Skip to content

Sync dev → main: README refresh, Phase 7 SCIM, Phase 10 fixtures, Phase 11 MFA hardening#98

Merged
scarson merged 33 commits into
mainfrom
dev
Apr 24, 2026
Merged

Sync dev → main: README refresh, Phase 7 SCIM, Phase 10 fixtures, Phase 11 MFA hardening#98
scarson merged 33 commits into
mainfrom
dev

Conversation

@scarson
Copy link
Copy Markdown
Owner

@scarson scarson commented Apr 24, 2026

Summary

Brings main up to date with the accumulated work on dev since the last sync. The tip of dev is a README refresh anchored to 2026-03-17, but this PR carries the whole delta.

Major themes on dev since main:

  • Phase 7 — SCIM 2.0 provisioning (Users, Groups, bearer auth, group-to-role mapping, scim_exempt, dedicated rate limiter, hardening pass from security/pitfall review)
  • Phase 10 — Test fixture corpus (captured feed responses, testutil.SeedCorpus with 65 real CVEs across 8 feeds, golden-file tests for every adapter, MSRC CSAF rewrite to use static files via changes.csv)
  • Phase 11 — MFA bug hunt remediation (TOTP FOR UPDATE replay prevention, pending-token step enforcement, token-version rotation, enrollment cookie path fix, email OTP exhaustion events)
  • Phase 8 — Test coverage remediation (cross-org isolation, admin user/audit/config secrets, auth edge cases, doctor + periodic tests)
  • Feed client hardening (sony/gobreaker v2 per-feed circuit breaker, safeurl outbound + response body size limits, reworked dependent pagination validation)
  • Crypto — AES-GCM AAD binding to entity context
  • Audit logging fleshed out across API keys, ingest, reports, groups handlers
  • Dependency cadence — Vite 7 → 8, pgx 5.9.1, go-jose 4.1.4, many batched dev/prod bumps via Dependabot
  • Docs — implementation-pitfalls.md reorganized by domain with TOC; pitfall meta-review audit artifacts; README refreshed today

Test plan

  • CI green on the PR (lint, vet, Go tests, frontend tests)
  • go test ./... -count=1 -timeout=600s passes on the merged branch
  • cd web && npm run test:unit passes
  • Spot-check: cvert-ops doctor still passes on a fresh migrate
  • Spot-check: SCIM discovery endpoints reachable at /scim/v2/ServiceProviderConfig

🤖 Generated with Claude Code

dependabot Bot and others added 30 commits April 5, 2026 17:31
@dependabot @scarson
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#71
58fd889 
)

Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump defu from 6.1.4 to 6.1.6 in /web (#72)
01846f1 
Bumps [defu](https://github.com/unjs/defu) from 6.1.4 to 6.1.6.
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](unjs/defu@v6.1.4...v6.1.6)

---
updated-dependencies:
- dependency-name: defu
  dependency-version: 6.1.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump picomatch in /web (#66)
0b9e46e 
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.3…
10ec597 
…7.3 (#69)

Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.37.2 to 2.37.3.
- [Release notes](https://github.com/danielgtaylor/huma/releases)
- [Commits](danielgtaylor/huma@v2.37.2...v2.37.3)

---
updated-dependencies:
- dependency-name: github.com/danielgtaylor/huma/v2
  dependency-version: 2.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/genai from 1.50.0 to 1.52.0 (#70)
efcbd6b 
Bumps [google.golang.org/genai](https://github.com/googleapis/go-genai) from 1.50.0 to 1.52.0.
- [Release notes](https://github.com/googleapis/go-genai/releases)
- [Changelog](https://github.com/googleapis/go-genai/blob/v1.52.0/CHANGELOG.md)
- [Commits](googleapis/go-genai@v1.50.0...v1.52.0)

---
updated-dependencies:
- dependency-name: google.golang.org/genai
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0 (#60)
b0cbca4 
Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.11.2 to 1.12.0.
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.11.2...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#68)
52fda94 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4b73464...4a36011)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump @tailwindcss/vite from 4.2.1 to 4.2.2 in /web (#65)
96c199e 
Bumps [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-vite)

---
updated-dependencies:
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump yaml from 2.8.2 to 2.8.3 in /web (#67)
62a7ecc 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump vue-router from 5.0.3 to 5.0.4 in /web (#63)
7995dcf 
Bumps [vue-router](https://github.com/vuejs/router) from 5.0.3 to 5.0.4.
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v5.0.3...v5.0.4)

---
updated-dependencies:
- dependency-name: vue-router
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump eslint from 10.0.3 to 10.1.0 in /web (#64)
403257e 
Bumps [eslint](https://github.com/eslint/eslint) from 10.0.3 to 10.1.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.0.3...v10.1.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump @vitest/eslint-plugin in /web (#62)
abc07e3 
Bumps [@vitest/eslint-plugin](https://github.com/vitest-dev/eslint-plugin-vitest) from 1.6.12 to 1.6.13.
- [Release notes](https://github.com/vitest-dev/eslint-plugin-vitest/releases)
- [Commits](vitest-dev/eslint-plugin-vitest@v1.6.12...v1.6.13)

---
updated-dependencies:
- dependency-name: "@vitest/eslint-plugin"
  dependency-version: 1.6.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#59)
c7611ca 
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.8.0 to 5.9.1.
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.8.0...v5.9.1)

---
updated-dependencies:
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump vite from 7.3.1 to 8.0.1 in /web (#61)
1bab411 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 8.0.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.0.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@scarson @claude
chore(deps): remove vite-plugin-vue-devtools (no Vite 8 support)
b6eb60d 
The plugin's transitive dep vite-plugin-inspect doesn't support Vite 8
yet (vuejs/devtools#1071). It was installed but never registered in
vite.config.ts. The Vue DevTools browser extension provides equivalent
functionality. Re-add when upstream updates the peer dep range.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson @claude
feat(crypto): bind GCM ciphertext to entity context via AAD (#83)
866ab4a 
Add Additional Authenticated Data (AAD) to AES-256-GCM encrypt/decrypt,
preventing ciphertext relocation between database rows. SSO client
secrets are bound to org_id, MFA TOTP secrets to user_id, and the
doctor encryption sentinel to a fixed label.

Also adds dev/specs/sso-secret-storage.md documenting the full
encryption architecture for external sharing.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot
chore(deps): bump reka-ui from 2.9.2 to 2.9.3 in /web (#80)
922732c 
Bumps [reka-ui](https://github.com/unovue/reka-ui) from 2.9.2 to 2.9.3.
- [Release notes](https://github.com/unovue/reka-ui/releases)
- [Commits](unovue/reka-ui@v2.9.2...v2.9.3)

---
updated-dependencies:
- dependency-name: reka-ui
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump vue from 3.5.30 to 3.5.32 in /web (#79)
3e95c0e 
Bumps [vue](https://github.com/vuejs/core) from 3.5.30 to 3.5.32.
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.30...v3.5.32)

---
updated-dependencies:
- dependency-name: vue
  dependency-version: 3.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.3 (#76)
64b104c 
Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.12.0 to 1.12.3.
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.12.0...v1.12.3)

---
updated-dependencies:
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/genai from 1.52.0 to 1.52.1 (#75)
cd8c461 
Bumps [google.golang.org/genai](https://github.com/googleapis/go-genai) from 1.52.0 to 1.52.1.
- [Release notes](https://github.com/googleapis/go-genai/releases)
- [Changelog](https://github.com/googleapis/go-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/go-genai@v1.52.0...v1.52.1)

---
updated-dependencies:
- dependency-name: google.golang.org/genai
  dependency-version: 1.52.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@scarson @claude
chore(deps-dev): bump oxlint and eslint-plugin-oxlint to ~1.58.0
5bc0df7 
eslint-plugin-oxlint 1.58.0 adds a peerDependency on oxlint ~1.58.0,
so both must be bumped together. Lint and tests verified.

Closes #78.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot
chore(deps-dev): bump @types/node from 24.12.0 to 25.5.2 in /web (#77)
ea50fee 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.12.0 to 25.5.2.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.5.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@scarson
Merge remote-tracking branch 'origin/main' into dev
6bae0c2 
# Conflicts:
#	go.mod
#	go.sum
#	web/package-lock.json
#	web/package.json
@scarson @claude
chore(deps): upgrade TypeScript 5.9 to 6.0
6efb34b 
- Bump typescript from ~5.9.3 to ~6.0.2
- Bump @vue/tsconfig from ^0.9.0 to ^0.9.1 (adds TS6 peer support)
- Remove deprecated baseUrl from tsconfig.json and tsconfig.app.json
  (TS6 resolves paths relative to the tsconfig file by default)

Type-check, lint, and all 419 unit tests pass.

Closes #81.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson @claude
revert(deps): revert TypeScript 6 upgrade, keep baseUrl removal
02c8474 
openapi-typescript@7.13.0 requires peer typescript ^5.x with no TS6
support yet. Revert typescript and @vue/tsconfig version bumps.

Keep the baseUrl removal from tsconfig.json and tsconfig.app.json —
paths resolve relative to the tsconfig file without it on TS 5.9 too,
and this prepares for TS6 when the ecosystem catches up.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson @claude
chore(lint): disable require-mock-type-parameters rule
1763dbb 
New in oxlint 1.58.0 under the correctness category. Requires type
parameters on all vi.fn() calls — a style preference, not a
correctness issue. Disable rather than modifying 147 test call sites.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson
Revert "chore(lint): disable require-mock-type-parameters rule"
26873dd 
This reverts commit 1763dbb.
@scarson @claude
fix(lint): add type parameters to all vi.fn() mock calls
e85a60a 
oxlint 1.58.0 enables require-mock-type-parameters under correctness.
Untyped vi.fn() returns Mock<(...args: any[]) => any>, silently
discarding type safety on mock arguments and return values.

Add explicit type parameters to all 147 vi.fn() call sites across
28 test files. All tests pass (419/419).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson @claude
fix(lint): use precise mock types where generic unknown breaks type-c…
e53c030 
…heck

Three files needed more specific type parameters than the generic
(...args: unknown[]) => unknown pattern:

- CreateWatchlistDialog: cast mock.calls access for body property access
- client.test.ts: type fetchMock as typeof fetch (assigned to globalThis.fetch)
- CveDetailView: type mockGET first arg as string (used in mockImplementation)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson @claude
fix(lint): match proxy signature to typed mockGET in CveDetailView test
558e9d3 
The spread proxy (...args: unknown[]) can't spread into a
(string, ...unknown[]) parameter. Match the proxy's signature.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
scarson and others added 3 commits April 23, 2026 03:10
@scarson @claude
docs: fix accomodate → accommodate and architectutral → architectural…
2366a83 
… typos

Both typos propagated here from the shared agent-guidance ruleset
heritage. Same two typos were fixed in laserfiche-cli-temp#125. Caught
this time by a codespell pass during related work in laserfiche.

CLAUDE.md and AGENTS.md both carry the same 4 typo instances (each
file has 'architectutral' at line 39 and 'accomodate' at line 56);
all 4 fixed.

PRing (line 150 in CLAUDE.md) was also flagged by codespell but is
intentional GitHub/dev vernacular for 'creating a pull request';
skipped as a false positive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@scarson
Merge pull request #97 from scarson/docs/fix-claude-md-typos
7347cb0 
docs: fix accomodate + architectutral typos in CLAUDE.md and AGENTS.md
@scarson @claude
docs: refresh README with SCIM, MFA, and infrastructure updates
08e0f2d 
Anchored to the last README update on 2026-03-17, catching up on five
weeks of drift:

- SCIM 2.0 moved from "planned" to a shipped feature section
- added Multi-Factor Authentication section (TOTP + email OTP)
- CLI table expanded from 3 to 8 cvert-ops subcommands plus the
  standalone healthcheck binary
- refreshed test counts (2,200+ funcs, 200+ files, 100+ integration)
  and added SeedCorpus + golden-file fixture description
- noted per-feed circuit breakers (sony/gobreaker v2) and
  SSRF-hardened shared feed client
- added crypto, doctor, metrics, secure, tier packages to the project
  layout
- fixed stale docs/plans/ path (now dev/plans/)
- softened coverage percentages that are 5 weeks stale

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@scarson scarson merged commit e2bc036 into main Apr 24, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scarson