27 Commits

Include renames

Author	SHA1	Message	Date
popertots	4d5d2cd381	fix: restart-loop-A findings — pending sweep refunds, tip carve on discounts, TOCTOU redemption, single-use 2FA code + mint endpoint, refresh-token family revocation, admin 2FA code UX ... Restart of Loop A (fresh review -> fix -> verify) findings from commit 5e967fa: - B1: sweep auto-refund treats Square PENDING refunds as NON-terminal (row stays pending, no gift-card clawback, refunds row inserted for payments AND till_sales, re-polls the deterministic sweepdup- key); Square-less pre-pass exempts square_refund_id IS NOT NULL rows - M4: terminal tip carve accounts for pending campaign discounts (headroom = total - pending - paid) so explicit tips aren't absorbed as service revenue; no-tip case stays a single record - max_redemptions TOCTOU closed with atomic conditional UPDATE ... RETURNING; exhausted-at-apply surfaces campaign_fully_redeemed - 2FA: verification code is single-use on the saved-card gate (VerifyForUser consume=true, interactive flows unaffected); new POST /api/user/2fa/code mints a fresh code for enabled users (RequireAuth + RequireNonGuest + mint cooldown + per-user limiter) - Refresh tokens: family_id + used_at columns; reuse of an already-rotated token revokes the ENTIRE family and inserts a refresh_token_reuse admin alert; rotation mints descendants in the same family - Frontend: 2FA code input + Request-a-new-code on all saved-card surfaces; admin modal keys code input to customer 2FA + 403 self-heal; tip-display note for pending discounts; 76 frontend tests - Verified: all 26 backend packages pass, frontend build+tests green, env-docs 41/41	2026-08-22 00:34:50 +01:00
popertots	fe88f2084d	fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence) ... Loop B aggressive adversarial round (3 attack agents) + fix + secondary + verification: - CRITICAL: sweep replay auto-refunds provably-created-later duplicate charges (gated on parseable CreatedAt); 22h legitimate-retry window == 22h sweep cutoff (no dead zone) - HIGH: admin Take Payment clamps to remaining obligation (cash/giftcard/saved-card/terminal); no unintended tip from overflow; campaign credit against remaining - HIGH: /api/services/eligible-for/{id} requires auth + owner-or-admin (DOB/age + patch-test health-data leak closed) - HIGH: opaque refresh-token rotation (login/refresh return {token, jti, refreshToken}; refresh REQUIRES opaque token; single-use rotation; logout revokes; access token rejected at refresh) - HIGH: saved-card charges require a REAL 2FA verification code (B6/B10) — backend gate on all 8 charge paths + shared TwoFactorCodeInput frontend component on all 7 surfaces; 2FA gate is no longer setup-flag-only - MEDIUM: ungated CF-Connecting-IP in reserve/admin_reserve gated via exported mw.ClientIP; 2FA limiter keyed on userID alone (no header-rotation bypass); ChangePassword actually revokes JTI + refresh tokens; 2FA setup mint cooldown + persistent failed-attempt counter; campaign redemption race surfaces campaign_fully_redeemed - Terminal saved-card VAT applied (was under-collected); age-guard reconcile failures notify; isWeakJWTSecret entropy gate; gift-card redeem per-card counter + per-user limiter; webhook signature key startup validation - NEW internal/twofa package (single source of truth breaking the payments<->user import cycle); consolidation of duplicate 2FA hash/verify - Frontend: refresh-token storage + rotation, TwoFactorCodeInput component, amountPaidPence in admin modal, B5/B6/B10 contract wiring; 70 frontend tests - Tests: loop_b_fixes_test.go, internal/twofa tests, updated auth/services/profile/twofa/mw tests All 26 backend packages pass (incl. internal/twofa); frontend 70/70 + build clean; env-docs 41/41.	2026-08-22 00:34:50 +01:00
popertots	6567ff4904	fix: harden login validation with proper JSON error responses ... Change LoginHandler validation error from http.Error (plain text, mismatched Content-Type) to mw.RespondError (proper JSON {error:...} response). Add TestLogin_EmptyFields and TestLogin_MissingEmail tests verifying JSON error format.	2026-08-22 00:34:48 +01:00
popertotsandSisyphus	35bc021857	fix: replace err.Error() string match with errors.Is(err, pgx.ErrTxClosed) ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 17:53:29 +01:00
popertots	5d9fa1178b	fix: replace silent json.Encode with error-logging pattern across all handlers	2026-07-11 17:50:07 +01:00
popertots	8ae592d0c5	fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper	2026-07-11 17:38:50 +01:00
popertots	0c1fc2b819	fix: log internal errors server-side, add timeout to GDPR goroutine	2026-07-11 16:09:11 +01:00
popertots	7a51bcc49a	fix: JTI revocation returns error, LogoutHandler returns 500 on failure	2026-07-11 14:35:34 +01:00
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	e4b9003439	refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns ... Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:50 +01:00
popertotsandSisyphus	3d0e2afc4c	refactor(backend): migrate db.DB to db.Conn PoolProxy across all handlers ... Replace direct *pgxpool.Pool usage with PoolProxy wrapper across the entire backend: - db.DB renamed to db.Conn (*pgxpool.Pool -> *PoolProxy) - JWT functions now accept context.Context instead of using context.Background() - Handler DB calls route through PoolProxy for per-test transaction support - Fixture/helper/testdb functions accept Querier interface for decoupling - Query ordering fixed in bookings handlers: COUNT after data query to avoid pgx conn busy - Time truncation fixed: time.Date instead of Truncate(24*time.Hour) for week start calc - testmain_test.go files updated with SeedBaseline and NewPoolProxy Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-21 19:28:54 +01:00
popertotsandSisyphus	efd3ad5405	refactor(backend): migrate from sql.ErrNoRows to pgx.ErrNoRows ... Replace all database/sql.ErrNoRows checks with pgx.ErrNoRows across backend handlers. Migration includes: jwt.go, local.go, admin_reserve.go, custom_services.go, discount_campaigns.go, services.go, account.go, customer_relationship.go, guest.go. Also removes unused test_helpers.go resetTestData function. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-20 16:58:08 +01:00
popertotsandSisyphus	b6a23f8889	feat(backend): update local auth handler and tests ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-18 16:26:05 +01:00
popertotsandSisyphus	e7fd9c89eb	style(backend): lowercase error messages across handlers ... Normalize error message casing to lowercase for consistency across auth, bookings, services, customer relationship, and profile handlers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-12 10:50:43 +01:00
popertotsandSisyphus	7d1b90a5be	fix(auth): lowercase referral code before validation and lookup ... Defense-in-depth: referral codes are generated as hex (lowercase only) by the DB. The frontend already lowercases on input, but direct API calls with uppercase would fail the DB lookup. Normalize to lowercase on the backend to prevent capslock situations. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-04 12:02:39 +01:00
popertots	bffb984ebb	feat(auth,security,scheduling): JWT revocation, S3 fix, notes validation, docs, tests ... - JWT revocation with JTI (UUID v4): in-memory tracking, POST /api/logout, refresh handler revokes old JTI, RequireAuth rejects revoked tokens - Fix extractKey for S3 portfolio deletion: extracts full key path from URLs instead of just filename, preventing orphaned storage files - Notes validation: max=1000000 on all 13 Notes fields across 4 booking structs - CharCounter: grapheme-aware counter (Intl.Segmenter), threshold 750K, color-coded, integrated into 6 booking/admin components - loginInProgress: timestamp-based tracking, 30s staleness, 20-entry cap (429), ticker cleanup for stuck entries - Profile picture 15MB client-side limit, portfolio 20MB backend limit - Exceptional scheduling: expand query start to Monday of week - TodayCalendar: week-range fetching, closing time indicator, short-day lunch skip - NavBar: link reorder, mobile burger badge, slide transition, backdrop - ImageUpload: 20MB limit with visual feedback - formatDateISO: shared YYYY-MM-DD utility, shouldApplyLunchProtection helper - Update README.md and all Obsidian docs (Overview, Technical, Admin, Future Work) - Add 28 new tests: JWT (11), auth handlers (7), portfolio extractKey (5), notes validation (5). go build + go vet clean with test,dev tags	2026-06-03 11:17:41 +01:00
popertotsandSisyphus	1d8247e655	fix(auth,services,profile): add request struct validation ... Add validate tags and validators.Validate.Struct() calls on request structs for auth verification, service creation, and user patch test endpoints. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-31 18:49:12 +01:00
popertotsandSisyphus	605c1422b9	feat: validate auth and user request structs ... Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-31 10:54:48 +01:00
popertotsandSisyphus	9deae1b0d7	feat: referral code validation in registration with tests ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-29 16:06:19 +01:00
popertots	a7c8837073	Tests	2026-03-02 22:17:43 +00:00
popertots	df3439bd70	fix: improve test infrastructure and add ID validation ... - Add TestMain to set test env vars and testdb.TruncateTables for test isolation - Add chi routing context to test helpers for path parameter extraction - Fix SQL error handling to use errors.Is() instead of == - Add validators package with ID validation - Fix admin test middleware chain (RequireAdmin wrapper) - Update test user inserts to include phone and date_of_birth fields - Update service delete test to check soft-delete (is_active=false) - Update holiday hours test to use new schema (weekday, is_open) - Add phone number validation tests for UK mobile numbers	2026-02-23 00:59:32 +00:00
popertots	970cc5554d	feat: add email verification, profile pictures, deposits, and calendar ... export Backend: - Add email verification code generation and verification endpoints - Add profile picture upload with S3 storage and image processing - Add deposit_required field to users with 48h advance booking requirement - Add loyalty stamps that accumulate on completed bookings - Auto-transition bookings: confirmed → in_progress → completed - Add booking cancellation handler with no-show detection - Add ICS calendar file download endpoint for bookings - Sync bookings to CalDAV on confirmation Frontend: - Add schedule page route - Add avatar and image-cropper UI components - Update shadcn-svelte components (button, dialog) - Add "Add to Calendar" button in booking modal Database: - Add verification_codes table - Add profile_pic_url, loyalty_stamps, deposits_required to users - Various schema updates	2026-02-21 18:48:29 +00:00
popertots	f536a7fd04	Fix booking count filters, add admin notifications, and improve bookings ... UI	2026-01-06 16:45:17 +00:00
popertots	708b741a32	Initial commit. Working login, example UI with prototype and demo, connections to DB and DAV, local and prod setups.	2025-10-12 22:13:19 +01:00