters is hostile and must be
+// rejected before reaching the store. Rejecting controls (CR, LF, TAB, NUL,
+// etc.) also closes a log-injection vector since the rejected segment is
+// echoed into the access log.
+func safePictureSegment(seg string) bool {
+	if seg == "" || seg == "." {
+		return false
+	}
+	if strings.ContainsAny(seg, "/\\") {
+		return false
+	}
+	if strings.Contains(seg, "..") { // also covers seg == ".."
+		return false
+	}
+	for _, r := range seg {
+		if unicode.IsControl(r) {
+			return false
+		}
+	}
+	return true
+}
+
+// sendPictureError writes a no-store Cache-Control header and delegates to rest.SendErrorJSON.
+// Used by every rejection branch in loadPictureCtrl so error responses never inherit the
+// 7-day client cache of the success path.
+func sendPictureError(w http.ResponseWriter, r *http.Request, status int, err error, details string, code int) {
+	w.Header().Set("Cache-Control", "no-store")
+	rest.SendErrorJSON(w, r, status, err, details, code)
+}
+
 // GET /picture/{user}/{id} - get picture
 func (s *public) loadPictureCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "user") + "/" + chi.URLParam(r, "id")
-	img, err := s.imageService.Load(id)
-	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't get image "+id, rest.ErrAssetNotFound)
+	rest.SetImageDefenseHeaders(w)
+
+	user, imgID := r.PathValue("user"), r.PathValue("id")
+	if user == "" || imgID == "" || !safePictureSegment(user) || !safePictureSegment(imgID) {
+		log.Printf("[WARN] rejected picture request with unsafe id segments user=%q id=%q", user, imgID)
+		sendPictureError(w, r, http.StatusBadRequest, fmt.Errorf("invalid picture id"), "invalid picture id", rest.ErrAssetNotFound)
 		return
 	}
-	// enforce client-side caching
+	id := user + "/" + imgID
+	img, err := s.imageService.Load(id)
+	if err != nil {
+		log.Printf("[WARN] can't load image %s: %v", id, err)
+		sendPictureError(w, r, http.StatusBadRequest, fmt.Errorf("image not found"), "can't get image", rest.ErrAssetNotFound)
+		return
+	}
+
+	contentType, err := rest.SafeImgContentType(img)
+	if err != nil {
+		log.Printf("[WARN] rejecting non-image picture %s: %v", id, err)
+		sendPictureError(w, r, http.StatusUnsupportedMediaType, err, "invalid image content", rest.ErrAssetNotFound)
+		return
+	}
+
+	// /picture/ does not need a security-version etag prefix — the upload flow
+	// validates input format (readAndValidateImage) and the serve path re-validates
+	// the stored bytes via rest.SafeImgContentType. Bytes within the resize dimension
+	// limits ARE preserved verbatim by resize, so the browser defense relies on the
+	// response headers (validated Content-Type + nosniff + strict CSP +
+	// Content-Disposition: inline), not on byte normalization. Picture IDs are limited
+	// to safePictureSegment (alphanumeric xid-generated guids), so the comma split
+	// inside rest.EtagMatches cannot collide; if the ID format ever changes, revisit.
 	etag := `"` + id + `"`
 	w.Header().Set("Etag", etag)
 	w.Header().Set("Cache-Control", "max-age=604800") // 7 days
-	if match := r.Header.Get("If-None-Match"); match != "" {
-		if strings.Contains(match, etag) {
-			w.WriteHeader(http.StatusNotModified)
-			return
-		}
+	if match := r.Header.Get("If-None-Match"); match != "" && rest.EtagMatches(match, etag) {
+		w.WriteHeader(http.StatusNotModified)
+		return
 	}
 
-	w.Header().Set("Content-Type", s.imageService.ImgContentType(img))
+	w.Header().Set("Content-Type", contentType)
 	w.Header().Set("Content-Length", strconv.Itoa(len(img)))
 	w.WriteHeader(http.StatusOK)
 	if _, err = io.Copy(w, bytes.NewReader(img)); err != nil {
@@ -359,13 +447,14 @@ func (s *public) loadPictureCtrl(w http.ResponseWriter, r *http.Request) {
 }
 
 // GET /robots.txt
-func (s *public) robotsCtrl(w http.ResponseWriter, r *http.Request) {
+func (s *public) robotsCtrl(w http.ResponseWriter, _ *http.Request) {
 	allowed := []string{"/find", "/last", "/id", "/count", "/counts", "/list", "/config", "/user",
 		"/img", "/avatar", "/picture"}
 	for i := range allowed {
 		allowed[i] = "Allow: /api/v1" + allowed[i]
 	}
-	render.PlainText(w, r, "User-agent: *\nDisallow: /auth/\nDisallow: /api/\n"+strings.Join(allowed, "\n")+"\n")
+	responseText := fmt.Sprintf("User-agent: *\nDisallow: /auth/\nDisallow: /api/\n%s\n", strings.Join(allowed, "\n"))
+	rest.PlainTextResponse(w, http.StatusOK, responseText)
 }
 
 // GET /qr/telegram - generates QR for provided URL, used for Telegram auth and notifications subscription. The first
@@ -397,7 +486,7 @@ func (s *public) telegramQrCtrl(w http.ResponseWriter, r *http.Request) {
 	}
 
 	w.Header().Set("Content-Type", "image/png")
-	if _, err = w.Write(png); err != nil {
+	if _, err = w.Write(png); err != nil { //nolint:gosec // png bytes from go-qrcode, not HTML
 		log.Printf("[WARN] can't render qr, %v", err)
 	}
 }
@@ -432,3 +521,25 @@ func (s *public) parseSince(r *http.Request) (time.Time, error) {
 	}
 	return sinceTS, nil
 }
+
+// limitComments returns limited list of comments and count of comments left after limit.
+// If offsetID is provided, the list will be sliced starting from the comment with this ID.
+// If offsetID is not found, the full list will be returned.
+// It's used for only "
+func limitComments(c []store.Comment, limit int, offsetID string) (comments []store.Comment, countLeft int) {
+	if offsetID != "" {
+		for i, comment := range c {
+			if comment.ID == offsetID {
+				c = c[i+1:]
+				break
+			}
+		}
+	}
+
+	if limit > 0 && len(c) > limit {
+		countLeft = len(c) - limit
+		c = c[:limit]
+	}
+
+	return c, countLeft
+}

backend/app/rest/api/rest_public_test.go

@@ -1,9 +1,11 @@
 package api
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
+	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -14,10 +16,13 @@ import (
 
 	cache "github.com/go-pkgz/lcw/v2"
 	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/umputun/remark42/backend/app/store"
+	"github.com/umputun/remark42/backend/app/store/image"
 	"github.com/umputun/remark42/backend/app/store/service"
 )
 
@@ -140,9 +145,9 @@ srv, ts := prep(t)
 }
 BKT
 `
-	text = strings.Replace(text, "BKT", "```", -1)
+	text = strings.ReplaceAll(text, "BKT", "```")
 	j := fmt.Sprintf(`{"text": %q, "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`, text)
-	j = strings.Replace(j, "\n", "\\n", -1)
+	j = strings.ReplaceAll(j, "\n", "\\n")
 
 	resp, err := post(t, ts.URL+"/api/v1/preview", j)
 	assert.NoError(t, err)
@@ -168,17 +173,17 @@ func TestRest_PreviewCode(t *testing.T) {
 func main(aa string) int {return 0}
 BKT
 `
-	text = strings.Replace(text, "BKT", "```", -1)
+	text = strings.ReplaceAll(text, "BKT", "```")
 	j := fmt.Sprintf(`{"text": %q, "locator":{"url": "https://radio-t.com/blah1", "site": "radio-t"}}`, text)
-	j = strings.Replace(j, "\n", "\\n", -1)
+	j = strings.ReplaceAll(j, "\n", "\\n")
 
 	resp, err := post(t, ts.URL+"/api/v1/preview", j)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 	b, err := io.ReadAll(resp.Body)
 	assert.NoError(t, err)
-	assert.Equal(t, `<pre class="chroma"><code><span class="line"><span class="cl"><span class="kd">func</span> <span class="nf">main</span><span class="p">(</span><span class="nx">aa</span> <span class="kt">string</span><span class="p">)</span> <span class="kt">int</span> <span class="p">{</span><span class="k">return</span> <span class="mi">0</span><span class="p">}</span>
-</span></span></code></pre>`, string(b))
+	assert.Equal(t, `<pre class="chroma"><code><span class="line"><span class="cl"><span class="kd">func</span><span class="w"> </span><span class="nf">main</span><span class="p">(</span><span class="nx">aa</span><span class="w"> </span><span class="kt">string</span><span class="p">)</span><span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="p">{</span><span class="k">return</span><span class="w"> </span><span class="mi">0</span><span class="p">}</span><span class="w">
+</span></span></span></code></pre>`, string(b))
 	assert.NoError(t, resp.Body.Close())
 }
 
@@ -561,8 +566,8 @@ func TestPublic_FindCommentsCtrl_ConsistentCount(t *testing.T) {
 		}
 	}
 
-	// Adding initial comments (8 to test-url and 1 to another-url) and voting, and delete two of comments to the first post.
-	// With sleep so that at least few millisecond pass between each comment
+	// adding initial comments (8 to test-url and 1 to another-url) and voting, and delete two of comments to the first post.
+	// with sleep so that at least few millisecond pass between each comment
 	// and later we would be able to use that in "since" filter with millisecond precision
 	ids := make([]string, 9)
 	timestamps := make([]time.Time, 9)
@@ -598,7 +603,7 @@ func TestPublic_FindCommentsCtrl_ConsistentCount(t *testing.T) {
 	setScore(commentLocator, ids[4], -3)
 	time.Sleep(time.Millisecond * 5)
 
-	c6 := store.Comment{Text: "third-level comment 2", ParentID: ids[4], Locator: commentLocator}
+	c6 := store.Comment{Text: "deleted third-level comment 2", ParentID: ids[4], Locator: commentLocator}
 	ids[5], timestamps[5] = addCommentGetCreatedTime(t, c6, ts)
 	// deleted later so not visible in site-wide requests
 	setScore(commentLocator, ids[5], 10)
@@ -612,7 +617,7 @@ func TestPublic_FindCommentsCtrl_ConsistentCount(t *testing.T) {
 	setScore(commentLocator, ids[6], 1)
 	time.Sleep(time.Millisecond * 5)
 
-	c8 := store.Comment{Text: "second-level comment 3", ParentID: ids[6], Locator: commentLocator}
+	c8 := store.Comment{Text: "deleted second-level comment 3", ParentID: ids[6], Locator: commentLocator}
 	ids[7], timestamps[7] = addCommentGetCreatedTime(t, c8, ts)
 	// deleted later so not visible in site-wide requests
 	setScore(commentLocator, ids[7], -20)
@@ -646,18 +651,19 @@ func TestPublic_FindCommentsCtrl_ConsistentCount(t *testing.T) {
 		params       string
 		expectedBody string
 	}{
-		{"", fmt.Sprintf(`"info":{"count":7,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"url=test-url", fmt.Sprintf(`"info":{"url":"test-url","count":6,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
-		{"format=plain", fmt.Sprintf(`"info":{"count":7,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"format=plain&url=test-url", fmt.Sprintf(`"info":{"url":"test-url","count":6,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
-		{"since=" + sinceTenSecondsAgo, fmt.Sprintf(`"info":{"count":7,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"url=test-url&since=" + sinceTenSecondsAgo, fmt.Sprintf(`"info":{"url":"test-url","count":6,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
-		{"since=" + sinceTS[0], fmt.Sprintf(`"info":{"count":7,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"url=test-url&since=" + sinceTS[0], fmt.Sprintf(`"info":{"url":"test-url","count":6,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
-		{"since=" + sinceTS[1], fmt.Sprintf(`"info":{"count":6,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"url=test-url&since=" + sinceTS[1], fmt.Sprintf(`"info":{"url":"test-url","count":5,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
-		{"since=" + sinceTS[4], fmt.Sprintf(`"info":{"count":3,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
-		{"url=test-url&since=" + sinceTS[4], fmt.Sprintf(`"info":{"url":"test-url","count":2,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		// test parameters url, format, since, sort
+		{"", fmt.Sprintf(`"info":{"count":7,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"url=test-url", fmt.Sprintf(`"info":{"url":"test-url","count":6,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		{"format=plain", fmt.Sprintf(`"info":{"count":7,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"format=plain&url=test-url", fmt.Sprintf(`"info":{"url":"test-url","count":6,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		{"since=" + sinceTenSecondsAgo, fmt.Sprintf(`"info":{"count":7,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"url=test-url&since=" + sinceTenSecondsAgo, fmt.Sprintf(`"info":{"url":"test-url","count":6,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		{"since=" + sinceTS[0], fmt.Sprintf(`"info":{"count":7,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"url=test-url&since=" + sinceTS[0], fmt.Sprintf(`"info":{"url":"test-url","count":6,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		{"since=" + sinceTS[1], fmt.Sprintf(`"info":{"count":6,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"url=test-url&since=" + sinceTS[1], fmt.Sprintf(`"info":{"url":"test-url","count":5,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
+		{"since=" + sinceTS[4], fmt.Sprintf(`"info":{"count":3,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[8])},
+		{"url=test-url&since=" + sinceTS[4], fmt.Sprintf(`"info":{"url":"test-url","count":2,"count_left":0,"first_time":%q,"last_time":%q}`, formattedTS[0], formattedTS[7])},
 		{"format=tree", `"info":{"count":7`},
 		{"format=tree&url=test-url", `"info":{"url":"test-url","count":6`},
 		{"format=tree&sort=+time", `"info":{"count":7`},
@@ -677,19 +683,103 @@ func TestPublic_FindCommentsCtrl_ConsistentCount(t *testing.T) {
 		// three comments of which last one deleted and doesn't have controversy so returned last
 		{"sort=-controversy&url=test-url&since=" + sinceTS[5], fmt.Sprintf(`"score":0,"vote":0,"time":%q,"delete":true}],"info":{"url":"test-url","count":1`, formattedTS[7])},
 		// test readonly status for the post without comments
-		{"url=readonly-test", `"info":{"count":0,"read_only":true`},
-		{"format=tree&url=readonly-test", `"info":{"count":0,"read_only":true`},
+		{"url=readonly-test", `"info":{"count":0,"count_left":0,"read_only":true`},
+		{"format=tree&url=readonly-test", `"info":{"count":0,"count_left":0,"read_only":true`},
+
+		// test parameters limit, offset_id for format=plain
+		{"limit=bad", `{"code":1,"details":"bad limit value","error":"strconv.Atoi: parsing \"bad\": invalid syntax"}`},
+		{"offset_id=bad", `{"code":1,"details":"bad offset_id value","error":"invalid UUID length: 3"}`},
+		{"limit=2", `"info":{"count":7,"count_left":5,"last_comment":"` + ids[1]},
+		{"limit=6", `"info":{"count":7,"count_left":1,"last_comment":"` + ids[6]},
+		{"limit=7", `"info":{"count":7,"count_left":0,"last_comment":"` + ids[8]},
+		{"limit=2&url=test-url", `"info":{"url":"test-url","count":6,"count_left":6,"last_comment":"` + ids[1]},
+		{"limit=6&url=test-url", `"info":{"url":"test-url","count":6,"count_left":2,"last_comment":"` + ids[5]},
+		{"limit=7&url=test-url", `"info":{"url":"test-url","count":6,"count_left":1,"last_comment":"` + ids[6]},
+		{fmt.Sprintf("limit=2&offset_id=%s", ids[2]), `"info":{"count":7,"count_left":2,"last_comment":"` + ids[4]},
+		{fmt.Sprintf("limit=2&offset_id=%s", ids[3]), `"info":{"count":7,"count_left":1,"last_comment":"` + ids[6]},
+		{fmt.Sprintf("limit=2&offset_id=%s", ids[4]), `"info":{"count":7,"count_left":0`},
+		{fmt.Sprintf("limit=1&offset_id=%s", ids[6]), `"info":{"count":7,"count_left":0`},
+		{fmt.Sprintf("limit=2&offset_id=%s", ids[8]), `"info":{"count":7,"count_left":0`},
+		{fmt.Sprintf("limit=2&url=test-url&offset_id=%s", ids[2]), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[4]},
+		{fmt.Sprintf("limit=2&url=test-url&offset_id=%s", ids[3]), `"info":{"url":"test-url","count":6,"count_left":2,"last_comment":"` + ids[5]},
+		{fmt.Sprintf("limit=2&url=test-url&offset_id=%s", ids[4]), `"info":{"url":"test-url","count":6,"count_left":1,"last_comment":"` + ids[6]},
+		{fmt.Sprintf("limit=1&url=test-url&offset_id=%s", ids[6]), `"info":{"url":"test-url","count":6,"count_left":0,"last_comment":"` + ids[7]},
+		{fmt.Sprintf("limit=2&url=test-url&offset_id=%s", ids[8]), `"info":{"url":"test-url","count":6,"count_left":6,`},
+		// deleted comment, offset is ignored in site-wide request but not for particular URL
+		{fmt.Sprintf("limit=2&offset_id=%s", ids[5]), `"info":{"count":7,"count_left":5,"last_comment":"` + ids[1]},
+		{fmt.Sprintf("limit=2&url=test-url&offset_id=%s", ids[5]), `"info":{"url":"test-url","count":6,"count_left":0,"last_comment":"` + ids[7]},
+		// non-existing comment, offset is ignored, deleted comments included into request with "url"
+		{fmt.Sprintf("limit=1&offset_id=%s", uuid.New().String()), `"info":{"count":7,"count_left":6,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("limit=1&url=test-url&offset_id=%s", uuid.New().String()), `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[0]},
+		// since is ignored for tree format, so we test it only for plain
+		{"limit=6&since=" + sinceTenSecondsAgo, `"info":{"count":7,"count_left":1,"last_comment":"` + ids[6]},
+		{"limit=1&since=" + sinceTS[4], `"info":{"count":3,"count_left":2,"last_comment":"` + ids[4]},
+		{"limit=6&url=test-url&since=" + sinceTenSecondsAgo, `"info":{"url":"test-url","count":6,"count_left":2,"last_comment":"` + ids[5]},
+		{"limit=1&url=test-url&since=" + sinceTS[4], `"info":{"url":"test-url","count":2,"count_left":3,"last_comment":"` + ids[4]},
+		// start with deleted comment timestamp
+		{"limit=1&since=" + sinceTS[5], `"info":{"count":2,"count_left":1,"last_comment":"` + ids[6]},
+		{"limit=1&since=" + sinceTS[6], `"info":{"count":2,"count_left":1,"last_comment":"` + ids[6]},
+		{"limit=1&url=test-url&since=" + sinceTS[5], `"info":{"url":"test-url","count":1,"count_left":2,"last_comment":"` + ids[5]},
+		{"limit=1&url=test-url&since=" + sinceTS[6], `"info":{"url":"test-url","count":1,"count_left":1,"last_comment":"` + ids[6]},
+		// test sort
+		{"limit=1&sort=+time&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[0]},
+		{"limit=1&sort=-time&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[7]},
+		{"limit=1&sort=+score&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[6]},
+		{"limit=1&sort=-score&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[2]},
+		{"limit=1&sort=+controversy&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[0]},
+		{"limit=1&sort=-controversy&url=test-url", `"info":{"url":"test-url","count":6,"count_left":7,"last_comment":"` + ids[3]},
+
+		// test parameters limit, offset_id for format=tree
+		{"format=tree&limit=bad", `{"code":1,"details":"bad limit value","error":"strconv.Atoi: parsing \"bad\": invalid syntax"}`},
+		{"format=tree&offset_id=bad", `{"code":1,"details":"bad offset_id value","error":"invalid UUID length: 3"}`},
+		{"format=tree&limit=2", `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{"format=tree&limit=6", `"info":{"count":7,"count_left":2,"last_comment":"` + ids[1]},
+		{"format=tree&limit=7", `"info":{"count":7,"count_left":1,"last_comment":"` + ids[6]},
+		{"format=tree&url=test-url&limit=2", `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{"format=tree&url=test-url&limit=6", `"info":{"url":"test-url","count":6,"count_left":1,"last_comment":"` + ids[1]},
+		{"format=tree&url=test-url&limit=7", `"info":{"url":"test-url","count":6,"count_left":0,"last_comment":"` + ids[6]},
+		// start after first top-level comment
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[0]), `"info":{"count":7,"count_left":2,"last_comment":"` + ids[1]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[0]), `"info":{"url":"test-url","count":6,"count_left":1,"last_comment":"` + ids[1]},
+		// start after second top-level comment
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[1]), `"info":{"count":7,"count_left":1,"last_comment":"` + ids[6]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[1]), `"info":{"url":"test-url","count":6,"count_left":0,"last_comment":"` + ids[6]},
+		// start after third top-level comment, so expect comment to post 2, or no comments on post 1 if "url" is set
+		{fmt.Sprintf("format=tree&limit=1&offset_id=%s", ids[6]), `"info":{"count":7,"count_left":0,"last_comment":"` + ids[8]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=1&offset_id=%s", ids[6]), `"info":{"url":"test-url","count":6,"count_left":0`},
+		// non-root comment IDs or non-existing IDs are ignored
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[2]), `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[3]), `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[4]), `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&limit=2&offset_id=%s", ids[7]), `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&limit=1&offset_id=%s", uuid.New().String()), `"info":{"count":7,"count_left":4,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[2]), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[3]), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[4]), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=2&offset_id=%s", ids[7]), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{fmt.Sprintf("format=tree&url=test-url&limit=1&offset_id=%s", uuid.New().String()), `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		// test sort
+		{"format=tree&limit=1&sort=+time&url=test-url", `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{"format=tree&limit=1&sort=-time&url=test-url", `"info":{"url":"test-url","count":6,"count_left":5,"last_comment":"` + ids[6]},
+		{"format=tree&limit=1&sort=+score&url=test-url", `"info":{"url":"test-url","count":6,"count_left":5,"last_comment":"` + ids[6]},
+		{"format=tree&limit=1&sort=-score&url=test-url", `"info":{"url":"test-url","count":6,"count_left":4,"last_comment":"` + ids[1]},
+		{"format=tree&limit=1&sort=+controversy&url=test-url", `"info":{"url":"test-url","count":6,"count_left":3,"last_comment":"` + ids[0]},
+		{"format=tree&limit=1&sort=-controversy&url=test-url", `"info":{"url":"test-url","count":6,"count_left":5,"last_comment":"` + ids[6]},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.params, func(t *testing.T) {
 			url := fmt.Sprintf(ts.URL+"/api/v1/find?site=remark42&%s", tc.params)
 			body, code := get(t, url)
-			assert.Equal(t, http.StatusOK, code)
+			expectedStatus := http.StatusOK
+			if strings.Contains(tc.params, "=bad") {
+				expectedStatus = http.StatusBadRequest
+			}
+			assert.Equal(t, expectedStatus, code)
 			assert.Contains(t, body, tc.expectedBody)
 			t.Log(body)
 			// prevent hit limiter from engaging
-			time.Sleep(50 * time.Millisecond)
+			time.Sleep(80 * time.Millisecond)
 		})
 	}
 }
@@ -844,7 +934,7 @@ func TestRest_Config(t *testing.T) {
 	err := json.Unmarshal([]byte(body), &j)
 	assert.NoError(t, err)
 	assert.Equal(t, 300.0, j["edit_duration"])
-	assert.EqualValues(t, []interface{}{"a1", "a2"}, j["admins"])
+	assert.EqualValues(t, []any{"a1", "a2"}, j["admins"])
 	assert.Equal(t, "admin@remark-42.com", j["admin_email"])
 	assert.Equal(t, 4000.0, j["max_comment_size"])
 	assert.Equal(t, -5.0, j["low_score"])
@@ -942,3 +1032,197 @@ func TestRest_Robots(t *testing.T) {
 		"Allow: /api/v1/list\nAllow: /api/v1/config\nAllow: /api/v1/user\nAllow: /api/v1/img\n"+
 		"Allow: /api/v1/avatar\nAllow: /api/v1/picture\n", body)
 }
+
+// TestRest_LoadPictureRejectsPathTraversal reproduces the unauthenticated path-traversal
+// vulnerability in GET /api/v1/picture/{user}/{id}. Before the fix, the handler concatenated
+// the URL params verbatim into a filesystem path via path.Join, so a request like
+// `/api/v1/picture/../remark.db` would resolve to `<base>/../remark.db`, escaping the image
+// directory. Even when the file did not exist (default Partitions=100 mitigates direct hits),
+// the FS error message leaked the constructed internal path back to the unauthenticated caller.
+func TestRest_LoadPictureRejectsPathTraversal(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	cases := []struct {
+		name       string
+		path       string
+		wantStatus int
+	}{
+		// A literal ".." is normalized away by net/http.ServeMux before routing: the request
+		// is redirected to the cleaned path, which matches no picture route, so it never reaches
+		// loadPictureCtrl and resolves to 404. The traversal is neutralized at the router level
+		// (the cleaned path can only ever reach defined routes or the webRoot-bounded file server),
+		// so nothing is served either way.
+		{name: "dotdot in user segment", path: "/api/v1/picture/../remark.db", wantStatus: http.StatusNotFound},
+		// Encoded traversal is not cleaned by the router, so the handler's safePictureSegment
+		// validation is what rejects it, with 400.
+		{name: "dotdot in id segment", path: "/api/v1/picture/dev_user/..%2Fremark.db", wantStatus: http.StatusBadRequest},
+		{name: "encoded dotdot in user segment", path: "/api/v1/picture/%2E%2E/remark.db", wantStatus: http.StatusBadRequest},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, ts.URL+c.path, http.NoBody)
+			require.NoError(t, err)
+			resp, err := http.DefaultClient.Do(req)
+			require.NoError(t, err)
+			defer func() { _ = resp.Body.Close() }()
+
+			assert.Equal(t, c.wantStatus, resp.StatusCode)
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			s := string(body)
+			assert.NotContains(t, s, "..", "error body must not echo traversal marker")
+			assert.NotContains(t, s, "remark.db", "error body must not echo attacker-supplied filename")
+			assert.NotContains(t, s, "no such file", "error body must not leak filesystem state")
+			assert.NotContains(t, s, "/var/", "error body must not leak internal filesystem path")
+		})
+	}
+}
+
+// TestRest_LoadPictureRejectsControlCharsInSegment makes sure a CRLF / tab / NUL
+// in the URL segment is rejected by safePictureSegment. Without the rejection
+// the [WARN] log line constructed from %q-formatted segments would still be
+// safe (Go's %q escapes control chars), but a future log change to %s would
+// turn this into log forgery — and no legitimate picture id ever needs control
+// characters, so the right place to slam the door is in the validator.
+func TestRest_LoadPictureRejectsControlCharsInSegment(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	cases := []struct {
+		name string
+		path string
+	}{
+		{name: "lf in user segment", path: "/api/v1/picture/dev%0Auser/abc.png"},
+		{name: "cr in user segment", path: "/api/v1/picture/dev%0Duser/abc.png"},
+		{name: "tab in user segment", path: "/api/v1/picture/dev%09user/abc.png"},
+		{name: "lf in id segment", path: "/api/v1/picture/dev_user/abc%0A.png"},
+		{name: "nul in id segment", path: "/api/v1/picture/dev_user/abc%00.png"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, ts.URL+c.path, http.NoBody)
+			require.NoError(t, err)
+			resp, err := http.DefaultClient.Do(req)
+			require.NoError(t, err)
+			defer func() { _ = resp.Body.Close() }()
+
+			assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			s := string(body)
+			assert.Contains(t, s, "invalid picture id", "must reject as invalid input, not fall through to storage")
+			assert.NotContains(t, s, "no such file", "must not reach the filesystem")
+		})
+	}
+}
+
+// TestRest_LoadPictureDefenseHeaders saves a real PNG via the standard upload handler
+// and asserts that GET /api/v1/picture/{user}/{id} carries the layered defense headers
+// (strict CSP, nosniff, Content-Disposition with filename) and that the strict ETag
+// matcher does not 304 on a substring-of-the-real-etag (the pre-fix matcher would).
+func TestRest_LoadPictureDefenseHeaders(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	// upload a real PNG via /api/v1/picture
+	bodyBuf := &bytes.Buffer{}
+	bodyWriter := multipart.NewWriter(bodyBuf)
+	fileWriter, err := bodyWriter.CreateFormFile("file", "picture.png")
+	require.NoError(t, err)
+	_, err = io.Copy(fileWriter, gopherPNG())
+	require.NoError(t, err)
+	contentType := bodyWriter.FormDataContentType()
+	require.NoError(t, bodyWriter.Close())
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+	req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/picture?site=remark42", ts.URL), bodyBuf)
+	require.NoError(t, err)
+	req.Header.Add("Content-Type", contentType)
+	req.Header.Add("X-JWT", devToken)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	m := map[string]string{}
+	require.NoError(t, json.Unmarshal(body, &m))
+	require.NotEmpty(t, m["id"])
+
+	// fetch the picture and assert defense headers
+	resp, err = http.Get(fmt.Sprintf("%s/api/v1/picture/%s", ts.URL, m["id"]))
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "default-src 'none'; sandbox; frame-ancestors 'none'",
+		resp.Header.Get("Content-Security-Policy"))
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, `inline; filename="image"`, resp.Header.Get("Content-Disposition"))
+	assert.Equal(t, "image/png", resp.Header.Get("Content-Type"))
+	realEtag := resp.Header.Get("Etag")
+	require.NotEmpty(t, realEtag)
+
+	// strict matcher: an If-None-Match value that CONTAINS the real etag as a substring
+	// but is not equal to it must NOT trigger 304. The pre-fix matcher used
+	// strings.Contains(header, etag) and would have returned true here.
+	require.True(t, len(realEtag) > 4)
+	substringMatch := "prefix-" + realEtag + "-suffix"
+	req2, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/picture/%s", ts.URL, m["id"]), http.NoBody)
+	require.NoError(t, err)
+	req2.Header.Set("If-None-Match", substringMatch)
+	resp2, err := client.Do(req2)
+	require.NoError(t, err)
+	defer resp2.Body.Close()
+	assert.Equal(t, http.StatusOK, resp2.StatusCode,
+		"strict etag matcher must NOT 304 when real etag appears only as a substring of If-None-Match; got %q vs real %q", substringMatch, realEtag)
+
+	// sanity: the exact real etag DOES validate
+	req3, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/picture/%s", ts.URL, m["id"]), http.NoBody)
+	require.NoError(t, err)
+	req3.Header.Set("If-None-Match", realEtag)
+	resp3, err := client.Do(req3)
+	require.NoError(t, err)
+	defer resp3.Body.Close()
+	assert.Equal(t, http.StatusNotModified, resp3.StatusCode, "exact etag must round-trip as 304")
+}
+
+// TestRest_LoadPictureRejectsNonImage proves the /picture/ handler rejects bytes that
+// don't sniff as a real image — even when retrieved successfully from the image store.
+// Uses a StoreMock so we can return arbitrary attacker bytes for a valid-looking id.
+func TestRest_LoadPictureRejectsNonImage(t *testing.T) {
+	htmlBody := []byte("<html><body><script>alert(document.domain)</script></body></html>")
+
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
+		return htmlBody, nil
+	}}
+	// minimal public struct on purpose: the reject path only exercises imageService.Load
+	// (other fields like dataService, cache, commentFormatter are not touched here).
+	p := &public{imageService: image.NewService(&imageStore, image.ServiceParams{})}
+
+	router := routegroup.New(http.NewServeMux())
+	router.HandleFunc("GET /api/v1/picture/{user}/{id}", p.loadPictureCtrl)
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/api/v1/picture/dev_user/abc.png")
+	require.NoError(t, err)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	assert.Equal(t, http.StatusUnsupportedMediaType, resp.StatusCode,
+		"non-image bytes must be rejected as 415")
+	assert.False(t, strings.HasPrefix(resp.Header.Get("Content-Type"), "text/html"),
+		"reject response must not be text/html; got %q", resp.Header.Get("Content-Type"))
+	assert.NotContains(t, string(body), "<script>",
+		"attacker payload must not be echoed back")
+	assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"),
+		"rejection path must not be cacheable")
+	// defense headers still present on the reject path
+	assert.Equal(t, "default-src 'none'; sandbox; frame-ancestors 'none'",
+		resp.Header.Get("Content-Security-Policy"))
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, `inline; filename="image"`, resp.Header.Get("Content-Disposition"))
+}

backend/app/rest/api/rest_test.go

@@ -16,10 +16,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-pkgz/auth"
-	"github.com/go-pkgz/auth/avatar"
-	"github.com/go-pkgz/auth/provider"
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2"
+	"github.com/go-pkgz/auth/v2/avatar"
+	"github.com/go-pkgz/auth/v2/provider"
+	"github.com/go-pkgz/auth/v2/token"
 	cache "github.com/go-pkgz/lcw/v2"
 	R "github.com/go-pkgz/rest"
 	"github.com/stretchr/testify/assert"
@@ -68,6 +68,122 @@ func TestRest_FileServer(t *testing.T) {
 	_ = os.Remove(testHTMLFile)
 }
 
+// TestRest_FileServerStaticAssets covers the static file server behaviors that are
+// sensitive to the router: the bare /web -> /web/ redirect, cache headers applied to
+// served assets, 404 for missing files, and the directory-listing block.
+func TestRest_FileServerStaticAssets(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	require.NoError(t, os.WriteFile(srv.WebRoot+"/asset-test.html", []byte("static body"), 0o600))
+	require.NoError(t, os.MkdirAll(srv.WebRoot+"/subdir-test", 0o700))
+	defer func() {
+		_ = os.Remove(srv.WebRoot + "/asset-test.html")
+		_ = os.RemoveAll(srv.WebRoot + "/subdir-test")
+	}()
+
+	noRedirect := http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	defer noRedirect.CloseIdleConnections()
+
+	t.Run("bare /web redirects to /web/", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMovedPermanently, resp.StatusCode)
+		assert.Equal(t, "/web/", resp.Header.Get("Location"))
+	})
+
+	t.Run("serves an existing asset with cache headers", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web/asset-test.html")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		body, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
+		assert.Equal(t, "static body", string(body))
+		assert.NotEmpty(t, resp.Header.Get("Etag"), "cacheControl must set an Etag on served assets")
+		assert.Contains(t, resp.Header.Get("Cache-Control"), "max-age", "cacheControl must set max-age on served assets")
+	})
+
+	t.Run("missing asset returns 404", func(t *testing.T) {
+		_, code := get(t, ts.URL+"/web/does-not-exist.html")
+		assert.Equal(t, http.StatusNotFound, code)
+	})
+
+	t.Run("directory listing is blocked", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web/subdir-test/")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusNotFound, resp.StatusCode, "directory listings must be blocked")
+	})
+}
+
+// TestRest_RejectHeadOnDestructiveGET verifies that HEAD is blocked on the state-mutating
+// GET routes (which stdlib http.ServeMux would otherwise route to the GET handler) while
+// still being served for safe, read-only routes.
+func TestRest_RejectHeadOnDestructiveGET(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+
+	t.Run("HEAD is rejected on a destructive GET route", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodHead, ts.URL+"/api/v1/admin/deleteme?site=remark42", http.NoBody)
+		require.NoError(t, err)
+		req.SetBasicAuth("admin", "password")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "HEAD must not reach a state-mutating GET handler")
+		assert.Equal(t, "GET", resp.Header.Get("Allow"), "405 must carry an Allow header")
+	})
+
+	t.Run("HEAD is rejected on the email unsubscribe route", func(t *testing.T) {
+		// emailUnsubscribeCtrl deletes the user's email subscription on GET, so HEAD (which
+		// ServeMux would route to the GET handler) must be rejected before it runs
+		resp, err := client.Head(ts.URL + "/email/unsubscribe.html?site=remark42")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "HEAD must not reach the email-unsubscribe handler")
+		assert.Equal(t, "GET, POST", resp.Header.Get("Allow"), "Allow must list every method the resource supports")
+	})
+
+	t.Run("HEAD still works on a safe read-only route", func(t *testing.T) {
+		resp, err := client.Head(ts.URL + "/api/v1/config?site=remark42")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD must still be served for safe read-only routes")
+	})
+
+	t.Run("wrong method on a known route returns 405 with Allow", func(t *testing.T) {
+		// method-in-pattern is new under ServeMux; a wrong method on a known route must
+		// still yield 405 with the allowed methods advertised
+		resp, err := client.Post(ts.URL+"/api/v1/config?site=remark42", "application/json", http.NoBody)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode)
+		assert.Contains(t, resp.Header.Get("Allow"), "GET", "405 must advertise the allowed methods")
+	})
+}
+
+// TestRest_AvatarMounts verifies both avatar mounts (root /avatar/ and /api/v1/avatar/)
+// still route to the avatar handler after the chi Mount -> ServeMux Handle rewiring,
+// rather than falling through to a router 404.
+func TestRest_AvatarMounts(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	for _, path := range []string{"/api/v1/avatar/nonexistent.image", "/avatar/nonexistent.image"} {
+		t.Run(path, func(t *testing.T) {
+			body, code := get(t, ts.URL+path)
+			// the avatar handler responds (403 "can't load avatar"), not a router 404
+			assert.Equal(t, http.StatusForbidden, code, "avatar mount must reach the avatar handler")
+			assert.Contains(t, body, "can't load avatar", "request must reach the avatar handler, not a routing 404")
+		})
+	}
+}
+
 func TestRest_Shutdown(t *testing.T) {
 	srv := Rest{Authenticator: &auth.Service{}, ImageProxy: &proxy.Image{}}
 	done := make(chan bool)
@@ -193,28 +309,6 @@ func TestRest_RunAutocertModeHTTPOnly(t *testing.T) {
 	srv.Shutdown()
 }
 
-func TestRest_rejectAnonUser(t *testing.T) {
-	ts := httptest.NewServer(fakeAuth(rejectAnonUser(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprintln(w, "Hello")
-	}))))
-	defer ts.Close()
-
-	resp, err := http.Get(ts.URL)
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "use not logged in")
-
-	resp, err = http.Get(ts.URL + "?fake_id=anonymous_user123&fake_name=test")
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "anon rejected")
-
-	resp, err = http.Get(ts.URL + "?fake_id=real_user123&fake_name=test")
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusOK, resp.StatusCode, "real user")
-}
-
 func Test_URLKey(t *testing.T) {
 	tbl := []struct {
 		url  string
@@ -227,7 +321,6 @@ func Test_URLKey(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			r, err := http.NewRequest("GET", tt.url, http.NoBody)
 			require.NoError(t, err)
@@ -252,7 +345,6 @@ func Test_URLKeyWithUser(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			r, err := http.NewRequest("GET", tt.url, http.NoBody)
 			require.NoError(t, err)
@@ -279,7 +371,6 @@ func TestRest_parseError(t *testing.T) {
 	}
 
 	for n, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(n), func(t *testing.T) {
 			res := parseError(tt.err, rest.ErrInternal)
 			assert.Equal(t, tt.res, res)
@@ -287,134 +378,35 @@ func TestRest_parseError(t *testing.T) {
 	}
 }
 
-func TestRest_cacheControl(t *testing.T) {
-	tbl := []struct {
-		url     string
-		version string
-		exp     time.Duration
-		etag    string
-		maxAge  int
-	}{
-		{"http://example.com/foo", "v1", time.Hour, "b433be1ea19edaee9dc92ca4b895b6bdf3c058cb", 3600},
-		{"http://example.com/foo2", "v1", 10 * time.Hour, "6d8466aef3246c1057452561acddf7ad9d0d99e0", 36000},
-		{"http://example.com/foo", "v2", time.Hour, "481700c52aab0dfbca99f3ffc2a4fbb27884c114", 3600},
-		{"https://example.com/foo", "v2", time.Hour, "bebd4f1b87f474792c4e75e5affe31fbf67f5778", 3600},
-	}
-
-	for i, tt := range tbl {
-		tt := tt
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", tt.url, http.NoBody)
-			w := httptest.NewRecorder()
-
-			h := cacheControl(tt.exp, tt.version)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, http.StatusOK, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-			t.Logf("%+v", resp.Header)
-			assert.Equal(t, `"`+tt.etag+`"`, resp.Header.Get("Etag"))
-			assert.Equal(t, `max-age=`+strconv.Itoa(int(tt.exp.Seconds()))+", no-cache", resp.Header.Get("Cache-Control"))
-		})
-	}
-}
-
 func TestRest_frameAncestors(t *testing.T) {
-	tbl := []struct {
-		hosts  []string
-		header string
-	}{
-		{[]string{"http://example.com"}, "frame-ancestors http://example.com;"},
-		{[]string{}, ""},
-		{[]string{"http://example.com", "http://example2.com"}, "frame-ancestors http://example.com http://example2.com;"},
-	}
+	ts, _, teardown := startupT(t, func(o *Rest) {
+		o.AllowedAncestors = []string{"'self'", "https://example.com"}
+	})
 
-	for i, tt := range tbl {
-		tt := tt
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", "http://example.com", http.NoBody)
-			w := httptest.NewRecorder()
+	// test case with frame-ancestors
+	client := http.Client{}
+	resp, err := client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "frame-ancestors 'self' https://example.com;")
+	teardown()
 
-			h := frameAncestors(tt.hosts)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, http.StatusOK, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-			t.Logf("%+v", resp.Header)
-			assert.Equal(t, tt.header, resp.Header.Get("Content-Security-Policy"))
-		})
-	}
-}
-
-func TestRest_subscribersOnly(t *testing.T) {
-	paidSubUser := &token.User{}
-	paidSubUser.SetPaidSub(true)
-
-	tbl := []struct {
-		subsOnly bool
-		user     token.User
-		setUser  bool
-		status   int
-	}{
-		{true, token.User{}, false, http.StatusUnauthorized},
-		{true, token.User{}, true, http.StatusForbidden},
-		{false, token.User{}, false, http.StatusOK},
-		{false, token.User{}, true, http.StatusOK},
-		{true, *paidSubUser, true, http.StatusOK},
-	}
-
-	for i, tt := range tbl {
-		tt := tt
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", "http://example.com", http.NoBody)
-			if tt.setUser {
-				req = token.SetUserInfo(req, tt.user)
-			}
-			w := httptest.NewRecorder()
-			h := subscribersOnly(tt.subsOnly)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, tt.status, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-		})
-	}
-}
-
-func Test_validEmailAuth(t *testing.T) {
-	tbl := []struct {
-		req    string
-		status int
-	}{
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone", http.StatusOK},
-		{"/auth/email/login?site=site-with-dash_and_underscore-and.dot&address=umputun%example.com&user=someone", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone+blah", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=Евгений+Умпутун", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=12", http.StatusForbidden},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusForbidden},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someonelooong+loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong", http.StatusForbidden},
-		{"/auth/twitter/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun+example.com&user=someone", http.StatusForbidden},
-		{"/auth/email/login?site=bad!site&address=umputun%example.com&user=someone", http.StatusForbidden},
-		{"/auth/email/login?site=loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongsite&address=umputun%example.com&user=someone", http.StatusForbidden},
-	}
-
-	for i, tt := range tbl {
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", "http://example.com"+tt.req, http.NoBody)
-			w := httptest.NewRecorder()
-			h := validEmailAuth()(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, tt.status, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-		})
-	}
+	// test case without frame-ancestors
+	ts, _, teardown = startupT(t, func(srv *Rest) {
+		srv.AllowedAncestors = []string{}
+	})
+	defer teardown()
+	resp, err = client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "frame-ancestors *;")
 }
 
 // randomPath pick a file or folder name which is not in use for sure
 func randomPath(tempDir, basename, suffix string) (string, error) {
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		fname := fmt.Sprintf("/%s/%s-%d%s", tempDir, basename, rand.Int31(), suffix)
 		fmt.Printf("fname %q", fname)
 		_, err := os.Stat(fname)
@@ -607,7 +599,11 @@ func addCommentGetCreatedTime(t *testing.T, c store.Comment, ts *httptest.Server
 
 	client := &http.Client{Timeout: 5 * time.Second}
 	defer client.CloseIdleConnections()
-	req, err := http.NewRequest("POST", ts.URL+"/api/v1/comment", bytes.NewBuffer(b))
+	postURL := ts.URL + "/api/v1/comment"
+	if c.Locator.SiteID != "" {
+		postURL += "?site=" + c.Locator.SiteID
+	}
+	req, err := http.NewRequest("POST", postURL, bytes.NewBuffer(b))
 	require.NoError(t, err)
 	req.Header.Add("X-JWT", devToken)
 	resp, err := client.Do(req)
@@ -644,7 +640,7 @@ func requireAdminOnly(t *testing.T, req *http.Request) {
 }
 
 func chooseRandomUnusedPort() (port int) {
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		port = 40000 + int(rand.Int31n(10000))
 		if ln, err := net.Listen("tcp", fmt.Sprintf(":%d", port)); err == nil {
 			_ = ln.Close()
@@ -656,7 +652,7 @@ func chooseRandomUnusedPort() (port int) {
 
 func waitForHTTPSServerStart(port int) {
 	// wait for up to 3 seconds for HTTPS server to start
-	for i := 0; i < 300; i++ {
+	for range 300 {
 		time.Sleep(time.Millisecond * 10)
 		conn, _ := net.DialTimeout("tcp", fmt.Sprintf("localhost:%d", port), time.Millisecond*10)
 		if conn != nil {

backend/app/rest/api/rss.go

@@ -56,7 +56,7 @@ func (s *rss) postCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "application/xml; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
-	if _, err = w.Write(data); err != nil {
+	if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML
 		log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err)
 	}
 }
@@ -87,7 +87,7 @@ func (s *rss) siteCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "application/xml; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
-	if _, err = w.Write(data); err != nil {
+	if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML
 		log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err)
 	}
 }
@@ -119,7 +119,7 @@ func (s *rss) repliesCtrl(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "application/xml; charset=utf-8")
 	w.WriteHeader(http.StatusOK)
-	if _, err = w.Write(data); err != nil {
+	if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML
 		log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err)
 	}
 }

backend/app/rest/api/rss_test.go

@@ -271,10 +271,7 @@ func TestServer_RssReplies(t *testing.T) {
 }
 
 func waitOnSecChange() {
-	for {
-		if time.Now().Nanosecond() < 100000000 {
-			break
-		}
+	for time.Now().Nanosecond() >= 100000000 {
 		time.Sleep(10 * time.Nanosecond)
 	}
 }
@@ -283,11 +280,11 @@ func waitOnSecChange() {
 func cleanRssFormatting(expected, actual string) (cleanExp, cleanAct string) {
 	reSpaces := regexp.MustCompile(`[\s\p{Zs}]{2,}`)
 
-	expected = strings.Replace(expected, "\n", " ", -1)
-	expected = strings.Replace(expected, "\t", " ", -1)
+	expected = strings.ReplaceAll(expected, "\n", " ")
+	expected = strings.ReplaceAll(expected, "\t", " ")
 	expected = reSpaces.ReplaceAllString(expected, " ")
 
-	actual = strings.Replace(actual, "\n", " ", -1)
+	actual = strings.ReplaceAll(actual, "\n", " ")
 	actual = reSpaces.ReplaceAllString(actual, " ")
 	return expected, actual
 }

backend/app/rest/api/ssl.go

@@ -2,16 +2,16 @@ package api
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 	log "github.com/go-pkgz/lgr"
-	"golang.org/x/crypto/acme/autocert"
-
 	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
+	"golang.org/x/crypto/acme/autocert"
 )
 
 // sslMode defines ssl mode for rest server
@@ -40,13 +40,13 @@ type SSLConfig struct {
 
 // httpToHTTPSRouter creates new router which does redirect from http to https server
 // with default middlewares. Used in 'static' ssl mode.
-func (s *Rest) httpToHTTPSRouter() chi.Router {
-	log.Printf("[DEBUG] create https-to-http redirect routes")
-	router := chi.NewRouter()
-	router.Use(middleware.RealIP, R.Recoverer(log.Default()))
-	router.Use(middleware.Throttle(1000), middleware.Timeout(60*time.Second))
+func (s *Rest) httpToHTTPSRouter() http.Handler {
+	log.Printf("[DEBUG] create http-to-https redirect routes")
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Recoverer(log.Default()))
+	router.Use(R.Throttle(1000), R.Timeout(60*time.Second))
 
-	router.Handle("/*", s.redirectHandler())
+	router.Handle("/", s.redirectHandler())
 	return router
 }
 
@@ -54,26 +54,45 @@ func (s *Rest) httpToHTTPSRouter() chi.Router {
 // with default middlewares. This part is necessary to obtain certificate from LE.
 // If it receives not a acme challenge it performs redirect to https server.
 // Used in 'auto' ssl mode.
-func (s *Rest) httpChallengeRouter(m *autocert.Manager) chi.Router {
+func (s *Rest) httpChallengeRouter(m *autocert.Manager) http.Handler {
 	log.Printf("[DEBUG] create http-challenge routes")
-	router := chi.NewRouter()
-	router.Use(middleware.RealIP, R.Recoverer(log.Default()))
-	router.Use(middleware.Throttle(1000), middleware.Timeout(60*time.Second))
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Recoverer(log.Default()))
+	router.Use(R.Throttle(1000), R.Timeout(60*time.Second))
 
-	router.Handle("/*", m.HTTPHandler(s.redirectHandler()))
+	router.Handle("/", m.HTTPHandler(s.redirectHandler()))
 	return router
 }
 
 func (s *Rest) redirectHandler() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		newURL := s.RemarkURL + r.URL.Path
-		if r.URL.RawQuery != "" {
-			newURL += "?" + r.URL.RawQuery
+		newURL, err := s.redirectURL(r)
+		if err != nil {
+			log.Printf("[WARN] failed to build redirect URL, %s", err)
+			http.Error(w, "invalid redirect URL", http.StatusInternalServerError)
+			return
 		}
 		http.Redirect(w, r, newURL, http.StatusTemporaryRedirect)
 	})
 }
 
+func (s *Rest) redirectURL(r *http.Request) (string, error) {
+	baseURL, err := url.Parse(s.RemarkURL)
+	if err != nil {
+		return "", fmt.Errorf("parse remark URL: %w", err)
+	}
+	if baseURL.Scheme != "http" && baseURL.Scheme != "https" || baseURL.Host == "" {
+		return "", fmt.Errorf("remark URL must be absolute HTTP(S) URL")
+	}
+
+	basePath := strings.TrimRight(baseURL.Path, "/")
+	requestPath := "/" + strings.TrimLeft(r.URL.Path, "/")
+	baseURL.Path = basePath + requestPath
+	baseURL.RawQuery = r.URL.RawQuery
+	baseURL.Fragment = ""
+	return baseURL.String(), nil
+}
+
 func (s *Rest) makeAutocertManager() *autocert.Manager {
 	return &autocert.Manager{
 		Prompt:     autocert.AcceptTOS,

backend/app/rest/api/ssl_test.go

@@ -40,6 +40,16 @@ func TestSSL_Redirect(t *testing.T) {
 	assert.Equal(t, "https://localhost:443/blah?param=1", resp.Header.Get("Location"))
 }
 
+func TestSSL_RedirectURLKeepsConfiguredHost(t *testing.T) {
+	rest := Rest{RemarkURL: "https://localhost:443/base"}
+	req, err := http.NewRequest("GET", "http://example.com//evil.test/path?next=//evil.test", http.NoBody)
+	require.NoError(t, err)
+
+	redirectURL, err := rest.redirectURL(req)
+	require.NoError(t, err)
+	assert.Equal(t, "https://localhost:443/base/evil.test/path?next=//evil.test", redirectURL)
+}
+
 func TestSSL_ACME_HTTPChallengeRouter(t *testing.T) {
 	rest := Rest{
 		RemarkURL: "https://localhost:443",

backend/app/rest/httperrors.go

@@ -10,7 +10,6 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/go-chi/render"
 	log "github.com/go-pkgz/lgr"
 	"github.com/go-pkgz/rest"
 
@@ -52,7 +51,7 @@ type errTmplData struct {
 // error code is not included in render as it is intended for UI developers and not for the users
 func SendErrorHTML(w http.ResponseWriter, r *http.Request, httpStatusCode int, err error, details string, errCode int) {
 	// MustExecute behaves like template.Execute, but panics if an error occurs.
-	MustExecute := func(tmpl *template.Template, wr io.Writer, data interface{}) {
+	MustExecute := func(tmpl *template.Template, wr io.Writer, data any) {
 		if err = tmpl.Execute(wr, data); err != nil {
 			panic(err)
 		}
@@ -67,20 +66,36 @@ func SendErrorHTML(w http.ResponseWriter, r *http.Request, httpStatusCode int, e
 	tmplstr := MustRead("error_response.html.tmpl")
 	tmpl := template.Must(template.New("error").Parse(tmplstr))
 	log.Printf("[WARN] %s", errDetailsMsg(r, httpStatusCode, err, details, errCode))
-	render.Status(r, httpStatusCode)
+
 	msg := bytes.Buffer{}
 	MustExecute(tmpl, &msg, errTmplData{
 		Error:   err.Error(),
 		Details: details,
 	})
-	render.HTML(w, r, msg.String())
+
+	HTMLResponse(w, httpStatusCode, msg.String())
 }
 
 // SendErrorJSON makes {error: blah, details: blah, code: 42} json body and responds with error code
 func SendErrorJSON(w http.ResponseWriter, r *http.Request, httpStatusCode int, err error, details string, errCode int) {
 	log.Printf("[WARN] %s", errDetailsMsg(r, httpStatusCode, err, details, errCode))
-	render.Status(r, httpStatusCode)
-	render.JSON(w, r, rest.JSON{"error": err.Error(), "details": details, "code": errCode})
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(httpStatusCode)
+	rest.RenderJSON(w, rest.JSON{"error": err.Error(), "details": details, "code": errCode})
+}
+
+// HTMLResponse writes HTML content with the given status code
+func HTMLResponse(w http.ResponseWriter, status int, html string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+	_, _ = w.Write([]byte(html))
+}
+
+// PlainTextResponse writes plain text content with the given status code
+func PlainTextResponse(w http.ResponseWriter, status int, text string) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(status)
+	_, _ = w.Write([]byte(text))
 }
 
 func errDetailsMsg(r *http.Request, httpStatusCode int, err error, details string, errCode int) string {

backend/app/rest/image_headers.go

@@ -0,0 +1,76 @@
+package rest
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// StrictImageCSP is the strictest default-deny Content-Security-Policy used both by
+// image-serving handlers (/api/v1/img, /api/v1/picture/{user}/{id}) and by the api-wide
+// apiCSPMiddleware (covering all /api/v1/* responses — JSON, XML/RSS, images). The name
+// keeps the "image" prefix for historical reasons; the policy itself is generic and
+// suitable for any non-document API response.
+//
+// Re-setting the same value inside the image handlers (after the middleware already set
+// it) is intentional defense-in-depth: if the middleware ever stops applying (route
+// refactor, mount point change), the handlers still emit the header.
+const StrictImageCSP = "default-src 'none'; sandbox; frame-ancestors 'none'"
+
+// SafeImgContentType returns the sniffed content type for provided bytes if and only
+// if it is in the strict allowlist of image formats safe to serve from a same-origin
+// proxy endpoint: image/png, image/jpeg, image/gif, image/webp, image/bmp, image/x-icon.
+// Anything else — HTML, XML, SVG, plain text, application/octet-stream, or any future
+// image format the stdlib sniffer may learn (e.g. AVIF, HEIC, JXL, TIFF) — is rejected.
+// SVG would also be rejected as it sniffs as text/xml or text/plain, never image/svg+xml.
+// The previous behavior silently mapped application/octet-stream to image/* and is gone.
+func SafeImgContentType(img []byte) (string, error) {
+	contentType := http.DetectContentType(img)
+	base, _, _ := strings.Cut(contentType, ";")
+	base = strings.TrimSpace(base)
+	switch base {
+	case "image/png", "image/jpeg", "image/gif", "image/webp", "image/bmp", "image/x-icon":
+		return base, nil
+	}
+	return "", fmt.Errorf("non-image content type %q", contentType)
+}
+
+// SetImageDefenseHeaders applies the layered defense headers shared by every response
+// from image-serving endpoints (success, 304, or error). Each header survives content-type
+// validation regressions, browser sniffing, and top-level navigation:
+//   - Content-Security-Policy: strict, with sandbox — blocks inline scripts and event handlers
+//   - X-Content-Type-Options: nosniff — prevents browsers from MIME-overriding the declared type
+//   - Content-Disposition: inline; filename="image" — frames the response as a file, not a document
+//
+// CSP is duplicated by apiCSPMiddleware for /api/v1/* — re-setting the same value here is
+// harmless and provides defense-in-depth if the middleware is bypassed or moved. The other
+// two headers (nosniff, Content-Disposition with filename) are image-specific and not set
+// by the middleware.
+func SetImageDefenseHeaders(w http.ResponseWriter) {
+	w.Header().Set("Content-Security-Policy", StrictImageCSP)
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Content-Disposition", `inline; filename="image"`)
+}
+
+// EtagMatches reports whether If-None-Match header value contains the given etag.
+// Handles the * wildcard, comma-separated etag lists with the W/ weak-validator prefix.
+// NOTE: This is intentionally a simple splitter — it does not handle opaque-tags that
+// contain commas (allowed by RFC 7232 but never emitted by this codebase, whose etag
+// format is `"v2:<base64-url>"` or `"<user>/<xid>"`). If the etag format ever changes
+// to include comma-bearing values, revisit this parser.
+// Replaces a substring search that could match unrelated entries (e.g. an etag that
+// happens to be a prefix of another).
+func EtagMatches(header, etag string) bool {
+	header = strings.TrimSpace(header)
+	if header == "*" {
+		return true
+	}
+	for tag := range strings.SplitSeq(header, ",") {
+		tag = strings.TrimSpace(tag)
+		tag = strings.TrimPrefix(tag, "W/")
+		if tag == etag {
+			return true
+		}
+	}
+	return false
+}

backend/app/rest/image_headers_test.go

@@ -0,0 +1,103 @@
+package rest
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestEtagMatches covers the strict If-None-Match parser that replaced a substring
+// search prone to false positives (etag "abc" being matched inside "fooabc").
+func TestEtagMatches(t *testing.T) {
+	tbl := []struct {
+		name   string
+		header string
+		etag   string
+		want   bool
+	}{
+		{"exact match", `"v2:abc"`, `"v2:abc"`, true},
+		{"comma-separated, second matches", `"x", "v2:abc"`, `"v2:abc"`, true},
+		{"weak validator prefix", `W/"v2:abc"`, `"v2:abc"`, true},
+		{"wildcard matches anything", `*`, `"v2:abc"`, true},
+		{"leading/trailing whitespace", `   "v2:abc"   `, `"v2:abc"`, true},
+		{"substring not enough", `"v2:abcdef"`, `"v2:abc"`, false},
+		{"prefix-only mismatch", `"v2:ab"`, `"v2:abc"`, false},
+		{"pre-fix etag no longer matches v2", `"abc"`, `"v2:abc"`, false},
+		{"empty header", ``, `"v2:abc"`, false},
+		{"different etag", `"v2:xyz"`, `"v2:abc"`, false},
+	}
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, EtagMatches(tt.header, tt.etag))
+		})
+	}
+}
+
+func TestSetImageDefenseHeaders(t *testing.T) {
+	w := httptest.NewRecorder()
+	SetImageDefenseHeaders(w)
+	assert.Equal(t, StrictImageCSP, w.Header().Get("Content-Security-Policy"))
+	assert.Equal(t, "nosniff", w.Header().Get("X-Content-Type-Options"))
+	assert.Equal(t, `inline; filename="image"`, w.Header().Get("Content-Disposition"))
+}
+
+// TestSafeImgContentType exercises the strict allowlist. The previous behavior
+// (HasPrefix "image/" with an explicit image/svg+xml carve-out) is gone — the
+// allowlist is the source of truth, and the explicit svg branch was dead code
+// because http.DetectContentType never returns image/svg+xml (real SVG bodies
+// sniff as text/xml or text/plain depending on whether they carry an XML decl,
+// so they are rejected implicitly by not matching the allowlist).
+func TestSafeImgContentType(t *testing.T) {
+	// minimal magic-byte bodies — verified via http.DetectContentType to produce
+	// the expected image/* result without needing testdata files for every format
+	pngMagic := []byte("\x89PNG\r\n\x1a\n")
+	jpegMagic := []byte("\xff\xd8\xff\xe0\x00\x10JFIF\x00")
+	gifBytes := []byte("GIF89a")
+	webpBytes := []byte("RIFF\x00\x00\x00\x00WEBPVP8 ")
+	bmpBytes := []byte("BM\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
+	icoBytes := []byte("\x00\x00\x01\x00\x01\x00")
+
+	// SVG with XML decl sniffs as text/xml — rejected because it's not in the allowlist
+	svgWithXMLDecl := []byte(`<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"></svg>`)
+	// SVG without XML decl sniffs as text/plain — also rejected
+	svgPlain := []byte(`<svg xmlns="http://www.w3.org/2000/svg" width="10"></svg>`)
+
+	tbl := []struct {
+		name    string
+		body    []byte
+		wantCT  string
+		wantErr bool
+	}{
+		{name: "nil rejected", body: nil, wantErr: true},
+		{name: "empty rejected", body: []byte{}, wantErr: true},
+		{name: "png magic accepted", body: pngMagic, wantCT: "image/png"},
+		{name: "jpeg magic accepted", body: jpegMagic, wantCT: "image/jpeg"},
+		{name: "gif accepted", body: gifBytes, wantCT: "image/gif"},
+		{name: "webp accepted", body: webpBytes, wantCT: "image/webp"},
+		{name: "bmp accepted", body: bmpBytes, wantCT: "image/bmp"},
+		{name: "ico accepted", body: icoBytes, wantCT: "image/x-icon"},
+		{name: "html doc rejected", body: []byte(`<!DOCTYPE html><html></html>`), wantErr: true},
+		{name: "html fragment rejected", body: []byte(`<body><img></body>`), wantErr: true},
+		{name: "plain text rejected", body: []byte("hello world"), wantErr: true},
+		{name: "octet-stream rejected", body: []byte{0x00, 0x01, 0x02, 0x03, 0x04}, wantErr: true},
+		{name: "svg with xml decl rejected (sniffs as text/xml)", body: svgWithXMLDecl, wantErr: true},
+		{name: "svg without xml decl rejected (sniffs as text/plain)", body: svgPlain, wantErr: true},
+	}
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := SafeImgContentType(tt.body)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Empty(t, got)
+				assert.Contains(t, err.Error(), "non-image content type")
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantCT, got)
+			// returned type must never carry a charset suffix (the strip code path)
+			assert.NotContains(t, got, ";")
+		})
+	}
+}

backend/app/rest/proxy/image.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,12 +13,18 @@ import (
 
 	"github.com/PuerkitoBio/goquery"
 	log "github.com/go-pkgz/lgr"
-	"github.com/go-pkgz/repeater"
+	"github.com/go-pkgz/repeater/v2"
 
 	"github.com/umputun/remark42/backend/app/rest"
+	"github.com/umputun/remark42/backend/app/safehttp"
 	"github.com/umputun/remark42/backend/app/store/image"
 )
 
+// errInvalidUpstreamContentType is returned by downloadImage when the upstream's
+// Content-Type header is not image/*. The handler checks via errors.Is to convert
+// it into a 400 (input rejected) instead of the generic 404 (fetch failed).
+var errInvalidUpstreamContentType = errors.New("invalid upstream content type")
+
 // Image extracts image src from comment's html and provides proxy for them
 // this is needed to keep remark42 running behind of HTTPS serve all images via https
 type Image struct {
@@ -27,6 +34,11 @@ type Image struct {
 	CacheExternal bool
 	Timeout       time.Duration
 	ImageService  *image.Service
+	// Transport, if non-nil, is used as-is for outbound image fetches and is the
+	// caller's responsibility to make SSRF-safe. When nil, safehttp.Transport()
+	// is installed, which blocks dialing any private/reserved IP and resolves
+	// hostnames to defeat DNS rebinding.
+	Transport http.RoundTripper
 }
 
 // Convert img src links to proxied links depends on enabled options
@@ -72,37 +84,73 @@ func (p Image) replace(commentHTML string, imgs []string) string {
 	for _, img := range imgs {
 		encodedImgURL := base64.URLEncoding.EncodeToString([]byte(img))
 		resImgURL := p.RemarkURL + p.RoutePath + "?src=" + encodedImgURL
-		commentHTML = strings.Replace(commentHTML, img, resImgURL, -1)
+		commentHTML = strings.ReplaceAll(commentHTML, img, resImgURL)
 	}
 
 	return commentHTML
 }
 
+// etagVersionPrefix is the security-version tag bumped whenever cached responses for the
+// same src need to be invalidated. Pre-fix responses were served as text/html and cached
+// by browsers/proxies under ETag `"<base64(src)>"`; the prefix invalidates those validators
+// so revalidating clients get a fresh 200 instead of letting the cached HTML 304.
+//
+// LIMITATION: with the 30-day max-age below, browsers serve pre-fix bytes from their
+// local cache without contacting the server until that TTL expires or the cache is
+// evicted under memory pressure. The prefix only helps clients that revalidate during
+// the cached lifetime (Ctrl+R, intermediaries, post-expiry use). Operators running a
+// CDN/edge cache in front of remark42 should purge /api/v1/img after deploy. The
+// realistic exposure is narrow: cache carryover only affects users who navigated
+// top-level to an attacker URL pre-fix and still have that URL cached — the normal
+// <img> embed path cached text/html but never executed it.
+const etagVersionPrefix = "v2:"
+
 // Handler returns http handler respond to proxied request
 func (p Image) Handler(w http.ResponseWriter, r *http.Request) {
-	src, err := base64.URLEncoding.DecodeString(r.URL.Query().Get("src"))
+	rest.SetImageDefenseHeaders(w)
+
+	srcParam := r.URL.Query().Get("src")
+	src, err := base64.URLEncoding.DecodeString(srcParam)
 	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't decode image url", rest.ErrDecode)
+		sendImageProxyError(w, r, http.StatusBadRequest, err, "can't decode image url", rest.ErrDecode)
 		return
 	}
 
 	imgURL := string(src)
-	var img []byte
 	imgID, err := image.CachedImgID(imgURL)
 	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't parse image url "+imgURL, rest.ErrAssetNotFound)
+		sendImageProxyError(w, r, http.StatusBadRequest, fmt.Errorf("invalid image url"), "can't parse image url", rest.ErrAssetNotFound)
 		return
 	}
+
+	// compute the current-version etag once. We don't set it as a response header yet
+	// because error paths below must NOT inherit it — otherwise transient failures
+	// (4xx) would get cached alongside the 30-day Cache-Control of the success path.
+	// The etag (and Cache-Control) are set only on the 304 short-circuit and the
+	// validated 200 path.
+	etag := `"` + etagVersionPrefix + srcParam + `"`
+	// short-circuit revalidation before any cache lookup or upstream fetch: a matching
+	// current-version If-None-Match means the client already has bytes from a prior
+	// successful (post-fix, validated) 200, so a bodyless 304 is safe and avoids
+	// upstream DoS amplification on hot comment pages without CacheExternal.
+	if match := r.Header.Get("If-None-Match"); match != "" && rest.EtagMatches(match, etag) {
+		w.Header().Set("Etag", etag)
+		w.Header().Set("Cache-Control", "max-age=2592000") // 30 days
+		w.WriteHeader(http.StatusNotModified)
+		return
+	}
+
 	// try to load from cache for case it was saved when CacheExternal was enabled
-	img, _ = p.ImageService.Load(imgID)
+	img, _ := p.ImageService.Load(imgID)
 	if img == nil {
-		img, err = p.downloadImage(context.Background(), imgURL)
+		img, err = p.downloadImage(r.Context(), imgURL)
 		if err != nil {
-			if strings.Contains(err.Error(), "invalid content type") {
-				rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "invalid content type", rest.ErrImgNotFound)
+			log.Printf("[WARN] failed to download image: %v", err)
+			if errors.Is(err, errInvalidUpstreamContentType) {
+				sendImageProxyError(w, r, http.StatusBadRequest, fmt.Errorf("invalid content type"), "invalid content type", rest.ErrImgNotFound)
 				return
 			}
-			rest.SendErrorJSON(w, r, http.StatusNotFound, err, "can't get image "+imgURL, rest.ErrAssetNotFound)
+			sendImageProxyError(w, r, http.StatusNotFound, fmt.Errorf("failed to fetch"), "can't get image", rest.ErrAssetNotFound)
 			return
 		}
 		if p.CacheExternal {
@@ -110,24 +158,37 @@ func (p Image) Handler(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// enforce client-side caching
-	etag := `"` + r.URL.Query().Get("src") + `"`
-	w.Header().Set("Etag", etag)
-	w.Header().Set("Cache-Control", "max-age=2592000") // 30 days
-	if match := r.Header.Get("If-None-Match"); match != "" {
-		if strings.Contains(match, etag) {
-			w.WriteHeader(http.StatusNotModified)
-			return
-		}
+	// validate body bytes are actually an image — never trust upstream Content-Type or cache
+	contentType, err := rest.SafeImgContentType(img)
+	if err != nil {
+		log.Printf("[WARN] rejecting non-image content from %s: %v", imgURL, err)
+		sendImageProxyError(w, r, http.StatusUnsupportedMediaType, err, "invalid image content", rest.ErrImgNotFound)
+		return
 	}
 
-	w.Header().Add("Content-Type", p.ImageService.ImgContentType(img))
+	// success path: long-lived client cache with etag for cheap revalidation. 30-day
+	// TTL keeps the proxy efficient for hot pages; when clients DO revalidate
+	// (Ctrl+R, intermediaries, post-expiry), the versioned etag ensures pre-fix
+	// poisoned validators don't match and a fresh validated 200 is returned. See
+	// etagVersionPrefix godoc for the limitation on browser-local caches.
+	w.Header().Set("Etag", etag)
+	w.Header().Set("Cache-Control", "max-age=2592000") // 30 days
+	w.Header().Set("Content-Type", contentType)
 	_, err = io.Copy(w, bytes.NewReader(img))
 	if err != nil {
 		log.Printf("[WARN] can't copy image stream, %s", err)
 	}
 }
 
+// sendImageProxyError writes a no-store error response so a transient failure (4xx)
+// cannot inherit the success path's 30-day Cache-Control or the versioned ETag, which
+// would otherwise pin the error in the browser/intermediary cache for that TTL.
+// Defense headers from SetImageDefenseHeaders at the top of the handler survive.
+func sendImageProxyError(w http.ResponseWriter, r *http.Request, status int, err error, details string, errCode int) {
+	w.Header().Set("Cache-Control", "no-store")
+	rest.SendErrorJSON(w, r, status, err, details, errCode)
+}
+
 // cache image from provided Reader using given ID
 func (p Image) cacheImage(r io.Reader, imgID string) {
 	err := p.ImageService.SaveWithID(imgID, r)
@@ -148,16 +209,26 @@ func (p Image) downloadImage(ctx context.Context, imgURL string) ([]byte, error)
 	ctx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	client := http.Client{Timeout: 30 * time.Second}
+	transport := p.Transport
+	if transport == nil {
+		transport = safehttp.Transport()
+	}
+	client := http.Client{
+		Timeout:   30 * time.Second,
+		Transport: transport,
+	}
 	defer client.CloseIdleConnections()
 	var resp *http.Response
-	err := repeater.NewDefault(5, time.Second).Do(ctx, func() error {
+	err := repeater.NewFixed(5, time.Second).Do(ctx, func() error {
 		var e error
-		req, e := http.NewRequest("GET", imgURL, http.NoBody)
+		// SSRF safety: client.Transport is safehttp.Transport() when p.Transport is nil
+		// (see Image.Transport contract above); when caller supplies a transport they
+		// own SSRF safety for that path.
+		req, e := http.NewRequest("GET", imgURL, http.NoBody) //nolint:gosec // see comment above
 		if e != nil {
 			return fmt.Errorf("failed to make request for %s: %w", imgURL, e)
 		}
-		resp, e = client.Do(req.WithContext(ctx)) //nolint:bodyclose // need a refactor to fix that
+		resp, e = client.Do(req.WithContext(ctx)) //nolint:bodyclose,gosec // body closed in defer; transport contract above
 		return e
 	})
 	if err != nil {
@@ -171,12 +242,20 @@ func (p Image) downloadImage(ctx context.Context, imgURL string) ([]byte, error)
 
 	contentType := resp.Header.Get("Content-Type")
 	if !strings.HasPrefix(contentType, "image/") {
-		return nil, fmt.Errorf("invalid content type %s", contentType)
+		return nil, fmt.Errorf("%w: %s", errInvalidUpstreamContentType, contentType)
 	}
 
-	imgData, err := io.ReadAll(resp.Body)
+	maxSize := 5 * 1024 * 1024 // 5MB default
+	if p.ImageService != nil && p.ImageService.MaxSize > 0 {
+		maxSize = p.ImageService.MaxSize
+	}
+	lr := io.LimitReader(resp.Body, int64(maxSize)+1)
+	imgData, err := io.ReadAll(lr)
 	if err != nil {
-		return nil, fmt.Errorf("unable to read image body")
+		return nil, fmt.Errorf("unable to read image body: %w", err)
+	}
+	if len(imgData) > maxSize {
+		return nil, fmt.Errorf("image is too large")
 	}
 	return imgData, nil
 }

backend/app/rest/proxy/image_test.go

@@ -77,7 +77,6 @@ func TestImage_Extract(t *testing.T) {
 	img := Image{HTTP2HTTPS: true}
 
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			res, err := img.extract(tt.inp, func(src string) bool { return strings.HasPrefix(src, "http://") })
 			assert.NoError(t, err)
@@ -101,6 +100,7 @@ func TestImage_Routes(t *testing.T) {
 		RemarkURL:    "https://demo.remark42.com",
 		RoutePath:    "/api/v1/proxy",
 		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
 	}
 
 	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
@@ -151,6 +151,7 @@ func TestImage_DisabledCachingAndHTTP2HTTPS(t *testing.T) {
 		RemarkURL:    "https://demo.remark42.com",
 		RoutePath:    "/api/v1/proxy",
 		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
 	}
 
 	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
@@ -184,6 +185,7 @@ func TestImage_RoutesCachingImage(t *testing.T) {
 		RemarkURL:     "https://demo.remark42.com",
 		RoutePath:     "/api/v1/proxy",
 		ImageService:  image.NewService(&imageStore, image.ServiceParams{MaxSize: 1500}),
+		Transport:     http.DefaultTransport,
 	}
 
 	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
@@ -208,34 +210,59 @@ func TestImage_RoutesCachingImage(t *testing.T) {
 }
 
 func TestImage_RoutesUsingCachedImage(t *testing.T) {
-	// In order to validate that cached data used cache "will return" some other data from what http server would
-	testImage := []byte(fmt.Sprintf("%256s", "X"))
-	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
-		return testImage, nil
-	}}
-	img := Image{
-		CacheExternal: true,
-		RemarkURL:     "https://demo.remark42.com",
-		RoutePath:     "/api/v1/proxy",
-		ImageService:  image.NewService(&imageStore, image.ServiceParams{}),
-	}
+	t.Run("cached image is served", func(t *testing.T) {
+		imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
+			return gopherPNGBytes(), nil
+		}}
+		img := Image{
+			CacheExternal: true,
+			RemarkURL:     "https://demo.remark42.com",
+			RoutePath:     "/api/v1/proxy",
+			ImageService:  image.NewService(&imageStore, image.ServiceParams{}),
+		}
 
-	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
-	defer ts.Close()
-	httpSrv := imgHTTPTestsServer(t)
-	defer httpSrv.Close()
+		ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+		defer ts.Close()
+		httpSrv := imgHTTPTestsServer(t)
+		defer httpSrv.Close()
 
-	encodedImgURL := base64.URLEncoding.EncodeToString([]byte(httpSrv.URL + "/image/img1.png"))
+		encodedImgURL := base64.URLEncoding.EncodeToString([]byte(httpSrv.URL + "/image/img1.png"))
+		resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
+		require.NoError(t, err)
+		assert.NoError(t, resp.Body.Close())
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
+		assert.Equal(t, "image/png", resp.Header.Get("Content-Type"))
+		assert.Equal(t, 1, len(imageStore.LoadCalls()))
+	})
 
-	resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
-	require.NoError(t, err)
-	assert.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-	assert.Equal(t, "256", resp.Header["Content-Length"][0])
-	assert.Equal(t, "text/plain; charset=utf-8", resp.Header["Content-Type"][0],
-		"if you save text you receive text/plain in response, that's only fair option you got")
+	t.Run("non-image cached bytes are rejected (cache poisoning defense)", func(t *testing.T) {
+		nonImage := fmt.Appendf(nil, "%256s", "X")
+		imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
+			return nonImage, nil
+		}}
+		img := Image{
+			CacheExternal: true,
+			RemarkURL:     "https://demo.remark42.com",
+			RoutePath:     "/api/v1/proxy",
+			ImageService:  image.NewService(&imageStore, image.ServiceParams{}),
+		}
 
-	assert.Equal(t, 1, len(imageStore.LoadCalls()))
+		ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+		defer ts.Close()
+		httpSrv := imgHTTPTestsServer(t)
+		defer httpSrv.Close()
+
+		encodedImgURL := base64.URLEncoding.EncodeToString([]byte(httpSrv.URL + "/image/img1.png"))
+		resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
+		require.NoError(t, err)
+		body, _ := io.ReadAll(resp.Body)
+		assert.NoError(t, resp.Body.Close())
+		assert.Equal(t, http.StatusUnsupportedMediaType, resp.StatusCode,
+			"non-image bytes from cache must be rejected, not served as text/plain (XSS defense)")
+		assert.False(t, strings.HasPrefix(resp.Header.Get("Content-Type"), "text/html"),
+			"reject response must not be text/html; got %q", resp.Header.Get("Content-Type"))
+		assert.NotContains(t, string(body), "XXXXX", "non-image bytes must not be echoed back")
+	})
 }
 
 func TestImage_RoutesTimedOut(t *testing.T) {
@@ -247,6 +274,7 @@ func TestImage_RoutesTimedOut(t *testing.T) {
 		RoutePath:    "/api/v1/proxy",
 		Timeout:      50 * time.Millisecond,
 		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
 	}
 
 	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
@@ -263,7 +291,8 @@ func TestImage_RoutesTimedOut(t *testing.T) {
 	assert.NoError(t, resp.Body.Close())
 	require.NoError(t, err)
 	t.Log(string(b))
-	assert.True(t, strings.Contains(string(b), "deadline exceeded"))
+	assert.Contains(t, string(b), "failed to fetch")
+	assert.NotContains(t, string(b), "deadline exceeded", "should not leak transport details")
 	assert.Equal(t, 1, len(imageStore.LoadCalls()))
 }
 
@@ -305,6 +334,474 @@ func TestImage_ConvertCachingMode(t *testing.T) {
 	assert.Equal(t, `<img src="https://remark42.com/img?src=aHR0cDovL3JhZGlvLXQuY29tL2ltZzMucG5n"/> xyz <img src="https://remark42.com/img?src=aHR0cDovL2ltYWdlcy5wZXhlbHMuY29tLzY3NjM2L2ltZzQuanBlZw==">`, r)
 }
 
+func TestImage_PrivateIPBlocking(t *testing.T) {
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+	img := Image{
+		HTTP2HTTPS:   true,
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		Timeout:      100 * time.Millisecond,
+		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		// no Transport override — uses SSRF-safe transport
+	}
+
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+
+	tbl := []struct {
+		name string
+		url  string
+	}{
+		{"loopback", "http://127.0.0.1/image.png"},
+		{"rfc1918 10.x", "http://10.0.0.1/image.png"},
+		{"rfc1918 172.16.x", "http://172.16.0.1/image.png"},
+		{"rfc1918 192.168.x", "http://192.168.1.1/image.png"},
+		{"link-local", "http://169.254.1.1/image.png"},
+		{"ipv6 loopback", "http://[::1]/image.png"},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			encodedImgURL := base64.URLEncoding.EncodeToString([]byte(tt.url))
+			resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
+			require.NoError(t, err)
+			b, err := io.ReadAll(resp.Body)
+			assert.NoError(t, resp.Body.Close())
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+			assert.NotContains(t, string(b), "private address", "should not leak private IP check details")
+			assert.Contains(t, string(b), "failed to fetch")
+		})
+	}
+}
+
+func TestImage_ErrorSanitization(t *testing.T) {
+	// server that immediately closes connections to simulate transport errors
+	httpSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		hj, ok := w.(http.Hijacker)
+		if !ok {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		conn, _, _ := hj.Hijack()
+		conn.Close() // forcefully close to trigger transport error
+	}))
+	defer httpSrv.Close()
+
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+	img := Image{
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		Timeout:      2 * time.Second,
+		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
+	}
+
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+
+	encodedImgURL := base64.URLEncoding.EncodeToString([]byte(httpSrv.URL + "/image.png"))
+	resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
+	require.NoError(t, err)
+	b, err := io.ReadAll(resp.Body)
+	assert.NoError(t, resp.Body.Close())
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+	assert.Contains(t, string(b), "failed to fetch")
+	assert.NotContains(t, string(b), "EOF", "should not leak transport details")
+	assert.NotContains(t, string(b), "connection", "should not leak transport details")
+}
+
+func TestImage_ResponseSizeLimit(t *testing.T) {
+	// create a test server that returns a large image
+	largeImg := make([]byte, 2000)
+	for i := range largeImg {
+		largeImg[i] = 0xFF
+	}
+	httpSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "image/png")
+		_, _ = w.Write(largeImg)
+	}))
+	defer httpSrv.Close()
+
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+	img := Image{
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		ImageService: image.NewService(&imageStore, image.ServiceParams{MaxSize: 1000}),
+		Transport:    http.DefaultTransport,
+	}
+
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+
+	encodedImgURL := base64.URLEncoding.EncodeToString([]byte(httpSrv.URL + "/big-image.png"))
+	resp, err := http.Get(ts.URL + "/?src=" + encodedImgURL)
+	require.NoError(t, err)
+	b, err := io.ReadAll(resp.Body)
+	assert.NoError(t, resp.Body.Close())
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+	assert.Contains(t, string(b), "failed to fetch")
+}
+
+// TestImage_ContentTypeHandling covers both the rock-solid acceptance of legitimate
+// images and the rejection of content-type-spoofing payloads (the XSS vector where
+// upstream lies about Content-Type and the proxy serves attacker HTML back from the
+// remark42 origin). Every response — accept or reject — must carry the layered
+// defense headers (strict CSP, nosniff, Content-Disposition: inline).
+//
+// The defense must not depend on the upstream Content-Type header: each row controls
+// it independently of the body so the matrix exercises attackers who flip the upstream
+// header on the fly, and polyglot bodies where image magic bytes prefix HTML payloads.
+func TestImage_ContentTypeHandling(t *testing.T) {
+	htmlBody := []byte("<html><body><script>alert(document.domain)</script></body></html>")
+	// polyglot: real PNG magic + trailing HTML. Sniffs as image/png, must be served
+	// as image/png so the browser renders as image (broken or otherwise) — never as HTML.
+	polyglot := append(append([]byte{}, gopherPNGBytes()...), []byte("<script>alert(1)</script>")...)
+
+	tbl := []struct {
+		name          string
+		upstreamCT    string // Content-Type header the upstream sends
+		body          []byte
+		accept        bool   // true: legitimate image, served back; false: attack, rejected
+		wantCT        string // exact Content-Type if accept
+		payloadMarker string // attack substring that must NOT appear in the response body
+	}{
+		// legitimate
+		{name: "real png", upstreamCT: "image/png", body: gopherPNGBytes(), accept: true, wantCT: "image/png"},
+
+		// upstream lies — body is HTML, header varies. All must be rejected at body-sniff.
+		{name: "html body claimed as image/png", upstreamCT: "image/png", body: htmlBody, payloadMarker: "<script>"},
+		{name: "html body claimed as image/jpeg", upstreamCT: "image/jpeg", body: htmlBody, payloadMarker: "<script>"},
+		{name: "html body claimed as image/gif", upstreamCT: "image/gif", body: htmlBody, payloadMarker: "<script>"},
+		// upstream claims svg+xml; body still sniffs as text/html (the stdlib sniffer
+		// never returns image/svg+xml, see rest.SafeImgContentType godoc).
+		{name: "html body upstream claims image/svg+xml", upstreamCT: "image/svg+xml", body: htmlBody, payloadMarker: "<script>"},
+		{name: "html body claimed as image/webp", upstreamCT: "image/webp", body: htmlBody, payloadMarker: "<script>"},
+
+		// svg payloads — even if upstream claims a valid image format, the sniffer sees XML/text and we must reject
+		{
+			name:          "svg with xml declaration and onload",
+			upstreamCT:    "image/png",
+			body:          []byte(`<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"></svg>`),
+			payloadMarker: "onload",
+		},
+		{
+			name:          "html fragment without doctype",
+			upstreamCT:    "image/png",
+			body:          []byte(`<body><img src=x onerror=alert(1)></body>`),
+			payloadMarker: "onerror",
+		},
+
+		// polyglot — image magic + appended HTML. Sniffs as image/png so we accept and serve as image/png.
+		// Safety comes from the response headers (Content-Type: image/png + X-Content-Type-Options: nosniff),
+		// not from body filtering: the bytes round-trip verbatim by design (assertion below). The browser
+		// cannot execute the trailing HTML when the response type is image/png with nosniff.
+		{name: "polyglot png+html served as png", upstreamCT: "image/png", body: polyglot, accept: true, wantCT: "image/png"},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.Header().Set("Content-Type", tt.upstreamCT)
+				_, _ = w.Write(tt.body)
+			}))
+			defer upstream.Close()
+
+			imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+			img := Image{
+				RemarkURL:    "https://demo.remark42.com",
+				RoutePath:    "/api/v1/proxy",
+				ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+				Transport:    http.DefaultTransport,
+			}
+
+			ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+			defer ts.Close()
+
+			encodedURL := base64.URLEncoding.EncodeToString([]byte(upstream.URL + "/logo.png"))
+			resp, err := http.Get(ts.URL + "/?src=" + encodedURL)
+			require.NoError(t, err)
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			require.NoError(t, resp.Body.Close())
+
+			// every response — accept or reject — must carry the defense headers
+			assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+			assert.Contains(t, resp.Header.Get("Content-Disposition"), "inline")
+			csp := resp.Header.Get("Content-Security-Policy")
+			assert.Contains(t, csp, "default-src 'none'", "strict CSP missing")
+			assert.Contains(t, csp, "sandbox", "CSP sandbox missing")
+
+			if tt.accept {
+				assert.Equal(t, http.StatusOK, resp.StatusCode)
+				assert.Equal(t, tt.wantCT, resp.Header.Get("Content-Type"))
+				assert.Equal(t, tt.body, body, "body bytes must round-trip")
+				assert.Contains(t, resp.Header.Get("Cache-Control"), "max-age=2592000",
+					"validated success path carries the 30-day TTL")
+				assert.True(t, strings.HasPrefix(resp.Header.Get("Etag"), `"v2:`),
+					"validated success path carries the versioned etag")
+				return
+			}
+
+			// reject path
+			assert.GreaterOrEqual(t, resp.StatusCode, 400, "must reject non-image content")
+			// reject responses must NOT inherit the success path's long-lived cache
+			// headers — a transient 4xx would otherwise be pinned in browser/intermediary
+			// caches alongside the versioned etag for 30 days.
+			assert.Contains(t, resp.Header.Get("Cache-Control"), "no-store",
+				"reject path must set Cache-Control: no-store; got %q", resp.Header.Get("Cache-Control"))
+			assert.NotContains(t, resp.Header.Get("Cache-Control"), "max-age=2592000",
+				"reject path must not carry the success-path 30-day TTL")
+			assert.Empty(t, resp.Header.Get("Etag"),
+				"reject path must not carry the versioned etag (would pin the failure in cache)")
+			ct := resp.Header.Get("Content-Type")
+			assert.False(t, strings.HasPrefix(ct, "text/html"),
+				"reject response must not be text/html; got %q", ct)
+			assert.NotContains(t, string(body), tt.payloadMarker,
+				"reject response must not echo attack payload; got body=%q", string(body))
+		})
+	}
+}
+
+// TestEtagMatches lives in the rest package alongside the shared EtagMatches helper
+// (see backend/app/rest/image_headers_test.go). The proxy handler delegates to it.
+
+// TestImage_ContentTypeHandling_CacheHit exercises the cache-hit branch of the handler:
+// the StoreMock returns attacker bytes directly, so the upstream is never contacted.
+// Without the body-sniff at serve time, pre-fix code would have echoed cached HTML as
+// text/html. After the fix the same content-type defense applies on the cache path.
+func TestImage_ContentTypeHandling_CacheHit(t *testing.T) {
+	htmlBody := []byte("<html><body><script>alert(document.domain)</script></body></html>")
+	polyglot := append(append([]byte{}, gopherPNGBytes()...), []byte("<script>alert(1)</script>")...)
+
+	tbl := []struct {
+		name          string
+		cached        []byte
+		accept        bool
+		wantCT        string
+		payloadMarker string
+	}{
+		{name: "html in cache claimed as image/png", cached: htmlBody, payloadMarker: "<script>"},
+		{name: "polyglot in cache served as png", cached: polyglot, accept: true, wantCT: "image/png"},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
+				return tt.cached, nil
+			}}
+			img := Image{
+				CacheExternal: true,
+				RemarkURL:     "https://demo.remark42.com",
+				RoutePath:     "/api/v1/proxy",
+				ImageService:  image.NewService(&imageStore, image.ServiceParams{}),
+				// no Transport — cache hit must not reach upstream
+			}
+			ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+			defer ts.Close()
+
+			encodedURL := base64.URLEncoding.EncodeToString([]byte("https://attacker.example.com/logo.png"))
+			resp, err := http.Get(ts.URL + "/?src=" + encodedURL)
+			require.NoError(t, err)
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			require.NoError(t, resp.Body.Close())
+
+			assert.Equal(t, 1, len(imageStore.LoadCalls()), "served from cache")
+			assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+			assert.Contains(t, resp.Header.Get("Content-Disposition"), "inline")
+			assert.Contains(t, resp.Header.Get("Content-Security-Policy"),
+				"default-src 'none'; sandbox; frame-ancestors 'none'")
+
+			if tt.accept {
+				assert.Equal(t, http.StatusOK, resp.StatusCode)
+				assert.Equal(t, tt.wantCT, resp.Header.Get("Content-Type"))
+				return
+			}
+			assert.GreaterOrEqual(t, resp.StatusCode, 400, "must reject non-image cached content")
+			assert.False(t, strings.HasPrefix(resp.Header.Get("Content-Type"), "text/html"),
+				"reject response must not be text/html; got %q", resp.Header.Get("Content-Type"))
+			assert.NotContains(t, string(body), tt.payloadMarker,
+				"reject response must not echo cached attack payload")
+		})
+	}
+}
+
+// TestImage_EtagVersioned proves browser/proxy caches with pre-fix etags (the
+// unversioned base64 of src that used to be served alongside text/html bodies)
+// no longer satisfy revalidation: the server returns a fresh 200 with image
+// content instead of 304-ing the poisoned cached entry. The 30-day Cache-Control
+// max-age is unchanged — local browser caches still serving pre-fix bytes within
+// their TTL are not reached; the prefix only helps clients that revalidate during
+// the cached lifetime (Ctrl+R, intermediaries, post-expiry). See etagVersionPrefix
+// godoc for the tradeoff.
+func TestImage_EtagVersioned(t *testing.T) {
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+	img := Image{
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
+	}
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+	httpSrv := imgHTTPTestsServer(t)
+	defer httpSrv.Close()
+
+	srcRaw := httpSrv.URL + "/image/img1.png"
+	encodedSrc := base64.URLEncoding.EncodeToString([]byte(srcRaw))
+	preFixEtag := `"` + encodedSrc + `"` // what a pre-fix browser would have cached
+
+	req, err := http.NewRequest("GET", ts.URL+"/?src="+encodedSrc, http.NoBody)
+	require.NoError(t, err)
+	req.Header.Set("If-None-Match", preFixEtag)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode,
+		"pre-fix etag must NOT validate as 304 — old cached text/html must be replaced")
+	assert.Equal(t, "image/png", resp.Header.Get("Content-Type"))
+	assert.NotEqual(t, preFixEtag, resp.Header.Get("Etag"), "new etag must differ from pre-fix")
+	assert.True(t, strings.HasPrefix(resp.Header.Get("Etag"), `"v2:`), "new etag must carry the version prefix")
+	cc := resp.Header.Get("Cache-Control")
+	assert.Contains(t, cc, "max-age=2592000", "success path keeps 30-day TTL for cache efficiency")
+
+	// sanity: the NEW etag round-trips as 304 when sent back
+	loadsBefore := len(imageStore.LoadCalls())
+	req2, err := http.NewRequest("GET", ts.URL+"/?src="+encodedSrc, http.NoBody)
+	require.NoError(t, err)
+	req2.Header.Set("If-None-Match", resp.Header.Get("Etag"))
+	resp2, err := http.DefaultClient.Do(req2)
+	require.NoError(t, err)
+	defer resp2.Body.Close()
+	assert.Equal(t, http.StatusNotModified, resp2.StatusCode, "new etag must validate against itself")
+	body, _ := io.ReadAll(resp2.Body)
+	assert.Empty(t, body, "304 must have no body")
+	// 304 path must skip the store lookup entirely — revalidation must not amplify load
+	assert.Equal(t, loadsBefore, len(imageStore.LoadCalls()),
+		"revalidation 304 must not trigger any store Load (avoids upstream DoS amplification)")
+	// 304 path must still carry the layered defense headers
+	assert.Equal(t, "nosniff", resp2.Header.Get("X-Content-Type-Options"))
+	assert.Contains(t, resp2.Header.Get("Content-Disposition"), "inline")
+	assert.Contains(t, resp2.Header.Get("Content-Security-Policy"), "default-src 'none'")
+	assert.Contains(t, resp2.Header.Get("Content-Security-Policy"), "sandbox")
+}
+
+// TestImage_RevalidationSkipsIO proves that a matching current-version If-None-Match
+// short-circuits before any cache lookup or upstream fetch. With no Transport and no
+// upstream server reachable, the only way this test can pass with 304 is if Load is
+// never called and downloadImage is never attempted. This closes the DoS amplification
+// where every reuse on a hot comment page would otherwise re-hit the upstream when
+// CacheExternal is false.
+func TestImage_RevalidationSkipsIO(t *testing.T) {
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) {
+		t.Fatal("Load must not be called on the revalidation short-circuit path")
+		return nil, nil
+	}}
+	img := Image{
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		// no Transport — any downloadImage attempt would also fail
+	}
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+
+	encodedSrc := base64.URLEncoding.EncodeToString([]byte("https://example.com/whatever.png"))
+	currentEtag := `"v2:` + encodedSrc + `"`
+
+	req, err := http.NewRequest("GET", ts.URL+"/?src="+encodedSrc, http.NoBody)
+	require.NoError(t, err)
+	req.Header.Set("If-None-Match", currentEtag)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusNotModified, resp.StatusCode,
+		"matching current-version etag must short-circuit to 304 without I/O")
+	assert.Equal(t, 0, len(imageStore.LoadCalls()),
+		"revalidation must not trigger store Load")
+	body, _ := io.ReadAll(resp.Body)
+	assert.Empty(t, body, "304 must have no body")
+	// defense headers must still be set on the short-circuit path
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Contains(t, resp.Header.Get("Content-Disposition"), "inline")
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "default-src 'none'")
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "sandbox")
+	assert.Equal(t, currentEtag, resp.Header.Get("Etag"))
+	assert.Contains(t, resp.Header.Get("Cache-Control"), "max-age=2592000")
+}
+
+// TestImage_PerRequestRevalidation proves the defense holds when upstream flips its
+// response body between requests (give a real PNG once, HTML next time, etc.). Each
+// proxy response is independently validated against the body actually returned, so
+// trust never accumulates and an earlier "good" response cannot grant the next one a
+// free pass.
+func TestImage_PerRequestRevalidation(t *testing.T) {
+	htmlBody := []byte("<html><script>alert(1)</script></html>")
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "image/png") // always lie consistently
+		switch r.URL.Path {
+		case "/png":
+			_, _ = w.Write(gopherPNGBytes())
+		case "/html":
+			_, _ = w.Write(htmlBody)
+		}
+	}))
+	defer upstream.Close()
+
+	imageStore := image.StoreMock{LoadFunc: func(string) ([]byte, error) { return nil, nil }}
+	img := Image{
+		RemarkURL:    "https://demo.remark42.com",
+		RoutePath:    "/api/v1/proxy",
+		ImageService: image.NewService(&imageStore, image.ServiceParams{}),
+		Transport:    http.DefaultTransport,
+	}
+	ts := httptest.NewServer(http.HandlerFunc(img.Handler))
+	defer ts.Close()
+
+	// alternate calls: PNG, HTML, PNG, HTML — each must be judged on its own bytes.
+	type step struct {
+		path       string
+		wantStatus int
+		wantCT     string // prefix match
+	}
+	steps := []step{
+		{path: "/png", wantStatus: http.StatusOK, wantCT: "image/png"},
+		{path: "/html", wantStatus: http.StatusUnsupportedMediaType, wantCT: "application/json"},
+		{path: "/png", wantStatus: http.StatusOK, wantCT: "image/png"},
+		{path: "/html", wantStatus: http.StatusUnsupportedMediaType, wantCT: "application/json"},
+	}
+	for i, s := range steps {
+		t.Run(fmt.Sprintf("step_%d_%s", i, s.path), func(t *testing.T) {
+			encodedURL := base64.URLEncoding.EncodeToString([]byte(upstream.URL + s.path))
+			resp, err := http.Get(ts.URL + "/?src=" + encodedURL)
+			require.NoError(t, err)
+			body, _ := io.ReadAll(resp.Body)
+			require.NoError(t, resp.Body.Close())
+
+			assert.Equal(t, s.wantStatus, resp.StatusCode)
+			assert.True(t, strings.HasPrefix(resp.Header.Get("Content-Type"), s.wantCT),
+				"expected Content-Type prefix %q, got %q", s.wantCT, resp.Header.Get("Content-Type"))
+			assert.False(t, strings.HasPrefix(resp.Header.Get("Content-Type"), "text/html"),
+				"must never serve text/html under any flip")
+			assert.NotContains(t, string(body), "<script>",
+				"attacker payload must never appear in response body")
+			// every response must still carry the defense headers
+			assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+			assert.Contains(t, resp.Header.Get("Content-Disposition"), "inline")
+			assert.Contains(t, resp.Header.Get("Content-Security-Policy"),
+				"default-src 'none'; sandbox; frame-ancestors 'none'")
+		})
+	}
+}
+
 func imgHTTPTestsServer(t *testing.T) *httptest.Server {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/image/img1.png" {

backend/app/rest/user.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/go-pkgz/auth/token"
+	"github.com/go-pkgz/auth/v2/token"
 
 	"github.com/umputun/remark42/backend/app/store"
 )
@@ -56,7 +56,7 @@ func SetUserInfo(r *http.Request, user store.User) *http.Request {
 		Picture:  user.Picture,
 		IP:       user.IP,
 		Audience: user.SiteID,
-		Attributes: map[string]interface{}{
+		Attributes: map[string]any{
 			"blocked":  user.Blocked,
 			"verified": user.Verified,
 		},

backend/app/safehttp/safehttp.go

@@ -0,0 +1,86 @@
+// Package safehttp provides HTTP transports hardened against SSRF: outbound
+// connections are dialed using a pre-resolved IP, with a check that all
+// resolved IPs sit outside private/reserved ranges. This blocks both naive
+// SSRF (private IP literals in user-supplied URLs) and DNS rebinding.
+package safehttp
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+)
+
+// Transport returns an *http.Transport whose DialContext refuses any address
+// that resolves to a private/reserved IP, choosing the IP itself for the dial
+// to defeat DNS rebinding (an attacker cannot have the resolver hand back a
+// public IP at the check and a private one at the connect).
+//
+// The returned transport is a clone of http.DefaultTransport with only
+// DialContext overridden, preserving Proxy, HTTP/2, idle/keep-alive and
+// TLS handshake timeouts that bare &http.Transport{} would lose.
+func Transport() *http.Transport {
+	dialer := &net.Dialer{Timeout: 30 * time.Second}
+	t := http.DefaultTransport.(*http.Transport).Clone()
+	t.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		host, port, err := net.SplitHostPort(addr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid address %s: %w", addr, err)
+		}
+
+		ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+		if err != nil {
+			return nil, fmt.Errorf("can't resolve host %s: %w", host, err)
+		}
+		if len(ips) == 0 {
+			return nil, fmt.Errorf("no IP addresses resolved for host %s", host)
+		}
+
+		for _, ip := range ips {
+			if IsPrivateIP(ip.IP) {
+				return nil, fmt.Errorf("access to private address is not allowed")
+			}
+		}
+
+		var lastErr error
+		for _, ip := range ips {
+			conn, dialErr := dialer.DialContext(ctx, network, net.JoinHostPort(ip.String(), port))
+			if dialErr == nil {
+				return conn, nil
+			}
+			lastErr = dialErr
+		}
+		return nil, fmt.Errorf("can't connect to %s: %w", host, lastErr)
+	}
+	return t
+}
+
+// privateCIDRs holds pre-parsed private/reserved CIDR blocks.
+var privateCIDRs = func() []*net.IPNet {
+	cidrs := []string{
+		"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+		"100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
+		"::1/128", "fc00::/7", "fe80::/10",
+	}
+	blocks := make([]*net.IPNet, 0, len(cidrs))
+	for _, cidr := range cidrs {
+		_, block, _ := net.ParseCIDR(cidr)
+		blocks = append(blocks, block)
+	}
+	return blocks
+}()
+
+// IsPrivateIP reports whether ip falls in any private, loopback, link-local,
+// CGNAT, or reserved range — including IPv4 and IPv6 unspecified addresses.
+func IsPrivateIP(ip net.IP) bool {
+	if ip.IsUnspecified() {
+		return true
+	}
+	for _, block := range privateCIDRs {
+		if block.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}

backend/app/safehttp/safehttp_test.go

@@ -0,0 +1,90 @@
+package safehttp
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsPrivateIP(t *testing.T) {
+	tbl := []struct {
+		ip      string
+		private bool
+	}{
+		{"127.0.0.1", true},
+		{"10.0.0.1", true},
+		{"10.255.255.255", true},
+		{"172.16.0.1", true},
+		{"172.31.255.255", true},
+		{"192.168.0.1", true},
+		{"192.168.255.255", true},
+		{"169.254.1.1", true},
+		{"100.64.0.1", true},
+		{"100.127.255.255", true},
+		{"::1", true},
+		{"fc00::1", true},
+		{"fe80::1", true},
+		{"0.0.0.0", true},
+		{"::", true},
+		{"8.8.8.8", false},
+		{"203.0.113.1", false},
+		{"1.1.1.1", false},
+		{"2001:db8::1", false},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.ip, func(t *testing.T) {
+			ip := net.ParseIP(tt.ip)
+			require.NotNil(t, ip)
+			assert.Equal(t, tt.private, IsPrivateIP(ip))
+		})
+	}
+}
+
+func TestTransport_BlocksPrivate(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: Transport(), Timeout: 2 * time.Second}
+	resp, err := client.Get(srv.URL) // httptest.NewServer binds 127.0.0.1
+	if resp != nil {
+		_ = resp.Body.Close()
+	}
+	require.Error(t, err, "private address must be refused")
+	assert.Contains(t, err.Error(), "access to private address is not allowed")
+}
+
+func TestTransport_AllowsPublic(t *testing.T) {
+	tr := Transport()
+	// the policy check must reject the loopback literal
+	_, err := tr.DialContext(context.Background(), "tcp", "127.0.0.1:1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "access to private address is not allowed")
+
+	// public IP literal passes the policy check; bound the dial with a tight context
+	// so the test does not depend on real-world routing of TEST-NET-3 (203.0.113.0/24).
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	_, err = tr.DialContext(ctx, "tcp", "203.0.113.1:1")
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "access to private address is not allowed")
+}
+
+func TestTransport_PreservesDefaultTransportSettings(t *testing.T) {
+	def := http.DefaultTransport.(*http.Transport)
+	tr := Transport()
+	assert.NotNil(t, tr.Proxy, "Proxy must be inherited from http.DefaultTransport")
+	assert.Equal(t, def.ForceAttemptHTTP2, tr.ForceAttemptHTTP2, "ForceAttemptHTTP2")
+	assert.Equal(t, def.MaxIdleConns, tr.MaxIdleConns, "MaxIdleConns")
+	assert.Equal(t, def.IdleConnTimeout, tr.IdleConnTimeout, "IdleConnTimeout")
+	assert.Equal(t, def.TLSHandshakeTimeout, tr.TLSHandshakeTimeout, "TLSHandshakeTimeout")
+	assert.Equal(t, def.ExpectContinueTimeout, tr.ExpectContinueTimeout, "ExpectContinueTimeout")
+}

backend/app/store/comment.go

@@ -45,11 +45,13 @@ type Edit struct {
 
 // PostInfo holds summary for given post url
 type PostInfo struct {
-	URL      string    `json:"url,omitempty"` // can be attached to site-wide comments but won't be set then
-	Count    int       `json:"count"`
-	ReadOnly bool      `json:"read_only,omitempty" bson:"read_only,omitempty"` // can be attached to site-wide comments but won't be set then
-	FirstTS  time.Time `json:"first_time,omitempty" bson:"first_time,omitempty"`
-	LastTS   time.Time `json:"last_time,omitempty" bson:"last_time,omitempty"`
+	URL         string    `json:"url,omitempty"` // can be attached to site-wide comments but won't be set then
+	Count       int       `json:"count"`
+	CountLeft   int       `json:"count_left"`                                     // used only with returning search results limited by number, otherwise zero
+	LastComment string    `json:"last_comment,omitempty"`                         // used only with returning search results limited by number
+	ReadOnly    bool      `json:"read_only,omitempty" bson:"read_only,omitempty"` // can be attached to site-wide comments but won't be set then
+	FirstTS     time.Time `json:"first_time" bson:"first_time,omitempty"`
+	LastTS      time.Time `json:"last_time" bson:"last_time,omitempty"`
 }
 
 // BlockedUser holds id and ts for blocked user
@@ -142,7 +144,7 @@ func (c *Comment) Snippet(limit int) string {
 	if limit <= 0 {
 		limit = snippetLen
 	}
-	cleanText := strings.Replace(c.Text, "\n", " ", -1)
+	cleanText := strings.ReplaceAll(c.Text, "\n", " ")
 	size := len([]rune(cleanText))
 	if size < limit {
 		return cleanText
@@ -155,7 +157,7 @@ func (c *Comment) Snippet(limit int) string {
 			break
 		}
 	}
-	// Don't add a space if comment is just a one single word which has been truncated.
+	// don't add a space if comment is just a one single word which has been truncated.
 	if len(snippet) == limit {
 		return string(snippet) + "..."
 	}
@@ -177,9 +179,9 @@ func (c *Comment) SanitizeAsURL(inp string) string {
 
 func (c *Comment) escapeHTMLWithSome(inp string) string {
 	res := template.HTMLEscapeString(inp)
-	res = strings.Replace(res, "&amp;", "&", -1)
-	res = strings.Replace(res, "&#34;", "\"", -1)
-	res = strings.Replace(res, "&#39;", "'", -1)
+	res = strings.ReplaceAll(res, "&amp;", "&")
+	res = strings.ReplaceAll(res, "&#34;", "\"")
+	res = strings.ReplaceAll(res, "&#39;", "'")
 	return res
 }
 

backend/app/store/comment_test.go

@@ -120,7 +120,7 @@ func TestComment_PrepareUntrusted(t *testing.T) {
 		Score:       10,
 		Pin:         true,
 		Deleted:     true,
-		Timestamp:   time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Timestamp:   time.Date(2018, 1, 1, 9, 30, 0, 0, time.UTC),
 		Votes:       map[string]bool{"uu": true},
 		Controversy: 123,
 		Imported:    true,
@@ -150,7 +150,7 @@ func TestComment_SetDeleted(t *testing.T) {
 		Locator:   Locator{SiteID: "site", URL: "url"},
 		Score:     10,
 		Deleted:   false,
-		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.UTC),
 		Votes:     map[string]bool{"uu": true},
 		Pin:       true,
 	}
@@ -177,7 +177,7 @@ func TestComment_SetDeletedHard(t *testing.T) {
 		Locator:   Locator{SiteID: "site", URL: "url"},
 		Score:     10,
 		Deleted:   false,
-		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.UTC),
 		Votes:     map[string]bool{"uu": true},
 		Pin:       true,
 	}
@@ -209,7 +209,6 @@ func TestComment_Snippet(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			c := Comment{Text: tt.inp}
 			out := c.Snippet(tt.limit)
@@ -245,7 +244,6 @@ func TestComment_sanitizeAsURL(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		c := Comment{}
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			assert.Equal(t, tt.out, c.SanitizeAsURL(tt.inp))
@@ -276,7 +274,6 @@ func TestComment_sanitizeText(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		c := Comment{}
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			assert.Equal(t, tt.out, c.SanitizeText(tt.inp))

backend/app/store/engine/bolt.go

@@ -3,6 +3,7 @@ package engine
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -10,6 +11,7 @@ import (
 	log "github.com/go-pkgz/lgr"
 	"github.com/hashicorp/go-multierror"
 	bolt "go.etcd.io/bbolt"
+	berrors "go.etcd.io/bbolt/errors"
 
 	"github.com/umputun/remark42/backend/app/store"
 )
@@ -346,13 +348,13 @@ func (b *BoltDB) Info(req InfoRequest) ([]store.PostInfo, error) {
 
 // ListFlags get list of flagged keys, like blocked & verified user
 // works for full locator (post flags) or with userID
-func (b *BoltDB) ListFlags(req FlagRequest) (res []interface{}, err error) {
+func (b *BoltDB) ListFlags(req FlagRequest) (res []any, err error) {
 	bdb, e := b.db(req.Locator.SiteID)
 	if e != nil {
 		return nil, e
 	}
 
-	res = []interface{}{}
+	res = []any{}
 	switch req.Flag {
 	case Verified:
 		err = bdb.View(func(tx *bolt.Tx) error {
@@ -865,7 +867,6 @@ func (b *BoltDB) deleteUser(bdb *bolt.DB, siteID, userID string, mode store.Dele
 	// get list of commentID for all user's comment
 	comments := []commentInfo{}
 	for _, postInfo := range posts {
-		postInfo := postInfo
 		err = bdb.View(func(tx *bolt.Tx) error {
 			postsBkt := tx.Bucket([]byte(postsBucketName))
 			postBkt := postsBkt.Bucket([]byte(postInfo.URL))
@@ -894,31 +895,26 @@ func (b *BoltDB) deleteUser(bdb *bolt.DB, siteID, userID string, mode store.Dele
 	// delete collected comments
 	for _, ci := range comments {
 		if e := b.deleteComment(bdb, ci.locator, ci.commentID, mode); e != nil {
-			return fmt.Errorf("failed to delete comment %+v: %w", ci, err)
+			return fmt.Errorf("failed to delete comment %+v: %w", ci, e)
 		}
 	}
 
-	// delete user bucket in hard mode
+	// delete the user's bucket in hard mode. A user who only logged in but never commented has
+	// no per-user bucket, so tolerate ErrBucketNotFound; the top-level users bucket is created
+	// by NewBoltDB and is always present.
 	if mode == store.HardDelete {
 		err = bdb.Update(func(tx *bolt.Tx) error {
 			usersBkt := tx.Bucket([]byte(userBucketName))
-			if usersBkt != nil {
-				if e := usersBkt.DeleteBucket([]byte(userID)); e != nil {
-					return fmt.Errorf("failed to delete user bucket for %s: %w", userID, err)
-				}
+			if e := usersBkt.DeleteBucket([]byte(userID)); e != nil && !errors.Is(e, berrors.ErrBucketNotFound) {
+				return fmt.Errorf("failed to delete user bucket for %s: %w", userID, e)
 			}
 			return nil
 		})
-
 		if err != nil {
 			return fmt.Errorf("can't delete user meta: %w", err)
 		}
 	}
 
-	if len(comments) == 0 {
-		return fmt.Errorf("unknown user %s", userID)
-	}
-
 	return b.deleteUserDetail(bdb, userID, AllUserDetails)
 }
 
@@ -958,7 +954,7 @@ func (b *BoltDB) getUserBucket(tx *bolt.Tx, userID string) (*bolt.Bucket, error)
 }
 
 // save marshaled value to key for bucket. Should run in update tx
-func (b *BoltDB) save(bkt *bolt.Bucket, key string, value interface{}) (err error) {
+func (b *BoltDB) save(bkt *bolt.Bucket, key string, value any) (err error) {
 	if value == nil {
 		return fmt.Errorf("can't save nil value for %s", key)
 	}
@@ -973,7 +969,7 @@ func (b *BoltDB) save(bkt *bolt.Bucket, key string, value interface{}) (err erro
 }
 
 // load and unmarshal json value by key from bucket. Should run in view tx
-func (b *BoltDB) load(bkt *bolt.Bucket, key string, res interface{}) error {
+func (b *BoltDB) load(bkt *bolt.Bucket, key string, res any) error {
 	value := bkt.Get([]byte(key))
 	if value == nil {
 		return fmt.Errorf("no value for %s", key)
@@ -1028,7 +1024,7 @@ func (b *BoltDB) db(siteID string) (*bolt.DB, error) {
 
 // makeRef creates reference combining url and comment id
 func (b *BoltDB) makeRef(comment store.Comment) []byte {
-	return []byte(fmt.Sprintf("%s!!%s", comment.Locator.URL, comment.ID))
+	return fmt.Appendf(nil, "%s!!%s", comment.Locator.URL, comment.ID)
 }
 
 // parseRef gets parts of reference

backend/app/store/engine/bolt_test.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -48,7 +49,7 @@ func TestBoltDB_CreateFailedReadOnly(t *testing.T) {
 	comment := store.Comment{
 		ID:        "id-ro",
 		Text:      `some text, <a href="http://radio-t.com">link</a>`,
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com/ro", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}
@@ -147,20 +148,20 @@ func TestBoltDB_FindLastSince(t *testing.T) {
 	var b, teardown = prep(t)
 	defer teardown()
 
-	ts := time.Date(2017, 12, 20, 15, 18, 21, 0, time.Local)
+	ts := time.Date(2017, 12, 20, 15, 18, 21, 0, time.UTC)
 	req := FindRequest{Locator: store.Locator{SiteID: "radio-t"}, Sort: "-time", Since: ts}
 	res, err := b.Find(req)
 	assert.NoError(t, err)
 	require.Equal(t, 2, len(res))
 	assert.Equal(t, "some text2", res[0].Text)
 
-	req.Since = time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local)
+	req.Since = time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC)
 	res, err = b.Find(req)
 	assert.NoError(t, err)
 	require.Equal(t, 1, len(res))
 	assert.Equal(t, "some text2", res[0].Text)
 
-	req.Since = time.Date(2017, 12, 20, 16, 18, 22, 0, time.Local)
+	req.Since = time.Date(2017, 12, 20, 16, 18, 22, 0, time.UTC)
 	res, err = b.Find(req)
 	assert.NoError(t, err)
 	assert.Equal(t, 0, len(res))
@@ -170,20 +171,20 @@ func TestBoltDB_FindInPostSince(t *testing.T) {
 	var b, teardown = prep(t)
 	defer teardown()
 
-	ts := time.Date(2017, 12, 20, 15, 18, 21, 0, time.Local)
+	ts := time.Date(2017, 12, 20, 15, 18, 21, 0, time.UTC)
 	req := FindRequest{Locator: store.Locator{URL: "https://radio-t.com", SiteID: "radio-t"}, Sort: "-time", Since: ts}
 	res, err := b.Find(req)
 	assert.NoError(t, err)
 	require.Equal(t, 2, len(res))
 	assert.Equal(t, "some text2", res[0].Text)
 
-	req.Since = time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local)
+	req.Since = time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC)
 	res, err = b.Find(req)
 	assert.NoError(t, err)
 	require.Equal(t, 1, len(res))
 	assert.Equal(t, "some text2", res[0].Text)
 
-	req.Since = time.Date(2017, 12, 20, 16, 18, 22, 0, time.Local)
+	req.Since = time.Date(2017, 12, 20, 16, 18, 22, 0, time.UTC)
 	res, err = b.Find(req)
 	assert.NoError(t, err)
 	assert.Equal(t, 0, len(res))
@@ -236,10 +237,10 @@ func TestBoltDB_FindForUserPagination(t *testing.T) {
 	}
 
 	// write 200 comments
-	for i := 0; i < 200; i++ {
+	for i := range 200 {
 		c.ID = fmt.Sprintf("id-%d", i)
 		c.Text = fmt.Sprintf("text #%d", i)
-		c.Timestamp = time.Date(2017, 12, 20, 15, 18, i, 0, time.Local)
+		c.Timestamp = time.Date(2017, 12, 20, 15, 18, i, 0, time.UTC)
 		_, err = b.Create(c)
 		require.NoError(t, err)
 	}
@@ -324,13 +325,13 @@ func TestBoltDB_InfoPost(t *testing.T) {
 	b, teardown := prep(t) // two comments for https://radio-t.com
 	defer teardown()
 
-	ts := func(min int) time.Time { return time.Date(2017, 12, 20, 15, 18, min, 0, time.Local) }
+	ts := func(minute int) time.Time { return time.Date(2017, 12, 20, 15, 18, minute, 0, time.UTC) }
 
 	// add one more for https://radio-t.com/2
 	comment := store.Comment{
 		ID:        "12345",
 		Text:      `some text, <a href="http://radio-t.com">link</a>`,
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 24, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 24, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com/2", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}
@@ -379,14 +380,14 @@ func TestBoltDB_InfoList(t *testing.T) {
 	comment := store.Comment{
 		ID:        "12345",
 		Text:      `some text, <a href="http://radio-t.com">link</a>`,
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com/2", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}
 	_, err := b.Create(comment)
 	assert.NoError(t, err)
 
-	ts := func(sec int) time.Time { return time.Date(2017, 12, 20, 15, 18, sec, 0, time.Local) }
+	ts := func(sec int) time.Time { return time.Date(2017, 12, 20, 15, 18, sec, 0, time.UTC) }
 
 	req := InfoRequest{Locator: store.Locator{SiteID: "radio-t"}}
 	res, err := b.Info(req)
@@ -540,7 +541,7 @@ func TestBolt_FlagListVerified(t *testing.T) {
 	b, teardown := prep(t)
 	defer teardown()
 
-	toIDs := func(inp []interface{}) (res []string) {
+	toIDs := func(inp []any) (res []string) {
 		res = make([]string, len(inp))
 		for i, v := range inp {
 			vv, ok := v.(string)
@@ -571,47 +572,49 @@ func TestBolt_FlagListVerified(t *testing.T) {
 }
 
 func TestBolt_FlagListBlocked(t *testing.T) {
-	b, teardown := prep(t)
-	defer teardown()
+	synctest.Test(t, func(t *testing.T) {
+		b, teardown := prep(t)
+		defer teardown()
 
-	setBlocked := func(site, user string, status FlagStatus, ttl time.Duration) error {
-		req := FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: site}, UserID: user, Update: status, TTL: ttl}
-		_, err := b.Flag(req)
-		return err
-	}
-
-	toBlocked := func(inp []interface{}) (res []store.BlockedUser) {
-		res = make([]store.BlockedUser, len(inp))
-		for i, v := range inp {
-			vv, ok := v.(store.BlockedUser)
-			require.True(t, ok)
-			res[i] = vv
+		setBlocked := func(site, user string, status FlagStatus, ttl time.Duration) error {
+			req := FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: site}, UserID: user, Update: status, TTL: ttl}
+			_, err := b.Flag(req)
+			return err
 		}
-		return res
-	}
-	assert.NoError(t, setBlocked("radio-t", "user1", FlagTrue, 0))
-	assert.NoError(t, setBlocked("radio-t", "user2", FlagTrue, 150*time.Millisecond))
-	assert.NoError(t, setBlocked("radio-t", "user3", FlagFalse, 0))
 
-	vv, err := b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "radio-t"}})
-	assert.NoError(t, err)
+		toBlocked := func(inp []any) (res []store.BlockedUser) {
+			res = make([]store.BlockedUser, len(inp))
+			for i, v := range inp {
+				vv, ok := v.(store.BlockedUser)
+				require.True(t, ok)
+				res[i] = vv
+			}
+			return res
+		}
+		assert.NoError(t, setBlocked("radio-t", "user1", FlagTrue, 0))
+		assert.NoError(t, setBlocked("radio-t", "user2", FlagTrue, 150*time.Millisecond))
+		assert.NoError(t, setBlocked("radio-t", "user3", FlagFalse, 0))
 
-	blockedList := toBlocked(vv)
-	require.Equal(t, 2, len(blockedList))
-	assert.Equal(t, "user1", blockedList[0].ID)
-	assert.Equal(t, "user2", blockedList[1].ID)
-	t.Logf("%+v", blockedList)
+		vv, err := b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "radio-t"}})
+		assert.NoError(t, err)
 
-	// check block expiration
-	time.Sleep(150 * time.Millisecond)
-	vv, err = b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "radio-t"}})
-	assert.NoError(t, err)
-	blockedList = toBlocked(vv)
-	require.Equal(t, 1, len(blockedList))
-	assert.Equal(t, "user1", blockedList[0].ID)
+		blockedList := toBlocked(vv)
+		require.Equal(t, 2, len(blockedList))
+		assert.Equal(t, "user1", blockedList[0].ID)
+		assert.Equal(t, "user2", blockedList[1].ID)
+		t.Logf("%+v", blockedList)
 
-	_, err = b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "bad"}})
-	assert.EqualError(t, err, `site "bad" not found`)
+		// check block expiration
+		time.Sleep(150 * time.Millisecond)
+		vv, err = b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "radio-t"}})
+		assert.NoError(t, err)
+		blockedList = toBlocked(vv)
+		require.Equal(t, 1, len(blockedList))
+		assert.Equal(t, "user1", blockedList[0].ID)
+
+		_, err = b.ListFlags(FlagRequest{Flag: Blocked, Locator: store.Locator{SiteID: "bad"}})
+		assert.EqualError(t, err, `site "bad" not found`)
+	})
 }
 
 func TestBoltDB_UserDetail(t *testing.T) {
@@ -840,6 +843,63 @@ func TestBoltAdmin_DeleteUserHard(t *testing.T) {
 	assert.EqualError(t, err, `site "radio-t-bad" not found`)
 }
 
+// TestBoltAdmin_DeleteUserHard_NoComments covers hard-deleting a user who has no comments
+// (and therefore no user bucket) — e.g. one who only logged in. This must succeed rather than
+// fail on the missing bucket, and must still remove any stored user details.
+func TestBoltAdmin_DeleteUserHard_NoComments(t *testing.T) {
+	b, teardown := prep(t)
+	defer teardown()
+
+	t.Run("login-only user with a detail but no comments", func(t *testing.T) {
+		const userID = "login-only-user"
+		loc := store.Locator{SiteID: "radio-t"}
+
+		// user logged in and has a stored detail, but never commented (no user bucket)
+		_, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail, Update: "user@example.com"})
+		require.NoError(t, err)
+
+		err = b.Delete(DeleteRequest{Locator: loc, UserID: userID, DeleteMode: store.HardDelete})
+		require.NoError(t, err, "hard delete must not fail on a missing user bucket")
+
+		details, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail})
+		require.NoError(t, err)
+		assert.Empty(t, details, "stored user detail must be removed on hard delete")
+	})
+
+	t.Run("unknown user is a no-op", func(t *testing.T) {
+		err := b.Delete(DeleteRequest{Locator: store.Locator{SiteID: "radio-t"}, UserID: "never-seen-user", DeleteMode: store.HardDelete})
+		assert.NoError(t, err, "hard-deleting an unknown user must not error")
+	})
+}
+
+// TestBoltAdmin_DeleteUserSoft_NoComments covers soft-deleting a user with no comments. As with the
+// hard path (and the existing soft path for users who do have comments) it cleans stored user
+// details and is a no-op for an unknown user.
+func TestBoltAdmin_DeleteUserSoft_NoComments(t *testing.T) {
+	b, teardown := prep(t)
+	defer teardown()
+
+	t.Run("login-only user with a detail but no comments", func(t *testing.T) {
+		const userID = "login-only-soft"
+		loc := store.Locator{SiteID: "radio-t"}
+
+		_, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail, Update: "user@example.com"})
+		require.NoError(t, err)
+
+		err = b.Delete(DeleteRequest{Locator: loc, UserID: userID, DeleteMode: store.SoftDelete})
+		require.NoError(t, err)
+
+		details, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail})
+		require.NoError(t, err)
+		assert.Empty(t, details, "soft delete cleans stored user details, consistent with the has-comments path")
+	})
+
+	t.Run("unknown user is a no-op", func(t *testing.T) {
+		err := b.Delete(DeleteRequest{Locator: store.Locator{SiteID: "radio-t"}, UserID: "never-seen-soft", DeleteMode: store.SoftDelete})
+		assert.NoError(t, err, "soft-deleting an unknown user must not error")
+	})
+}
+
 func TestBoltAdmin_DeleteUserSoft(t *testing.T) {
 	b, teardown := prep(t)
 	defer teardown()
@@ -890,7 +950,7 @@ func TestBoltDB_ref(t *testing.T) {
 	comment := store.Comment{
 		ID:        "12345",
 		Text:      `some text, <a href="http://radio-t.com">link</a>`,
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com/2", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}
@@ -929,7 +989,7 @@ func prep(t *testing.T) (b *BoltDB, teardown func()) {
 	comment := store.Comment{
 		ID:        "id-1",
 		Text:      `some text, <a href="http://radio-t.com">link</a>`,
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 22, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}
@@ -939,7 +999,7 @@ func prep(t *testing.T) (b *BoltDB, teardown func()) {
 	comment = store.Comment{
 		ID:        "id-2",
 		Text:      "some text2",
-		Timestamp: time.Date(2017, 12, 20, 15, 18, 23, 0, time.Local),
+		Timestamp: time.Date(2017, 12, 20, 15, 18, 23, 0, time.UTC),
 		Locator:   store.Locator{URL: "https://radio-t.com", SiteID: "radio-t"},
 		User:      store.User{ID: "user1", Name: "user name"},
 	}

backend/app/store/engine/engine.go

@@ -24,7 +24,7 @@ type Interface interface {
 	Count(req FindRequest) (int, error)                         // get count for post or user
 	Delete(req DeleteRequest) error                             // Delete post(s), user, comment, user details, or everything
 	Flag(req FlagRequest) (bool, error)                         // set and get flags
-	ListFlags(req FlagRequest) ([]interface{}, error)           // get list of flagged keys, like blocked & verified user
+	ListFlags(req FlagRequest) ([]any, error)                   // get list of flagged keys, like blocked & verified user
 
 	// UserDetail sets or gets single detail value, or gets all details for requested site
 	// Returns list even for single entry request is a compromise in order to have both single detail getting and setting
@@ -45,7 +45,7 @@ type FindRequest struct {
 	Locator store.Locator `json:"locator"`           // lack of URL means site operation
 	UserID  string        `json:"user_id,omitempty"` // presence of UserID treated as user-related find
 	Sort    string        `json:"sort,omitempty"`    // sort order with +/-field syntax
-	Since   time.Time     `json:"since,omitempty"`   // time limit for found results
+	Since   time.Time     `json:"since"`             // time limit for found results
 	Limit   int           `json:"limit,omitempty"`
 	Skip    int           `json:"skip,omitempty"`
 }

backend/app/store/engine/engine_mock.go

@@ -4,8 +4,9 @@
 package engine
 
 import (
-	store "github.com/umputun/remark42/backend/app/store"
 	"sync"
+
+	store "github.com/umputun/remark42/backend/app/store"
 )
 
 // Ensure, that InterfaceMock does implement Interface.

backend/app/store/engine/engine_test.go

@@ -11,10 +11,10 @@ import (
 
 func TestEngine_sortComments(t *testing.T) {
 	cc := []store.Comment{
-		{ID: "1", Score: 5, Controversy: 1, Timestamp: time.Date(2018, 2, 5, 10, 1, 0, 0, time.Local)},
-		{ID: "2", Score: 4, Controversy: 2, Timestamp: time.Date(2018, 2, 5, 10, 2, 0, 0, time.Local)},
-		{ID: "3", Score: 6, Controversy: 3, Timestamp: time.Date(2018, 2, 5, 10, 3, 0, 0, time.Local)},
-		{ID: "4", Score: 6, Controversy: 1, Timestamp: time.Date(2018, 2, 5, 10, 4, 0, 0, time.Local)},
+		{ID: "1", Score: 5, Controversy: 1, Timestamp: time.Date(2018, 2, 5, 10, 1, 0, 0, time.UTC)},
+		{ID: "2", Score: 4, Controversy: 2, Timestamp: time.Date(2018, 2, 5, 10, 2, 0, 0, time.UTC)},
+		{ID: "3", Score: 6, Controversy: 3, Timestamp: time.Date(2018, 2, 5, 10, 3, 0, 0, time.UTC)},
+		{ID: "4", Score: 6, Controversy: 1, Timestamp: time.Date(2018, 2, 5, 10, 4, 0, 0, time.UTC)},
 	}
 
 	SortComments(cc, "+time")

backend/app/store/engine/remote.go

@@ -71,24 +71,24 @@ func (r *RPC) Flag(req FlagRequest) (status bool, err error) {
 	return status, err
 }
 
-func unmarshalString(data []byte) ([]interface{}, error) {
+func unmarshalString(data []byte) ([]any, error) {
 	var strings []string
 	if err := json.Unmarshal(data, &strings); err != nil {
 		return nil, err
 	}
-	list := make([]interface{}, 0, len(strings))
+	list := make([]any, 0, len(strings))
 	for _, w := range strings {
 		list = append(list, w)
 	}
 	return list, nil
 }
 
-func unmarshalBlockedUser(data []byte) ([]interface{}, error) {
+func unmarshalBlockedUser(data []byte) ([]any, error) {
 	var blockedUsers []store.BlockedUser
 	if err := json.Unmarshal(data, &blockedUsers); err != nil {
 		return nil, err
 	}
-	list := make([]interface{}, 0, len(blockedUsers))
+	list := make([]any, 0, len(blockedUsers))
 	for _, w := range blockedUsers {
 		list = append(list, w)
 	}
@@ -96,7 +96,7 @@ func unmarshalBlockedUser(data []byte) ([]interface{}, error) {
 }
 
 // ListFlags get list of flagged keys, like blocked & verified user
-func (r *RPC) ListFlags(req FlagRequest) ([]interface{}, error) {
+func (r *RPC) ListFlags(req FlagRequest) ([]any, error) {
 	resp, err := r.Call("store.list_flags", req)
 	if err != nil {
 		return nil, err

backend/app/store/formatter.go

@@ -99,7 +99,7 @@ func (f *CommentFormatter) unEscape(txt string) (res string) {
 	}
 	res = txt
 	for _, e := range elems {
-		res = strings.Replace(res, e.from, e.to, -1)
+		res = strings.ReplaceAll(res, e.from, e.to)
 	}
 	return res
 }

backend/app/store/formatter_test.go

@@ -43,14 +43,13 @@ func TestFormatter_FormatText(t *testing.T) {
 		{`no_smartpants «quoted» text`, "<p>no_smartpants «quoted» text</p>\n!converted", "French guillemets without smartpants"},
 		{`«quoted» text`, "<p>«quoted» text</p>\n!converted", "French guillemets with smartpants"},
 		{"smth\n```go\nfunc main(aa string) int {return 0}\n```", `<p>smth</p>
-<pre class="chroma"><code><span class="line"><span class="cl"><span class="kd">func</span> <span class="nf">main</span><span class="p">(</span><span class="nx">aa</span> <span class="kt">string</span><span class="p">)</span> <span class="kt">int</span> <span class="p">{</span><span class="k">return</span> <span class="mi">0</span><span class="p">}</span>
-</span></span></code></pre>!converted`, "code with language"},
+<pre class="chroma"><code><span class="line"><span class="cl"><span class="kd">func</span><span class="w"> </span><span class="nf">main</span><span class="p">(</span><span class="nx">aa</span><span class="w"> </span><span class="kt">string</span><span class="p">)</span><span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="p">{</span><span class="k">return</span><span class="w"> </span><span class="mi">0</span><span class="p">}</span><span class="w">
+</span></span></span></code></pre>!converted`, "code with language"},
 		{"```\ntest_code\n```", `<pre class="chroma"><code><span class="line"><span class="cl">test_code
 </span></span></code></pre>!converted`, "code without language"},
 	}
 	f := NewCommentFormatter(mockConverter{})
 	for _, tt := range tbl {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			raw := strings.HasPrefix(tt.in, `no_smartpants`)
 			t.Logf("raw: %v", raw)
@@ -80,7 +79,7 @@ func TestFormatter_FormatComment(t *testing.T) {
 		Score:     10,
 		Pin:       true,
 		Deleted:   true,
-		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.UTC),
 		Votes:     map[string]bool{"uu": true},
 	}
 
@@ -146,7 +145,6 @@ func TestCommentFormatter_lazyImage(t *testing.T) {
 
 	f := NewCommentFormatter(nil)
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			assert.Equal(t, tt.out, f.lazyImage(tt.inp))
 		})

backend/app/store/image/bolt_store_test.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -89,50 +90,53 @@ func TestBoltStore_LoadAfterDelete(t *testing.T) {
 }
 
 func TestBoltStore_Cleanup(t *testing.T) {
-	svc, teardown := prepareBoltImageStorageTest(t)
-	defer teardown()
+	synctest.Test(t, func(t *testing.T) {
+		svc, teardown := prepareBoltImageStorageTest(t)
+		defer teardown()
 
-	save := func(file string) (id string) {
-		err := svc.Save(file, gopherPNGBytes())
+		save := func(file string) (id string) {
+			err := svc.Save(file, gopherPNGBytes())
+			require.NoError(t, err)
+
+			checkBoltImgData(t, svc.db, imagesStagedBktName, file, func(data []byte) error {
+				require.NotNil(t, data)
+				assert.Equal(t, 1462, len(data))
+				return nil
+			})
+			return file
+		}
+
+		// save 3 images to staging
+		img1 := save("blah_ff1.png")
+		img1ts := time.Now()
+		time.Sleep(100 * time.Millisecond)
+		img2 := save("blah_ff2.png")
+		time.Sleep(100 * time.Millisecond)
+		img3 := save("blah_ff3.png")
+
+		// Cleanup check is `age > ttl` (strict), so pick a ttl strictly less than img1's age
+		err := svc.Cleanup(context.Background(), time.Since(img1ts)-time.Millisecond)
+		assert.NoError(t, err)
+
+		assertBoltImgNil(t, svc.db, imagesStagedBktName, img1)
+		assertBoltImgNil(t, svc.db, imagesBktName, img1)
+		assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img2)
+		assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img3)
+
+		err = svc.Commit(img3)
 		require.NoError(t, err)
 
-		checkBoltImgData(t, svc.db, imagesStagedBktName, file, func(data []byte) error {
-			require.NotNil(t, data)
-			assert.Equal(t, 1462, len(data))
-			return nil
-		})
-		return file
-	}
+		// reset the time to cleanup
+		err = svc.ResetCleanupTimer(img2)
+		require.NoError(t, err)
+		err = svc.Cleanup(context.Background(), time.Millisecond*100)
+		assert.NoError(t, err)
 
-	// save 3 images to staging
-	img1 := save("blah_ff1.png")
-	img1ts := time.Now()
-	time.Sleep(100 * time.Millisecond)
-	img2 := save("blah_ff2.png")
-	time.Sleep(100 * time.Millisecond)
-	img3 := save("blah_ff3.png")
-
-	err := svc.Cleanup(context.Background(), time.Since(img1ts)) // clean first images
-	assert.NoError(t, err)
-
-	assertBoltImgNil(t, svc.db, imagesStagedBktName, img1)
-	assertBoltImgNil(t, svc.db, imagesBktName, img1)
-	assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img2)
-	assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img3)
-
-	err = svc.Commit(img3)
-	require.NoError(t, err)
-
-	// reset the time to cleanup
-	err = svc.ResetCleanupTimer(img2)
-	require.NoError(t, err)
-	err = svc.Cleanup(context.Background(), time.Millisecond*100)
-	assert.NoError(t, err)
-
-	assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img2)
-	assertBoltImgNil(t, svc.db, imagesBktName, img2)
-	assertBoltImgNotNil(t, svc.db, imagesBktName, img3)
-	assert.NoError(t, err)
+		assertBoltImgNotNil(t, svc.db, imagesStagedBktName, img2)
+		assertBoltImgNil(t, svc.db, imagesBktName, img2)
+		assertBoltImgNotNil(t, svc.db, imagesBktName, img3)
+		assert.NoError(t, err)
+	})
 }
 
 func TestBolt_Info(t *testing.T) {

backend/app/store/image/fs_store.go

@@ -37,11 +37,11 @@ type FileSystem struct {
 func (f *FileSystem) Save(id string, img []byte) error {
 	dst := f.location(f.Staging, id)
 
-	if err := os.MkdirAll(path.Dir(dst), 0o700); err != nil {
+	if err := os.MkdirAll(path.Dir(dst), 0o700); err != nil { //nolint:gosec // id is server-generated hash via image.Service (Save / SaveWithID); dst computed via f.location
 		return fmt.Errorf("can't make image directory: %w", err)
 	}
 
-	if err := os.WriteFile(dst, img, 0o600); err != nil {
+	if err := os.WriteFile(dst, img, 0o600); err != nil { //nolint:gosec // same as MkdirAll above
 		return fmt.Errorf("can't write image file with id %s: %w", id, err)
 	}
 
@@ -147,8 +147,8 @@ func (f *FileSystem) Cleanup(_ context.Context, ttl time.Duration) error {
 		age := time.Since(info.ModTime())
 		if age > (ttl + 100*time.Millisecond) { // delay cleanup triggering to allow commit
 			log.Printf("[INFO] remove staging image %s, age %v", fpath, age)
-			rmErr := os.Remove(fpath)
-			_ = os.Remove(path.Dir(fpath)) // try to remove directory
+			rmErr := os.Remove(fpath)             //nolint:gosec // staging dir is server-only, no untrusted symlinks land here
+			_ = os.Remove(path.Dir(fpath))        //nolint:gosec // same staging dir
 			return rmErr
 		}
 		return nil

backend/app/store/image/fs_store_test.go

@@ -173,7 +173,6 @@ func TestFsStore_location(t *testing.T) {
 		{0, "user/12345", "/tmp/user/12345"},
 	}
 	for n, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(n), func(t *testing.T) {
 			svc := FileSystem{Location: "/tmp", Partitions: tt.partitions}
 			assert.Equal(t, tt.res, svc.location("/tmp", tt.id))
@@ -191,7 +190,7 @@ func TestFsStore_location(t *testing.T) {
 	}
 
 	svc := FileSystem{Location: "/tmp", Partitions: 10}
-	for i := 0; i < 1000; i++ {
+	for range 1000 {
 		v := randomID(rand.Intn(64))
 		location := svc.location("/tmp", v)
 		elems := strings.Split(location, "/")

backend/app/store/image/image.go

@@ -13,9 +13,8 @@ import (
 	"encoding/base64"
 	"fmt"
 	"image"
-	// support gif and jpeg images decoding
-	_ "image/gif"
-	_ "image/jpeg"
+	_ "image/gif"  // register gif decoder
+	_ "image/jpeg" // register jpeg decoder
 	"image/png"
 	"io"
 	"net/http"
@@ -31,6 +30,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/rs/xid"
 	"golang.org/x/image/draw"
+	_ "golang.org/x/image/webp" // register webp decoder so DecodeConfig accepts what readAndValidateImage allows
 )
 
 // Service wraps Store with common functions needed for any store implementation
@@ -110,9 +110,7 @@ func (s *Service) Submit(idsFn func() []string) {
 	s.once.Do(func() {
 		log.Printf("[DEBUG] image submitter activated")
 		s.submitCh = make(chan submitReq, submitQueueSize)
-		s.wg.Add(1)
-		go func() {
-			defer s.wg.Done()
+		s.wg.Go(func() {
 			for req := range s.submitCh {
 				// wait for EditDuration expiration with emergency pass on term
 				for atomic.LoadInt32(&s.term) == 0 && time.Since(req.TS) <= s.EditDuration {
@@ -126,7 +124,7 @@ func (s *Service) Submit(idsFn func() []string) {
 				atomic.AddInt32(&s.submitCount, -1)
 			}
 			log.Printf("[INFO] image submitter terminated")
-		}()
+		})
 	})
 
 	atomic.AddInt32(&s.submitCount, 1)
@@ -154,6 +152,12 @@ func (s *Service) ExtractNonProxiedPictures(commentHTML string) (ids []string) {
 
 // Cleanup runs periodic cleanup with 1.5*ServiceParams.EditDuration. Blocking loop, should be called inside of goroutine by consumer
 func (s *Service) Cleanup(ctx context.Context) {
+	if s.EditDuration <= 0 {
+		log.Printf("[INFO] pictures cleanup disabled, edit duration is %v", s.EditDuration)
+		<-ctx.Done()
+		return
+	}
+
 	cleanupTTL := s.EditDuration * 15 / 10 // cleanup images older than 1.5 * EditDuration
 	log.Printf("[INFO] start pictures cleanup, staging ttl=%v", cleanupTTL)
 
@@ -233,16 +237,6 @@ func (s *Service) SaveWithID(id string, r io.Reader) error {
 	return s.store.Save(id, img)
 }
 
-// ImgContentType returns content type for provided image
-func (s *Service) ImgContentType(img []byte) string {
-	contentType := http.DetectContentType(img)
-	if contentType == "application/octet-stream" {
-		// replace generic fallback with one which make sense in our scenario
-		return "image/*"
-	}
-	return contentType
-}
-
 // returns list of image IDs from the comment html, including proxied images if includeProxied is true
 func (s *Service) extractImageIDs(commentHTML string, includeProxied bool) (ids []string) {
 	doc, err := goquery.NewDocumentFromReader(strings.NewReader(commentHTML))
@@ -280,6 +274,13 @@ func (s *Service) extractImageIDs(commentHTML string, includeProxied bool) (ids
 	return ids
 }
 
+// maxImagePixels caps the declared pixel count of an image before any raster decode
+// is allowed. Without this, a tiny compressed "decompression bomb" image declaring
+// e.g. 65535x65535 px would force image.Decode to allocate gigabytes of pixel memory
+// and OOM the service on a single comment upload. 16 MP covers any realistic image
+// (~4096x4096) while keeping peak allocation bounded.
+const maxImagePixels = 16 * 1024 * 1024
+
 // prepareImage calls readAndValidateImage and resize on provided image.
 func (s *Service) prepareImage(r io.Reader) ([]byte, error) {
 	data, err := readAndValidateImage(r, s.MaxSize)
@@ -287,32 +288,59 @@ func (s *Service) prepareImage(r io.Reader) ([]byte, error) {
 		return nil, fmt.Errorf("can't load image: %w", err)
 	}
 
-	data = resize(data, s.MaxWidth, s.MaxHeight)
-	return data, nil
+	resized := resize(data, s.MaxWidth, s.MaxHeight)
+	if resized == nil {
+		return nil, fmt.Errorf("image rejected: malformed or exceeds %d-pixel safe limit", maxImagePixels)
+	}
+	return resized, nil
 }
 
-// resize an image of supported format (PNG, JPG, GIF) to the size of "limit" px of
-// the biggest side (width or height) preserving aspect ratio.
-// Returns original data if resizing is not needed or failed.
-// If resized the result will be for png format
+// resize validates an image and, if needed, re-encodes it to fit within the given
+// pixel limits preserving aspect ratio. Returns nil for malformed input or for
+// declared dimensions exceeding maxImagePixels so attacker payloads (decompression
+// bombs) never reach the store. With limit <= 0 or when the image already fits, the
+// original bytes are returned verbatim so animated GIFs and other multi-frame formats
+// round-trip without being flattened to one frame.
+//
+// Validation uses image.DecodeConfig (cheap — declares dimensions, allocates nothing)
+// before any full image.Decode, so a 100 KB compressed image declaring 65535x65535 px
+// is rejected without ever materializing the raster.
 func resize(data []byte, limitW, limitH int) []byte {
-	if data == nil || limitW <= 0 || limitH <= 0 {
-		return data
+	if len(data) == 0 {
+		return nil
 	}
 
-	src, _, err := image.Decode(bytes.NewBuffer(data))
+	// validate format and dimensions without allocating pixel memory.
+	cfg, _, err := image.DecodeConfig(bytes.NewReader(data))
 	if err != nil {
-		log.Printf("[WARN] can't decode image, %s", err)
-		return data
+		log.Printf("[WARN] can't decode image config, %s", err)
+		return nil
+	}
+	// multiply in int64 — on 32-bit builds (GOARCH=386, 32-bit arm) the int
+	// product of two 16-bit-or-larger dimensions can overflow and wrap below
+	// maxImagePixels, bypassing the cap.
+	if cfg.Width <= 0 || cfg.Height <= 0 || int64(cfg.Width)*int64(cfg.Height) > int64(maxImagePixels) {
+		log.Printf("[WARN] image dimensions %dx%d exceed safe limit", cfg.Width, cfg.Height)
+		return nil
+	}
+
+	// dimensions are bounded — full decode is now safe to allocate. Decode also
+	// validates the raster body: a header that DecodeConfig accepts but with a
+	// corrupt or truncated payload would slip through if we returned early on the
+	// no-resize path without ever touching the pixels. Decode unconditionally,
+	// then either return the original bytes (no resize needed, multi-frame intact)
+	// or the re-encoded result.
+	src, _, err := image.Decode(bytes.NewReader(data))
+	if err != nil {
+		log.Printf("[WARN] can't decode image after dim-check, %s", err)
+		return nil
 	}
 
-	bounds := src.Bounds()
-	w, h := bounds.Dx(), bounds.Dy()
-	if w <= limitW && h <= limitH || w <= 0 || h <= 0 {
-		log.Printf("[DEBUG] resizing image is smaller that the limit or has 0 size")
+	if limitW <= 0 || limitH <= 0 || (cfg.Width <= limitW && cfg.Height <= limitH) {
 		return data
 	}
 
+	w, h := src.Bounds().Dx(), src.Bounds().Dy()
 	newW, newH := getProportionalSizes(w, h, limitW, limitH)
 	m := image.NewRGBA(image.Rect(0, 0, newW, newH))
 	draw.CatmullRom.Scale(m, m.Bounds(), src, src.Bounds(), draw.Src, nil)
@@ -320,7 +348,7 @@ func resize(data []byte, limitW, limitH int) []byte {
 	var out bytes.Buffer
 	if err = png.Encode(&out, m); err != nil {
 		log.Printf("[WARN] can't encode resized image to png, %s", err)
-		return data
+		return data // fall back to the validated original
 	}
 	return out.Bytes()
 }
@@ -361,8 +389,14 @@ func readAndValidateImage(r io.Reader, maxSize int) ([]byte, error) {
 		return nil, fmt.Errorf("file is too large (limit=%d)", maxSize)
 	}
 
-	// read header first, needs it to check if data is valid png/gif/jpeg
-	if !isValidImage(data[:512]) {
+	// read header first to check the format. http.DetectContentType inspects up
+	// to the first 512 bytes, but a smaller body is fine — pass the whole slice
+	// rather than panicking on a fixed-size sub-slice.
+	header := data
+	if len(header) > 512 {
+		header = header[:512]
+	}
+	if !isValidImage(header) {
 		return nil, fmt.Errorf("file format not allowed")
 	}
 

backend/app/store/image/image_test.go

@@ -11,6 +11,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -56,10 +57,10 @@ func TestService_ResizeJpeg(t *testing.T) {
 
 	img, err := readAndValidateImage(fh, 32000)
 	assert.NoError(t, err)
-	assert.Equal(t, 16756, len(img))
+	assert.InDelta(t, 16756, len(img), 100)
 
 	img = resize(img, 400, 300)
-	assert.Equal(t, 10918, len(img))
+	assert.InDelta(t, 10913, len(img), 100)
 }
 
 func TestService_SaveTooLarge(t *testing.T) {
@@ -125,37 +126,41 @@ func TestService_ExtractPictures(t *testing.T) {
 }
 
 func TestService_Cleanup(t *testing.T) {
-	store := StoreMock{
-		CleanupFunc: func(context.Context, time.Duration) error {
-			return nil
-		},
-	}
+	synctest.Test(t, func(t *testing.T) {
+		store := StoreMock{
+			CleanupFunc: func(context.Context, time.Duration) error {
+				return nil
+			},
+		}
 
-	svc := NewService(&store, ServiceParams{EditDuration: 20 * time.Millisecond})
-	// cancel context after 2.1 cleanup TTLs
-	ctx, cancel := context.WithTimeout(context.Background(), svc.EditDuration/100*15*21)
-	defer cancel()
-	svc.Cleanup(ctx)
-	assert.Equal(t, 2, len(store.CleanupCalls()))
+		svc := NewService(&store, ServiceParams{EditDuration: 20 * time.Millisecond})
+		// cancel context after 2.1 cleanup TTLs
+		ctx, cancel := context.WithTimeout(context.Background(), svc.EditDuration/100*15*21)
+		defer cancel()
+		svc.Cleanup(ctx)
+		assert.Equal(t, 2, len(store.CleanupCalls()))
+	})
 }
 
 func TestService_Submit(t *testing.T) {
-	store := StoreMock{
-		CommitFunc:            func(string) error { return nil },
-		ResetCleanupTimerFunc: func(string) error { return nil },
-	}
-	svc := NewService(&store, ServiceParams{ImageAPI: "/blah/", EditDuration: time.Millisecond * 100})
-	svc.Submit(func() []string { return []string{"id1", "id2", "id3"} })
-	assert.Equal(t, 3, len(store.ResetCleanupTimerCalls()))
-	err := svc.Commit(func() []string { return []string{"id4", "id5"} })
-	assert.NoError(t, err)
-	svc.Submit(func() []string { return []string{"id6", "id7"} })
-	assert.Equal(t, 5, len(store.ResetCleanupTimerCalls()))
-	svc.Submit(nil)
-	assert.Equal(t, 2, len(store.CommitCalls()))
-	time.Sleep(time.Millisecond * 175)
-	assert.Equal(t, 7, len(store.CommitCalls()))
-	svc.Close(context.TODO())
+	synctest.Test(t, func(t *testing.T) {
+		store := StoreMock{
+			CommitFunc:            func(string) error { return nil },
+			ResetCleanupTimerFunc: func(string) error { return nil },
+		}
+		svc := NewService(&store, ServiceParams{ImageAPI: "/blah/", EditDuration: time.Millisecond * 100})
+		svc.Submit(func() []string { return []string{"id1", "id2", "id3"} })
+		assert.Equal(t, 3, len(store.ResetCleanupTimerCalls()))
+		err := svc.Commit(func() []string { return []string{"id4", "id5"} })
+		assert.NoError(t, err)
+		svc.Submit(func() []string { return []string{"id6", "id7"} })
+		assert.Equal(t, 5, len(store.ResetCleanupTimerCalls()))
+		svc.Submit(nil)
+		assert.Equal(t, 2, len(store.CommitCalls()))
+		time.Sleep(time.Millisecond * 175)
+		assert.Equal(t, 7, len(store.CommitCalls()))
+		svc.Close(context.TODO())
+	})
 }
 
 func TestService_Close(t *testing.T) {
@@ -173,21 +178,23 @@ func TestService_Close(t *testing.T) {
 }
 
 func TestService_SubmitDelay(t *testing.T) {
-	store := StoreMock{
-		CommitFunc: func(string) error { return nil },
-		ResetCleanupTimerFunc: func(string) error {
-			return nil
-		},
-	}
-	svc := NewService(&store, ServiceParams{EditDuration: 20 * time.Millisecond})
-	svc.Submit(func() []string { return []string{"id1", "id2", "id3"} })
-	time.Sleep(150 * time.Millisecond) // let first batch to pass TTL
-	svc.Submit(func() []string { return []string{"id4", "id5"} })
-	svc.Submit(nil)
-	assert.Equal(t, 5, len(store.ResetCleanupTimerCalls()))
-	assert.Equal(t, 3, len(store.CommitCalls()))
-	svc.Close(context.TODO())
-	assert.Equal(t, 5, len(store.CommitCalls()))
+	synctest.Test(t, func(t *testing.T) {
+		store := StoreMock{
+			CommitFunc: func(string) error { return nil },
+			ResetCleanupTimerFunc: func(string) error {
+				return nil
+			},
+		}
+		svc := NewService(&store, ServiceParams{EditDuration: 20 * time.Millisecond})
+		svc.Submit(func() []string { return []string{"id1", "id2", "id3"} })
+		time.Sleep(150 * time.Millisecond) // let first batch to pass TTL
+		svc.Submit(func() []string { return []string{"id4", "id5"} })
+		svc.Submit(nil)
+		assert.Equal(t, 5, len(store.ResetCleanupTimerCalls()))
+		assert.Equal(t, 3, len(store.CommitCalls()))
+		svc.Close(context.TODO())
+		assert.Equal(t, 5, len(store.CommitCalls()))
+	})
 }
 
 func TestService_Info(t *testing.T) {
@@ -203,19 +210,17 @@ func TestService_Info(t *testing.T) {
 }
 
 func TestService_resize(t *testing.T) {
-	// reader is nil
-	resized := resize(nil, 100, 100)
-	assert.Nil(t, resized)
+	t.Run("empty data returns nil", func(t *testing.T) {
+		assert.Nil(t, resize(nil, 100, 100))
+		assert.Nil(t, resize([]byte{}, 100, 100))
+	})
 
-	// negative limit error
-	resized = resize([]byte("some picture bin data"), -1, -1)
-	require.NotNil(t, resized)
-	assert.Equal(t, resized, []byte("some picture bin data"))
-
-	// decode error
-	resized = resize([]byte("invalid image content"), 100, 100)
-	assert.NotNil(t, resized)
-	assert.Equal(t, resized, []byte("invalid image content"))
+	t.Run("non-image bytes are refused", func(t *testing.T) {
+		// previously resize would fall back to the raw bytes on decode failure, letting
+		// attacker-controlled non-image content reach the store. After hardening, refuse.
+		assert.Nil(t, resize([]byte("some picture bin data"), -1, -1))
+		assert.Nil(t, resize([]byte("invalid image content"), 100, 100))
+	})
 
 	cases := []struct {
 		file   string
@@ -230,7 +235,7 @@ func TestService_resize(t *testing.T) {
 		require.NoError(t, err, "can't open test file %s", c.file)
 
 		// no need for resize, image dimensions are smaller than resize limit
-		resized = resize(img, 800, 800)
+		resized := resize(img, 800, 800)
 		assert.NotNil(t, resized, "file %s", c.file)
 		assert.Equal(t, resized, img)
 
@@ -246,6 +251,76 @@ func TestService_resize(t *testing.T) {
 	}
 }
 
+// TestService_SaveWithIDShortPayload guards readAndValidateImage from panicking
+// on a body shorter than 512 bytes — historically it sliced data[:512] without
+// a bounds check, which would panic before any decode-bomb defense could fire.
+func TestService_SaveWithIDShortPayload(t *testing.T) {
+	short := []byte("not an image")
+
+	svc := Service{ServiceParams: ServiceParams{ImageAPI: "/blah/", MaxSize: 1500, MaxWidth: 32, MaxHeight: 32}}
+	err := svc.SaveWithID("test_id", bytes.NewReader(short))
+	require.Error(t, err, "short non-image body must return an error, not panic")
+	assert.Contains(t, err.Error(), "file format not allowed")
+}
+
+// TestService_SaveWithIDWebP confirms that WebP — listed as an allowed format
+// in readAndValidateImage — still round-trips through prepareImage now that
+// resize() runs image.DecodeConfig. Without registering the WebP decoder, a
+// legitimate WebP upload would fail DecodeConfig and prepareImage would error.
+func TestService_SaveWithIDWebP(t *testing.T) {
+	webp, err := os.ReadFile("testdata/pixel.webp")
+	require.NoError(t, err)
+
+	// sanity: the fixture must be a well-formed 1x1 WebP that DecodeConfig accepts.
+	cfg, format, err := image.DecodeConfig(bytes.NewReader(webp))
+	require.NoError(t, err)
+	require.Equal(t, "webp", format)
+	require.Equal(t, 1, cfg.Width)
+	require.Equal(t, 1, cfg.Height)
+
+	store := StoreMock{SaveFunc: func(string, []byte) error { return nil }}
+	svc := Service{store: &store, ServiceParams: ServiceParams{MaxSize: 1500}}
+
+	err = svc.SaveWithID("webp_id", bytes.NewReader(webp))
+	require.NoError(t, err, "valid WebP must round-trip through SaveWithID")
+	assert.Equal(t, 1, len(store.SaveCalls()))
+	assert.Equal(t, webp, store.SaveCalls()[0].Img, "no-resize path must return bytes verbatim")
+}
+
+// TestService_resizeRejectsDecompressionBomb verifies the dimension-cap defense.
+// Builds a tiny GIF that declares 65535x65535 (4 gigapixels) in its logical-screen
+// header — image.DecodeConfig reads the dimensions, the int64 product overflows
+// any 32-bit int wrap, and resize must refuse before image.Decode allocates ~17 GB
+// of pixel memory.
+func TestService_resizeRejectsDecompressionBomb(t *testing.T) {
+	// minimal GIF87a header with 65535x65535 logical screen, no global color table.
+	// Bytes 6-7 are the little-endian width, 8-9 are the little-endian height.
+	bomb := []byte{
+		'G', 'I', 'F', '8', '7', 'a',
+		0xFF, 0xFF,
+		0xFF, 0xFF,
+		0x00,
+		0x00,
+		0x00,
+		0x3B,
+	}
+	cfg, _, err := image.DecodeConfig(bytes.NewReader(bomb))
+	require.NoError(t, err, "bomb header must decode at the config level")
+	assert.Equal(t, 65535, cfg.Width)
+	assert.Equal(t, 65535, cfg.Height)
+
+	assert.Nil(t, resize(bomb, 100, 100), "resize must refuse oversized dimensions before raster decode")
+	assert.Nil(t, resize(bomb, 0, 0), "even with no-resize limits, oversized dims must be refused")
+
+	// integration-level: SaveWithID must reject the same bomb without panicking
+	// or allocating gigabytes of raster memory.
+	store := StoreMock{SaveFunc: func(string, []byte) error { return nil }}
+	svc := Service{store: &store, ServiceParams: ServiceParams{MaxSize: 1500}}
+	err = svc.SaveWithID("bomb_id", bytes.NewReader(bomb))
+	require.Error(t, err, "SaveWithID must reject decompression bomb")
+	assert.Equal(t, 0, len(store.SaveCalls()), "rejected bomb must not be stored")
+}
+
 func TestGetProportionalSizes(t *testing.T) {
 	tbl := []struct {
 		inpW, inpH     int
@@ -259,7 +334,6 @@ func TestGetProportionalSizes(t *testing.T) {
 	}
 
 	for i, tt := range tbl {
-		tt := tt
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
 			resW, resH := getProportionalSizes(tt.inpW, tt.inpH, tt.limitW, tt.limitH)
 			assert.Equal(t, tt.resW, resW, "width")
@@ -285,3 +359,6 @@ func TestService_DoubleClose(*testing.T) {
 	// second call should not result in panic
 	svc.Close(context.TODO())
 }
+
+// TestSafeImgContentType now lives in the rest package alongside the SafeImgContentType
+// helper itself (see backend/app/rest/image_headers_test.go).