Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend/internal/token
CarterPerez-dev 30ebda39d5 fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _
Audit F2: the PDF placeholder was padded with underscores embedded directly
in the /URI path, so Acrobat fetched /c/<id>____________ and the chi route
extracted the padded id. Lookup returned ErrNotFound, the webbug fallback
served a 1x1 GIF, and event recording skipped because tok was nil. PDF
tokens silently never recorded events.

Part B (durable): pad inside a ?p= query string so the trigger path stays
canonical and chi extracts the real id. Part A (defense in depth): handler
TrimRight on _ so PDFs already in the field also resolve correctly. Added
two regression tests: byte-after-id assertion in the PDF artifact, and the
handler's trim path.
2026-05-17 19:07:50 -04:00
..
generators fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ 2026-05-17 19:07:50 -04:00
contract.go feat(canary): event + notify domain — contracts, senders, services 2026-05-14 00:30:42 -04:00
dto.go feat(canary): manage page handlers + DTOs (GET + DELETE /m/{manage_id}) 2026-05-14 01:07:09 -04:00
entity.go feat(canary): Phase 1 — Postgres schema + token & event repositories 2026-05-10 05:47:24 -04:00
handler.go fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ 2026-05-17 19:07:50 -04:00
handler_test.go fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ 2026-05-17 19:07:50 -04:00
repository.go feat(canary): admin handler (stats + tokens list + disable) + repo methods 2026-05-14 06:57:28 -04:00
repository_test.go feat(canary): admin handler (stats + tokens list + disable) + repo methods 2026-05-14 06:57:28 -04:00
service.go feat(canary): event.CountActiveDedup + token.DeleteByManageID for manage page 2026-05-14 01:06:45 -04:00
service_test.go feat(canary): event.CountActiveDedup + token.DeleteByManageID for manage page 2026-05-14 01:06:45 -04:00
types.go feat(canary): token HTTP handlers (API + trigger routes) 2026-05-13 15:16:41 -04:00