Replaces the Go server with a Rust one (axum, tokio, sqlx, feed-rs,
ammonia, reqwest) serving the same REST/WebSocket API, so the React
frontend is unchanged.
- Same database: migrations keep the schema_migrations table and file
names, Argon2id hashes and hashed session tokens created by the Go
server keep working (users stay logged in), and feed item GUIDs are
computed the same way, so existing articles are not re-ingested.
- Same security model: SSRF-safe fetching (public addresses only,
checked at resolution time and on every redirect), HTML sanitization,
CSP and security headers, same-origin guard, WebSocket origin check,
per-IP / per-user rate limits, trusted-proxy aware client IPs.
- Fix: articles whose publication date lies in the future (ingested
before the clamp existed) pinned the top of the list. The maintenance
job now pulls such dates back at startup and daily.
- Relative links and images in feed content are resolved against the
article URL instead of being dropped.
- Deploy: static musl binary in an Alpine image; the Unraid compose file
uses pull_policy: always so the new image is applied on the next
`docker compose up -d`. CI runs fmt, clippy and tests (including a
PostgreSQL integration test) before building the image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fc1UFpB4V1MGWLxHAu3BMK
Security:
- WebSocket events are routed to their owner only (no cross-user leak);
hub close is idempotent (fixes double-close panic), adds ping/pong and
write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.
Performance:
- List endpoints return a plain-text excerpt and reading time instead of
full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
exponential backoff, dedupe before insert, column-safe truncation,
retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
handler, server timeouts; expired sessions purged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- XSS stocké (critique) : sanitisation bluemonday sur tous les endpoints
d'articles (List, ListByFeed, Favorites, Search, Get), pas seulement Get
- SSRF (élevé) : nouveau utils/safehttp.go (ValidateExternalURL + client durci
via Dialer.Control, bloque IP privées/loopback/link-local/metadata,
anti-DNS-rebinding et limite de redirections) appliqué à l'extracteur et au parser
- WebSocket CSWSH (élevé) : politique same-origin + override WS_ALLOWED_ORIGINS
- rate-limiting (moyen) : token-bucket en mémoire sur /auth/*
- token de session retiré du corps JSON (json:"-"), livré uniquement par le
cookie HttpOnly
- cookie Secure correct derrière un reverse-proxy (X-Forwarded-Proto +
override COOKIE_SECURE)
- admin : interdiction de supprimer son propre compte
- en-têtes de sécurité (nosniff, X-Frame-Options, Referrer-Policy,
Permissions-Policy)
Note : backend non compilé localement (pas de toolchain Go) ; à valider via Docker.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude
Antigravity AgentandClaude Opus 5.5
MichaelandClaude Opus 4.8