25f2002654 f6a233220a perf(auth): look up api tokens by their hash index (#6915) ...

Every bearer-authenticated request, including each node-sync call, loaded all
enabled api_tokens rows and compared each stored SHA-256 hash in constant time.
Tokens are stored hashed, so the database can compare hashes directly: a
timing leak there reveals only a stored hash, which cannot authenticate. The
lookup is now one indexed seek on idx_api_tokens_token, which AutoMigrate
creates from the model tag on new and existing databases; scope and expiry
are still checked afterwards.

2026-10-24 05:06:49 +02:00

..

api_token_scope_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

api_token_test.go

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

api_token.go

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

panel_other.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel_test.go

refactor(util): move panel version comparison into a shared package

2026-10-02 23:56:52 +02:00

panel_unix.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel.go

refactor(util): move panel version comparison into a shared package

2026-10-02 23:56:52 +02:00

sponsor_test.go

feat(sponsors): drop the sidebar slot and simplify the Sponsors page

2026-10-13 23:32:56 +02:00

sponsor.go

fix(sponsor): fetch sponsor data from raw.githubusercontent.com

2026-10-14 17:10:02 +02:00

user_test.go

fix(database): create the first panel user with random credentials

2026-10-24 01:26:05 +02:00

user.go

fix(database): create the first panel user with random credentials

2026-10-24 01:26:05 +02:00

websocket.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00