100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertots	a4a80246d1	fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment ... - s3.go: restore error returns on prod Upload/Download/Delete stubs (silent nil was dangerous — callers would think writes succeeded) - CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env - handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal - validators.go: fix comment to include A-F (matched the regex)	2026-07-10 20:39:17 +01:00
popertots	e896591098	chore: upgrade npm deps — vite 8, prettier plugins, @types/node, @eslint/compat ... Upgrades applied: @types/node: 22.20.1 → 26.1.1 @eslint/compat: 1.4.1 → 2.1.0 prettier-plugin-tailwindcss: 0.7.4 → 0.8.0 prettier-plugin-svelte: 3.5.2 → 4.1.1 (formatted textarea.svelte) vite: 7.3.6 → 8.1.4 @sveltejs/vite-plugin-svelte: 6.2.4 → 7.2.0 Left at current (blocked by deps chain): eslint / @eslint/js — typescript-eslint needs eslint 10 support typescript — typescript-eslint needs TS 7 support Added CI TODO note for when vite-plugin-svelte-inspector catches up.	2026-07-10 20:03:41 +01:00
popertots	609a099677	fix: data races in Square mock and scheduler hostname tests ... - square_dev.go: return a copy of CheckoutResult to the caller instead of sharing the map-stored pointer, preventing the goroutine from racing with the caller on Status field reads - scheduler_test.go: remove t.Parallel from TestInitHostname_* tests which modify a shared package-level hostname variable	2026-07-10 19:10:31 +01:00
popertots	2cd35ea84a	fix: S3-dependent tests skip in prod, add GO_TESTING to CI for dav init	2026-07-10 18:45:18 +01:00
popertots	cbaed41056	fix: restrict user_coverage_test build to test && dev	2026-07-10 18:24:39 +01:00
popertots	3029fd5179	test: add coverage tests across backend + fix mock for PENDING checkout support ... New test files cover previously untested paths across DAV, validators, S3, Square, mw, bookings, user, and payments packages. Includes mock fix: HoldCheckouts flag on MockClient allows tests to pause auto-complete goroutine for testing PENDING checkout states. Coverage: 50.4% → 65.0% (+14.6pp)	2026-07-10 18:13:44 +01:00
popertots	c0442d4ebd	ci: enable coverage on Tests (prod), remove unrealistic threshold, fix prettier	2026-07-10 13:18:23 +01:00
popertots	990c86495c	fix: suppress unused nonDepositPaymentType in prod-staticcheck	2026-07-10 13:00:33 +01:00
popertots	3d337b61b8	fix: remove t.Parallel from VAT tests to eliminate deadlock flakiness	2026-07-10 12:49:57 +01:00
popertots	19d1d8dd47	fix: correct prop names in Svelte templates after a11y cleanup	2026-07-10 12:27:08 +01:00
popertots	bee2ce81e6	fix: resolve remaining staticcheck SA4006 and gosec G120 issues	2026-07-10 12:25:29 +01:00
popertots	0c91482aac	fix: adjust upload limits to 20MB profile, 30MB portfolio	2026-07-10 12:25:25 +01:00
popertots	9ea929901a	fix: exclude RefreshToken from JSON response (G117)	2026-07-10 12:09:54 +01:00
popertots	cb09020b0d	fix: add http.Server timeouts to mitigate Slowloris (G112)	2026-07-10 12:08:08 +01:00
popertots	6599ef85fd	fix: suppress false positive G304 (hardcoded paths in test utility)	2026-07-10 12:07:11 +01:00
popertots	3a9bc02796	fix: check ParseMultipartForm errors, reduce maxMemory, handle 413 properly	2026-07-10 12:06:12 +01:00
popertots	ef3cfe8c4f	fix: replace crypto/md5 with crypto/sha256 for IP hashing	2026-07-10 12:04:49 +01:00
popertots	d1e85bb855	fix: add missing err checks and fix loop termination in tests	2026-07-10 12:03:11 +01:00
popertots	cf0cd8de15	fix: remove 10 unused test functions flagged by staticcheck U1000	2026-07-10 12:01:02 +01:00
popertots	eed8814021	fix: remove unused variables from Svelte components	2026-07-10 11:58:42 +01:00
popertots	895d7f0df9	chore: update shadcn-svelte from 1.4.0 to 1.4.1	2026-07-10 11:20:35 +01:00
popertots	6fd3d13540	ci: install openssl for nginx dummy cert generation	2026-07-10 11:13:20 +01:00
popertots	f0c5f53f3f	ci: nginx needs dummy TLS certs, frontend major deps now visible ... - nginx-check: generate self-signed certs so nginx -t can resolve ssl_certificate paths without failing - frontend-deps-major: exit(1) when major updates found + continue- on-error: true so it shows as red/visible but doesn't block pipeline	2026-07-10 11:07:02 +01:00
popertots	5246ed3c64	ci: add hosts entries so nginx -t can resolve upstream service names	2026-07-10 11:00:20 +01:00
popertots	6f557257bb	ci: fix nginx http.d dir, golangci-lint timeout, frontend major deps parallel ... - nginx-check: Alpine's nginx package includes /etc/nginx/conf.d at MAIN level and /etc/nginx/http.d at HTTP level. Use http.d so that proxy_cache_path, limit_req_zone, and server blocks are valid. - golangci-lint: add --timeout 5m to prevent timeout on first run when Go module cache is cold and many deps must be downloaded - frontend-deps-major: remove needs dependency so it runs in parallel with frontend-deps (provides visibility even when deps check fails)	2026-07-10 10:53:53 +01:00
popertots	e0f072b593	ci: split dev/prod jobs, add non-blocking frontend major deps check ... Split 3 multi-step jobs into separate dev and prod jobs for clearer parallel execution: - go-vet → go-vet-dev + go-vet-prod - go-staticcheck → go-staticcheck-dev + go-staticcheck-prod - go-gosec → go-gosec-dev + go-gosec-prod Each split job runs independently with its own setup and cache key. Updated test/race needs to reference all split job names. Added frontend-deps-major job (warn-only, exit 0): - Detects major/out-of-range npm updates (wanted !== latest) - Non-blocking informational check alongside the existing blocking frontend-deps job that catches in-range updates	2026-07-10 10:45:29 +01:00
popertots	2a0b81e565	ci: mkdir before cp for nginx config validation	2026-07-10 10:37:59 +01:00
popertots	9e3c9323c3	ci: fix nginx config check cp path, add R2_ENDPOINT to .env.example ... - nginx-check: cp needs trailing filename when copying to a directory - .env.example: uncomment R2_ENDPOINT as an active variable so the env-docs-check script detects it as documented	2026-07-10 10:33:33 +01:00
popertots	3d5b9350bc	ci: install git for gitleaks, use nginx default config for validation ... - secrets-scan: install git before gitleaks (gitleaks needs git in PATH to scan the repository; the node:22-alpine3.21 container lacks it) - nginx-check: copy site config into /etc/nginx/conf.d/ and use 'nginx -t' with default config instead of constructing a custom one (avoids fastcgi_params resolution issues with relative includes)	2026-07-10 10:27:48 +01:00
popertots	fbb8837981	ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope ... - secrets-scan: gitleaks module path was renamed from github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8 - docker-compose-check: create backend/.env from .env.example before running docker compose config (env file required by compose.yml) - nginx: move limit_req_zone directives outside server block to http level, where nginx requires them	2026-07-10 10:22:32 +01:00
popertots	d073172670	ci: fix infra failures — install go/python3/docker/nginx in job containers ... Four CI jobs failed because the runner's node:22-alpine3.21 container lacked required tooling (Go, Python3, Docker CLI, nginx): - secrets-scan: add actions/setup-go@v5 before gitleaks install - env-docs-check: apk add python3 before running check script - docker-compose-check: apk add docker-cli docker-compose - nginx-check: install nginx locally, validate with minimal config	2026-07-10 10:16:01 +01:00
popertotsandSisyphus	cbede4c267	hooks: add staticcheck, gosec, go mod tidy, and gitleaks to pre-commit ... Pre-commit now runs: prettier, eslint, go vet, staticcheck, gosec, go mod tidy check, and gitleaks (if installed). Matches the expanded CI pipeline. gitleaks is optional locally (skips gracefully if not installed). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:58:44 +01:00
popertotsandSisyphus	9a96a7a8a1	ci: add prod-tag variants to staticcheck and gosec ... Both tools now run under test,dev and test,!dev tags, matching go-vet pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:50:21 +01:00
popertotsandSisyphus	f532b05e72	ci: set coverage threshold to 100%, govulncheck gated behind go-build ... Coverage check now requires 100% (fail on any uncovered line). govulncheck (vulns) now has needs: [go-build], placing it in the gate block alongside vet/lint/staticcheck/gosec. Test and race already depended on vulns, so the chain is: go-build → gate jobs (incl vulns) → test+race. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:44:47 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	49ee167d69	chore: add missing env vars to .env.example ... Add 11 previously undocumented env vars: TEST_DB_HOST, TEST_DB_DSN, GO_TESTING, SQUARE_WEBHOOK_NOTIFICATION_URL, DAV_BASE_URL, DAV_ADMIN_PASSWORD, NO_COLOR, VITE_BACKEND_URL, RUSTFS_* Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:31:28 +01:00
popertotsandSisyphus	0668438ab0	fix: knip clean — delete remaining dead map files, add knip config, unexport internal types ... Delete 6 unused map components and use-map.svelte.ts hook. Create knip.json to handle worker entry points and dynamic imports. Unexport UserRole/DecodedToken types (only used internally). Remove resolved ignoreDependencies entries. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:45:14 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	9e6c415cc4	fix: run go mod tidy to sync go.sum after golangci-lint changes ... 2 stale checksum entries removed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:54:01 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	b26bf14419	ci: svelte strict check runs after typecheck QC, not before ... frontend-svelte-strict now needs frontend-qc. QC gates on build+knip. Strict runs after QC completes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:05:20 +01:00
popertotsandSisyphus	d272eb7cfe	ci: restructure Go gate into separate jobs, add knip and svelte strict check ... Go: go-build gates three parallel jobs (go-vet, golangci-lint, go-mod-tidy) which gate test+race. Frontend: add knip (between deps and QC) and svelte-check --fail-on-warnings (after build). QC now gates on build, knip, and svelte strict. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:03:04 +01:00
popertotsandSisyphus	b11dee1c49	ci: add golangci-lint and go-mod-tidy to Go gate job ... Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:57:37 +01:00
popertotsandSisyphus	53b0507148	ci: run frontend-deps and frontend-build in parallel, both gate QC ... frontend-deps (dep staleness check) and frontend-build now run concurrently. frontend-qc waits for both. Removed (gate) from build job name. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:54:50 +01:00
popertotsandSisyphus	93883602d9	ci: extract frontend deps checks into separate gating job ... frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:52:53 +01:00
popertotsandSisyphus	2604f9ab0d	ci: add stale override detection to frontend build gate ... Parses npm explain output for each overridden package. If the parent's required range already satisfies the override target, flags it as stale — dev must remove the override. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:51:32 +01:00
popertotsandSisyphus	4b5d3640bb	ci: add dependency staleness check to frontend build gate ... After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:46:54 +01:00
popertotsandSisyphus	96410c9f18	chore: remove minimatch override (no longer needed), keep cookie override (SvelteKit pinned dep) ... npm update resolved minimatch transitively. cookie still pinned via override because SvelteKit <= 2.69.2 depends on vulnerable cookie < 0.7.0. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:44:34 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	a17d6fd2e6	ci: fail npm audit on any vuln, not just high/critical ... Change audit-level from high to info so low and moderate findings also fail the CI step. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:35:23 +01:00
popertotsandSisyphus	29958620b6	ci: fix literal ${matrix.task} in step names (Gitea does not resolve them) ... Replace with static names. Job names still use matrix templates (those work). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:29:39 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	f59b7df97f	ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs ... 1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:07:17 +01:00
popertotsandSisyphus	7fd74dc65e	ci: bump Go from 1.25 to 1.25.12 to fix GO-2026-5856 ... govulncheck found crypto/tls vuln fixed in 1.25.12. Bump all 4 setup-go instances. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:03:45 +01:00
popertotsandSisyphus	0a73c07f09	ci: split frontend into build gate then parallel typecheck/lint/audit ... npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:02:21 +01:00
popertotsandSisyphus	e5f823eecd	ci: gate test and race behind both vet and vulns ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 16:58:18 +01:00
popertotsandSisyphus	8326b15e72	ci: split dev/prod test and race jobs into parallel matrix ... Extract Build & Vet into a separate gate job. Use matrix strategy for test and race jobs so dev and prod variants run concurrently after vet passes. Cache keys include label to avoid collisions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:15:25 +01:00
popertotsandSisyphus	f4969645c4	chore: update CI, DB init, and documentation ... Update CI workflow, PostgreSQL init script, README, and obsidian technical docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:18 +01:00
popertotsandSisyphus	27be7cea91	refactor: wire centralized job scheduler and custom request logging in main.go ... Replace inline cleanup goroutines and default chi logger with centralized jobs scheduler and custom colored request logger. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:09 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	a4fa75154d	refactor: centralize scheduling cleanup with row-count returns ... Convert all scheduling cleanup functions to return (int, error). Remove inline cleanup calls from GetAvailableHours. Add scheduled-cleanup.go for centralized job wrappers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:51 +01:00
popertotsandSisyphus	6064a06b7d	refactor: extract shared rate limiter types into ratelimit_shared.go ... Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:43 +01:00
popertotsandSisyphus	f78489ae00	feat: add logutil and jobs internal packages ... Add centralized jobs scheduler and logutil package with ANSI colors and duration formatting. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:34 +01:00
popertotsandSisyphus	72161e8c4f	docs(backend): clarify auth fallback rationale in reserve handler ... Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:08 +01:00
popertotsandSisyphus	e303c07f8d	refactor(backend): replace inline Bearer parsing with OptionalAuth middleware in services ... Removes the inline Bearer token fallback in ServicesHandler — the OptionalAuth middleware (added to the public services route group in main.go) now handles auth context population. This eliminates duplicated token parsing logic and ensures consistent auth behavior across all routes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:00 +01:00
popertotsandSisyphus	92124158bf	feat(frontend): add apiFetch wrapper for automatic auth token injection ... Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:21:34 +01:00
popertots	e831953e5b	fix(ui): improve reservation lifecycle in BookingFlow ... - Release reservation on service change, date change, and step-back navigation - Add synchronous double-click payment guard (isProcessingPaymentSync) - Immutable update for confirmedBooking to prevent race-condition overcharge - Generate fresh idempotency key per submission attempt (was reused across component lifetime, causing stale-booking illusion on re-submit) - Release reservation after successful booking submission - Extract releaseReservation() helper for DRY reservation cleanup - Race-condition guard in selectTimeWithValidation: pass clicked time explicitly so stale validation can't clobber a newer selection	2026-07-06 17:58:14 +01:00
popertots	98d561e8b6	docs: update API docs and test counts for admin cancel ... Update README and obsidian documentation with the new admin reservation cancel endpoint (DELETE /api/admin/bookings/reserve), updated API route tables, reservation TTL descriptions, and test count from 1,180 to 1,198.	2026-07-06 17:58:08 +01:00
popertots	c2aa0b93cb	feat(api): add admin reservation cancel endpoint ... Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations. New handler AdminCancelReservationHandler targets only RESERVATION:admin:% entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes 12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx, walkin+callin coexistence, anon untouched, response format parity, overlapping reservations deleted, user reservations untouched, and idempotent double-cancel. Inverse-isolation tests in cancel_reservation_test.go prove the user-side DELETE /api/bookings/reserve does not touch admin or anon reservations.	2026-07-06 17:58:03 +01:00
popertotsandSisyphus	1c09e4220b	fix: run eslint on every commit and restore gdpr navigation eslint-disable ... Pre-commit hook now runs eslint on all frontend files regardless of what's staged, catching pre-existing issues. Restore the necessary eslint-disable in gdpr page for the async goto call. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:43:48 +01:00
popertotsandSisyphus	878624e6f2	fix: resolve eslint warnings and error ... Remove unused eslint-disable directives in BookingCreateModal and GDPR page. Rename isMobile to _isMobile to match allowed unused vars pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:39:55 +01:00
popertotsandSisyphus	27f1f6f5cc	chore: add pre-commit hook with auto-format and lint checks ... Pre-commit hook runs prettier --write on staged frontend files, re-stages them, then checks eslint and go vet. Blocks the commit if eslint or vet fails. Stored in .githooks/ (version controlled) — enable with: git config core.hooksPath .githooks Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:37:08 +01:00
popertotsandSisyphus	9c0b189b73	style: fix prettier formatting in 3 admin files ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:30:42 +01:00
popertotsandSisyphus	5f1f6c4b44	style: standardise select styling in DiscountsManagement, HolidayHours, TodayCalendar ... Update select element classes to consistent h-9, shadow-xs, bg-background, focus-visible ring styling. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:38 +01:00
popertotsandSisyphus	5616357269	style: standardise input styling in booking create, business settings, custom services, patch test, walk-in create ... Update input element classes to consistent h-9, py-1, shadow-xs, focus-visible border-ring with ring-[3px] and ring-ring/50 for visual consistency across admin components. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:28 +01:00
popertotsandSisyphus	b7fa22b018	refactor: accept defaultHours prop in WeeklySchedule and TimeBlockers ... Add optional defaultHours prop to accept pre-fetched data from parent page. Standardise select element styling with shadow-xs, focus-visible ring, and consistent padding. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:18 +01:00
popertotsandSisyphus	56eda0ead5	refactor: accept services prop in PatchTestsManagement and ServicesManagement ... Add optional services prop so the page can pass pre-fetched data, avoiding duplicate API calls. Fall back to self-fetching when prop is not provided. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:08 +01:00
popertotsandSisyphus	42c3b65a27	feat: add collapsible sections and lifted data fetching to admin page ... Add independently toggleable collapsible sections for scheduling, customers, services, promotions, settings. Lift services and default-hours fetching to page level to avoid duplicate API calls. Add responsive breakpoint detection — sections default expanded on desktop, collapsed on mobile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:25:49 +01:00
popertotsandSisyphus	b1b6607ca1	docs: note caching speed improvement in README ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:50:25 +01:00
popertotsandSisyphus	016d302212	docs: document CI caching setup in README ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:45:36 +01:00
popertotsandSisyphus	d8dfad2b32	ci: add Go and npm dependency caching via actions/cache ... Add actions/cache@v4 to all four CI jobs. Go module cache (go/pkg/mod + go-build) keyed on go.sum for test, race, and vulns jobs. npm cache (~/.npm + node_modules) keyed on package-lock.json for frontend job. Cuts dependency download time to near-zero on cache hit. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:37:59 +01:00
popertotsandSisyphus	1c1fc6a921	docs: update README and obsidian docs with reservation improvements ... Document self-blocking prevention (excludeUserID), explicit reservation cancellation endpoint, background cleanup goroutine, and edit_request reservation scrubbing. Bump test counts from 1,169 to 1,180 and package count from 19 to 20. Add race detector command to README. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:47 +01:00
popertotsandSisyphus	be22710f7b	test: add scheduling excludeUserID integration test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:40 +01:00
popertotsandSisyphus	2e0760f083	feat: add IP-based anon reservation cleanup to admin reserve handler ... Extend AdminReserveSlotHandler's pre-overlap DELETE to also clean up anonymous RESERVATION:anon entries matching the admin's IP address. This handles the edge case where an admin previously reserved a slot without authentication. Also reorganise imports to follow goimports conventions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:33 +01:00
popertotsandSisyphus	cc6ad7f00f	fix: remove t.Parallel from VAT lifecycle test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:12 +01:00
popertotsandSisyphus	30c9012562	fix: move dav.Service init from auth_test to user testmain ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:09 +01:00
popertotsandSisyphus	4879ca5a82	style: format multi-line expressions in BookingFlow.svelte ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 12:00:09 +01:00
popertotsandSisyphus	e642b0fa3e	fix: move BookingFlow window type to app.d.ts and fix authHeaders typing ... Move __bookingFlowCountdownInterval from inline declare global in BookingFlow.svelte to global app.d.ts. Fix authHeaders type from {} to undefined to satisfy TypeScript. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:55:45 +01:00
popertotsandSisyphus	69ae3e1f99	chore: bump golang.org/x/image from v0.42.0 to v0.43.0 ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:55:39 +01:00
popertotsandSisyphus	2069a99f8c	feat: improve booking flow with auth headers and reservation release ... Send auth token in reserve/availability/working-hours requests so the backend can exclude the user's own reservations. Cancel old reservation via DELETE before reserving a new slot. Track reserved slot time/date for back-navigate detection. Clean up countdown interval via onDestroy and window reference to prevent duplicates. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:48:14 +01:00
popertotsandSisyphus	296a67770e	fix: resolve RLock deadlock in Square mock client ... Move m.mu.RUnlock to defer in GetCheckout and remove duplicate RLock/RUnlock around m.completed lookup. This prevents a deadlock when CheckoutPending error is returned but the RLock was already released. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:48:04 +01:00
popertotsandSisyphus	33c945159c	feat: add cancel reservation handler and background cleanup ... Add CancelReservationHandler (DELETE /api/bookings/reserve) to release authenticated user's active reservation. Register route in main.go. Add background goroutine for periodic reservation cleanup using CleanupOldReservations. Add idx_time_blockers_created_at index and extend anon cleanup to cover edit_request reservations in init-script.sql. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:47:54 +01:00
popertotsandSisyphus	2386bd0ca2	test: add tests for reservation self-block prevention ... Add TestReserveSlot_DoesNotSelfBlock, TestAdminReserveSlot_DoesNotSelfBlock and TestReserveSlot_CleansUpAnonReservation. Add UserIDKey context to admin approve edit request tests. Remove weekend-day adjustment in TestAdminApproveEditRequest_OverlapWithBooking_Regression and TestAdminApproveEditRequest_EvictsPendingRelease (no longer needed). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:47:43 +01:00
popertotsandSisyphus	c1a9f35ea5	feat: prevent reservation self-block in booking handlers ... Pass excludeUserID to CheckTimeBlockerOverlap in AdminReserveSlotHandler, CreateBookingHandler, EditBookingHandler, AdminRescheduleBookingHandler, AdminCreateBookingForUserHandler, AdminApproveEditRequestHandler, and ReserveSlotHandler. Also clean up stale reservations before overlap check in AdminReserveSlotHandler and ReserveSlotHandler via db.Conn.Exec for cross-connection visibility. Improve error handling in RequestEditHandler's service update block. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:45:02 +01:00
popertotsandSisyphus	920eb761fd	feat: add excludeUserID param to scheduling time blockers ... Add optional excludeUserID parameter to GetTimeBlockersInRange and CheckTimeBlockerOverlap so a user's own RESERVATION entries are excluded from overlap checks. This prevents users from self-blocking on their existing reservation when checking availability or confirming a booking. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:44:52 +01:00
popertots	a00ed3c283	ci: re-add test and race jobs alongside lint and vulns	2026-06-25 19:39:09 +01:00
popertots	34147f87ab	fix: add inline eslint-disable inside handleGotoAccount function	2026-06-25 18:55:39 +01:00