Cybersecurity-Projects

Commit Graph

Author	SHA1	Message	Date
CarterPerez-dev	41b9d2c911	fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)` around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the MarkdownV2 reserved set when used outside `[text](url)` link delimiter positions. Telegram would reject the entire message with `Bad Request: can't parse entities: Character '(' is reserved`. Fix: write the wrapping parens as `\(` and `\)` literals in the three parens-construction switch arms. The dynamic field values inside still flow through EscapeMD as before. The `[View full event timeline](url)` inline link is left alone — its `(` `)` ARE link delimiters and per V2 rules must NOT be escaped (only `)` and `\` inside the URL portion need escapes, and our manage URL has neither). Regression test: TestSender_Send_MessageContainsKeyFields now asserts `require.Contains(text, \\(Toronto, CA\\))` so substring matching can't hide future regressions on the wrapping parens.	2026-05-14 00:47:08 -04:00
CarterPerez-dev	0757d9f196	feat(canary): event + notify domain — contracts, senders, services Lays the domain layer for Phase 10 notification dispatch. - event/contract.go: NotifyInfo (token-shape DTO that breaks the would-be event→notify→token cycle), Notifier interface, TokenIncrementer interface, Store interface (Insert+UpdateNotifyStatus+PruneToLimit). - token.Token.NotifyInfo() helper bridges *token.Token → event.NotifyInfo for the main.go adapter. - notify/types.go: Sender + StatusWriter interfaces. - notify.Service: per-channel sender registry, async fire-and-forget Notify with bounded sendTimeout, WaitGroup for graceful drain, status writeback (sent / failed) on the configured StatusWriter. - telegram.Sender: POST /bot{TOKEN}/sendMessage with MarkdownV2-escaped body, cenkalti/backoff/v5 retry (3 tries / 30s window), permanent on 4xx, 10s overall + 5s connect timeouts. Note: spec body said parse_mode=Markdown but escape table is the V2 set; using MarkdownV2 keeps the escape rules consistent. - webhook.Sender: POST user URL with versioned JSON envelope (§10.4), optional HMAC-SHA256 signing via X-Canary-Signature, URL validation at the call site (rejects non-http(s), missing host, userinfo). Same retry/timeout policy as telegram. - event.Service: Record(ctx, info, evt) inserts → IncrementTriggerCount → Redis SetNX dedup gate (15m TTL, fail-open on Redis error). First trigger calls notifier; duplicates INCR + UpdateNotifyStatus(deduped). - event.Service.RunRetentionLoop(ctx, interval, limit) tickered prune. Adds cenkalti/backoff/v5 + miniredis/v2 to go.mod for backoff API and unit-test Redis fakes.	2026-05-14 00:30:42 -04:00

Author

SHA1

Message

Date

CarterPerez-dev

41b9d2c911

fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup

Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)`
around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the
MarkdownV2 reserved set when used outside `[text](url)` link delimiter
positions. Telegram would reject the entire message with
`Bad Request: can't parse entities: Character '(' is reserved`.

Fix: write the wrapping parens as `\(` and `\)` literals in the three
parens-construction switch arms. The dynamic field values inside still
flow through EscapeMD as before. The `[View full event timeline](url)`
inline link is left alone — its `(` `)` ARE link delimiters and per V2
rules must NOT be escaped (only `)` and `\` inside the URL portion need
escapes, and our manage URL has neither).

Regression test: TestSender_Send_MessageContainsKeyFields now asserts
`require.Contains(text, \\(Toronto, CA\\))` so substring matching can't
hide future regressions on the wrapping parens.

2026-05-14 00:47:08 -04:00

CarterPerez-dev

0757d9f196

feat(canary): event + notify domain — contracts, senders, services

Lays the domain layer for Phase 10 notification dispatch.

- event/contract.go: NotifyInfo (token-shape DTO that breaks the would-be
  event→notify→token cycle), Notifier interface, TokenIncrementer interface,
  Store interface (Insert+UpdateNotifyStatus+PruneToLimit).
- token.Token.NotifyInfo() helper bridges *token.Token → event.NotifyInfo
  for the main.go adapter.
- notify/types.go: Sender + StatusWriter interfaces.
- notify.Service: per-channel sender registry, async fire-and-forget
  Notify with bounded sendTimeout, WaitGroup for graceful drain, status
  writeback (sent / failed) on the configured StatusWriter.
- telegram.Sender: POST /bot{TOKEN}/sendMessage with MarkdownV2-escaped
  body, cenkalti/backoff/v5 retry (3 tries / 30s window), permanent on
  4xx, 10s overall + 5s connect timeouts. Note: spec body said
  parse_mode=Markdown but escape table is the V2 set; using MarkdownV2
  keeps the escape rules consistent.
- webhook.Sender: POST user URL with versioned JSON envelope (§10.4),
  optional HMAC-SHA256 signing via X-Canary-Signature, URL validation
  at the call site (rejects non-http(s), missing host, userinfo). Same
  retry/timeout policy as telegram.
- event.Service: Record(ctx, info, evt) inserts → IncrementTriggerCount
  → Redis SetNX dedup gate (15m TTL, fail-open on Redis error). First
  trigger calls notifier; duplicates INCR + UpdateNotifyStatus(deduped).
- event.Service.RunRetentionLoop(ctx, interval, limit) tickered prune.

Adds cenkalti/backoff/v5 + miniredis/v2 to go.mod for backoff API and
unit-test Redis fakes.

2026-05-14 00:30:42 -04:00

2 Commits