gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-11 14:00:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
cf26ed7f1241d61aa7df1d7541bed35c3a0b192e
pulse/internal/api
T
History
rcourtman cf26ed7f12 security: Add request body size limits to remaining API handlers 
Add http.MaxBytesReader to 8 additional handlers to complete API
hardening against memory exhaustion attacks:

- guest_metadata.go: HandleUpdateMetadata (16KB)
- notification_queue.go: RetryDLQItem, DeleteDLQItem (8KB each)
- temperature_proxy.go: HandleRegister (8KB)
- host_agents.go: HandleReport (256KB)
- updates.go: HandleApplyUpdate (8KB)
- docker_metadata.go: HandleUpdateMetadata (16KB)
- system_settings.go: UpdateSystemSettings (64KB)

All API handlers that decode JSON request bodies now have size limits.
2025-12-02 16:47:13 +00:00
..
alerts_test.go
Allow printable alert IDs for acknowledgements (#550)
2025-10-14 16:48:22 +00:00
alerts.go
security: Add request body size limits to API handlers
2025-12-02 16:43:13 +00:00
auth_helpers_test.go
test: Add CheckAuth tests for API package
2025-12-02 13:57:23 +00:00
auth_scope_test.go
test: Add ensureScope tests for API package
2025-12-02 13:19:11 +00:00
auth.go
style: fix revive linter warnings
2025-11-27 10:26:26 +00:00
bootstrap_token_test.go
test: Add edge case for initializeBootstrapToken error path
2025-12-02 00:51:44 +00:00
bootstrap_token.go
Improve temperature proxy control-plane flow
2025-11-15 21:49:51 +00:00
config_handlers_auto_reg_test.go
test: Add edge cases for markAutoRegistered empty inputs
2025-12-01 23:50:10 +00:00
config_handlers_auto_register_test.go
Harden setup token flow and enforce encrypted persistence
2025-10-25 16:00:37 +00:00
config_handlers_cluster_test.go
test: Improve coverage for cluster config handler functions
2025-12-01 14:46:00 +00:00
config_handlers_host_test.go
test: Add edge case for normalizeNodeHost URL parse error
2025-12-01 23:28:32 +00:00
config_handlers_pve_user_test.go
test: Add tests for instance lookup and setup token validation
2025-12-01 22:19:30 +00:00
config_handlers_sanitize_test.go
test: Add tests for config handler utility functions
2025-12-01 14:09:35 +00:00
config_handlers_setup_script_test.go
test: Add HandleSetupScript PBS path tests for API package
2025-12-02 13:36:23 +00:00
config_handlers_temperature_test.go
Improve temperature proxy workflow
2025-11-17 14:25:46 +00:00
config_handlers_transport_guard_test.go
Improve temperature proxy workflow
2025-11-17 14:25:46 +00:00
config_handlers.go
security: Add request body size limits to API handlers
2025-12-02 16:43:13 +00:00
csrf_store_test.go
test: Add CSRFTokenStore.load format tests for API package
2025-12-02 14:07:00 +00:00
csrf_store.go
chore: fix staticcheck U1000 unused code warnings
2025-11-27 09:12:17 +00:00
demo_middleware_test.go
test: Add edge case for DemoModeMiddleware WebSocket POST upgrade
2025-12-01 23:24:06 +00:00
demo_middleware.go
Fix demo mode to allow authentication endpoints
2025-11-06 13:48:28 +00:00
diagnostics_test.go
test: Add diagnostics function tests for error handling
2025-12-02 03:39:52 +00:00
diagnostics.go
fix: mark unused parameters to satisfy unparam linter
2025-11-27 10:12:48 +00:00
DO_NOT_EDIT_FRONTEND_HERE.md
Fix settings security tab navigation
2025-10-11 23:29:47 +00:00
docker_agents_test.go
ADA: Add normalizeCommandStatus helper with unit tests
2025-11-29 17:06:18 +00:00
docker_agents.go
security: Add request body size limits to API handlers
2025-12-02 16:43:13 +00:00
docker_metadata.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
export_test.go
fix: Update TestPublicURLDetectionUsesForwardedHeaders for proxy hardening
2025-12-02 03:16:52 +00:00
frontend_embed.go
Improve static asset caching for hashed files
2025-11-06 13:54:26 +00:00
guest_metadata.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
host_agents_test.go
test: Add edge cases for HandleLookup error paths
2025-12-02 00:49:16 +00:00
host_agents.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
http_metrics_test.go
Add unit tests for HTTP metrics utility functions
2025-11-30 02:48:05 +00:00
http_metrics.go
feat: comprehensive diagnostics and observability improvements
2025-10-21 12:37:39 +00:00
middleware_test.go
test: Add edge case for writeErrorResponse encode failure
2025-12-01 23:52:21 +00:00
middleware.go
style: fix whitespace in middleware.go
2025-11-27 08:34:31 +00:00
notification_queue.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
notifications_test.go
Fix redactSecretsFromURL matching params with prefixed names
2025-11-29 22:03:15 +00:00
notifications.go
security: Add request body size limits to notification handlers
2025-12-02 16:37:30 +00:00
oidc_handlers_test.go
test: Add edge case test for addQueryParam URL parse error
2025-12-01 23:08:36 +00:00
oidc_handlers.go
Add OIDC CA bundle support
2025-11-22 09:44:03 +00:00
oidc_service_test.go
test: Add invalid PEM data test for newOIDCHTTPClient
2025-12-02 01:00:06 +00:00
oidc_service.go
Add OIDC CA bundle support
2025-11-22 09:44:03 +00:00
rate_limit_config_test.go
test: Add edge cases for UniversalRateLimitMiddleware
2025-12-02 00:54:37 +00:00
rate_limit_config.go
Improve temperature proxy control-plane flow
2025-11-15 21:49:51 +00:00
ratelimit_test.go
Add unit tests for RateLimiter (internal/api/ratelimit.go)
2025-11-30 04:33:59 +00:00
ratelimit.go
docs: Add godoc comments to exported functions
2025-12-02 15:58:59 +00:00
README.md
Fix settings security tab navigation
2025-10-11 23:29:47 +00:00
recovery_tokens_test.go
test: Add filesystem error tests for RecoveryTokenStore.saveUnsafe
2025-12-02 01:36:21 +00:00
recovery_tokens.go
chore: remove unused store methods
2025-11-27 08:31:50 +00:00
router_arch_test.go
test: Add tests for API helper functions
2025-12-01 21:33:45 +00:00
router_download_test.go
Fix #735: Allow HEAD requests for download endpoints and fix routing
2025-11-24 15:16:14 +00:00
router_integration_test.go
fix: Update TestPublicURLDetectionUsesForwardedHeaders for proxy hardening
2025-12-02 03:16:52 +00:00
router_test.go
test: Add isRequestAuthenticated tests for API package
2025-12-02 12:59:18 +00:00
router.go
refactor: Remove unreachable dead code branches
2025-12-02 14:41:53 +00:00
security_oidc.go
fix: mark unused parameters to satisfy unparam linter
2025-11-27 10:12:48 +00:00
security_setup_fix_test.go
test: Add edge case for ensureSettingsWriteScope valid scope
2025-12-02 00:13:32 +00:00
security_setup_fix.go
Add mutex protection for config watcher reloads (re #748)
2025-11-24 07:45:21 +00:00
security_test.go
test: Add CheckCSRF valid token test for 100% coverage
2025-12-02 13:51:27 +00:00
security_tokens_test.go
test: Add edge cases for normalizeRequestedScopes
2025-12-02 00:19:20 +00:00
security_tokens.go
refactor: Remove unreachable dead code branches
2025-12-02 14:41:53 +00:00
security.go
chore: fix staticcheck U1000 unused code warnings
2025-11-27 09:12:17 +00:00
session_store_test.go
test: Add SessionStore.load legacy format tests for API package
2025-12-02 14:12:32 +00:00
session_store.go
chore: fix staticcheck U1000 unused code warnings
2025-11-27 09:12:17 +00:00
system_settings_temperature_test.go
feat: make PVE polling interval configurable (related to #467)
2025-11-18 21:30:04 +00:00
system_settings_utils_test.go
Add unit tests for system_settings.go map utility functions
2025-12-01 01:05:07 +00:00
system_settings_validate_test.go
Show CPU core count on EnhancedCPUBar progress bar
2025-11-29 21:47:22 +00:00
system_settings.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
temperature_proxy_command_test.go
fix: Use --ctid instead of --standalone --http-mode in quick-setup command
2025-12-02 11:38:47 +00:00
temperature_proxy_test.go
Add unit tests for temperature proxy utility functions (api)
2025-11-30 14:07:04 +00:00
temperature_proxy.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00
types.go
chore: remove unused API response types
2025-11-27 08:37:22 +00:00
unified_agent_test.go
Add unit tests for normalizeUnifiedAgentArch and getClientIP (api)
2025-11-30 15:05:37 +00:00
unified_agent.go
fix: use correct script paths in unified agent handlers
2025-11-26 10:05:43 +00:00
updates_test.go
Add unit tests for normalizeUnifiedAgentArch and getClientIP (api)
2025-11-30 15:05:37 +00:00
updates.go
security: Add request body size limits to remaining API handlers
2025-12-02 16:47:13 +00:00

README.md

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: /opt/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.

Reference in New Issue View Git Blame Copy Permalink