50 Commits

Include renames

Author	SHA1	Message	Date
popertots	faceb9809c	fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming ... Round-A fresh review (6 agents) + fix + secondary cross-cutting + verification rounds: - F1: campaign discounts reduce the charged amount (deposit credit + admin PaymentModal discounted total); capDiscountToRemainingObligation prevents over-credit at completion in all four campaign blocks - F2: sweep replay rescue distinguishes legitimate same-key retries (21h window) from expired-key new charges; ccof blind-fails leave pending + CRITICAL instead of clawing back - F3: post-start online overflow carved as a tip record (mirrors terminal split builder) - A1: single-source Square decline-code classification (till delegates to square.IsDefinitivePaymentError) - A2/A5: refund attempt-cap literals consolidated; refund-failure counter capped + reset on terminal resolutions + admin notifications - A3/A9: idempotency helpers adopted across derivations; IsExplicitDevOrMockEnv relocated + all gates unified (incl. health-check) - A7: 2FA user+IP limiter + TRUST_PROXY_HEADERS startup warning; SNAPSHOT_ENC_KEY startup validation; TWO_FACTOR_PEPPER docs corrected - A8: snapshot encryption on all 6 write sites + marker-aware reuse paths; MPV->SPV effective voucher type (single VAT point) - A10/A11/A12/A16: gift-card slot scan advances past failed; amount-aware refund reconciliation; completed-booking refund re-check; PaymentWasRefunded on SquareClient interface - Dedup refund revalidation on tip/terminal/gift-card paths; sweep acknowledged_at IS NULL parity; refund-notification single source (exported payments.InsertRefundFailedNotifications) - Duplication/modularisation round: shared frontend helpers (sanitizeDecimalInput, campaignDiscountCents, twoFactorBlocksSavedCards getter, generateUUID), single-source MaxIdempotencyKeyLength, notification-helper consolidation, snapshot-guard comments - Cross-cutting GBP rename: Cents->Pence across backend + frontend + tests (26 identifiers, 16 files) - Tests: 11 behavior-change tests updated to new invariants; coverage for fixed functions; frontend vitest 55 tests; docs corrected (test counts, 2FA delivery, pre-launch checklist, resolution status) - gitleaks: allowlist backend/internal/square test fixtures (mock idempotency keys) All 25 backend packages pass; frontend 55/55 + build clean; env-docs 41/41.	2026-08-22 00:34:50 +01:00
popertots	6d82535780	fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs ... Addresses the adversarial fresh-eyes audit (findings A1-A20) plus review-round fixes: - CRITICAL A1: replay-by-key rescue cross-checks replayed CreatedAt; ccof blind-fail leaves pending with CRITICAL + notification instead of clawing back - A2/A3/A4: till idempotency key restored to unconditional hash; tip rejected in CreateBookingPayment; campaign discount now reduces the charged amount (deposit credit) - A5: admin notifications on blind-fail, manual-refund re-arm, cap-stranded charge-group, webhook FAILED/REJECTED refunds - A6/A10: BuyGiftCard idempotency user-scoped; gift-card slot scan advances past failed rows - A7/A14/A15: 2FA user+IP limiter, SNAPSHOT_ENC_KEY startup validation, accurate pepper/log-delivery docs - A8/A9: snapshot encryption on all write+reuse sites; MPV->SPV effective voucher type (single VAT point) - A11/A12/A13/A16: amount-aware refund reconciliation; completed-booking refund re-validation; till retry dedup; PaymentWasRefunded on SquareClient interface - A17/A18/A19/A20: CI runs npm test; confirm_overflow_tip frontend dialog; unknown-event admin notification; mock token redaction - M7 ConfirmOverflowTip, M9 snapshot encryption, C1 discount ordering regression test - Frontend vitest framework (41 tests), backend coverage for fixed functions, docs corrected (2,269 tests, SUPPORT_EMAIL tokens, resolution status) All 25 backend packages pass; frontend 41/41; build + env-docs green.	2026-08-22 00:34:50 +01:00
popertots	8ae592d0c5	fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper	2026-07-11 17:38:50 +01:00
popertots	0afa642a10	fix: add 60% coverage minimum to CI, scope prettier to staged frontend files	2026-07-11 17:09:37 +01:00
popertots	4d87bf791f	fix: replace GO_TESTING with DAV_SKIP_INIT for DAV service initialization	2026-07-11 15:06:16 +01:00
popertots	d412dc3cc4	ci: frontend major deps always exits 0 (informational only)	2026-07-11 11:48:20 +01:00
popertots	0b5a6d23ce	ci: replace upload-artifact@v4 with inline coverage echo (not compatible with Gitea)	2026-07-11 11:23:23 +01:00
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertots	a4a80246d1	fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment ... - s3.go: restore error returns on prod Upload/Download/Delete stubs (silent nil was dangerous — callers would think writes succeeded) - CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env - handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal - validators.go: fix comment to include A-F (matched the regex)	2026-07-10 20:39:17 +01:00
popertots	e896591098	chore: upgrade npm deps — vite 8, prettier plugins, @types/node, @eslint/compat ... Upgrades applied: @types/node: 22.20.1 → 26.1.1 @eslint/compat: 1.4.1 → 2.1.0 prettier-plugin-tailwindcss: 0.7.4 → 0.8.0 prettier-plugin-svelte: 3.5.2 → 4.1.1 (formatted textarea.svelte) vite: 7.3.6 → 8.1.4 @sveltejs/vite-plugin-svelte: 6.2.4 → 7.2.0 Left at current (blocked by deps chain): eslint / @eslint/js — typescript-eslint needs eslint 10 support typescript — typescript-eslint needs TS 7 support Added CI TODO note for when vite-plugin-svelte-inspector catches up.	2026-07-10 20:03:41 +01:00
popertots	2cd35ea84a	fix: S3-dependent tests skip in prod, add GO_TESTING to CI for dav init	2026-07-10 18:45:18 +01:00
popertots	c0442d4ebd	ci: enable coverage on Tests (prod), remove unrealistic threshold, fix prettier	2026-07-10 13:18:23 +01:00
popertots	6fd3d13540	ci: install openssl for nginx dummy cert generation	2026-07-10 11:13:20 +01:00
popertots	f0c5f53f3f	ci: nginx needs dummy TLS certs, frontend major deps now visible ... - nginx-check: generate self-signed certs so nginx -t can resolve ssl_certificate paths without failing - frontend-deps-major: exit(1) when major updates found + continue- on-error: true so it shows as red/visible but doesn't block pipeline	2026-07-10 11:07:02 +01:00
popertots	5246ed3c64	ci: add hosts entries so nginx -t can resolve upstream service names	2026-07-10 11:00:20 +01:00
popertots	6f557257bb	ci: fix nginx http.d dir, golangci-lint timeout, frontend major deps parallel ... - nginx-check: Alpine's nginx package includes /etc/nginx/conf.d at MAIN level and /etc/nginx/http.d at HTTP level. Use http.d so that proxy_cache_path, limit_req_zone, and server blocks are valid. - golangci-lint: add --timeout 5m to prevent timeout on first run when Go module cache is cold and many deps must be downloaded - frontend-deps-major: remove needs dependency so it runs in parallel with frontend-deps (provides visibility even when deps check fails)	2026-07-10 10:53:53 +01:00
popertots	e0f072b593	ci: split dev/prod jobs, add non-blocking frontend major deps check ... Split 3 multi-step jobs into separate dev and prod jobs for clearer parallel execution: - go-vet → go-vet-dev + go-vet-prod - go-staticcheck → go-staticcheck-dev + go-staticcheck-prod - go-gosec → go-gosec-dev + go-gosec-prod Each split job runs independently with its own setup and cache key. Updated test/race needs to reference all split job names. Added frontend-deps-major job (warn-only, exit 0): - Detects major/out-of-range npm updates (wanted !== latest) - Non-blocking informational check alongside the existing blocking frontend-deps job that catches in-range updates	2026-07-10 10:45:29 +01:00
popertots	2a0b81e565	ci: mkdir before cp for nginx config validation	2026-07-10 10:37:59 +01:00
popertots	9e3c9323c3	ci: fix nginx config check cp path, add R2_ENDPOINT to .env.example ... - nginx-check: cp needs trailing filename when copying to a directory - .env.example: uncomment R2_ENDPOINT as an active variable so the env-docs-check script detects it as documented	2026-07-10 10:33:33 +01:00
popertots	3d5b9350bc	ci: install git for gitleaks, use nginx default config for validation ... - secrets-scan: install git before gitleaks (gitleaks needs git in PATH to scan the repository; the node:22-alpine3.21 container lacks it) - nginx-check: copy site config into /etc/nginx/conf.d/ and use 'nginx -t' with default config instead of constructing a custom one (avoids fastcgi_params resolution issues with relative includes)	2026-07-10 10:27:48 +01:00
popertots	fbb8837981	ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope ... - secrets-scan: gitleaks module path was renamed from github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8 - docker-compose-check: create backend/.env from .env.example before running docker compose config (env file required by compose.yml) - nginx: move limit_req_zone directives outside server block to http level, where nginx requires them	2026-07-10 10:22:32 +01:00
popertots	d073172670	ci: fix infra failures — install go/python3/docker/nginx in job containers ... Four CI jobs failed because the runner's node:22-alpine3.21 container lacked required tooling (Go, Python3, Docker CLI, nginx): - secrets-scan: add actions/setup-go@v5 before gitleaks install - env-docs-check: apk add python3 before running check script - docker-compose-check: apk add docker-cli docker-compose - nginx-check: install nginx locally, validate with minimal config	2026-07-10 10:16:01 +01:00
popertotsandSisyphus	9a96a7a8a1	ci: add prod-tag variants to staticcheck and gosec ... Both tools now run under test,dev and test,!dev tags, matching go-vet pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:50:21 +01:00
popertotsandSisyphus	f532b05e72	ci: set coverage threshold to 100%, govulncheck gated behind go-build ... Coverage check now requires 100% (fail on any uncovered line). govulncheck (vulns) now has needs: [go-build], placing it in the gate block alongside vet/lint/staticcheck/gosec. Test and race already depended on vulns, so the chain is: go-build → gate jobs (incl vulns) → test+race. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:44:47 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	b26bf14419	ci: svelte strict check runs after typecheck QC, not before ... frontend-svelte-strict now needs frontend-qc. QC gates on build+knip. Strict runs after QC completes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:05:20 +01:00
popertotsandSisyphus	d272eb7cfe	ci: restructure Go gate into separate jobs, add knip and svelte strict check ... Go: go-build gates three parallel jobs (go-vet, golangci-lint, go-mod-tidy) which gate test+race. Frontend: add knip (between deps and QC) and svelte-check --fail-on-warnings (after build). QC now gates on build, knip, and svelte strict. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:03:04 +01:00
popertotsandSisyphus	b11dee1c49	ci: add golangci-lint and go-mod-tidy to Go gate job ... Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:57:37 +01:00
popertotsandSisyphus	53b0507148	ci: run frontend-deps and frontend-build in parallel, both gate QC ... frontend-deps (dep staleness check) and frontend-build now run concurrently. frontend-qc waits for both. Removed (gate) from build job name. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:54:50 +01:00
popertotsandSisyphus	93883602d9	ci: extract frontend deps checks into separate gating job ... frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:52:53 +01:00
popertotsandSisyphus	2604f9ab0d	ci: add stale override detection to frontend build gate ... Parses npm explain output for each overridden package. If the parent's required range already satisfies the override target, flags it as stale — dev must remove the override. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:51:32 +01:00
popertotsandSisyphus	4b5d3640bb	ci: add dependency staleness check to frontend build gate ... After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:46:54 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	a17d6fd2e6	ci: fail npm audit on any vuln, not just high/critical ... Change audit-level from high to info so low and moderate findings also fail the CI step. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:35:23 +01:00
popertotsandSisyphus	29958620b6	ci: fix literal ${matrix.task} in step names (Gitea does not resolve them) ... Replace with static names. Job names still use matrix templates (those work). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:29:39 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	f59b7df97f	ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs ... 1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:07:17 +01:00
popertotsandSisyphus	7fd74dc65e	ci: bump Go from 1.25 to 1.25.12 to fix GO-2026-5856 ... govulncheck found crypto/tls vuln fixed in 1.25.12. Bump all 4 setup-go instances. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:03:45 +01:00
popertotsandSisyphus	0a73c07f09	ci: split frontend into build gate then parallel typecheck/lint/audit ... npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:02:21 +01:00
popertotsandSisyphus	e5f823eecd	ci: gate test and race behind both vet and vulns ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 16:58:18 +01:00
popertotsandSisyphus	8326b15e72	ci: split dev/prod test and race jobs into parallel matrix ... Extract Build & Vet into a separate gate job. Use matrix strategy for test and race jobs so dev and prod variants run concurrently after vet passes. Cache keys include label to avoid collisions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:15:25 +01:00
popertotsandSisyphus	f4969645c4	chore: update CI, DB init, and documentation ... Update CI workflow, PostgreSQL init script, README, and obsidian technical docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:18 +01:00
popertotsandSisyphus	d8dfad2b32	ci: add Go and npm dependency caching via actions/cache ... Add actions/cache@v4 to all four CI jobs. Go module cache (go/pkg/mod + go-build) keyed on go.sum for test, race, and vulns jobs. npm cache (~/.npm + node_modules) keyed on package-lock.json for frontend job. Cuts dependency download time to near-zero on cache hit. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:37:59 +01:00
popertots	a00ed3c283	ci: re-add test and race jobs alongside lint and vulns	2026-06-25 19:39:09 +01:00
popertots	82e6f75354	ci: split govulncheck and frontend checks into parallel jobs	2026-06-25 16:41:18 +01:00
popertots	c481400215	ci: strip to lint/vulns only, fix Post-step node toolcache ... Remove test and race jobs until lint + vulns are fully green. The node:22-alpine3.21 base image ships node at /usr/local/bin but actions/setup-node expects it in the toolcache at /opt/hostedtoolcache. Create a symlink so all Post-action cleanup steps (cache-save) find node and don't exit 255.	2026-06-25 14:05:57 +01:00
popertots	3f0155597a	ci: add CGO_ENABLED, build-base for race; auto-fix prettier before lint ... - Race job: install build-base (gcc) and set CGO_ENABLED=1 for Go's race detector on Alpine (requires cgo) - Quality job: run npm run format (prettier --write) before lint to auto-fix formatting issues instead of failing CI for style nits - Runner config on server updated to capacity: 8 (parallel jobs)	2026-06-25 13:15:15 +01:00
popertots	a4a475a07d	ci: fix quality job working-directory and adjust timeouts ... working-directory wasn't being honored for npm steps in the quality job. Switch to explicit cd frontend && commands. Reduce race timeout from 300s to 240s.	2026-06-25 13:03:50 +01:00
popertots	aa875339b5	ci: add race detector, govulncheck, and frontend quality jobs ... Three parallel jobs: - test: existing Go tests (unchanged) - race: Go tests with -race flag (catches data races) - quality: govulncheck + svelte-check + eslint/prettier (no PG needed) Race job has its own PG service container so all three can run in parallel.	2026-06-25 12:57:15 +01:00