SPDT/sapl - sapl - Gitea: Git with a cup of tea

5878 Commits

61 Branches

269 Tags

217 MiB

Tree: f838a71d05

Commit Graph

Author	SHA1	Message	Date
Edward Ribeiro	f838a71d05	Fix norma etag field and media private path - _norma_last_modified: use ultima_edicao instead of data_ultima_atualizacao - serve_media: gate on sapl/private/ instead of documentos_privados/ - plan: update norma freshness field reference Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 weeks ago
Edward Ribeiro	a9416f5ad2	Phase 7: HTTP conditional requests, static caching, nginx cleanup - ConditionalGetMiddleware added to MIDDLEWARE (ETag/304 for all views) - @condition(etag_func, last_modified_func) on MateriaLegislativa and NormaJuridica detail views — skips view execution on cache hit via data_ultima_atualizacao (auto_now=True) as freshness signal - nginx /static/: expires 90m + Cache-Control public, max-age=5400 - nginx: removed upload-endpoint special-casing (location ~* ^/(protocoloadm/criar-protocolo\|...)) - plan/RATE-LIMITER-PLAN.md updated to reflect all Phase 7 changes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2 weeks ago
Edward Ribeiro	c5eea025ab	Phase 6: scanner probe blocking, plan consolidation, and flow diagram Code: - Block IPs dynamically on scanner extension probes (.php, .asp, .aspx, .jsp, .cgi, .env) — writes rl:ip:{ip}:blocked on first hit; subsequent requests short-circuit at check 2 with zero counting overhead - Add RATE_LIMIT_SCANNER_EXTENSIONS setting (space-separated, env-overridable) - Import os in ratelimit.py for os.path.splitext Plan (RATE_LIMITER_PLAN.md → RATE-LIMITER-PLAN.md): - Rename to kebab-case for consistency with rate-limiter-v2.md - Merge missing content from rate-limiter-v2.md: context & problem statement, component diagram (DB0/DB1 split), decision log, Gunicorn tuning, nginx real-IP fixes, upload settings, N+1 fix (synced to actual implementation), enforcement graduation order, decorator migration table, file serving decision matrix, dynamic page caching guidelines, open questions - Add Mermaid decision flow diagram for RateLimitMiddleware._evaluate() - Add rationale section for rl:{ns}:ip:{ip}:w:{bucket} namespace scoping (5 arguments covering attack pattern match, gaming resistance, key orthogonality, multi-portal fairness, and isolation contract) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	3 weeks ago

Author

SHA1

Message

Date

Edward Ribeiro

f838a71d05

Fix norma etag field and media private path

- _norma_last_modified: use ultima_edicao instead of data_ultima_atualizacao
- serve_media: gate on sapl/private/ instead of documentos_privados/
- plan: update norma freshness field reference

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 weeks ago

Edward Ribeiro

a9416f5ad2

Phase 7: HTTP conditional requests, static caching, nginx cleanup

- ConditionalGetMiddleware added to MIDDLEWARE (ETag/304 for all views)
- @condition(etag_func, last_modified_func) on MateriaLegislativa and
  NormaJuridica detail views — skips view execution on cache hit via
  data_ultima_atualizacao (auto_now=True) as freshness signal
- nginx /static/: expires 90m + Cache-Control public, max-age=5400
- nginx: removed upload-endpoint special-casing (location ~* ^/(protocoloadm/criar-protocolo|...))
- plan/RATE-LIMITER-PLAN.md updated to reflect all Phase 7 changes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 weeks ago

Edward Ribeiro

c5eea025ab

Phase 6: scanner probe blocking, plan consolidation, and flow diagram

Code:
- Block IPs dynamically on scanner extension probes (.php, .asp, .aspx,
  .jsp, .cgi, .env) — writes rl:ip:{ip}:blocked on first hit; subsequent
  requests short-circuit at check 2 with zero counting overhead
- Add RATE_LIMIT_SCANNER_EXTENSIONS setting (space-separated, env-overridable)
- Import os in ratelimit.py for os.path.splitext

Plan (RATE_LIMITER_PLAN.md → RATE-LIMITER-PLAN.md):
- Rename to kebab-case for consistency with rate-limiter-v2.md
- Merge missing content from rate-limiter-v2.md: context & problem statement,
  component diagram (DB0/DB1 split), decision log, Gunicorn tuning, nginx
  real-IP fixes, upload settings, N+1 fix (synced to actual implementation),
  enforcement graduation order, decorator migration table, file serving
  decision matrix, dynamic page caching guidelines, open questions
- Add Mermaid decision flow diagram for RateLimitMiddleware._evaluate()
- Add rationale section for rl:{ns}:ip:{ip}:w:{bucket} namespace scoping
  (5 arguments covering attack pattern match, gaming resistance, key
  orthogonality, multi-portal fairness, and isolation contract)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 weeks ago

3 Commits (f838a71d05f21ccef5744829303a22aa751d040e)