- Add whitelist of valid actions to prevent arbitrary action values
- Fix error handling to properly detect database failures
Previously, any action value was accepted without validation, which could lead to unexpected behavior. The health check also incorrectly set dbOK to true when queries succeeded, now correctly sets it to false when errors occur.
Change apiClientIP from string to sql.NullString to properly handle
NULL values from the database, preventing potential runtime errors
when the column contains NULL entries.
Add .env and .env.local loading with InitEnv() helper that reads
environment variables from config files without overwriting existing
values.
Refactor SQL queries to use parameterized arguments instead of
string formatting for LIMIT/OFFSET clauses, improving query security
and preventing SQL injection vulnerabilities.
Clean up unnecessary rows.Close() calls and simplify error handling
in database query functions.
- Remove Config parameter from authHandler and CheckAuth
- Add doc comments and extract helper functions for IP extraction
- Refactor database operations (addPerm, addTemp, delPerm)
- Add CIDR matching support in IsPermanentWhitelisted
- Add request struct for temporary whitelist handler
- Update route registrations to match new function signatures
Rename the 'entry' column to 'ip' throughout the database schema and
function signatures for clarity. This affects both the CREATE TABLE
statement and all INSERT queries in the audit_log table.
The parameter naming in AddPermanentEntry, DeletePermanentEntry, and
AddTempEntry functions has also been updated to reflect the more
specific 'ip' terminology. Corresponding log messages have been
adjusted to use 'temp ip' instead of 'temp entry' for consistency.
Rename the `entry` field to `ip` throughout the whitelist API for
clarity and consistency. This affects API request/response bodies,
path parameters, OpenAPI spec, documentation, and database queries
in the audit log endpoint.
