Skip to content

Commit dd65f43

Browse files
h0tak88rh0tak88r
committed
feat: remove Discord bot, fix AEM scanner, add rate limiting and Swagger docs
- Remove entire Discord bot (internal/bot/*, utils/discord.go) ~8,000 lines - Cleanse Discord references from api, app, cmd, scanner, config, utils - Drop discordgo dependency from go.mod, fix Go version 1.25.7 -> 1.24 - Fix AEM scanner: implement 7 SSRF detection stubs (replaces TODO placeholders) - Add HTTP API rate limiting middleware (token bucket, 100 req/s default) - Add Swagger/OpenAPI docs endpoint at /docs - Add phase_files.go stub for workflow compatibility - Update env.example and autoar.sample.yaml (remove Discord vars)
1 parent a4df370 commit dd65f43

40 files changed

Lines changed: 853 additions & 7965 deletions

‎autoar.sample.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ hunter: [""]
3333
# Additional API Keys
3434
H1_API_KEY: ""
3535
INTEGRITI_API_KEY: ""
36-
DISCORD_WEBHOOK: ""
3736
openrouter_api: ""
3837

3938
# Database Configuration

‎env.example‎

Lines changed: 10 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -4,48 +4,24 @@
44
# ============================================================================
55
# OPERATIONAL MODE CONFIGURATION
66
# ============================================================================
7-
# Choose how AutoAR runs:
8-
# - discord: Discord bot only (default)
9-
# - api: REST API server only
10-
# - both: Run Discord bot and API server simultaneously
11-
AUTOAR_MODE=discord
7+
AUTOAR_MODE=api
128

139
# ============================================================================
14-
# API SERVER CONFIGURATION (for api/both modes)
10+
# API SERVER CONFIGURATION
1511
# ============================================================================
1612
API_HOST=0.0.0.0
1713
API_PORT=8000
1814

1915
# ============================================================================
20-
# DASHBOARD AUTH (HTTP API + /ui) — optional; see docs/DASHBOARD_AUTH.md
16+
# DASHBOARD AUTH (HTTP API + /ui)
2117
# ============================================================================
2218
# When SUPABASE_JWT_SECRET or SUPABASE_URL is set, /api/* requires Authorization: Bearer <access_token>.
23-
# For local Postgres without Supabase login, either unset both variables or:
24-
# AUTOAR_API_AUTH_DISABLED=true
2519
#
2620
# SUPABASE_URL=https://xxxx.supabase.co
2721
# SUPABASE_JWT_SECRET= # Legacy HS256 secret; JWKS used when URL-only ES256
2822
# SUPABASE_ANON_KEY= # Publishable key (exposed to browser via /api/config)
2923
# SUPABASE_SECRET_KEY= # Server-only; never expose to UI
3024

31-
# ============================================================================
32-
# DISCORD BOT CONFIGURATION (for discord/both modes)
33-
# ============================================================================
34-
DISCORD_BOT_TOKEN=your_discord_bot_token_here
35-
DISCORD_WEBHOOK=your_discord_webhook_url_here
36-
37-
# Restrict bot to a specific Discord server/guild (optional)
38-
# Option 1: Use Guild ID (GUID) - RECOMMENDED (more reliable)
39-
# Get your server ID: Right-click server name -> Copy Server ID (enable Developer Mode in Discord)
40-
# Example: DISCORD_ALLOWED_GUILD_ID=123456789012345678
41-
DISCORD_ALLOWED_GUILD_ID=
42-
43-
# Option 2: Use Guild Name (legacy, deprecated - use GUID instead)
44-
# Leave empty to allow bot in all servers, or set to your server name
45-
# The bot will reject commands from other servers
46-
# Note: .env file values always override system environment variables
47-
DISCORD_ALLOWED_GUILD=
48-
4925
# ============================================================================
5026
# CORE APPLICATION CONFIGURATION
5127
# ============================================================================
@@ -63,7 +39,6 @@ AUTOAR_RESULTS_DIR=/app/new-results
6339
# AUTOAR_RESULTS_DIR=/home/user/AutoAR/new-results
6440

6541
# Tool Setup
66-
DISCORD_ONLY=false
6742
RUN_SETUP=false
6843
REGENERATE_CONFIG=true
6944
SAVE_TO_DB=true
@@ -88,8 +63,8 @@ LOG_JSON=false # Set true for machine-readable JSON logs
8863
AUTOAR_TRACING_ENABLED=false # Set true to enable OpenTelemetry tracing
8964

9065
# Rate Limiting
91-
DISCORD_RATE_LIMIT=5 # Discord files per second (default: 5, max: 50)
92-
DISCORD_MAX_RETRIES=3 # Max retry attempts for failed operations
66+
API_RATE_LIMIT=100 # API requests per second (default: 100)
67+
API_RATE_BURST=200 # Max burst size (default: 200)
9368

9469
# Graceful Shutdown
9570
GRACEFUL_SHUTDOWN_TIMEOUT=300 # Seconds to wait for active scans before force shutdown
@@ -247,24 +222,16 @@ TRUFFLEHOG_AUTOUPDATE=false
247222
# USAGE EXAMPLES
248223
# ============================================================================
249224
#
250-
# Discord Bot Only:
251-
# AUTOAR_MODE=discord
252-
# DISCORD_BOT_TOKEN=your_token_here
253-
# docker-compose up autoar-discord
254-
#
255-
# API Server Only:
225+
# API Server:
256226
# AUTOAR_MODE=api
257227
# API_HOST=0.0.0.0
258228
# API_PORT=8000
259-
# docker-compose --profile api up autoar-api
229+
# docker compose --profile api up -d autoar-api
230+
# Access dashboard: http://localhost:8000/ui/
260231
# Access API docs: http://localhost:8000/docs
261232
#
262-
# Both Discord Bot and API:
263-
# AUTOAR_MODE=both
264-
# DISCORD_BOT_TOKEN=your_token_here
265-
# API_HOST=0.0.0.0
266-
# API_PORT=8000
267-
# docker-compose --profile full up autoar-full
233+
# Full Stack (API + Postgres):
234+
# docker compose --profile full up -d
268235
#
269236
# ============================================================================
270237
ZHIPU_API_KEY=

‎go.mod‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ require (
88
github.com/aws/aws-sdk-go-v2/config v1.32.6
99
github.com/aws/aws-sdk-go-v2/credentials v1.19.6
1010
github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
11-
github.com/bwmarrin/discordgo v0.28.1
1211
github.com/deletescape/goop v0.0.0-20250503184938-5865759563e1
1312
github.com/fatih/color v1.18.0
1413
github.com/ffuf/ffuf/v2 v2.1.0
@@ -25,6 +24,7 @@ require (
2524
github.com/projectdiscovery/dnsx v1.2.2
2625
github.com/projectdiscovery/goflags v0.1.74
2726
github.com/projectdiscovery/httpx v1.8.1
27+
github.com/projectdiscovery/katana v1.6.1
2828
github.com/projectdiscovery/naabu/v2 v2.3.7
2929
github.com/projectdiscovery/nuclei/v3 v3.7.1
3030
github.com/projectdiscovery/subfinder/v2 v2.6.7
@@ -48,7 +48,7 @@ require (
4848
require (
4949
aead.dev/minisign v0.3.0 // indirect
5050
carvel.dev/ytt v0.52.0 // indirect
51-
code.gitea.io/sdk/gitea v0.17.0 // indirect
51+
code.gitea.io/sdk/gitea v0.22.1 // indirect
5252
filippo.io/edwards25519 v1.1.1 // indirect
5353
git.mills.io/prologic/smtpd v0.0.0-20210710122116-a525b76c287a // indirect
5454
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
@@ -68,6 +68,7 @@ require (
6868
github.com/Mzack9999/go-rsync v0.0.0-20250821180103-81ffa574ef4d // indirect
6969
github.com/Mzack9999/goja v0.0.0-20250507184235-e46100e9c697 // indirect
7070
github.com/Mzack9999/goja_nodejs v0.0.0-20250507184139-66bcbf65c883 // indirect
71+
github.com/Mzack9999/jsluice v0.0.0-20260306161058-30114a312f98 // indirect
7172
github.com/PuerkitoBio/goquery v1.11.0 // indirect
7273
github.com/STARRY-S/zip v0.2.3 // indirect
7374
github.com/Ullaakut/nmap/v3 v3.0.6 // indirect
@@ -216,13 +217,13 @@ require (
216217
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
217218
github.com/gopacket/gopacket v1.2.0 // indirect
218219
github.com/gorilla/css v1.0.1 // indirect
219-
github.com/gorilla/websocket v1.5.3 // indirect
220220
github.com/gosimple/slug v1.15.0 // indirect
221221
github.com/gosimple/unidecode v1.0.1 // indirect
222222
github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
223223
github.com/h2non/filetype v1.1.3 // indirect
224224
github.com/hahwul/volt v1.0.7 // indirect
225225
github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b // indirect
226+
github.com/happyhackingspace/dit v0.0.14 // indirect
226227
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
227228
github.com/hashicorp/go-uuid v1.0.3 // indirect
228229
github.com/hashicorp/go-version v1.8.0 // indirect
@@ -271,6 +272,7 @@ require (
271272
github.com/lor00x/goldap v0.0.0-20240304151906-8d785c64d1c8 // indirect
272273
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
273274
github.com/lufia/plan9stats v0.0.0-20250827001030-24949be3fa54 // indirect
275+
github.com/lukasbob/srcset v0.0.0-20190730101422-86b742e617f3 // indirect
274276
github.com/mackerelio/go-osstat v0.2.6 // indirect
275277
github.com/mailru/easyjson v0.9.0 // indirect
276278
github.com/mattn/go-colorable v0.1.14 // indirect
@@ -289,6 +291,7 @@ require (
289291
github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7 // indirect
290292
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
291293
github.com/mitchellh/go-homedir v1.1.0 // indirect
294+
github.com/mitchellh/mapstructure v1.5.0 // indirect
292295
github.com/moby/docker-image-spec v1.3.1 // indirect
293296
github.com/moby/sys/atomicwriter v0.1.0 // indirect
294297
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
@@ -303,6 +306,7 @@ require (
303306
github.com/nwaples/rardecode/v2 v2.2.2 // indirect
304307
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
305308
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
309+
github.com/odvcencio/gotreesitter v0.6.1-0.20260306002001-fbe5983c6f41 // indirect
306310
github.com/olekukonko/errors v1.1.0 // indirect
307311
github.com/olekukonko/ll v0.0.9 // indirect
308312
github.com/olekukonko/tablewriter v1.0.8 // indirect
@@ -338,7 +342,6 @@ require (
338342
github.com/projectdiscovery/hmap v0.0.100 // indirect
339343
github.com/projectdiscovery/interactsh v1.3.1 // indirect
340344
github.com/projectdiscovery/ipranger v0.0.53 // indirect
341-
github.com/projectdiscovery/katana v1.6.1 // indirect
342345
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb // indirect
343346
github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 // indirect
344347
github.com/projectdiscovery/mapcidr v1.1.97 // indirect
@@ -380,6 +383,7 @@ require (
380383
github.com/spf13/cast v1.10.0 // indirect
381384
github.com/spf13/pflag v1.0.10 // indirect
382385
github.com/spf13/viper v1.21.0 // indirect
386+
github.com/stoewer/go-strcase v1.3.0 // indirect
383387
github.com/subosito/gotenv v1.6.0 // indirect
384388
github.com/syndtr/goleveldb v1.0.0 // indirect
385389
github.com/tidwall/btree v1.8.1 // indirect
@@ -431,7 +435,7 @@ require (
431435
github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect
432436
github.com/zmap/zcrypto v0.0.0-20240803002437-3a861682ac77 // indirect
433437
github.com/zmap/zgrab2 v0.1.8 // indirect
434-
gitlab.com/gitlab-org/api/client-go v0.130.1 // indirect
438+
gitlab.com/gitlab-org/api/client-go v1.9.1 // indirect
435439
go.etcd.io/bbolt v1.4.3 // indirect
436440
go.mongodb.org/mongo-driver v1.17.9 // indirect
437441
go.opentelemetry.io/auto/sdk v1.1.0 // indirect

0 commit comments

Comments
 (0)