popertots
44cac94f64
Fix test setup and middleware chain - Handler tests now passing
...
- Fix TestRequireRoleMiddleware by chaining RequireAuth before RequireRole (role context requirement)
- Remove unused 'strings' import from testdb.go
- Create crussell_test database in Docker setup
- Tests now properly initialize authentication context for role-based tests
Result: handlers test suite passes (13/13 tests)
Remaining failures in admin/auth/bookings/portfolio/scheduling/services/user packages need further investigation (environment setup, database constraints, endpoint initialization)
2026-02-21 23:50:17 +00:00
popertots
41dc839830
feat(booking): add service eligibility based on age and patch tests
...
- Add eligibility filtering to /api/services: exclude services below
user's
age, gray out services requiring patch tests that are missing/expired
- Add new endpoint /api/services/eligible-for/{user_id} for admin
booking
flows to check eligibility for a specific user
- Add image metadata stripping: uploads now strip all EXIF/GPS data
via imaging library (security improvement)
- Update ServiceCard frontend: show grayed-out state for ineligible
services with "contact us" link (public) or just warning (admin)
- Add 2 patch test services to seed data: Gel Polish Full Set,
Luxury Gel Manicure (48h each)
- Remove deprecated local-dev.sh script
2026-02-20 18:46:38 +00:00
popertots
a5a2ffd83e
Security: add rate limiting, input validation, and filter category
...
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
2026-02-20 12:03:14 +00:00
popertots
e8f53f4282
linting and bugfixing
2025-11-09 01:49:21 +00:00
popertots
989e45e55c
add holiday test and tweak services
2025-10-21 00:26:21 +01:00
popertots
9630afe00d
Add, toggle, and delete services
2025-10-18 23:35:07 +01:00
popertots
68cf27541a
Better skeleton use, live services in booking
2025-10-18 21:39:57 +01:00
popertots
fad47df642
Better dev script
2025-10-18 16:10:16 +01:00
popertots
69b8c0cbe5
services WIP
2025-10-18 00:45:57 +01:00
popertots