feat: migrate to Fiber v3 (#662)

Framework migration from Fiber v2 to v3, grounded in the official
migration guide, rebased onto the post-#661 dependency state.

**Mechanical**: import path `fiber/v3`; handlers take the `fiber.Ctx`
interface (102 sites); `c.UserContext()` → `c.Context()` (36 sites);
`c.Redirect(...)` → the v3 builder (27 sites); `c.BodyParser` →
`c.Bind().Body` (2 sites); `app.Test` timeout args → `fiber.TestConfig`.

**Semantic surfaces**: session store via `session.NewStore` with
`Expiration` → `IdleTimeout`, and a pooled-session `Release()` added at
all nine `store.Get` sites; CSRF config moves to `Extractor:
extractors.FromForm` + `IdleTimeout`, and the removed `ContextKey` means
the token is read via `csrf.TokenFromContext`; the removed filesystem
middleware becomes the static middleware serving the embedded FS;
`EnableTrustedProxyCheck`/`TrustedProxies` become
`TrustProxy`/`TrustProxyConfig`.

**Behavior changes inherited from v3, deliberate and documented**: bare
redirects answer **303 See Other** instead of 302 Found; JSON responses
carry `; charset=utf-8`; v3's CSRF middleware additionally enforces
Origin/Referer/Sec-Fetch-Site consistency on unsafe methods (browser
flows unaffected — e2e green; a non-browser client stripping
Origin+Referer would newly 403); and v3's `c.IP()` now resolves the real
peer right-to-left past the trusted proxies instead of echoing the raw
client-controlled X-Forwarded-For — which **hardens** the login rate
limiter (previously a forged XFF entry evaded blocking).

**Adversarial review round** (tip 4c2d04a reviewed, fixes in 064f305):
the four designated high-risk items were verified with source- and
probe-level evidence — static asset resolution proven equivalent
empirically (200 + correct bytes + `Cache-Control` for `/static/js/*`,
`/static/app.css`, `/static/vendor/*`; traversal blocked), all nine
session `Release()` sites checked against the v3.5.0 pool implementation
(no double-release, Release-after-Destroy safe, login releases after
Save, no CSRF/session aliasing), the CSRF render→extract→validate round
trip is pinned by `bulk_csrf_test.go` and the e2e login-form test, and
the trust-proxy change was analyzed as above. The review's one Required
finding is fixed in 064f305: the doc/ops sweep — monitoring/deployment
runbook health checks now accept 303 (they would have raised false
CRITICAL alerts), the API docs' 302 statuses corrected,
`internal/web/AGENTS.md` rewritten from v2 to v3 teachings,
architecture/knowledge-base v2 references updated. Plus the review's
test-gap nit: `TestApp_StaticAssetsServed` now pins the static mount,
red-green verified (broken mount → fails with 303, restored → passes).

**Round-2 verification** (fresh agent on 064f305): all seven fix claims
verified PASS with module-source evidence; its two leftover findings of
the same class — the package godoc in `internal/web/doc.go` (the
pkg.go.dev surface), `docs/INDEX.md` and `cmd/AGENTS.md` still saying
Fiber v2 — are fixed in ff72324 together with aligning the AGENTS.md
CSRF example to the real config (`FromForm`, not `FromHeader`). A
repo-wide grep now finds zero live Fiber v2 claims (dated plan archives
excepted). Round 3 = that mechanical sweep plus this CI run: no findings
remain.

**Tests**: session stores via `NewStore`; the `fiber.Storage` mock
gained the v3 context-aware methods; CSRF tests read the token via
`TokenFromContext`; shifted test fixtures and one docs example password
carry detect-secrets allowlist pragmas; markdownlint's pre-existing
findings in the touched docs are fixed in the same pass.

Verified locally under go1.27.0 at 064f305: `templ generate` + build,
vet, golangci-lint (0 issues), `go test -race` (8 packages), `go mod
verify` clean; fiber v2 has left the module graph entirely.

_Assisted by claude-code:claude-fable-5 —
[Session](https://claude.ai/code/session_01L7tF9XuJfAfFk4yuY5KfPK)_

Author: CybotTM

cmd/AGENTS.md

@@ -4,11 +4,12 @@
 
 ## Overview
 
-The `cmd/` directory contains the main entry point for the LDAP Manager application. This follows Go's standard project layout for executable binaries.
+The `cmd/` directory contains the main entry point for the LDAP Manager application. This follows Go's standard
+project layout for executable binaries.
 
 - **Location**: `cmd/ldap-manager/main.go`
 - **Purpose**: CLI initialization, configuration parsing, server startup
-- **Framework**: Uses Fiber v2 web framework via `internal/web` package
+- **Framework**: Uses Fiber v3 web framework via `internal/web` package
 
 ## Setup & Environment
 

docs/API_REFERENCE.md

@@ -50,7 +50,7 @@ Authenticate user and create session.
 
 **Form Data:**
 
-```
+```text
 username=jdoe
 password=SecurePass123
 csrf_token=<generated-token>
@@ -60,10 +60,10 @@ csrf_token=<generated-token>
 
 #### Success Response
 
-**Code:** `302 Found`
+**Code:** `303 See Other`
 **Headers:**
 
-```
+```text
 Location: /
 Set-Cookie: session_id=...; HttpOnly; Secure; SameSite=Strict
 ```
@@ -110,10 +110,10 @@ Terminate user session.
 
 #### Success Response
 
-**Code:** `302 Found`
+**Code:** `303 See Other`
 **Headers:**
 
-```
+```text
 Location: /login
 Set-Cookie: session_id=; Expires=Thu, 01 Jan 1970 00:00:00 GMT
 ```
@@ -340,7 +340,7 @@ Dashboard/home page (redirects to users list).
 **Content-Type:** `text/html`
 **Headers:**
 
-```
+```text
 X-Cache: HIT | MISS
 ```
 
@@ -375,11 +375,11 @@ List all LDAP users.
 **Content-Type:** `text/html`
 **Headers:**
 
-```
+```text
 X-Cache: HIT | MISS
 ```
 
-**Rendered HTML with user table**
+#### Rendered HTML with user table
 
 #### Notes
 
@@ -456,7 +456,7 @@ Modify user attributes.
 
 **Form Data:**
 
-```
+```text
 csrf_token=<token>
 mail=newemail@example.com
 telephoneNumber=+1-555-0123
@@ -465,10 +465,10 @@ description=Updated description
 
 #### Success Response
 
-**Code:** `302 Found`
+**Code:** `303 See Other`
 **Headers:**
 
-```
+```text
 Location: /users/:userDN
 Set-Cookie: flash_message=User updated successfully
 ```
@@ -576,18 +576,18 @@ Modify group (add/remove members).
 
 **Form Data:**
 
-```
+```text
 csrf_token=<token>
 action=add_member | remove_member
 member_dn=cn=jdoe,ou=users,dc=example,dc=com
 ```
 
 #### Success Response
 
-**Code:** `302 Found`
+**Code:** `303 See Other`
 **Headers:**
 
-```
+```text
 Location: /groups/:groupDN
 Set-Cookie: flash_message=Member added successfully
 ```
@@ -616,7 +616,7 @@ List all computer accounts (Active Directory).
 **Code:** `200 OK`
 **Content-Type:** `text/html`
 
-**Rendered HTML with computer account table**
+#### Rendered HTML with computer account table
 
 #### Notes
 
@@ -640,7 +640,7 @@ Display computer account details.
 **Code:** `200 OK`
 **Content-Type:** `text/html`
 
-**Rendered HTML with computer attributes**
+#### Rendered HTML with computer attributes
 
 ---
 
@@ -764,4 +764,4 @@ curl -b cookies.txt -X POST \
 
 ---
 
-_Last Updated: 2025-09-30 | Version: 1.0.8_
+Last Updated: 2025-09-30 | Version: 1.0.8

docs/INDEX.md

@@ -135,7 +135,8 @@ Comprehensive technical analysis and session documentation (21 reports):
 | [**Frontend Analysis**](../claudedocs/comprehensive-frontend-analysis.md) | Complete frontend architecture review        | 2025-09-30   |
 | [**CSS Analysis**](../claudedocs/css-analysis.md)                         | CSS structure and optimization opportunities | 2025-09-30   |
 
-**Purpose:** These reports provide deep technical insights for developers, architects, and operations teams. Generated during development sessions for knowledge preservation and decision documentation.
+**Purpose:** These reports provide deep technical insights for developers, architects, and operations teams. Generated
+during development sessions for knowledge preservation and decision documentation.
 
 ---
 
@@ -250,7 +251,7 @@ LDAP_POOL_HEALTH_CHECK_INTERVAL=30s
 
 ## 🏗️ Project Structure
 
-```
+```text
 ldap-manager/
 ├── cmd/ldap-manager/        # Application entry point
 ├── internal/                 # Core application code
@@ -337,27 +338,28 @@ Current project health indicators:
 
 ### Official Documentation
 
-- **Go:** https://go.dev/doc/
-- **Fiber v2:** https://docs.gofiber.io/
-- **Templ:** https://templ.guide/
-- **TailwindCSS:** https://tailwindcss.com/docs
-- **go-ldap:** https://pkg.go.dev/github.com/go-ldap/ldap/v3
+- **Go:** <https://go.dev/doc/>
+- **Fiber v3:** <https://docs.gofiber.io/>
+- **Templ:** <https://templ.guide/>
+- **TailwindCSS:** <https://tailwindcss.com/docs>
+- **go-ldap:** <https://pkg.go.dev/github.com/go-ldap/ldap/v3>
 
 ### Related Projects
 
 - **simple-ldap-go v1.5.0:** Custom LDAP wrapper with indexed cache
-  - **Our Contribution:** [PR #45](https://github.com/netresearch/simple-ldap-go/pull/45) - Multi-key indexed cache (287x improvement)
+  - **Our Contribution:** [PR #45](https://github.com/netresearch/simple-ldap-go/pull/45) - Multi-key indexed cache
+(287x improvement)
   - **Status:** Merged and released in v1.5.0
-  - **GitHub:** https://github.com/netresearch/simple-ldap-go
+  - **GitHub:** <https://github.com/netresearch/simple-ldap-go>
 - **BBolt:** Embedded key-value database for sessions
   - **Use Case:** Persistent session storage for development and production
-  - **GitHub:** https://github.com/etcd-io/bbolt
+  - **GitHub:** <https://github.com/etcd-io/bbolt>
 
 ---
 
 ## 🆘 Getting Help
 
-### Documentation Not Found?
+### Documentation Not Found
 
 1. **Check AGENTS.md:** AI guidelines may have what you need
 2. **Search codebase:** `grep -r "pattern" internal/`
@@ -450,6 +452,7 @@ Potential future enhancements (not committed):
 
 ---
 
-_This index is maintained automatically and manually. Last comprehensive update: 2025-09-30 (Enhanced with PR #267 details, claudedocs integration, and API module reference)_
+This index is maintained automatically and manually. Last comprehensive update: 2025-09-30 (Enhanced with PR #267
+details, claudedocs integration, and API module reference)
 
 **📌 Bookmark this page** - it's your hub for all LDAP Manager documentation.

docs/KNOWLEDGE_BASE.md

@@ -34,22 +34,22 @@ Use Ctrl+F or Command+F to search this document for:
 
 ### By Persona
 
-**👤 End Users (Administrators)**
+#### 👤 End Users (Administrators)
 
 1. [Installation Guide](user-guide/installation.md) - Get started
 2. [Configuration Reference](user-guide/configuration.md) - Configure LDAP connection
 3. [API Documentation](user-guide/api.md) - Integrate with other systems
 4. [Implementation Examples](user-guide/implementation-examples.md) - Real-world scenarios
 
-**👨‍💻 Developers**
+#### 👨‍💻 Developers
 
 1. [Development Setup](development/setup.md) - Setup local environment
 2. [AGENTS.md](../AGENTS.md) - AI-assisted coding guidelines
 3. [Architecture Overview](development/architecture.md) - Understand system design
 4. [Contributing Guidelines](development/contributing.md) - Submit changes
 5. [Go Documentation](development/go-doc-reference.md) - Package API reference
 
-**⚙️ Operations / DevOps**
+#### ⚙️ Operations / DevOps
 
 1. [Deployment Guide](operations/deployment.md) - Deploy to production
 2. [Monitoring & Troubleshooting](operations/monitoring.md) - Operational procedures
@@ -279,9 +279,9 @@ make docker-test     # Run tests in container
 
 ### Component Map
 
-```
+```text
 ┌─────────────────────────────────────────────┐
-│  HTTP Layer (Fiber v2)                      │
+│  HTTP Layer (Fiber v3)                      │
 │  ├─ server.go - App initialization          │
 │  ├─ auth.go - Authentication                │
 │  ├─ users.go, groups.go, computers.go       │
@@ -380,7 +380,7 @@ LDAP_POOL_ACQUIRE_TIMEOUT=5s        # Lower acquisition timeout
 
 ### Common Issues
 
-**Build Fails**
+#### Build Fails
 
 ```bash
 # Solution
@@ -389,7 +389,7 @@ go mod tidy
 pnpm install
 ```
 
-**Tests Fail**
+#### Tests Fail
 
 ```bash
 # Check LDAP server is running
@@ -398,7 +398,7 @@ docker compose --profile dev up openldap -d
 go test -v ./...
 ```
 
-**Can't Connect to LDAP**
+#### Can't Connect to LDAP
 
 ```bash
 # Verify configuration
@@ -407,7 +407,7 @@ cat .env | grep LDAP_
 ldapsearch -H ldaps://dc1.example.com:636 -D "cn=readonly,DC=example,DC=com" -w password -b "DC=example,DC=com"
 ```
 
-**Performance Issues**
+#### Performance Issues
 
 ```bash
 # Check cache hit rates
@@ -460,29 +460,31 @@ curl http://localhost:3000/debug/ldap-pool
 
 ### Official Documentation
 
-- **Go Language:** https://go.dev/doc/ ([Tutorial](https://go.dev/tour/), [Effective Go](https://go.dev/doc/effective_go))
-- **Fiber v2:** https://docs.gofiber.io/ ([API](https://docs.gofiber.io/api/fiber), [Middleware](https://docs.gofiber.io/api/middleware))
-- **Templ:** https://templ.guide/ ([Components](https://templ.guide/syntax-and-usage/components), [IDE Support](https://templ.guide/commands-and-tools/ide-support))
-- **TailwindCSS:** https://tailwindcss.com/docs ([Configuration](https://tailwindcss.com/docs/configuration), [Utility Classes](https://tailwindcss.com/docs/utility-first))
-- **go-ldap/ldap:** https://pkg.go.dev/github.com/go-ldap/ldap/v3
+- **Go Language:** <https://go.dev/doc/> ([Tutorial](https://go.dev/tour/), [Effective Go](https://go.dev/doc/effective_go))
+- **Fiber v3:** <https://docs.gofiber.io/> ([API](https://docs.gofiber.io/api/fiber), [Middleware](https://docs.gofiber.io/api/middleware))
+- **Templ:** <https://templ.guide/> ([Components](https://templ.guide/syntax-and-usage/components), [IDE Support](https://templ.guide/commands-and-tools/ide-support))
+- **TailwindCSS:** <https://tailwindcss.com/docs> ([Configuration](https://tailwindcss.com/docs/configuration),
+[Utility Classes](https://tailwindcss.com/docs/utility-first))
+- **go-ldap/ldap:** <https://pkg.go.dev/github.com/go-ldap/ldap/v3>
 
 ### Project Resources
 
-- **simple-ldap-go v1.5.0:** https://github.com/netresearch/simple-ldap-go
+- **simple-ldap-go v1.5.0:** <https://github.com/netresearch/simple-ldap-go>
   - Our Contribution: [PR #45 - Multi-key Indexed Cache](https://github.com/netresearch/simple-ldap-go/pull/45)
-- **BBolt:** https://github.com/etcd-io/bbolt ([Getting Started](https://github.com/etcd-io/bbolt#getting-started))
+- **BBolt:** <https://github.com/etcd-io/bbolt> ([Getting Started](https://github.com/etcd-io/bbolt#getting-started))
 
 ### Learning Resources
 
-- **Go Testing:** https://go.dev/doc/tutorial/add-a-test
-- **LDAP Basics:** https://ldap.com/learn-about-ldap/
-- **Active Directory:** https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/
+- **Go Testing:** <https://go.dev/doc/tutorial/add-a-test>
+- **LDAP Basics:** <https://ldap.com/learn-about-ldap/>
+- **Active Directory:** <https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/>
 
 ---
 
 ## 📝 Keywords for Search
 
-**Features:** Authentication, Authorization, Caching, Connection Pooling, Health Checks, LDAP, Active Directory, Session Management, Template Rendering, Static Assets
+**Features:** Authentication, Authorization, Caching, Connection Pooling, Health Checks, LDAP, Active Directory,
+Session Management, Template Rendering, Static Assets
 
 **Technologies:** Go, Golang, Fiber, Templ, TailwindCSS, BBolt, LDAP, Active Directory, Docker, pnpm
 
@@ -498,4 +500,4 @@ curl http://localhost:3000/debug/ldap-pool
 
 ---
 
-_Last updated: 2025-09-30 | Comprehensive knowledge base with search aids and cross-references_
+Last updated: 2025-09-30 | Comprehensive knowledge base with search aids and cross-references

docs/development/architecture.md

@@ -1,17 +1,18 @@
 # Architecture Overview
 
-Comprehensive technical architecture documentation for LDAP Manager, covering system design, component interactions, and implementation patterns.
+Comprehensive technical architecture documentation for LDAP Manager, covering system design, component interactions,
+and implementation patterns.
 
 ## System Architecture
 
 ![LDAP Manager Architecture](../assets/architecture.png)
 
 LDAP Manager follows a layered architecture pattern with clear separation of concerns:
 
-```
+```text
 ┌─────────────────────────────────────────────────┐
 │                Web Layer                        │
-│  • HTTP Handlers & Routing (Fiber v2)          │
+│  • HTTP Handlers & Routing (Fiber v3)          │
 │  • Session Management                           │
 │  • Template Rendering (templ)                  │
 │  • Static Asset Serving                        │
@@ -644,4 +645,5 @@ CMD ["./ldap-manager"]
 - Memory cache size optimization
 - Resource limits and requests
 
-This architecture provides a solid foundation for a secure, performant, and maintainable LDAP directory management system. The modular design allows for easy testing, enhancement, and scaling as requirements evolve.
+This architecture provides a solid foundation for a secure, performant, and maintainable LDAP directory management
+system. The modular design allows for easy testing, enhancement, and scaling as requirements evolve.

docs/operations/deployment.md

@@ -1,6 +1,7 @@
 # Deployment Guide
 
-Comprehensive guide for deploying LDAP Manager in production environments, covering various deployment strategies, configurations, and operational best practices.
+Comprehensive guide for deploying LDAP Manager in production environments, covering various deployment strategies,
+configurations, and operational best practices.
 
 ## Overview
 
@@ -115,7 +116,7 @@ services:
 
 ```bash
 # Set password via environment
-export LDAP_PASSWORD="your_secure_password"
+export LDAP_PASSWORD="your_secure_password" # pragma: allowlist secret
 
 # Deploy
 docker compose up -d
@@ -750,7 +751,7 @@ RESPONSE=$(curl -s -o /dev/null -w "%{http_code}:%{time_total}" "$HEALTH_URL")
 STATUS_CODE=$(echo $RESPONSE | cut -d: -f1)
 RESPONSE_TIME=$(echo $RESPONSE | cut -d: -f2)
 
-if [ "$STATUS_CODE" = "200" ] || [ "$STATUS_CODE" = "302" ]; then
+if [ "$STATUS_CODE" = "200" ] || [ "$STATUS_CODE" = "303" ]; then
     echo "OK - LDAP Manager healthy (${RESPONSE_TIME}s)"
     exit 0
 else
@@ -896,4 +897,5 @@ sudo cp /opt/ldap-manager/ldap-manager.backup /opt/ldap-manager/ldap-manager
 sudo systemctl start ldap-manager
 ```
 
-This deployment guide provides production-ready configurations for various environments. Choose the deployment method that best fits your infrastructure and security requirements.
+This deployment guide provides production-ready configurations for various environments. Choose the deployment method
+that best fits your infrastructure and security requirements.