5 Commits

Include renames

Author	SHA1	Message	Date
fen	a0b34378a4	fix #280: key rate-limit buckets on peer address, not client XFF ... The deployed ingress does not append the peer to X-Forwarded-For, so the rightmost XFF entry was fully client-controlled and rotating the header gave a fresh rate-limit bucket per request (pentest: 8 creates, 6x201). clientIP() now defaults to the peer (RemoteAddr) and never trusts client-supplied headers. Per-client granularity is restored opt-in via PALETTE_CLIENT_IP_HEADER, honored only when the immediate peer is inside PALETTE_TRUSTED_PROXIES (default loopback + RFC1918) and the value parses as an IP.	2026-09-17 20:34:59 -05:00
poslop	9df6224a27	Result box: color-code by status + friendly error messages from error codes (#105) ... - Backend create/can validation paths emit machine-readable error codes (slug_taken, slug_invalid, content_empty, content_too_large, expiry_invalid, rate_limited, ...) alongside the human message - new.html JS maps codes to plain-language guidance with generic fallback - Result card colored via --ok/--err/--warn left border (result-ok/err/warn) - docs/API.md error section documents the code field - Tests assert the code on every validation path	2026-09-09 17:28:25 -05:00
agent	3d1d5ee1fd	ratelimit: key on rightmost X-Forwarded-For entry (fixes #85)	2026-09-09 10:57:59 -05:00
palette-agent	9811191648	admin: per-IP rate limit (5/min) on admin key attempts (#66)	2026-09-09 09:15:01 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00