Niklas Ye c4833067f0 Build the clusters query with Sprintf, as the other handlers do ...

gosec's G202 flagged the string concatenation in handleListClusters, and the
security job gates CI. The pieces joined were only placeholders and fixed
clauses, never request data, so this was not an injection; but every other
handler here builds its SQL with fmt.Sprintf over placeholders, and this one
now reads the same way. The query and its result are unchanged.

2026-10-08 18:28:26 +02:00

..

admin_test.go

Give every team a page of its own

2026-09-22 09:13:13 +02:00

advisory_lock_test.go

Guard the archiver and notifier passes with a Postgres advisory lock

2026-10-03 11:36:48 +02:00

alertmanager_test.go

Resolve the new-incident insert conflict instead of dropping the payload

2026-10-03 11:58:39 +02:00

alertmanager.go

Cap request body size and add baseline security headers

2026-10-07 21:57:00 +02:00

alerts.go

Scope everything to a team, and route alerts by integration key

2026-09-20 13:36:24 +02:00

api_keys_test.go

Add optional API key expiry and a missing way to list them

2026-10-07 22:31:44 +02:00

api_test.go

Add service accounts and operator mode

2026-09-29 21:25:17 +02:00

archiver.go

Add gosec to CI; fix the one real finding it surfaced

2026-10-07 22:12:31 +02:00

auth_test.go

Add service accounts and operator mode

2026-09-29 21:25:17 +02:00

auth.go

Add gosec to CI; fix the one real finding it surfaced

2026-10-07 22:12:31 +02:00

authz_scope_test.go

Add optional API key expiry and a missing way to list them

2026-10-07 22:31:44 +02:00

caller.go

Stop 500ing when a service account acts on an incident

2026-10-07 21:09:31 +02:00

deadman_test.go

List dead man's switches with their status on Team -> Switches

2026-09-25 23:40:55 +02:00

deadman.go

Add gosec to CI; fix the one real finding it surfaced

2026-10-07 22:12:31 +02:00

device_test.go

Sign in through an OpenID Connect provider, and from a terminal

2026-09-26 21:37:40 +02:00

device.go

Back the login/signup/OIDC/device rate limiters with Postgres

2026-10-07 22:03:51 +02:00

escalation_test.go

Show the escalation ladder as a list, with who it would page and where it is

2026-09-26 08:28:24 +02:00

escalation.go

Stop 500ing when a service account acts on an incident

2026-10-07 21:09:31 +02:00

helpers.go

Cap request body size and add baseline security headers

2026-10-07 21:57:00 +02:00

incident_store.go

Record the actor on assign, archive and unarchive (#35)

2026-10-08 08:53:04 +02:00

incidents_test.go

Filter the queue by cluster

2026-10-08 18:23:28 +02:00

incidents.go

Build the clusters query with Sprintf, as the other handlers do

2026-10-08 18:28:26 +02:00

members_test.go

Show team members as a list, with who is on call and who cannot be paged

2026-09-26 09:04:54 +02:00

middleware.go

Add optional API key expiry and a missing way to list them

2026-10-07 22:31:44 +02:00

notifier.go

Put the cluster first in an ntfy page title

2026-10-08 18:07:59 +02:00

notify_ack.go

Web: visual design pass (issue #26)

2026-10-03 09:01:54 +02:00

notify_test.go

Filter the queue by cluster

2026-10-08 18:23:28 +02:00

oidc_teams.go

Let each team name its own OIDC group, not a global mapping

2026-09-27 11:43:57 +02:00

oidc_test.go

Refuse an OIDC sign-in from creating the very first user

2026-10-02 09:12:32 +02:00

oidc.go

Add gosec to CI; fix the one real finding it surfaced

2026-10-07 22:12:31 +02:00

rate_limiter_test.go

Back the login/signup/OIDC/device rate limiters with Postgres

2026-10-07 22:03:51 +02:00

router.go

Filter the queue by cluster

2026-10-08 18:23:28 +02:00

schedule.go

Add gosec to CI; fix the one real finding it surfaced

2026-10-07 22:12:31 +02:00

security_headers_test.go

Cap request body size and add baseline security headers

2026-10-07 21:57:00 +02:00

service_accounts_test.go

internal/api: unify human/service-account authz into one Caller type

2026-10-02 21:52:43 +02:00

service_accounts.go

internal/api: unify human/service-account authz into one Caller type

2026-10-02 21:52:43 +02:00

settings_test.go

Add an admin page, and move the behaviour settings into the database

2026-09-20 18:23:46 +02:00

settings.go

Let each team name its own OIDC group, not a global mapping

2026-09-27 11:43:57 +02:00

signup_test.go

internal/api: unify human/service-account authz into one Caller type

2026-10-02 21:52:43 +02:00

signup.go

Back the login/signup/OIDC/device rate limiters with Postgres

2026-10-07 22:03:51 +02:00

similar_test.go

Show notes from similar earlier incidents

2026-09-25 15:42:25 +02:00

similar.go

Show notes from similar earlier incidents

2026-09-25 15:42:25 +02:00

sources_test.go

List alert sources with their status and last arrival on Team -> Sources

2026-09-26 07:52:07 +02:00

stats.go

Check rows.Err() in the remaining Next() loops (#27)

2026-10-08 09:00:54 +02:00

teams_test.go

Add GET /api/teams?name= (TEAM-LOOKUP.md)

2026-10-01 10:49:11 +02:00

teams.go

Add GET /api/teams?name= (TEAM-LOOKUP.md)

2026-10-01 10:49:11 +02:00

testdb_test.go

Add an admin page, and move the behaviour settings into the database

2026-09-20 18:23:46 +02:00

users.go

Check rows.Err() in the remaining Next() loops (#27)

2026-10-08 09:00:54 +02:00