Skip to content

Security hardening + DRY refactor#1

Merged
thomasluizon merged 1 commit into
mainfrom
chore/security-hardening-and-dry-refactor
Mar 20, 2026
Merged

Security hardening + DRY refactor#1
thomasluizon merged 1 commit into
mainfrom
chore/security-hardening-and-dry-refactor

Conversation

@thomasluizon

@thomasluizon thomasluizon commented Mar 20, 2026

Copy link
Copy Markdown
Owner

Summary

  • Emergency fixes: mandatory Stripe webhook signature verification, fix inverted HTTPS redirect, set Stripe API key globally at startup
  • Security hardening: SecurityHeadersMiddleware, restricted CORS, 10MB body limit, input validation for chat history and Stripe intervals
  • DRY infrastructure: ErrorMessages, AppConstants, CacheInvalidationHelper, ResultExtensions -- applied across 30+ handlers
  • DRY controllers: ResultActionResultExtensions (PayGate-aware responses), SharedHabitRules, TagsController logging
  • Code cleanup: replace goto with flag+continue in BulkCreateHabitsCommand
  • CLAUDE.md: documented new DRY patterns, security conventions, and git workflow

Test plan

  • dotnet build passes (verified)
  • Stripe checkout flow works (monthly/semiannual/yearly)
  • Stripe webhook processes events correctly
  • Habit CRUD still works end-to-end
  • Tag CRUD logs properly

Generated with Claude Code

@thomasluizon @claude
Security hardening + DRY refactor across API codebase
96cf9d6 
Emergency fixes: mandatory Stripe webhook signature verification,
fix inverted HTTPS redirect, set Stripe API key globally at startup.

Security: add SecurityHeadersMiddleware, restrict CORS to explicit
methods/headers, add 10MB request body limit, validate chat history
size and Stripe checkout intervals.

DRY: extract ErrorMessages, AppConstants, CacheInvalidationHelper,
ResultExtensions, ResultActionResultExtensions, SharedHabitRules.
Apply across 30+ command handlers and 5 controllers. Replace goto
with flag+continue in BulkCreateHabitsCommand. Add logging to
TagsController.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@thomasluizon
thomasluizon merged commit 0995ee7 into main Mar 20, 2026
1 check passed
@thomasluizon
thomasluizon deleted the chore/security-hardening-and-dry-refactor branch March 20, 2026 17:40
@thomasluizon thomasluizon mentioned this pull request Jun 5, 2026
Merged
@thomasluizon thomasluizon mentioned this pull request Jun 24, 2026
Merged
This was referenced Jun 25, 2026
Merged
Merged
Merged
Merged
This was referenced Jul 8, 2026
Merged
Merged
Merged
@thomasluizon thomasluizon mentioned this pull request Jul 14, 2026
Merged
@claude claude Bot mentioned this pull request Jul 18, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thomasluizon