naibaandcloudcode f246668586 ci(gosec): silence G101 false positives on PAT context keys and scope const ...

gosec G101 flags apiTokenCtxKey, apiTokenLastUsedCtxKey, and the
ScopeNotificationGroupWrite identifier as hardcoded credentials. They are
context-key names and a scope string, not secrets. Annotate them with
#nosec G101 (matching the existing JWTSecretEnvKey precedent) so the
gosec CI step passes without disabling the rule globally.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 08:16:55 +00:00

..

alertrule_api.go

fix: rule snapshot

2024-12-19 23:21:15 +08:00

alertrule_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

alertrule_test.go

improve transfer record logic (#1033)

2025-03-19 22:21:21 +08:00

alertrule.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_migration_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_unified_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token.go

ci(gosec): silence G101 false positives on PAT context keys and scope const

2026-05-31 08:16:55 +00:00

api.go

feat: 绑定 oauth2

2024-12-28 23:50:59 +08:00

common_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

common.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

config_test.go

feat(config): make jwt_secret_key env-first and never persist when injected

2026-05-26 03:50:26 +00:00

config.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

cron_admin_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_api.go

remove id field in every form struct, fix cron & ddns db (#11)

2024-11-19 23:34:56 +08:00

cron_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

ddns_api.go

fix struct tags (#7)

2024-11-16 20:57:03 +08:00

ddns.go

chore: cleanup some code (#1069)

2025-04-26 18:28:21 +08:00

fm_api.go

add fm api (#456)

2024-10-25 09:09:08 +08:00

host.go

update ws & settings api (#547)

2024-12-04 20:00:18 +08:00

jwt_session.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

mcp_audit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_enabled_atomic_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

nat_api.go

feat: disable nat

2025-01-21 22:23:15 +08:00

nat_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

nat.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

notification_api.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

notification_group_api.go

fix struct tags (#7)

2024-11-16 20:57:03 +08:00

notification_group_notification.go

implement notification group (#450)

2024-10-23 21:55:12 +08:00

notification_group.go

model redesign

2024-10-20 00:32:55 +08:00

notification_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

notification.go

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

oauth2bind.go

fix: possible redirect url inconsistency (#1003)

2025-02-24 20:53:11 +08:00

oauth2config.go

fix: oauth2 config not loaded (#1018)

2025-03-04 20:28:22 +08:00

rule.go

improve transfer record logic (#1033)

2025-03-19 22:21:21 +08:00

server_api.go

feat: batch set server config (#983)

2025-02-04 11:25:49 +08:00

server_group_api.go

fix struct tags (#7)

2024-11-16 20:57:03 +08:00

server_group_server.go

feat: server group api

2024-10-21 23:00:51 +08:00

server_group.go

refactor agent auth & server api

2024-10-20 23:23:04 +08:00

server_owner_json_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

server_owner_race_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

server_taskstream_race_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

server_transfer.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_api.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

service_history_api.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

service_history.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

service_ignoreall_false_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_api.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

terminal_api.go

feat: terminal api

2024-10-22 22:01:01 +08:00

transfer.go

fix struct tags (#7)

2024-11-16 20:57:03 +08:00

user_api.go

fix: member-created services shouldn't be applied to admin resources (#1113)

2025-08-28 22:37:44 +08:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat: update to go1.24 & support listening https (#1002)

2025-02-28 22:02:54 +08:00