4 Commits

Include renames

Author	SHA1	Message	Date
popertotsandSisyphus	2ba7b85d0b	feat: add OptionalAuth middleware and slot reservation endpoint ... OptionalAuth extracts user info from Bearer token if present, otherwise passes through without requiring authentication. ReserveSlotHandler creates temporary time_blockers reservations: - Logged-in users: max 1 active, 1hr TTL, tracked by user_id - Anonymous users: global cap of 50, 10min TTL, tracked by IP hash - Validates slot availability (working hours, booking overlap, blocker overlap) - Returns reservation ID, start_time, duration, and expires_at Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-04-29 22:56:53 +01:00
popertots	b4d91d5dc0	Security pass	2026-02-20 12:59:10 +00:00
popertots	f9eec94f2f	Security: add rate limiting, input validation, and filter category ... validation Backend: - Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP limiter - Apply rate limits per endpoint group: - Public read-only: 120/min - Registration: 10/min - Portfolio filters: 60/min - Authenticated users: 120/min - Admin: none (trusted) - Add 256 char input length validation on portfolio endpoints - Validate filter categories exist in DB before querying - Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20 digits) - Remove pattern-based image lookup to prevent enumeration - Add services validation: name (100), duration (1-480), patch test (0-168) Frontend: - Add maxlength=256 to portfolio tag/search inputs - Add maxlength to registration: name (50), email (255), phone (20), password (72) - Add maxlength=100 to service name input	2026-02-20 12:03:05 +00:00
popertots	708b741a32	Initial commit. Working login, example UI with prototype and demo, connections to DB and DAV, local and prod setups.	2025-10-12 22:13:19 +01:00