Skip to content

Release: security hardening, coded logging, CI/ops updates - #86

Merged
ATRIwOX merged 13 commits into
mainfrom
dev
Sep 6, 2026
Merged

Release: security hardening, coded logging, CI/ops updates#86
ATRIwOX merged 13 commits into
mainfrom
dev

Conversation

@ATRIwOX

@ATRIwOX ATRIwOX commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Promote stable dev to main:

  • Security: trust boundaries, session CSRF, password/setup hardening, headers
  • Observability: structured error codes + secret scrubbing across ORM/web/module/scheduler
  • CI/tooling: golangci-lint, Node 24, Go 1.26.6, Postgres/authz checks
  • Ops: sliding sessions, deploy/HA runbooks; assorted SWC/ORM/web fixes

Test plan

  • CI green on dev
  • Smoke: login/logout, RPC with CSRF, module sync
  • Confirm production defaults (no dev_mode, CSRF secret set)
  • Spot-check logs: coded failures, no plaintext secrets

ATRIwOX and others added 13 commits September 6, 2026 04:01
Emit stable error_code on Event logs, add ErrorCode/WarnCode helpers,
and scrub secret field values before context is written.
Route schema/SQL/outbox/side-effect failures through Event/WarnCode,
reuse ScrubMap for audit and sensitive SQL args, and drop applog.L.
Use WarnCode for SYNC_PARTIAL/XML_LINK_FAILED and cron failure paths,
and replace unstructured scheduler.L cron start logs with Events.
Stop logging failures via WebLogf success status; classify record and
access errors with errcode at shared web choke points.
Redact secret fields before printing records, validate Atoi input,
and send errors to stderr.
Align the Logging section with the structured error_code contract.
Align local lint with CI so make check does not run SWC twice.
Move shared stage colors into sumeru-theme and drop duplicate
hardcoded stage values from shell/workspace/views stylesheets.
Log or return information_schema and seed failures, honor XML link
errors during data sync, and fail bulk cancel when CancelBatch errors.
Keep only the record id; pass request context separately to handlers.
Stop empty catch blocks in shell storage, bus, RPC, and map helpers
so client-side failures are visible during development.
Share ClassifyLogCode across ORM/web, drop logORMOperationKV and
double-logs, and slim SQL debug wrappers without changing the
ErrorCode/WarnCode contract.
refactor(logging): collapse classifiers and Event boilerplate
@ATRIwOX ATRIwOX self-assigned this Sep 6, 2026
@ATRIwOX
ATRIwOX merged commit 93aaef7 into main Sep 6, 2026
10 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant