lafay b0f209fdf8 fix(security): security audit fixes for API vulnerabilities ...

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

2026-03-19 13:49:51 +08:00

..

cache

refactor: replace standard log with zap logger and optimize code patterns

2026-03-17 00:47:17 +08:00

config

feat(message): add message encryption with batch decryption optimization

2026-03-17 10:10:49 +08:00

dto

fix(security): security audit fixes for API vulnerabilities

2026-03-19 13:49:51 +08:00

errors

feat(auth): add Casbin RBAC and user activity tracking

2026-03-14 02:09:38 +08:00

grpc/runner

feat(grpc): add gRPC server infrastructure and schedule sync service

2026-03-13 20:40:20 +08:00

handler

fix(security): security audit fixes for API vulnerabilities

2026-03-19 13:49:51 +08:00

middleware

fix(security): security audit fixes for API vulnerabilities

2026-03-19 13:49:51 +08:00

model

feat(message): add message encryption with batch decryption optimization

2026-03-17 10:10:49 +08:00

pkg

feat(message): add message encryption with batch decryption optimization

2026-03-17 10:10:49 +08:00

repository

feat(message): add message encryption with batch decryption optimization

2026-03-17 10:10:49 +08:00

router

fix(security): security audit fixes for API vulnerabilities

2026-03-19 13:49:51 +08:00

service

fix(security): security audit fixes for API vulnerabilities

2026-03-19 13:49:51 +08:00

wire

feat(message): add message encryption with batch decryption optimization

2026-03-17 10:10:49 +08:00