ci: run go vet and go test; fix wp-confusion vet; document JWKS auth

- Remove redundant newlines in fmt.Println (go vet) in wp-confusion.
- CI: vet + test before build.
- DASHBOARD_AUTH: HS256 + JWKS (RS256/ES256), env table aligned with server.

Made-with: Cursor

Author: h0tak88r

.github/workflows/ci.yml

@@ -30,6 +30,12 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
+      - name: Vet
+        run: CGO_ENABLED=1 go vet ./...
+
+      - name: Test
+        run: CGO_ENABLED=1 go test ./...
+
       - name: Build
         run: |
           CGO_ENABLED=1 go build -o autoar ./cmd/autoar

docs/DASHBOARD_AUTH.md

@@ -6,24 +6,29 @@ When the AutoAR HTTP API is exposed on the public internet, enable JWT verificat
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `SUPABASE_JWT_SECRET` | For production | **JWT Secret** from Supabase → Project Settings → API (same value used to sign user JWTs). If unset, the API does **not** require auth (local development). |
-| `SUPABASE_URL` | Yes (for login UI) | Project URL, e.g. `https://xxxx.supabase.co` |
-| `SUPABASE_ANON_KEY` | Yes (for login UI) | **anon** / **public** key from Supabase → Settings → API. Safe to expose to the browser. **Never** put the `service_role` key here. |
+| `SUPABASE_URL` | Yes (for login UI + asymmetric JWTs) | Project URL, e.g. `https://xxxx.supabase.co`. Used to fetch **JWKS** at `{SUPABASE_URL}/auth/v1/.well-known/jwks.json` for **RS256** / **ES256** access tokens (Supabase “new JWT signing keys”). |
+| `SUPABASE_JWT_SECRET` | For **HS256** (legacy) | **JWT Secret** from Supabase → Project Settings → API. Used to verify **HS256** tokens. If the project only issues **ES256/RS256** keys, verification is still done via **JWKS**; keep this set if you also rely on legacy symmetric signing. |
+| `SUPABASE_ANON_KEY` | Yes (for login UI) | **anon** / **publishable** key from Supabase → Settings → API. Safe to expose to the browser via `/api/config`. **Never** put the `service_role` / `sb_secret_*` key here. |
+| `SUPABASE_SECRET_KEY` | Server-only | Privileged key for server-side Supabase APIs if you add them later — **never** expose to the UI or `/api/config`. |
 | `CORS_ALLOWED_ORIGINS` | If UI is on another origin | Comma-separated list, e.g. `https://dash.example.com`. If unset, `Access-Control-Allow-Origin: *` is used (development only). |
 
 ## Supabase project setup
 
 1. Enable **Email** provider (or another provider) under Authentication → Providers.
 2. Create a user under **Authentication → Users** (or enable sign-ups).
-3. Copy **JWT Secret**, **Project URL**, and **anon public** key into your server environment.
+3. Copy **JWT Secret** (if using legacy HS256), **Project URL**, and **anon public** key into your server environment.
 
 ## Behaviour
 
 - `GET /api/config` stays **public** so the SPA can read `auth_enabled` and Supabase URL/key before login.
 - `GET /health` stays **public** for uptime checks.
 - The UI loads `@supabase/supabase-js` from CDN, signs in with email/password, and sends `Authorization: Bearer <access_token>` on API calls.
-- The Go API verifies the HS256 signature using `SUPABASE_JWT_SECRET`.
+- The Go API verifies access tokens as follows:
+  - **HS256:** HMAC with `SUPABASE_JWT_SECRET` (optionally after base64-decoding the secret, matching Supabase’s storage format).
+  - **RS256 / ES256:** asymmetric keys loaded from **JWKS** at `{SUPABASE_URL}/auth/v1/.well-known/jwks.json` (required for projects using Supabase’s new signing keys).
+
+If neither `SUPABASE_JWT_SECRET` nor `SUPABASE_URL` is set, protected routes do not enforce JWT (local development only).
 
 ## Local development
 
-Leave `SUPABASE_JWT_SECRET` unset: the dashboard works without a login panel.
+Leave `SUPABASE_JWT_SECRET` and `SUPABASE_URL` unset: the dashboard can run without a login gate (API auth middleware is a no-op).

internal/modules/wp-confusion/confusion.go

@@ -99,34 +99,34 @@ func ScanWPConfusion(opts ScanOptions) error {
 
 	for _, targetURL := range urls {
 		vulnerable := []string{}
-		fmt.Println("-------------------------\n")
+		fmt.Println("-------------------------")
 		fmt.Printf("[i] Target: %s\n\n", targetURL)
 
 		if opts.Theme {
-			fmt.Println("[i] Searching theme\n")
+			fmt.Println("[i] Searching theme")
 			themeName := detectTheme(targetURL)
 			if themeName != "" {
 				fmt.Printf("[i] Found WP theme: %s\n\n", themeName)
 				if isVulnerable := checkWordPressOrgTheme(themeName); isVulnerable {
-					fmt.Println("\t[!] Vulnerable to WP Theme Confusion attack\n")
+					fmt.Println("\t[!] Vulnerable to WP Theme Confusion attack")
 					fmt.Printf("\t[!] %s/wp-content/themes/%s\n", targetURL, themeName)
 					fmt.Printf("\t[!] https://wordpress.org/themes/%s\n\n", themeName)
 					vulnerable = append(vulnerable, fmt.Sprintf("%s/wp-content/themes/%s", targetURL, themeName))
 				} else {
-					fmt.Println("\t[i] Not vulnerable\n")
+					fmt.Println("\t[i] Not vulnerable")
 				}
 			}
 		}
 
 		if opts.Plugins {
-			fmt.Println("[i] Searching plugins\n")
+			fmt.Println("[i] Searching plugins")
 			pluginList := detectPlugins(targetURL)
 
 			for _, plugin := range pluginList {
 				fmt.Printf("[i] Found WP plugin: %s\n", plugin)
 
 				if !isAllowedSlug(plugin) {
-					fmt.Println("\t[i] Not vulnerable - disallowed name\n")
+					fmt.Println("\t[i] Not vulnerable - disallowed name")
 					continue
 				}
 
@@ -154,12 +154,12 @@ func ScanWPConfusion(opts ScanOptions) error {
 				}
 
 				if isVulnerable := checkWordPressOrgPlugin(plugin); isVulnerable {
-					fmt.Println("\t[!] Vulnerable to WP Plugin Confusion attack\n")
+					fmt.Println("\t[!] Vulnerable to WP Plugin Confusion attack")
 					fmt.Printf("\t[!] %s/wp-content/plugins/%s\n", targetURL, plugin)
 					fmt.Printf("\t[!] https://wordpress.org/plugins/%s\n\n", plugin)
 					vulnerable = append(vulnerable, fmt.Sprintf("%s/wp-content/plugins/%s", targetURL, plugin))
 				} else {
-					fmt.Println("\t[i] Not vulnerable - already claimed\n")
+					fmt.Println("\t[i] Not vulnerable - already claimed")
 				}
 			}
 		}