- Use typed context key for auth context to prevent collisions (auth.go)
- Eliminate nested locking in CheckRateLimit to prevent potential deadlock (auth.go)
- Add 1MB request body size limit middleware to prevent DoS (router.go)
- Return proper gRPC status codes instead of nil errors on failures (handler.go)
- Use key name instead of raw API key in admin URL paths to prevent secret leakage (keys.go, router.go, keystore_db.go, keystore_hybrid.go)
- Enforce RBAC authorization in service Send/SendBatch for both REST and gRPC (service.go)
- Pin runtime Docker image to alpine:3.21 for reproducible builds (Dockerfile)
- Enable readOnlyRootFilesystem with /tmp emptyDir in k8s deployment (deployment.yaml)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add LDFLAGS_BASE for version info only, LDFLAGS for production (with -s -w optimization), and LDFLAGS_DEV for development
- Create 'build' target (production) that strips symbols, reducing binary size by ~30% (56MB -> 39MB)
- Create 'build-dev' target (development) that keeps debug symbols for profiling
- Update 'docker-build' to pass BUILD_FLAGS="-s -w" for optimized production images
- Create 'docker-build-dev' target that builds development images with notifier:latest-dev tag and no optimization
- Update Dockerfile to accept and use BUILD_FLAGS argument in build stage
- All targets now clearly indicate their optimization level in output messages
The Docker build was failing because protobuf-generated code wasn't
available during compilation. Changes made:
- Added protoc and protobuf-dev packages to build dependencies
- Installed protoc-gen-go and protoc-gen-go-grpc plugins
- Added make proto-gen step to generate pb files before build
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
igodwin