mirror of
https://github.com/R0m1k3/FlowReader.git
synced 2026-10-11 17:28:05 +02:00
Antigravity AgentandClaude Opus 5.5
03e57e4308
Security: - WebSocket events are routed to their owner only (no cross-user leak); hub close is idempotent (fixes double-close panic), adds ping/pong and write deadlines. - Session tokens stored as SHA-256 (migration 008 keeps sessions valid); single-query auth middleware puts the user in the request context. - Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter map is bounded; per-user limit on AI summaries. - Argon2id at OWASP minimum with a concurrency cap; constant-time login for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED. - CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits, wider SSRF denylist, bounded feed/page/AI response reads, generic errors. - Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum. Performance: - List endpoints return a plain-text excerpt and reading time instead of full HTML; content is sanitized once at ingest (legacy rows backfilled). - Keyset pagination on (sort_at, id) with matching partial indexes; redundant indexes dropped (migration 007). - Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified), exponential backoff, dedupe before insert, column-safe truncation, retention-aware ingest, per-user refresh coalescing. - Read/favorite/read-all are single ownership-scoped statements. - gzip compression, immutable caching for hashed assets, path-safe SPA handler, server timeouts; expired sessions purged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
package domain
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// Feed represents an RSS/Atom feed subscription.
|
|
type Feed struct {
|
|
ID uuid.UUID `json:"id"`
|
|
UserID uuid.UUID `json:"user_id"`
|
|
URL string `json:"url"`
|
|
Title string `json:"title"`
|
|
Description string `json:"description,omitempty"`
|
|
SiteURL string `json:"site_url,omitempty"`
|
|
ImageURL string `json:"image_url,omitempty"`
|
|
LastFetchedAt *time.Time `json:"last_fetched_at,omitempty"`
|
|
FetchError string `json:"fetch_error,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
|
|
// Fetch state (HTTP conditional GET + error backoff); not exposed.
|
|
ETag string `json:"-"`
|
|
LastModified string `json:"-"`
|
|
ErrorCount int `json:"-"`
|
|
NextFetchAt *time.Time `json:"-"`
|
|
|
|
// Virtual fields (not in DB)
|
|
UnreadCount int `json:"unread_count"`
|
|
}
|
|
|
|
// FetchResult is the outcome of one fetch attempt, persisted in one statement.
|
|
type FetchResult struct {
|
|
FetchedAt time.Time
|
|
NextFetchAt time.Time
|
|
Error string // empty on success
|
|
ErrorCount int
|
|
ETag string
|
|
LastModified string
|
|
// Metadata from the feed document; nil when the feed wasn't (re)parsed.
|
|
Title *string
|
|
Description *string
|
|
SiteURL *string
|
|
ImageURL *string
|
|
}
|
|
|
|
// FeedRepository defines the interface for feed data access.
|
|
type FeedRepository interface {
|
|
Create(feed *Feed) error
|
|
GetByID(id uuid.UUID) (*Feed, error)
|
|
GetByUserID(userID uuid.UUID) ([]*Feed, error)
|
|
GetByURL(userID uuid.UUID, url string) (*Feed, error)
|
|
Update(feed *Feed) error
|
|
Delete(id uuid.UUID) error
|
|
// GetFeedsToFetch returns feeds whose next fetch is due.
|
|
GetFeedsToFetch(limit int) ([]*Feed, error)
|
|
SaveFetchResult(id uuid.UUID, res FetchResult) error
|
|
}
|