CarterPerez-dev 30ebda39d5 fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ ... Audit F2: the PDF placeholder was padded with underscores embedded directly in the /URI path, so Acrobat fetched /c/<id>____________ and the chi route extracted the padded id. Lookup returned ErrNotFound, the webbug fallback served a 1x1 GIF, and event recording skipped because tok was nil. PDF tokens silently never recorded events. Part B (durable): pad inside a ?p= query string so the trigger path stays canonical and chi extracts the real id. Part A (defense in depth): handler TrimRight on _ so PDFs already in the field also resolve correctly. Added two regression tests: byte-after-id assertion in the PDF artifact, and the handler's trim path.		2026-05-17 19:07:50 -04:00
..
backend	fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _	2026-05-17 19:07:50 -04:00
frontend	fix(canary): accept null events from manage response	2026-05-17 17:58:13 -04:00
infra	fix(canary): declare VITE_TURNSTILE_SITE_KEY ARG in prod Dockerfile	2026-05-17 19:07:39 -04:00
scripts	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
.env.example	fix(canary-phase0): address audit findings before phase rollup	2026-05-10 05:37:32 -04:00
.gitignore	chore(canary): expand project .gitignore for Go + Node + secrets	2026-05-10 05:13:19 -04:00
cloudflared.compose.yml	fix(canary-phase0): address audit findings before phase rollup	2026-05-10 05:37:32 -04:00
compose.yml	fix(canary-phase1): clear all post-phase-1 audit observations + header normalization	2026-05-10 06:15:26 -04:00
dev.compose.yml	fix(canary): vite dev proxy — correct backend port + stop stripping /api	2026-05-17 17:37:36 -04:00
justfile	feat(canary): unified Justfile with frontend + backend + compose groups	2026-05-10 05:25:27 -04:00