Update .github/workflows/ci-cd.yml

fix: validate action parameter and correct database health check logic
- Add whitelist of valid actions to prevent arbitrary action values - Fix error handling to properly detect database failures Previously, any action value was accepted without validation, which could lead to unexpected behavior. The health check also incorrectly set dbOK to true when queries succeeded, now correctly sets it to false when errors occur.
2026-05-11 15:18:05 +03:30 · 2026-05-11 12:19:47 +03:30 · 2026-05-07 18:15:06 +03:30 · 2026-05-07 17:54:36 +03:30 · 2026-05-07 17:52:23 +03:30 · 2026-05-07 17:50:14 +03:30
4 changed files with 74 additions and 13 deletions
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -4,7 +4,7 @@ on:
  push:
    branches: [main, master]
    paths: 
-      - 'src/'
+      - 'src/**'
  pull_request:
    branches: [main, master]

@@ -22,6 +22,9 @@ jobs:
      - name: Download dependencies
        run: /usr/local/go/bin/go mod download

+      - name: Tidy modules
+        run: /usr/local/go/bin/go mod tidy
+
      - name: Check formatting
        run: |
          if [ "$(/usr/local/go/bin/gofmt -l $(find . -name '*.go' -not -path './vendor/*'))" ]; then
@@ -76,7 +79,7 @@ jobs:
        run: |
          docker buildx build \
            --platform linux/amd64 \
-            --tag "git.yejayekhoob.com/db123/auth-proxy:${{ github.sha }}" \
-            --tag "git.yejayekhoob.com/db123/auth-proxy:latest" \
+            --tag "git.yejayekhoob.com/yjkh/auth-proxy:${{ github.sha }}" \
+            --tag "git.yejayekhoob.com/yjkh/auth-proxy:latest" \
            --push \
            .
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
 *.exe
 *.env
-*.sum
+*.db*
--- a/go.sum
+++ b/go.sum
@@ -0,0 +1,51 @@
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
+modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
+modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
+modernc.org/ccgo/v4 v4.32.4/go.mod h1:lY7f+fiTDHfcv6YlRgSkxYfhs+UvOEEzj49jAn2TOx0=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.72.0 h1:IEu559v9a0XWjw0DPoVKtXpO2qt5NVLAnFaBbjq+n8c=
+modernc.org/libc v1.72.0/go.mod h1:tTU8DL8A+XLVkEY3x5E/tO7s2Q/q42EtnNWda/L5QhQ=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
+modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
--- a/src/auth.go
+++ b/src/auth.go
@@ -243,8 +243,15 @@ func parseLogFilter(r *http.Request) (*logFilter, error) {
 		Offset: 0,
 	}

+	validActions := map[string]bool{
+		"add_temp": true, "delete_temp": true,
+		"add_perm": true, "delete_perm": true, "expire_temp": true,
+	}
+
 	if v := r.URL.Query().Get("action"); v != "" {
-		f.Action = v
+		if validActions[v] {
+			f.Action = v
+		}
 	}
 	if v := r.URL.Query().Get("ip"); v != "" {
 		f.IP = v
@@ -302,8 +309,8 @@ func logsHandler(db *sql.DB) http.HandlerFunc {
 		logs := make([]map[string]interface{}, 0)
 		for rows.Next() {
 			var ts time.Time
-			var action, apiClientIP string
-			var ip, reason sql.NullString
+			var action string
+			var ip, reason, apiClientIP sql.NullString
 			var ttlSeconds sql.NullInt64
 			if err := rows.Scan(&ts, &action, &ip, &ttlSeconds, &reason, &apiClientIP); err != nil {
 				continue
@@ -311,7 +318,7 @@ func logsHandler(db *sql.DB) http.HandlerFunc {
 			entry := map[string]interface{}{
 				"timestamp":     ts,
 				"action":        action,
-				"api_client_ip": apiClientIP,
+				"api_client_ip": apiClientIP.String,
 				"reason":        reason.String,
 			}
 			if ip.Valid {
@@ -333,13 +340,13 @@ func statusHandler(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		var permCount int
 		var tempCount int
-		dbOK := false
+		dbOK := true

-		if err := db.QueryRow(`SELECT COUNT(*) FROM perm_whitelist`).Scan(&permCount); err == nil {
-			dbOK = true
+		if err := db.QueryRow(`SELECT COUNT(*) FROM perm_whitelist`).Scan(&permCount); err != nil {
+			dbOK = false
 		}
-		if err := db.QueryRow(`SELECT COUNT(*) FROM temp_whitelist WHERE expires_at > ?`, time.Now().Format(time.RFC3339)).Scan(&tempCount); err == nil {
-			dbOK = true
+		if err := db.QueryRow(`SELECT COUNT(*) FROM temp_whitelist WHERE expires_at > ?`, time.Now().Format(time.RFC3339)).Scan(&tempCount); err != nil {
+			dbOK = false
 		}

 		health := map[string]interface{}{
Author	SHA1	Message	Date
db1234719	d2992d2af6	Update .github/workflows/ci-cd.yml	2026-05-11 15:18:05 +03:30
db123-test	7930f2ec99	fix: validate action parameter and correct database health check logic - Add whitelist of valid actions to prevent arbitrary action values - Fix error handling to properly detect database failures Previously, any action value was accepted without validation, which could lead to unexpected behavior. The health check also incorrectly set dbOK to true when queries succeeded, now correctly sets it to false when errors occur.	2026-05-11 12:19:47 +03:30
db123-test	ef7abd386e	fix(auth): corrected apu_client_ip to only return an string instead of array with valid true	2026-05-07 18:15:06 +03:30
db123-test	bdc0d9beb2	fix: commit go.sum and remove .sum from gitignore The .sum exclusion was preventing version control of Go dependency checksums. Remove the pattern from .gitignore to allow go.sum to be committed while keeping generated binaries (.exe, .env, .db*) excluded.	2026-05-07 17:54:36 +03:30
db123-test	eb8ba0eb74	ci: replace manual sqlite driver download with go mod tidy The workflow previously ran `go get auth-proxy/src` to download the sqlite driver separately before downloading dependencies. This step has been removed and replaced with `go mod tidy`, which is the idiomatic Go approach for managing dependencies. It ensures go.mod is properly formatted and removes unused dependencies, eliminating the need for manual driver installation steps.	2026-05-07 17:52:23 +03:30
db123-test	31afa58ace	Merge branch 'master' of ssh://git.yejayekhoob.com:2222/db123/auth-proxy	2026-05-07 17:50:14 +03:30
db123-test	63dba60c44	fix: add SQLite Go driver download step in CI pipeline Add explicit go get for the auth-proxy/src package to ensure the SQLite driver is available before running go mod download, fixing dependency resolution during CI builds.	2026-05-07 17:50:05 +03:30
db1234719	b6d71a3929	fix: made it detect any change inside src folder and only run then	2026-05-07 17:47:40 +03:30
db123-test	3ba6d61117	fix: use sql.NullString for apiClientIP in logs query Change apiClientIP from string to sql.NullString to properly handle NULL values from the database, preventing potential runtime errors when the column contains NULL entries.	2026-05-07 17:46:23 +03:30
db123-test	6ea4019d55	chore(gitignore): ignored .db files	2026-05-07 16:53:11 +03:30