zeekay
a5f9a92fdf
feat: add tools/cache backed by luxfi/cache, migrate JWKS cache
...
Add tools/cache package that re-exports luxfi/cache Cacher interface
and LRU, plus a TTL wrapper for time-based expiration. Migrate the
hand-rolled JWKS key cache in tools/security to use cache.TTL.
2026-03-01 18:08:08 -07:00
zeekay
cc5f20c11a
feat: Go 1.26 stdlib crypto — hkdf, sha3
...
- OrgDB DEK derivation: raw HMAC → crypto/hkdf.Key (RFC 5869, stdlib)
- security.SHA3_256, SHA3_512 using crypto/sha3 (FIPS 202, stdlib)
- No more x/crypto for key derivation or SHA3
Go 1.26 moved these from x/crypto to stdlib:
crypto/hkdf, crypto/pbkdf2, crypto/sha3, crypto/mlkem
2026-03-02 14:31:16 -07:00
zeekay
d02a70442d
migrate: pocketbase/dbx → hanzoai/dbx v1.12.0
...
Drop-in replacement — same API, same package name (dbx).
75 Go files updated. Zero pocketbase references in imports.
2026-03-02 13:54:55 -07:00
zeekay
724c31293d
feat: IAM JWKS fallback in loadAuthToken — Base accepts IAM JWTs natively
2026-03-02 14:40:08 -07:00
zeekay
157b7127ab
security: fix critical and high findings from red team review
...
- C1: add orgId field to _tasks/_workflows, filter all queries by org
- C2: validate spaceID/orgID with regex before Temporal visibility queries
- H1: add sync.RWMutex to orgClients map (prevent concurrent map panic)
- H2: atomic FailTask with CASE expression (eliminate TOCTOU race)
- H4: extractCreator uses authenticated user ID, not raw headers
- Add orgId to collection schemas, store methods, and API filters
2026-03-02 01:02:45 -07:00
zeekay
fcfaa37ce2
chore: strip all PocketBase cruft from codebase
...
- Delete 7 one-off migration utilities (cmd/fix*, cmd/token*)
- Rename env vars: PB_ID_TOKEN_LEEWAY → HZ_ID_TOKEN_LEEWAY,
PB_FILES_DELETE_MAX_WORKERS → HZ_FILES_DELETE_MAX_WORKERS
- Rename temp file prefix: pb_buffer_file_ → hz_buffer_
- Rename test data dir: pb_base_app_test_data_dir → test_data_dir
- Strip all "PocketBase" from comments (→ "Base" or removed)
- Strip pb_data references in backup error messages
- Update @group PocketBase → @group Base in JSVM type docs
- Update filesystem blob/s3 package doc comments
- _hzf_ field IDs in test DB (already done prior commit)
Zero remaining PocketBase/pb_ references in production Go code.
Only legitimate deps remain: pocketbase/dbx (query builder),
pocketbase/tygoja (JS VM bindings).
2026-03-01 20:44:11 -07:00
zeekay
49d6f90dbb
fix(tests): resolve all flaky CI test failures
...
- router: remove self-import cycle in rereadable_read_closer_test.go
- rate limit: bump sleep waits (800→1100ms, 1000→1200ms) to reliably
cross 1-second window boundaries on slow CI
- verification: replace hardcoded expired JWT tokens with dynamically
generated tokens via BeforeTestFunc + bytes.Buffer pattern
- password reset: same dynamic token generation fix
- collection update: fix system field IDs (_hzf_ → _pbf_) to match
test database, so reserved name validation is reached
2026-03-01 18:37:12 -07:00
zeekay
3fe483ac1b
refactor: remove _hz_ prefix from collection IDs, add brand-neutral logo config
...
Remove all _hz_ prefixes from collection IDs, internal markers, and test
fixtures. The default users collection is now _users_auth_ instead of
_hz_users_auth_. Internal SQL parser tokens renamed from __hz_join__/__hz_discard__
to __join__/__discard__. Backup prefix changed from @auto_hz_backup_ to
@auto_backup_. Test database updated with correct collection IDs and indexes.
JWT tokens in test files regenerated with new collection IDs.
Add LogoURL field to MetaConfig so the admin UI logo is configurable via
app settings instead of hardcoded. FullPage.svelte and App.svelte sidebar
now read logo and app name from the settings store, falling back to
defaults when not configured.
2026-03-01 23:48:36 -07:00
zeekay
ee7255323b
fix: replace remaining pb references with base in ApiClient.js
2026-03-01 21:59:17 -07:00
zeekay
cf0252a28e
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# apis/record_auth_with_otp.go
# core/base_backup.go
# go.mod
# go.sum
# plugins/jsvm/internal/types/generated/types.d.ts
# tools/router/rereadable_read_closer_test.go
# ui/dist/assets/AuthMethodsDocs-C2aSYmNv.js
# ui/dist/assets/AuthRefreshDocs-BapWJLRK.js
# ui/dist/assets/AuthWithOAuth2Docs-Ck_pnbL8.js
# ui/dist/assets/AuthWithOtpDocs-D8uWq_C5.js
# ui/dist/assets/AuthWithPasswordDocs-BQyMhAeO.js
# ui/dist/assets/BatchApiDocs-rvUuWLZE.js
# ui/dist/assets/CodeEditor-DrMyw8z_.js
# ui/dist/assets/CreateApiDocs-XWzcGuMB.js
# ui/dist/assets/DeleteApiDocs-CScE0aw3.js
# ui/dist/assets/EmailChangeDocs-CxOtrB4s.js
# ui/dist/assets/FieldsQueryParam-BzNUQIb5.js
# ui/dist/assets/FilterAutocompleteInput-Dm2G2coC.js
# ui/dist/assets/Leaflet-DyumpnOc.js
# ui/dist/assets/ListApiDocs-CdOzMZnr.js
# ui/dist/assets/PageInstaller-vIXdffAJ.js
# ui/dist/assets/PageOAuth2RedirectFailure-ClpyaW_B.js
# ui/dist/assets/PageOAuth2RedirectSuccess-BLZml1eK.js
# ui/dist/assets/PageRecordConfirmEmailChange-Cm3O2YD1.js
# ui/dist/assets/PageRecordConfirmPasswordReset-D0XfuL45.js
# ui/dist/assets/PageRecordConfirmVerification-CYyNYH_v.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-BvlQ0_9t.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-gUPMclJZ.js
# ui/dist/assets/PasswordResetDocs-DMF1vqE0.js
# ui/dist/assets/RealtimeApiDocs-CNVij_C2.js
# ui/dist/assets/UpdateApiDocs-CwQ3ZhFQ.js
# ui/dist/assets/VerificationDocs-DUeWWjrS.js
# ui/dist/assets/ViewApiDocs-gocWxbTE.js
# ui/dist/assets/index-CWGqJiyp.js
# ui/dist/index.html
2026-03-01 19:27:21 -07:00
Gani Georgiev
f2f0435736
updated jsvm types
2026-03-02 15:02:59 +02:00
Gani Georgiev
82fdc4f137
replace the custom ratelimiter strategy with a fixed window
2026-03-02 11:25:15 +02:00
Gani Georgiev
4db7b2df97
fixed comment typo
2026-03-02 17:30:35 +02:00
Gani Georgiev
fb2eeb7f0e
[ #7575 ] use memory+file buffer when rereading the request body ( fix #7572 )
2026-03-02 17:19:09 +02:00
Gani Georgiev
9feb83cdad
applied lint typo fixes
2026-03-02 22:31:27 +02:00
Gani Georgiev
4161510f5e
limit the debug stack trace of FireAndForget to 2kb
2026-03-01 23:39:30 +02:00
zeekay
6759ac456c
Rebrand PocketBase imports to Hanzo Base across all Go files
...
Replace github.com/pocketbase/pocketbase with github.com/hanzoai/base
in 106 Go source files. Keep pocketbase/dbx and pocketbase/tygoja as-is
(upstream dependencies). Add compiled binary to .gitignore. Include
realtime DX design document inspired by Convex patterns.
2026-02-27 09:43:39 -08:00
zeekay
4b4d307330
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# .github/SECURITY.md
# plugins/jsvm/internal/types/generated/types.d.ts
# ui/dist/assets/AuthMethodsDocs-Dpd1KLEi.js
# ui/dist/assets/AuthRefreshDocs-KmFqCz1h.js
# ui/dist/assets/AuthWithOAuth2Docs-CyJfh606.js
# ui/dist/assets/AuthWithOtpDocs-CuAOVtzX.js
# ui/dist/assets/AuthWithPasswordDocs-CmHb4Jjn.js
# ui/dist/assets/BatchApiDocs-LUXI6B6N.js
# ui/dist/assets/DeleteApiDocs-KmnbmZ-6.js
# ui/dist/assets/EmailChangeDocs-DhDDRSkd.js
# ui/dist/assets/FieldsQueryParam-C7N80dkz.js
# ui/dist/assets/ListApiDocs-BZTCC2fq.js
# ui/dist/assets/PageInstaller-Cdywf0VY.js
# ui/dist/assets/PageOAuth2RedirectFailure-9trAN4R5.js
# ui/dist/assets/PageOAuth2RedirectSuccess-BKErE1i9.js
# ui/dist/assets/PageRecordConfirmEmailChange-B83GxdXn.js
# ui/dist/assets/PageRecordConfirmPasswordReset-72PfbDaZ.js
# ui/dist/assets/PageRecordConfirmVerification-Cudgspq-.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-BvmdsmYF.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-B8e2B4ZR.js
# ui/dist/assets/PasswordResetDocs-Do427Hpy.js
# ui/dist/assets/RealtimeApiDocs-DydjyGiu.js
# ui/dist/assets/VerificationDocs-CTnb2Ar3.js
# ui/dist/assets/ViewApiDocs-D9o91Lhw.js
2026-02-27 08:57:15 -08:00
Gani Georgiev
9ba848cb25
check the data again after the GetOrSet write lock
2026-02-24 23:02:11 +02:00
zeekay
4b229fae5b
Merge remote-tracking branch 'upstream/master'
...
# Conflicts:
# core/record_field_resolver_multi_match.go
# ui/dist/assets/AuthMethodsDocs-ChShXLwE.js
# ui/dist/assets/AuthMethodsDocs-Cqvl0T_l.js
# ui/dist/assets/AuthMethodsDocs-DIqhS7qY.js
# ui/dist/assets/AuthRefreshDocs-CHakkNnn.js
# ui/dist/assets/AuthRefreshDocs-DLb1qree.js
# ui/dist/assets/AuthRefreshDocs-DXgrlMdk.js
# ui/dist/assets/AuthWithOAuth2Docs-Bl8VRxNv.js
# ui/dist/assets/AuthWithOAuth2Docs-DVBOel22.js
# ui/dist/assets/AuthWithOAuth2Docs-I213UiJ7.js
# ui/dist/assets/AuthWithOtpDocs-B9tL6gIN.js
# ui/dist/assets/AuthWithOtpDocs-C2PPm9-Z.js
# ui/dist/assets/AuthWithOtpDocs-qEMoMG3D.js
# ui/dist/assets/AuthWithPasswordDocs-B8JWDbPL.js
# ui/dist/assets/AuthWithPasswordDocs-BTHeYJwE.js
# ui/dist/assets/AuthWithPasswordDocs-D9rqgLpO.js
# ui/dist/assets/BatchApiDocs-BV4PYYXn.js
# ui/dist/assets/BatchApiDocs-DXa997am.js
# ui/dist/assets/BatchApiDocs-Di2Qe2dV.js
# ui/dist/assets/DeleteApiDocs-C3IINRwz.js
# ui/dist/assets/DeleteApiDocs-LfmVp4Uf.js
# ui/dist/assets/DeleteApiDocs-SU4XdGhJ.js
# ui/dist/assets/EmailChangeDocs-COx1USU5.js
# ui/dist/assets/EmailChangeDocs-D-qNHT_P.js
# ui/dist/assets/EmailChangeDocs-DpfXIE_V.js
# ui/dist/assets/FieldsQueryParam-BYe9ZK-G.js
# ui/dist/assets/FieldsQueryParam-L8vpHeF4.js
# ui/dist/assets/FieldsQueryParam-z0dGQ6uY.js
# ui/dist/assets/ListApiDocs-BCTT-AOz.js
# ui/dist/assets/ListApiDocs-C0_GwI7k.js
# ui/dist/assets/ListApiDocs-T9_aO-pW.js
# ui/dist/assets/PageInstaller-B22bivaN.js
# ui/dist/assets/PageInstaller-C0BBhyBx.js
# ui/dist/assets/PageInstaller-IYSwJhZW.js
# ui/dist/assets/PageOAuth2RedirectFailure-BjbpqlFj.js
# ui/dist/assets/PageOAuth2RedirectFailure-COyNF79R.js
# ui/dist/assets/PageOAuth2RedirectFailure-DPmGG9zv.js
# ui/dist/assets/PageOAuth2RedirectSuccess-6cMXLFAX.js
# ui/dist/assets/PageOAuth2RedirectSuccess-CdkCarGH.js
# ui/dist/assets/PageOAuth2RedirectSuccess-DSEIHeQL.js
# ui/dist/assets/PageRecordConfirmEmailChange-BYW-6ASg.js
# ui/dist/assets/PageRecordConfirmEmailChange-Bm1CIYvq.js
# ui/dist/assets/PageRecordConfirmEmailChange-BpaqOT4u.js
# ui/dist/assets/PageRecordConfirmPasswordReset--wx_u2lI.js
# ui/dist/assets/PageRecordConfirmPasswordReset-CoeY2Z_C.js
# ui/dist/assets/PageRecordConfirmPasswordReset-Ptya5bfe.js
# ui/dist/assets/PageRecordConfirmVerification-6xjF3T0O.js
# ui/dist/assets/PageRecordConfirmVerification-C1UTIIJh.js
# ui/dist/assets/PageRecordConfirmVerification-C4LixXvA.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-19z2IFg4.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-DwNi0ugQ.js
# ui/dist/assets/PageSuperuserConfirmPasswordReset-SMnDTRNi.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-BpDW217f.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-DK63qE6z.js
# ui/dist/assets/PageSuperuserRequestPasswordReset-bG02qLIM.js
# ui/dist/assets/PasswordResetDocs-CE67mLC0.js
# ui/dist/assets/PasswordResetDocs-CHAK0vma.js
# ui/dist/assets/PasswordResetDocs-Dap-N4rx.js
# ui/dist/assets/RealtimeApiDocs-BooTSQCb.js
# ui/dist/assets/RealtimeApiDocs-CoHmYVEx.js
# ui/dist/assets/RealtimeApiDocs-D7ds3fHt.js
# ui/dist/assets/VerificationDocs-B42AIoCQ.js
# ui/dist/assets/VerificationDocs-BS7b11zH.js
# ui/dist/assets/VerificationDocs-ZhkdFVIl.js
# ui/dist/assets/ViewApiDocs-BXmRLHZ1.js
# ui/dist/assets/ViewApiDocs-DM5JJQjh.js
# ui/dist/assets/ViewApiDocs-DRpxcuJR.js
# ui/public/fonts/source-sans-pro/source-sans-pro-v18-latin_cyrillic-700.woff2
# ui/public/fonts/ubuntu-mono/ubuntu-mono-v17-cyrillic_latin-700.woff2
2026-02-22 01:17:16 -08:00
Gani Georgiev
8da3b837b8
updated jsvm types
2026-02-16 22:04:19 +02:00
zeekay
86273e0e2c
feat: rebrand to Hanzo Base with GeoPoint field support and token management
2026-02-13 22:12:10 -08:00
Gani Georgiev
2c08167eb4
updated test status codes to 2xx due to go 1.26.0 stricter checks
2026-02-13 20:02:55 +02:00
Gani Georgiev
eed8d7d904
[ #7523 ] added Accept-Encoding:identity to the S3 requests
2026-02-13 16:16:12 +02:00
Gani Georgiev
81968b1706
silenced race detector errors per #7484
2026-01-28 11:52:08 +02:00
Gani Georgiev
1b560439fe
fixed comment typos
2026-01-17 10:58:12 +02:00
Gani Georgiev
51aa5868a0
replaced NoCoalesce with NullFallback and updated tests
2026-01-15 18:06:15 +02:00
Gani Georgiev
d48823e527
added strftime filter function
2026-01-15 14:27:53 +02:00
Gani Georgiev
b19fc0223c
fixed typo and updated changelog
2026-01-13 22:23:23 +02:00
Gani Georgiev
babd16d998
use group by instead of distinct when possible
2026-01-13 18:47:32 +02:00
Gani Georgiev
d7a518bcc7
fixed comment typo
2025-12-21 09:24:07 +02:00
Gani Georgiev
a95f1a1558
upgraded to math/rand/v2
2025-12-19 19:08:56 +02:00
Gani Georgiev
f29c18c71a
cap the file name before normalization
2025-12-19 16:58:08 +02:00
Gani Georgiev
ca6eef6b62
added test for file name normalization with leading dot
2025-12-19 16:30:11 +02:00
Gani Georgiev
2f94977620
replace TrimSuffix with Trim
2025-12-12 08:52:22 +02:00
Gani Georgiev
6d763a1f86
trim normalized file extension
2025-12-12 08:49:10 +02:00
Gani Georgiev
0e2d39a03d
added small threshold for the cron time based tests
2025-12-12 08:48:29 +02:00
Gani Georgiev
e5601098cd
store the correct image/png as attrs content type when generating a thumb fallback
2025-12-09 17:09:32 +02:00
Gani Georgiev
60ce7d0ced
add extra subquery check for client-side relation filtering
2025-10-31 22:22:28 +02:00
Gani Georgiev
85451b6b26
moved ValidateTokenSignature to jwk and added tests
2025-10-19 18:19:26 +03:00
Gani Georgiev
968fdd3a41
[ #7252 ] support ed25519 oidc id_token signature validation
2025-10-19 13:49:39 +03:00
Gani Georgiev
f56cee00f5
support Uploader.MaxConcurrency=1 and updated tests
2025-10-02 20:52:36 +03:00
Gani Georgiev
ec7549e1c3
updated go deps
2025-09-22 23:04:20 +03:00
Gani Georgiev
2f483f6c4f
added DefaultClient.Send panic/recover handling as an extra precaution
2025-09-22 22:52:58 +03:00
Gani Georgiev
2637eae68a
fixed Message.WriteSSE example
2025-09-13 23:46:13 +03:00
Gani Georgiev
1a42a2b068
wrap DefaultClient.Send with a single lock/unlock and rename mux to mu for consistency
2025-09-13 23:42:46 +03:00
Gani Georgiev
07e94f94d8
updated changelog
2025-09-06 21:45:04 +03:00
Gani Georgiev
ba9b9ceacd
check the default user cachedir if GOCACHE is not explicitly set
2025-09-06 21:20:13 +03:00
Gani Georgiev
0fc158d1c5
added osutils.IsProbablyGoRun
2025-09-06 19:52:51 +03:00
Gani Georgiev
4fd31b4a36
added os.Root bindings to the JSVM
2025-09-06 14:51:27 +03:00
zeekay
Gani Georgiev