pansy

46 Commits 9 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
steve	2a86f87b50	Sharing backend: shares CRUD + ACL enforcement everywhere (#16 ) Build image / build-and-push (push) Successful in 4s Details Co-authored-by: Steve Dudenhoeffer <[email protected]>	2026-07-19 03:49:54 +00:00
steve	293532f021	Plant catalog backend: CRUD + seeded built-ins (#12 ) Build image / build-and-push (push) Successful in 5s Details Co-authored-by: Steve Dudenhoeffer <[email protected]>	2026-07-19 01:48:22 +00:00
steveandClaude Opus 4.8	3fbefa4e05	Address Gadfly review on #7 : garden cap, dim validation, shared errors Build image / build-and-push (push) Successful in 5s Details Fixes from the PR #26 adversarial review (graded 18 real / 0 false positive). Correctness / security - maxGardenCM fixed to 10_000 (100 m), matching its comment — it was 100_000 cm (1 km), 10x too lax (5 models flagged this). - Dimension validation now rejects NaN/Inf (which slip past naive comparisons) and subnormal-tiny positives, via a finite [1cm, 100m] check. Name (200) and notes (10_000) are length-capped so untrusted input can't balloon storage. - Update version binding is `required,min=1`, so a negative/zero version is a 400, not a 409. Maintainability / performance - One unified writeServiceError (new errors.go) maps every auth + resource sentinel; writeResourceError removed. writeVersionConflict and parseIDParam moved to errors.go (shared, not in the gardens feature file). - Request structs share an embedded gardenFields (one toInput). - CreateGarden uses INSERT ... RETURNING (one round-trip). - ListGardensForOwner has a defensive LIMIT (pagination is post-v1). Tests: name/notes length, NaN/Inf/subnormal dims, dimension-at-cap valid, negative/zero version -> 400. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 18:39:27 -04:00

Author

SHA1

Message

Date

steve

2a86f87b50

Sharing backend: shares CRUD + ACL enforcement everywhere (#16 )

Build image / build-and-push (push) Successful in 4s

Details

Co-authored-by: Steve Dudenhoeffer <[email protected]>

2026-07-19 03:49:54 +00:00

steve

293532f021

Plant catalog backend: CRUD + seeded built-ins (#12 )

Build image / build-and-push (push) Successful in 5s

Details

Co-authored-by: Steve Dudenhoeffer <[email protected]>

2026-07-19 01:48:22 +00:00

steveandClaude Opus 4.8

3fbefa4e05

Address Gadfly review on #7 : garden cap, dim validation, shared errors

Build image / build-and-push (push) Successful in 5s

Details

Fixes from the PR #26 adversarial review (graded 18 real / 0 false positive).

Correctness / security
- maxGardenCM fixed to 10_000 (100 m), matching its comment — it was
  100_000 cm (1 km), 10x too lax (5 models flagged this).
- Dimension validation now rejects NaN/Inf (which slip past naive
  comparisons) and subnormal-tiny positives, via a finite [1cm, 100m]
  check. Name (200) and notes (10_000) are length-capped so untrusted
  input can't balloon storage.
- Update version binding is `required,min=1`, so a negative/zero version
  is a 400, not a 409.

Maintainability / performance
- One unified writeServiceError (new errors.go) maps every auth + resource
  sentinel; writeResourceError removed. writeVersionConflict and
  parseIDParam moved to errors.go (shared, not in the gardens feature file).
- Request structs share an embedded gardenFields (one toInput).
- CreateGarden uses INSERT ... RETURNING (one round-trip).
- ListGardensForOwner has a defensive LIMIT (pagination is post-v1).

Tests: name/notes length, NaN/Inf/subnormal dims, dimension-at-cap valid,
negative/zero version -> 400.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

2026-07-18 18:39:27 -04:00