e54dd2e370
Go: - codegen: pass trimmed specPath to buildArgs instead of raw g.SpecPath - cmd/sdk: use local resolvedSpecFile to avoid mutating flag variable per-invocation - export: write to temp file + atomic rename to prevent destination truncation on failure - openapi: gate effectiveGraphQLPath/SwaggerPath/WSPath/SSEPath on enable flags; use effectiveSwaggerPath in effectiveAuthentikPublicPaths - cache: reject oversized replacement before mutating LRU state for existing keys - ratelimit: move setRateLimitHeaders before c.Next() so headers are sent; hash credential headers with SHA-256 to avoid storing raw secrets; prefer validated principal from context - response_meta: track size separately from body buffer so Size() is accurate after body rewrites and in passthrough mode - bridge: limit request body reads with http.MaxBytesReader (10 MiB); allow missing data key in ValidateResponse for nil/zero success responses; update recorder status in writeErrorResponse - pkg/provider/proxy: validate target scheme and host after url.Parse to catch hostless inputs - cmd_test: snapshot/restore global spec registry in TestAPISpecCmd_Good_RegisteredSpecGroups PHP: - HasApiResponses.php, config.php: add declare(strict_types=1) - RateLimitExceededException: validate Origin against cors.allowed_origins before reflecting in CORS header - ApiUsageService: import and use Core\Api\Models\ApiKey instead of fully-qualified Mod\ path - SeoReportService: add SSRF protection (scheme check, private-IP rejection); add .throw() for HTTP error handling; disable automatic redirects Co-Authored-By: Virgil <virgil@lethean.io> |
||
|---|---|---|
| .. | ||
| provider.go | ||
| proxy.go | ||
| proxy_internal_test.go | ||
| proxy_test.go | ||
| registry.go | ||
| registry_test.go | ||