Security fixes, bug fixes, cleanup, tests and CI

[PhantomPixelDev]

This PR fixes the security holes and bugs found in a full review of the codebase, cleans up the code, and adds tests and CI. There is one commit per phase, so it can be reviewed a commit at a time.

Critical security fixes

• Anyone could log in as admin. The JWT signing key was read into a package variable before the config file was loaded, so it was always empty. A token signed with an empty key got a 200 on /admin; I confirmed this against the old code. The key is now read when it is used. Tokens must be HS256 and carry an expiry. Production refuses to start without a real app.secret, and development falls back to a random secret. The unmaintained dgrijalva/jwt-go is replaced by golang-jwt/jwt/v5.
• The response cache served admin pages to anonymous users. It was keyed on the path only and ran before any auth check. It is removed.
• Admin routes without an auth check: POST /admin/post/add, POST /admin/post/edit, the post and custom-page editors, /search-{posts,tags,menu,categories}, and the shop's add_product. IsLoggedIn/IsAdmin also let a missing (nil) value through as allowed.
• Anonymous requests could crash the server through nil type assertions. There is now recover middleware and the assertions are fixed.
• Default admin/admin1234. The first admin's password now comes from ADMIN_PASSWORD or app.admin_password, or is generated at random and printed once in the log.
• Committed database. data/database.sqlite (with password hashes) and the generated sitemap are no longer tracked.

Middleware order, CSRF and CORS

• The 404 catch-all was registered before CSRF, CORS and the captcha middleware, so none of them ever ran on real routes. The order is now: recover → static → CORS → session → rate limiter → CSRF → auth/settings → routes → plugins → custom pages → 404.
• CSRF uses the csrf_ cookie plus the X-Csrf-Token header, and views/main.html adds the header to every HTMX request.
• CORS reads cors.allowed_origins, the key the example config actually uses. server.trusted_proxies is supported.
• Cookies are marked Secure when app.url is https.
• The plugin toggle is now a POST, because it changes state.

Bug fixes

• Registration no longer requires a captcha when captcha is disabled (the default). Before, nobody could sign up on a fresh install.
• Saving a post runs in db.Transaction. Early returns used to leave the SQLite database locked. The slug-uniqueness check could never trigger before; it now works on both add and edit.
• The sitemap is built per request. It keeps /, /blog, /login and /register, no longer links to /user/:id pages that don't exist, and XML-escapes URLs.
• Custom pages are served by one catch-all route, so they go live without a restart. Templates are restricted to page, page_sidebar and page_fullwidth.
• Uploads are checked by their actual content, upper-case extensions are accepted, and upload.max_size_mb is honoured.
• The comments table no longer drops its last page.
• The escape template helper no longer turns encoded text back into live HTML, and truncate no longer splits characters.
• Removed addForeignKeyConstraints, which logged errors on every start, and a no-op dbresolver.

Cleanup

• routes.go is split into public.go, auth.go and admin.go.
• Site settings are cached for 30s instead of queried on every request.
• "Clear cache" no longer wipes the session store, which would log everyone out and invalidate every CSRF token.
• Inline HTML moved out of Go code into views/partials.
• Toast messages are shown as text rather than HTML, and error toasts now show as errors.
• Shared pagination and sanitizing helpers.
• Debug printlns removed. One of them printed the hCaptcha secret.
• The logger plugin implements the Plugin interface again.
• The shop plugin seeds 30 demo products instead of 30,000.
• gofmt across the tree.

Tooling

• go.mod/go.sum are committed (Go 1.26).
• CI runs gofmt, go vet, staticcheck and go test -race. govulncheck runs as a separate, non-blocking job.
• A Makefile and an updated README.

Testing

• go test -race ./..., go vet, gofmt and staticcheck pass locally.

• The integration tests cover:

  • every admin route rejecting anonymous users and regular users;
  • forged JWTs (empty key, wrong key, alg:none, no expiry, expired);
  • admin pages not leaking through the cache;
  • CSRF enforcement;
  • login;
  • registration with captcha off;
  • duplicate slugs;
  • live custom pages and the template allowlist;
  • sitemap contents;
  • upload content checks;
  • unpublished posts returning 404 without a crash.

  Run against the old code, they fail on the auth bypasses, the cache leak and the crash.

• I ran the real server and checked it with curl:

  • login with and without the CSRF token;
  • anonymous access to admin pages;
  • the forged token;
  • custom pages;
  • static files, the sitemap and registration.

  Production mode exits when app.secret is empty.

• I could not run govulncheck locally because the vulnerability database was unreachable.

Deviations and follow-ups

• Old password hashes stay in git history. The committed database is only untracked, not removed from past commits. If it held real accounts, change those passwords or purge the file from history.
• Existing installs keep admin/admin1234. Any install that already created that account should change the password.
• app.secret is now required in production. Changing it logs everyone out.
• Slug indexes are plain, not unique. A unique index would stop the app from starting on any existing database with duplicate slugs. The app itself now enforces uniqueness.
• About 70 X-No-Cache template headers are left in place. They do nothing now that the cache is gone.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Nnrh7igQnxNpBMxtDAUKeU

---

Generated by Claude Code