audit and harden workspace

all/internal/server/server.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	gwRuntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
@@ -49,7 +50,13 @@ func (s *Server) Start(addr string) error {
 		}
 		s.HTTP.ServeHTTP(w, r)
 	}), &http2.Server{})
-	s.server = &http.Server{Addr: addr, Handler: handler}
+	s.server = &http.Server{
+		Addr:              addr,
+		Handler:           handler,
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       120 * time.Second,
+		MaxHeaderBytes:    1 << 20,
+	}
 	listener, err := net.Listen("tcp", addr)
 	if err != nil {
 		return err
@@ -59,9 +66,18 @@ func (s *Server) Start(addr string) error {
 }
 
 func (s *Server) Stop(ctx context.Context) error {
-	s.GRPC.GracefulStop()
+	stopped := make(chan struct{})
+	go func() {
+		s.GRPC.GracefulStop()
+		close(stopped)
+	}()
+	select {
+	case <-stopped:
+	case <-ctx.Done():
+		s.GRPC.Stop()
+	}
 	if s.server == nil {
-		return nil
+		return ctx.Err()
 	}
 	return s.server.Shutdown(ctx)
 }