remove agent access feature

1 files changed, 18 insertions, 41 deletions

diff --git a/SECURITY_CHECKLIST.md b/SECURITY_CHECKLIST.md
index 4e63174..46b8cea 100644
--- a/SECURITY_CHECKLIST.md
+++ b/SECURITY_CHECKLIST.md
@@ -2,14 +2,8 @@
 
 ## Critical Security Issues (Must Fix Before Production)
 
-### Authentication & Authorization
-- [ ] **Timing Attack in AI Auth** (15 min)
-  - File: `internal/middleware/ai_auth.go:31`
-  - Change: Use `crypto/subtle.ConstantTimeCompare()` instead of `!=`
-  - Impact: Prevents token brute-forcing
-
 ### Database Security
-- [ ] **SQL Injection in GetNotes()** (15 min)
+- [x] **SQL Injection in GetNotes()** (15 min)
   - File: `internal/store/sqlite.go:208`
   - Change: Use parameterized query for LIMIT clause
   - Impact: Prevents SQL injection attacks
@@ -30,11 +24,6 @@
   - Change: Validate paths stay within vault, skip symlinks
   - Impact: Prevents arbitrary file read attacks
 
-- [ ] **JSON Injection in Error Responses** (15 min)
-  - File: `internal/middleware/ai_auth.go:42-45`
-  - Change: Use `json.Encoder` instead of string concatenation
-  - Impact: Prevents JSON structure manipulation
-
 ### Network Security
 - [ ] **HTTPS Support** (1 hour)
   - File: `cmd/dashboard/main.go:86-94`
@@ -119,16 +108,6 @@
   - Impact: Protection against malicious API servers
 
 ### Testing
-- [ ] **Add AI Handler Tests** (2 hours)
-  - File: `internal/handlers/ai_handlers_test.go` (new)
-  - Tests: Task categorization, meal grouping, response size
-  - Impact: Better test coverage
-
-- [ ] **Add Middleware Tests** (1 hour)
-  - File: `internal/middleware/ai_auth_test.go` (new)
-  - Tests: Valid/invalid tokens, missing headers
-  - Impact: Better test coverage
-
 - [ ] **Add Edge Case Tests** (2 hours)
   - Files: Various test files
   - Tests: Empty responses, malformed JSON, network errors
@@ -202,22 +181,22 @@
 
 | Priority | Count | Estimated Time |
 |----------|-------|----------------|
-| Critical | 6 items | ~4 hours |
+| Critical | 4 items | ~2.5 hours |
 | High | 7 items | ~6.5 hours |
-| Medium | 11 items | ~13.5 hours |
+| Medium | 8 items | ~9.5 hours |
 | Low | 8 items | ~14 hours |
-| **Total** | **32 items** | **~38 hours** |
+| **Total** | **27 items** | **~32.5 hours** |
 
 ### Recommended Sprint 1 (Critical + High Priority)
 - **Duration**: 1-2 weeks part-time
-- **Items**: 13 items
-- **Time**: ~10.5 hours
+- **Items**: 11 items
+- **Time**: ~9 hours
 - **Focus**: Security hardening and performance
 
 ### Recommended Sprint 2 (Medium Priority)
 - **Duration**: 1-2 weeks part-time
-- **Items**: 11 items
-- **Time**: ~13.5 hours
+- **Items**: 8 items
+- **Time**: ~9.5 hours
 - **Focus**: Code quality and testing
 
 ---
@@ -226,18 +205,16 @@
 
 These can be done in small chunks:
 
-1. ✓ Timing attack fix (15 min)
-2. ✓ SQL injection fix (15 min)
-3. ✓ JSON injection fix (15 min)
-4. ✓ Database permissions (15 min)
-5. ✓ Health check endpoint (15 min)
-6. ✓ Security headers middleware (30 min)
-7. ✓ Database ping check (15 min)
-8. ✓ Check JSON unmarshal errors (30 min)
-9. ✓ Extract constants (30 min)
-10. ✓ Config validation (30 min)
-
-**Total Quick Wins**: ~4 hours, addresses 10 issues
+1. ✓ SQL injection fix (15 min)
+2. ✓ Database permissions (15 min)
+3. ✓ Health check endpoint (15 min)
+4. ✓ Security headers middleware (30 min)
+5. ✓ Database ping check (15 min)
+6. ✓ Check JSON unmarshal errors (30 min)
+7. ✓ Extract constants (30 min)
+8. ✓ Config validation (30 min)
+
+**Total Quick Wins**: ~3.5 hours, addresses 8 issues
 
 ---