100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
popertots	3db8b54923	Fix silent tip/gift-card money loss on pending retry; terminal checkout wire; sentinel error; docs ... CRITICAL — same-amount tip retry silently never charged: - CreateTipPayment idempotency check now only short-circuits when the existing record is 'completed'. A 'pending' record (previous Square call failed) is REUSED and the charge re-attempted with the same key (Square dedups safely), instead of returning the stale pending record as 200 with a success toast and no charge. - Same fix in BuyGiftCard: pending records trigger a re-attempt, not a false-success response. Unique idempotency_key constraint means the pending record must be reused, not re-inserted. - Fixes the savepoint/rollback interaction: the nested tx (savepoint) is now committed in the reuse path so the deferred rollback doesn't undo the later status UPDATE on the same connection. - Regression test: TestTipPayment_RetryPending_ReattemptsCharge verifies a pending record + same-key retry re-attempts and completes, reusing the record (count stays 1). MAJOR — terminal checkout wire contract: - device_id now sent as checkout.device_options.device_id (Square's required shape), not a top-level field which Square rejects with 400. - 'checkout pending' detection now uses typed sentinel ErrCheckoutPending with errors.Is in both handlers, matching mock and real HTTP client. MAJOR — exp_month/exp_year omitted from card creation payload when unset (now *int with omitempty) — Square would 400 on 0/0; expiry comes from the tokenized source. Docs: - README payments/infrastructure sections corrected (Web Payments SDK claim replaced with accurate P11-backlog note; dev mock parity described) - Future Work P11 updated to reflect raw-PAN rejection is now enforced in both mock and prod (new-card flows are a documented dead end) - Added plans/p11-square-web-payments-sdk.md: full implementation plan + handoff prompt for the agent picking up P11 (Web Payments SDK nonces)	2026-08-22 00:34:49 +01:00
popertots	bbb55dae82	Match dev mock to production: reject raw PAN card creation (PCI-DSS parity) ... Previously the dev MockClient was more permissive than production: - MockClient.CreateCardOnFileRaw processed raw PANs and stored mock cards, while ProdClient and devProdClient both block raw PANs. A dev testing the raw-card flow saw it succeed, masking a production failure. - MockClient.CreateCardOnFile accepted raw PANs as source_id via an isAllDigits branch. Real Square only accepts cnon:xxx/ccof:xxx tokens. Now the mock behaves identically to production: - CreateCardOnFileRaw returns the same PCI error as ProdClient - CreateCardOnFile validates source_id is token-like (cnon:/ccof:) and rejects raw PANs - Removed dead isAllDigits helper Tests updated to assert the parity behavior: - TestDevClient_CreateCardOnFileRaw_Rejected_ProdParity (table-driven, replaces 5 brand-specific raw-PAN tests) - TestDevClient_CreateCardOnFile_RejectsRawPAN (replaces RawNumber) - TestCreatePaymentMethod_HappyPath / SecondCardNotDefault now expect 500 instead of 200, documenting the prod block	2026-08-22 00:34:49 +01:00
popertots	73dd2c2dea	Fix regression: UserPaymentModal 'Use a new card' overridden by auto-select effect ... Move the saved-card auto-select effect INTO CardSelection, where it owns both cards and showNewCardForm. The effect is guarded by !showNewCardForm so the 'Use a new card' click (selectedCardId = '') is not immediately re-set to the default card — previously the parent's unguarded effect (moved from the OLD showNewCardForm guard during the CardSelection refactor) silently charged the saved default card instead of the newly entered card. CardSelection mounts fresh each time the modal opens (conditional {#if} mounting in UserBookingModal and BookingFlow), so the auto-select fires once on load, exactly like the tip flows' one-shot load-time selection.	2026-08-22 00:34:49 +01:00
popertots	5a373a3b0b	Unify card selection UI via reusable CardSelection component; fix Buy a Gift Card new-card bug ... Create CardSelection.svelte reusable component encapsulating the standard saved-card list + 'Use a new card' + CardInput pattern with blur-based validation (Luhn, expiry, CVC) — identical to the tip flows and account page. Refactor UserPaymentModal (Make a Payment submodal) to use CardSelection: - Removed its bespoke 'Use a different card' expand/collapse UI and inline validation derivations (parseExpiryParts, isValidLuhn, touched state) - Bound selectedCardId + new card fields to the component - payButtonDisabled now driven by component's onValidityChange callback - Removed now-unused CardInput import, SvelteDate import, formatCardExpiry Fix account 'Buy a Gift Card' bug: 'Use a new card' click did nothing because the auto-select effect immediately re-set buySelectedCard back to the default card. Added buyShowNewCard flag so the effect only auto-selects on initial load; reset after successful new-card purchase so the next purchase re-defaults.	2026-08-22 00:34:49 +01:00
popertots	28f0ddb328	Fix tip amount-change false dedup, wire BuyerEmail everywhere, clear ESLint errors ... Money-moving fixes: - Tip idempotency key regenerates when the tip amount changes after a failed attempt (all 3 tip flows). Cached key still reused on same-amount retry (dedup intact) and cleared on success/modal reset. Prevents silent under-charge when a user retries at a different amount. - Till replay path returns actual till_sales.status (may be 'pending') instead of hardcoded 'completed' — no more misreported successful charge. - BuyerEmail wired for CreateBookingPayment, gift card purchases, and till sales (saved_card + online_square), matching the tip flow. Email lookup errors logged, non-fatal. - Till buyer-email errors now logged (was silently swallowed). - on_the_house till top-up uses cached getIdempotencyKey() for retry-safe dedup (was fresh crypto.randomUUID()). Test/validation fixes: - Add TestPaymentFromSquare_* unit tests (else-branch + nil card details), build tag relaxed to 'test' so they run in the standard dev suite. - Add TestValidateCardInfo table test (7 cases: both/either/neither/empty). - Add TestCreateTillSale_TwoIdenticalCreateSales_BothSucceed regression test. - Remove dead mock pre-registration in TestTipPayment_WithSavedCard. - Correct misleading till regression-test comment. ESLint cleanup (12 errors -> 0): - Remove unused loadingCards in tip + pay-tip pages (dead assignments in loadSavedCards). - Scoped eslint-disable for {@html} in CardBrandIcon (hardcoded brand SVGs). - Remove dead confirmSaveDefaultHours + unused rescheduleVersion prop in WeeklySchedule (and its parent pass-through). - Replace new Date() with SvelteDate in WeeklySchedule + BusinessHours. - Fix each-block key in BusinessHours skeleton loader. - Use void expression for reactivity-tracker reads in effects.	2026-08-22 00:34:49 +01:00
popertots	a4441b6acf	Fix review findings: till idempotency keys, sha256 card key, paymentFromSquare fallback, regression test ... till.go: - Replace deterministicTillKey (request-field hash) with uniqueTillKey (crypto/rand.Text) - Deterministic hashes broke legitimate identical create sales (empty gift_card_id collides on till_sales idempotency_key UNIQUE constraint → 500 on second sale) - Client-supplied keys handle dedup; fallback only needs uniqueness - Use rand.Text() (Go 1.24+) instead of deprecated rand.Read with dead error check till_test.go: - Add TestCreateTillSale_TwoIdenticalCreateSales_BothSucceed regression test (two identical keyless cash creates must both return 201) square_http_client.go: - createCardOnFileHTTP: replace reversible hex encoding with crypto/sha256 - paymentFromSquare: replace dead-code fallback with reachable else branch - Remove unused url import cleanup where applicable	2026-08-22 00:34:49 +01:00
popertots	2459ddc919	Fix review findings: expiry bug (all 8 files), idempotency keys, card_expiry/card_cvc removal, URL encoding, BuyerEmail logging, ValidateCardInfo, saved-card test, future work doc ... Backend: - Fix refund idempotency key: clock.Now() → deterministic (pr.ID + amount) - Fix ValidateCardInfo: enforce mutual exclusivity, handle empty strings symmetrically - Fix paymentFromSquare brand fallback (remove dead SourceType fallback) - Fix URL encoding: PathEscape → QueryEscape for customer_id query param - Fix BuyerEmail: log warning on DB error instead of silent discard - Fix idempotency key in createCardOnFileHTTP: time.Now() → deterministic hex hash - Add BuyerEmail to CreateTipPayment Square request - Move realBaseURL from shared file to square_dev.go (only used in dev) - Add TestTipPayment_WithSavedCard test (card_id path coverage) - Fix AMEX brand in mock (AMEX → AMERICAN_EXPRESS, fix test) Frontend: - Fix off-by-month expiry bug in ALL 8 files using year-month arithmetic (parseExpiryParts returns 1-indexed, SvelteDate expects 0-indexed) Files: tip/+page, pay-tip/[id], UserBookingModal, UserPaymentModal, BookingFlow, account/+page (add card + buy gift card sections) - Remove card_expiry/card_cvc from tip request bodies (backend has no fields) Docs: - Mark P9 (placeholder tokens) as completed, add P11 (Square Web Payments SDK) - Mark T13 (rune arithmetic) as completed	2026-08-22 00:34:49 +01:00
popertots	4abcb324c9	Square payment integration: real HTTP client, tip flow rewrite, card UI/validation overhaul ... Backend: - Create square_http_client.go: real Square REST API client (Payments, Terminal Checkouts, Refunds, Cards, Locations) with proper JSON types, auth, error handling - Update ProdClient in square.go to delegate to shared HTTP functions - Wire devProdClient in square_dev.go to also make real HTTP calls for sandbox/prod env - Rewrite CreateTipPayment handler: accept card_id OR new_card_token (+save_card), advisory lock, idempotency check, max amount validation - Add ValidateCardInfo, bump ValidateAmount max to £10,000 - Fix mock CreateCardOnFile to detect brand/last4 from raw card numbers - Fix mock RefundPayment to index by SquarePayID and accept unknown payment IDs - Remove dead types (ProcessingFee, sqAddress), add Deadline parity - Fix AMEX brand inconsistency (AMEX -> AMERICAN_EXPRESS) - Pre-existing fix: remove unused context import in giftcards.go Frontend: - CardInput.svelte: add onfieldblur/onfieldinput callbacks for blur-based validation - CardBrandIcon.svelte: brand SVGs for VISA, MC, AMEX, Discover, Diners, JCB, Square Gift Card, UnionPay, Interac, EFTPOS - tip/+page, pay-tip/[id], UserBookingModal tip: saved card list + CardInput + Luhn/expiry/CVC validation + blur-based errors + no-saved-cards edge case - UserPaymentModal, BookingFlow: card validation parity (blur-based, all-valid check) - account page: replace text brand badges with CardBrandIcon - Fix handleCustomTip bug (state mutations outside if block) - Remove dead pageState variable - Add tip modal scroll (max-h-[90vh] overflow-y-auto) - Submit button disabled on !isCardValid Tests: - 30 square package tests (+new: CreateCardOnFile raw number path, detectCardInfo variants) - 5 tip handler tests (HappyPath, NoPriorPayment, WrongOwner, MultipleTips, TxFailure) - All +-race clean, refund tests fixed	2026-08-22 00:34:49 +01:00
popertots	f6caaab8a3	feat: redesign homepage, add global footer, fix carousel font ... Homepage: restored original v0 design, replaced lorem ipsum with real service descriptions, added BusinessHours (Opening Hours) section, alternating bg-gray-50 section backgrounds. Layout: added global sticky footer (hidden on /admin/schedule, /account, and ?format=pdf pages), wrapped content in min-h-screen flex layout. PortfolioCarousel: set heading to Playfair Display.	2026-08-22 00:34:49 +01:00
popertots	51d29e6bd4	fix: remove card shadows from prices page to match site-wide border-style ... All other pages (contact, admin, account, today, book) use border-based card styling without drop shadows. Removes shadow-sm, hover:shadow-md, and transition classes from all Card.Root instances on the prices page.	2026-08-22 00:34:49 +01:00
popertots	9d76b3a87b	docs: add popular services endpoint to technical manual	2026-08-22 00:34:49 +01:00
popertots	1f3d834f0c	docs: add feature catalog and update gap backlog ... Feature Catalog: comprehensive audit of all 15 feature areas with cross-references, verified against source code (18 parallel deep-dive agents). Gap Backlog: rewritten with dev-to-prod integration framing, 40 items across Pre-Launch/MVP/Stretch/Tech Debt. Gitleaks: whitelist obsidian/ docs containing curl examples.	2026-08-22 00:34:49 +01:00
popertots	df4c9afeb9	fix: remove admin notification for friend gift card purchase ... Admin no longer receives a notification when someone buys a gift card for a friend. The recipient email and gift code are logged for future SMTP delivery instead.	2026-08-22 00:34:49 +01:00
popertots	aad364bbd1	fix: order zero-booking services after popular ones (NULLS LAST) ... PostgreSQL ORDER BY ... DESC puts NULLs first by default, so services with no bookings appeared at the top instead of the bottom. Also removes the booking count column from SELECT entirely — the sort is done purely in the ORDER BY.	2026-08-22 00:34:49 +01:00
popertots	3c0c4dd962	feat: sort price list by booking popularity over last 6 months ... Adds GET /api/services/popular endpoint that returns services sorted by booking count (desc) then price (desc) for ties. Prices page now fetches from this endpoint instead of the default alphabetical sort.	2026-08-22 00:34:49 +01:00
popertots	8384197ef0	fix: clear date selection when clicking an unavailable/closed day ... bits-ui blocks onValueChange for unavailable dates, leaving stale selection. Adds native click detection on [data-unavailable] elements to call onchange(undefined) so the time picker hides and the user knows nothing was picked.	2026-08-22 00:34:49 +01:00
popertots	1fb84b8998	test: add hours validation tests for edit request handler ... Add TestRequestEditHandler_PastClosing_Blocked (19:30 extends past 20:00 closing), TestRequestEditHandler_StagedHoursClosed_Blocked (day closed under staged change), and TestRequestEditHandler_ValidTime_Succeeds (10:00 within open hours). Removed the closed-day test that was incompatible with the bookings test DB seed (all 7 days open 08:00-20:00) — that case is covered by the staged-hours test.	2026-08-22 00:34:49 +01:00
popertots	991f3af540	fix: add hours validation to user edit requests (was M8/L5 stubs) ... RequestEditHandler had empty M8/L5 placeholder comments where hours validation was planned. Implemented full validation: staged-hours-aware closing time check via getClosingTimeForDate, closed-day check, and closing-hours boundary check using the booking's total_duration_minutes. Removed placeholder comments. Updated test to propose an open-day time that doesn't extend past closing.	2026-08-22 00:34:49 +01:00
popertots	c80ad467e7	fix: add staged hours check to edit request approval ... AdminApproveEditRequestHandler checked exceptional hours but not staged default hours changes. Added getClosingTimeForDate check for the proposed reschedule time, matching the pattern used in AdminRescheduleBookingHandler.	2026-08-22 00:34:49 +01:00
popertots	503449b0bc	fix: staged hours no longer leak closed values to days before effective date ... The else-if chain in GetWorkingHours/computeAvailableHours entered the staged change block for ALL days when a pending change existed, but only applied hours for future dates — leaving earlier days as zero-value (closed). Moved the effective date check into the else-if condition so early days fall through to default hours.	2026-08-22 00:34:49 +01:00
popertots	9eecb375cf	docs: update test counts from ~1,642 to 1,716 (4 skipped, 0 failures) ... Reflect current test run results across README, Overview, Technical Manual, and Testing Architecture docs.	2026-08-22 00:34:49 +01:00
popertots	a991642157	fix: show only differing days in scheduled hours change section ... Replace unreactive @const with for the changed-days filter. Normalize PostgreSQL microsecond times before comparing (TIME::text produces '17:00:00.000000' but staged hours are '17:00'). Change header text to 'These opening hours will change from' when fewer than 7 days differ.	2026-08-22 00:34:49 +01:00
popertots	aa31b19f1c	docs: update all docs for staged default hours feature ... Update Technical Manual (API endpoints, DB schema, scheduling system, job catalogue), Admin Manual (scheduled changes workflow), Overview, Future Work backlog, and README to reflect the new staged default hours change scheduling system with conflict detection and auto-apply at 00:05.	2026-08-22 00:34:49 +01:00
popertots	0323313921	fix: add conflict re-check guard before saving holiday hours and time blockers ... Re-check conflicts immediately before finalizing holiday hours and time blocker saves to prevent race conditions. Add Refresh button to conflict banners. Fix prettier formatting in login page.	2026-08-22 00:34:49 +01:00
popertots	6470a3f6c9	feat: add scheduled change UI and conflict display to weekly schedule ... Convert WeeklySchedule to schedule staged changes with an effective date picker and conflict detection UI. Show pending scheduled changes in BusinessHours component. Update admin page to pass through props.	2026-08-22 00:34:49 +01:00
popertots	a6cb803ff2	test: fix today_test flakiness with London-timezone-aware booking times ... Replace clock.Now() with fixed London-timezone times in TestGetCurrentNext_WithMultipleDataPoints to prevent near-midnight UTC failures where bookings fall outside the London 'today' window.	2026-08-22 00:34:49 +01:00
popertots	70613497b4	feat: add daily cron to apply scheduled default hours changes ... Add ApplyScheduledDefaultHours which checks default_hours_scheduled_changes at midnight, bulk-updates working_hours with staged values, and inserts an admin_notification. Register as the 'apply-default-hours' job in the scheduler (daily at 00:05).	2026-08-22 00:34:49 +01:00
popertots	d0f233ae70	test: add tests for staged default hours change handlers ... Add tests for ScheduleDefaultHoursChange, GetScheduledDefaultHoursChange, CancelScheduledDefaultHoursChange, GetDefaultHoursConflictingBookings, and GetWorkingHours/GetDefaultHours integration with staged changes.	2026-08-22 00:34:49 +01:00
popertots	2a840bb7e6	feat: add staged default hours change handlers with conflict detection ... Add ScheduleDefaultHoursChange, GetScheduledDefaultHoursChange, CancelScheduledDefaultHoursChange, and GetDefaultHoursConflictingBookings handlers. Updates GetDefaultHours to return { current, scheduled_change }. Updates GetWorkingHours and computeAvailableHours to apply staged hours for dates on/after the effective_date.	2026-08-22 00:34:48 +01:00
popertots	8f99b8b5c3	feat: check staged default hours in all booking creation paths ... Integrate getClosingTimeForDate into AdminReserveSlotHandler, CreateBookingHandler, AdminRescheduleBookingHandler, and AdminCreateBookingForUserHandler. Rejects bookings when the staged schedule marks a day as closed (00:00).	2026-08-22 00:34:48 +01:00
popertots	52caf1b7b5	feat: add getClosingTimeForDate to check staged default hours for bookings ... Add getClosingTimeForDate that queries default_hours_scheduled_changes for a pending staged change whose effective_date <= the booking date. Falls back to current working_hours if no staged change applies. Also checks the staged schedule to see if a weekday is closed (returns 00:00).	2026-08-22 00:34:48 +01:00
popertots	bc37283009	feat: add default_hours_scheduled_changes table and admin_notifications enum value ... Add new table for staging future default hours changes with an upsert guard (at most one pending change). Extend admin_notification_reason enum with 'default_hours_changed'.	2026-08-22 00:34:48 +01:00
popertots	3eec71a56c	fix: sanitize API error text display and add time_blockers tests ... Add extractErrorMessage helper for JSON error body parsing and apply sanitizeText across all toast displays. Add time_blockers test coverage for new holiday placeholder cleanup and overlapping scenarios.	2026-08-22 00:34:48 +01:00
popertots	388ac5948a	docs: add holiday hours conflict resolution plan	2026-08-22 00:34:48 +01:00
popertots	5deefa1205	fix: prevent empty login form submission ... Fix isFormComplete derived always returning true for login mode. Now requires email and password to be non-empty before enabling Sign In button. Add early-return guard in handleSubmit to prevent sending empty credentials.	2026-08-22 00:34:48 +01:00
popertots	9170990340	feat: add conflict resolution UI to holiday hours modal ... Add conflict detection to the Create Exception Schedule modal with auto-checking, amber warning display, and View Booking/View Client buttons. Wire openUserModal and openBookingModal props from admin page. Fix TimeBlockers placeholder duration from hardcoded 60 to booking.duration_minutes. Remove dead placeholder creation code (isFormValid prevents save while conflicts exist). Fix formatTime overwriting raw hour data with display strings.	2026-08-22 00:34:48 +01:00
popertots	6567ff4904	fix: harden login validation with proper JSON error responses ... Change LoginHandler validation error from http.Error (plain text, mismatched Content-Type) to mw.RespondError (proper JSON {error:...} response). Add TestLogin_EmptyFields and TestLogin_MissingEmail tests verifying JSON error format.	2026-08-22 00:34:48 +01:00
popertots	5ed24f263a	fix: prevent internal error details leaking in HTTP responses ... Replace err.Error() concatenation in JSON decode error responses with fixed 'invalid request body' message across 5 locations in custom_services.go, discount_campaigns.go, and services.go.	2026-08-22 00:34:48 +01:00
popertots	291868f11a	test: add conflict detection and preview available hours tests ... Add 12 new tests for GetConflictingBookingsForExceptionHandler (closed day, within hours, before-opening, after-closing, multiple weeks, excluded statuses, invalid payload, wrong method) and GetPreviewAvailableHours (no proposed, proposed override, invalid JSON, missing params). Fix pre-existing test with FK violation (non-existent admin_id) by using fixture-created admin user.	2026-08-22 00:34:48 +01:00
popertots	e27db9202e	feat: add holiday hours conflict detection with shared scheduling core ... Extract computeAvailableHours as shared core between GetAvailableHours and GetPreviewAvailableHours, eliminating ~320 lines of duplication. Add GetConflictingBookingsForExceptionHandler (POST) for holiday hours conflict detection with batch service loading, int-based time comparison, and ActiveBookingStatuses constant. Add RESERVATION:placeholder cleanup (24h TTL). Fix scan error propagation in all scheduling row iterations. Add rows.Err() checks.	2026-08-22 00:34:48 +01:00
popertots	b5f215aaa4	fix: move preview-available-hours to admin route group ... Move GET /api/scheduling/preview-available-hours from public OptionalAuth group into the admin-only group (RequireAuth + RequireAdmin) since it's an admin simulation tool.	2026-08-22 00:34:48 +01:00
popertots	04d5c21f8c	feat: show live availability status on ContactCard	2026-08-22 00:34:48 +01:00
popertots	bea1582088	feat: add BusinessHours component and update contact page	2026-08-22 00:34:48 +01:00
popertots	117c37eaff	feat: add contact-availability handler and route	2026-08-22 00:34:48 +01:00
popertots	24af3a1fca	fix: enable eslint-plugin-svelte a11y rules and fix violations	2026-07-11 18:17:49 +01:00
popertots	6777fb9b97	fix: remove heavy linters from pre-commit (golangci-lint, staticcheck, gosec) — CI-only	2026-07-11 18:07:52 +01:00
popertots	bbbffce20d	fix: gocritic linter issues (appendAssign, ifElseChain, regexpMust)	2026-07-11 18:03:05 +01:00
popertotsandSisyphus	35bc021857	fix: replace err.Error() string match with errors.Is(err, pgx.ErrTxClosed) ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 17:53:29 +01:00
popertots	5d9fa1178b	fix: replace silent json.Encode with error-logging pattern across all handlers	2026-07-11 17:50:07 +01:00
popertots	0bef0f7973	fix: remove redundant rollback, document asymmetry in cancellation notifications	2026-07-11 17:45:24 +01:00
popertots	0edc111bfe	fix: correct global milestone discount indentation (C1)	2026-07-11 17:42:17 +01:00
popertots	8ae592d0c5	fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper	2026-07-11 17:38:50 +01:00
popertots	b864873310	fix: include SquarePaymentID in commit-failure log for manual reconciliation	2026-07-11 17:35:10 +01:00
popertots	11fbf869e1	fix: add 30s timeouts to account.go goroutines using context.Background()	2026-07-11 17:10:11 +01:00
popertots	0afa642a10	fix: add 60% coverage minimum to CI, scope prettier to staged frontend files	2026-07-11 17:09:37 +01:00
popertots	7d6cb0c375	fix: prettier formatting on EditRequestModal.svelte	2026-07-11 16:37:33 +01:00
popertotsandSisyphus	d6a3e30503	fix: compare notification IDs instead of timestamps in upsert test ... The PoolProxy.Begin routes to the outer test transaction, so PG NOW() returns the same value for both handler invocations. Comparing notification IDs correctly verifies the notification was deleted and recreated. Also removes unused testify/assert import. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 16:25:33 +01:00
popertots	c8051a76d6	fix: replace time.Sleep with poll loops in tests, fix a11y target=_blank violations	2026-07-11 16:16:23 +01:00
popertots	0c1fc2b819	fix: log internal errors server-side, add timeout to GDPR goroutine	2026-07-11 16:09:11 +01:00
popertots	05c5d73d30	fix: add ShouldFail to Square MockClient for testing payment error paths	2026-07-11 16:07:05 +01:00
popertots	ce0bb43ebf	fix: auth and ratelimit middleware return JSON errors instead of text/plain	2026-07-11 16:05:56 +01:00
popertots	e4a56ab04d	fix: add defer tx.Rollback to CreateTipPayment to prevent transaction leak	2026-07-11 16:04:48 +01:00
popertots	8b911d788c	ci: trigger fresh pipeline after Docker prune setup	2026-07-11 15:38:43 +01:00
popertots	b3729c8a5a	docs: add DAV_SKIP_INIT to .env.example	2026-07-11 15:25:44 +01:00
popertotsandSisyphus	a3243fab27	fix: auto-set DAV_SKIP_INIT=1 in test init to match local GO_TESTING behavior ... The DAV_SKIP_INIT env var was only set in CI, not locally. db_test_init.go always auto-sets GO_TESTING=1 for local runs — now does the same for DAV_SKIP_INIT, so tests don't panic on DAV init failure. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 15:13:51 +01:00
popertots	4d87bf791f	fix: replace GO_TESTING with DAV_SKIP_INIT for DAV service initialization	2026-07-11 15:06:16 +01:00
popertots	f147be0b99	fix: add error logging to remaining nolint:errcheck scan sites for observability	2026-07-11 15:04:53 +01:00
popertots	ad15127777	fix: remove nonDepositPaymentType dead code, wire dead handlers to routes	2026-07-11 15:01:26 +01:00
popertots	df325487cf	fix: gift card admin notification uses NULL booking_id (not cardID), use tx not db.Conn	2026-07-11 14:59:09 +01:00
popertots	ac104e19c5	fix: remove rate limiter dev stub, consolidate tests under all build tags	2026-07-11 14:41:58 +01:00
popertots	9b235a1298	fix: add error logging to 3 non-aggregate nolint:errcheck sites (duration lookup, deposit-paid scans)	2026-07-11 14:41:06 +01:00
popertots	d410dce0e0	fix: gift card friend purchase notifies admin, frontend no longer falsely claims email sent	2026-07-11 14:39:54 +01:00
popertots	9f9f0eed98	fix: add error logging to discount campaign payment/times_redeemed execs	2026-07-11 14:37:47 +01:00
popertots	7a51bcc49a	fix: JTI revocation returns error, LogoutHandler returns 500 on failure	2026-07-11 14:35:34 +01:00
popertotsandSisyphus	9e85bc766b	docs: update obsidian docs — test count, coverage, a11y, limitations ... All obsidian docs updated to reflect current state: test count ~1,642, coverage 50.4%→65.0%, 56 new test files. Overview: added a11y note (Svelte 5 compiler built-in checks), removed duplicate limitations. Technical Manual: coverage pass summary. Testing Architecture: bumped to v5 with coverage stats. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 14:12:44 +01:00
popertotsandSisyphus	428e250b4f	docs: update README test count and add pre-commit hook section ... Test count updated from 1,251/1,255 to ~1,642. New pre-commit hook section documents golangci-lint, staticcheck, gosec, gitleaks, and go mod tidy checks. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 14:12:35 +01:00
popertotsandSisyphus	85c043ad7f	fix: add golangci-lint to pre-commit hook, clarify R2_ENDPOINT in env example ... Pre-commit now runs golangci-lint (3m timeout) after go vet, before staticcheck. R2_ENDPOINT comment updated to clarify it is prod-only and local dev uses S3_* vars. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 14:12:28 +01:00
popertots	b549014a68	fix: add nolint:errcheck to AdminGetInProgressBookingHandler json.Encode	2026-07-11 13:30:09 +01:00
popertots	28620f69a5	fix: restore dead functions properly, match test expectations, fix vet/lint	2026-07-11 13:23:27 +01:00
popertots	a3c0be2890	fix: audit nolint:errcheck — fix dangerous suppression patterns	2026-07-11 12:57:41 +01:00
popertots	19be37171b	fix: remove 3 dead code blocks (UserCancelBookingHandler, AdminGetInProgressBookingHandler, processImage)	2026-07-11 12:51:42 +01:00
popertots	294d844493	fix: replace {__} workaround with clean range() helper in Svelte templates	2026-07-11 12:50:13 +01:00
popertots	d172adf392	fix: enable svelte a11y linting and fix violations	2026-07-11 12:41:10 +01:00
popertots	d412dc3cc4	ci: frontend major deps always exits 0 (informational only)	2026-07-11 11:48:20 +01:00
popertots	0b5a6d23ce	ci: replace upload-artifact@v4 with inline coverage echo (not compatible with Gitea)	2026-07-11 11:23:23 +01:00
popertots	844df4c127	fix: use raw clock.Now()+40h for booking test times (avoids time-sensitive boundaries)	2026-07-11 10:35:59 +01:00
popertots	abd53baf35	fix: time-sensitive tests use savepoint pattern, avoid 48h auto-approval boundary	2026-07-11 10:14:12 +01:00
popertots	ae2acc45c3	chore: bump eslint 9.39.4 -> 9.39.5	2026-07-11 00:31:40 +01:00
popertots	de37b07233	fix: use savepoint pattern for today test (matches other tests in file)	2026-07-11 00:26:14 +01:00
popertots	1e4460271b	fix: fix frontend a11y and lint errors	2026-07-11 00:21:31 +01:00
popertots	d787c9a94e	fix: remove duplicate green lunch warning, green card always shows Time selected	2026-07-10 21:27:34 +01:00
popertots	a2b4f84503	chore: bump @eslint/js 9.39.4 → 9.39.5	2026-07-10 21:25:22 +01:00
popertots	7833e87aab	fix: add split-lunch detection with formatted time range warnings	2026-07-10 21:16:59 +01:00
popertots	7c8fd94fcb	fix: restore admin lunch warning tier (30-60min) with gap-worsening comparison	2026-07-10 21:10:00 +01:00
popertots	fe47cb486a	fix: replace 3.5s sleep with poll loop in till checkout test	2026-07-10 20:53:42 +01:00
popertots	b91339ec56	fix: use targeted DELETE in DAV test instead of full table wipe	2026-07-10 20:53:04 +01:00
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertots	a4a80246d1	fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment ... - s3.go: restore error returns on prod Upload/Download/Delete stubs (silent nil was dangerous — callers would think writes succeeded) - CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env - handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal - validators.go: fix comment to include A-F (matched the regex)	2026-07-10 20:39:17 +01:00
popertots	e896591098	chore: upgrade npm deps — vite 8, prettier plugins, @types/node, @eslint/compat ... Upgrades applied: @types/node: 22.20.1 → 26.1.1 @eslint/compat: 1.4.1 → 2.1.0 prettier-plugin-tailwindcss: 0.7.4 → 0.8.0 prettier-plugin-svelte: 3.5.2 → 4.1.1 (formatted textarea.svelte) vite: 7.3.6 → 8.1.4 @sveltejs/vite-plugin-svelte: 6.2.4 → 7.2.0 Left at current (blocked by deps chain): eslint / @eslint/js — typescript-eslint needs eslint 10 support typescript — typescript-eslint needs TS 7 support Added CI TODO note for when vite-plugin-svelte-inspector catches up.	2026-07-10 20:03:41 +01:00
popertots	609a099677	fix: data races in Square mock and scheduler hostname tests ... - square_dev.go: return a copy of CheckoutResult to the caller instead of sharing the map-stored pointer, preventing the goroutine from racing with the caller on Status field reads - scheduler_test.go: remove t.Parallel from TestInitHostname_* tests which modify a shared package-level hostname variable	2026-07-10 19:10:31 +01:00