345 Commits

Include renames

Author	SHA1	Message	Date
popertots	7a51bcc49a	fix: JTI revocation returns error, LogoutHandler returns 500 on failure	2026-07-11 14:35:34 +01:00
popertots	b549014a68	fix: add nolint:errcheck to AdminGetInProgressBookingHandler json.Encode	2026-07-11 13:30:09 +01:00
popertots	28620f69a5	fix: restore dead functions properly, match test expectations, fix vet/lint	2026-07-11 13:23:27 +01:00
popertots	a3c0be2890	fix: audit nolint:errcheck — fix dangerous suppression patterns	2026-07-11 12:57:41 +01:00
popertots	19be37171b	fix: remove 3 dead code blocks (UserCancelBookingHandler, AdminGetInProgressBookingHandler, processImage)	2026-07-11 12:51:42 +01:00
popertots	844df4c127	fix: use raw clock.Now()+40h for booking test times (avoids time-sensitive boundaries)	2026-07-11 10:35:59 +01:00
popertots	abd53baf35	fix: time-sensitive tests use savepoint pattern, avoid 48h auto-approval boundary	2026-07-11 10:14:12 +01:00
popertots	ae2acc45c3	chore: bump eslint 9.39.4 -> 9.39.5	2026-07-11 00:31:40 +01:00
popertots	de37b07233	fix: use savepoint pattern for today test (matches other tests in file)	2026-07-11 00:26:14 +01:00
popertots	fe47cb486a	fix: replace 3.5s sleep with poll loop in till checkout test	2026-07-10 20:53:42 +01:00
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertots	a4a80246d1	fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment ... - s3.go: restore error returns on prod Upload/Download/Delete stubs (silent nil was dangerous — callers would think writes succeeded) - CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env - handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal - validators.go: fix comment to include A-F (matched the regex)	2026-07-10 20:39:17 +01:00
popertots	2cd35ea84a	fix: S3-dependent tests skip in prod, add GO_TESTING to CI for dav init	2026-07-10 18:45:18 +01:00
popertots	cbaed41056	fix: restrict user_coverage_test build to test && dev	2026-07-10 18:24:39 +01:00
popertots	3029fd5179	test: add coverage tests across backend + fix mock for PENDING checkout support ... New test files cover previously untested paths across DAV, validators, S3, Square, mw, bookings, user, and payments packages. Includes mock fix: HoldCheckouts flag on MockClient allows tests to pause auto-complete goroutine for testing PENDING checkout states. Coverage: 50.4% → 65.0% (+14.6pp)	2026-07-10 18:13:44 +01:00
popertots	990c86495c	fix: suppress unused nonDepositPaymentType in prod-staticcheck	2026-07-10 13:00:33 +01:00
popertots	3d337b61b8	fix: remove t.Parallel from VAT tests to eliminate deadlock flakiness	2026-07-10 12:49:57 +01:00
popertots	19d1d8dd47	fix: correct prop names in Svelte templates after a11y cleanup	2026-07-10 12:27:08 +01:00
popertots	0c91482aac	fix: adjust upload limits to 20MB profile, 30MB portfolio	2026-07-10 12:25:25 +01:00
popertots	9ea929901a	fix: exclude RefreshToken from JSON response (G117)	2026-07-10 12:09:54 +01:00
popertots	3a9bc02796	fix: check ParseMultipartForm errors, reduce maxMemory, handle 413 properly	2026-07-10 12:06:12 +01:00
popertots	ef3cfe8c4f	fix: replace crypto/md5 with crypto/sha256 for IP hashing	2026-07-10 12:04:49 +01:00
popertots	d1e85bb855	fix: add missing err checks and fix loop termination in tests	2026-07-10 12:03:11 +01:00
popertots	cf0cd8de15	fix: remove 10 unused test functions flagged by staticcheck U1000	2026-07-10 12:01:02 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	a4fa75154d	refactor: centralize scheduling cleanup with row-count returns ... Convert all scheduling cleanup functions to return (int, error). Remove inline cleanup calls from GetAvailableHours. Add scheduled-cleanup.go for centralized job wrappers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:51 +01:00
popertotsandSisyphus	72161e8c4f	docs(backend): clarify auth fallback rationale in reserve handler ... Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:08 +01:00
popertotsandSisyphus	e303c07f8d	refactor(backend): replace inline Bearer parsing with OptionalAuth middleware in services ... Removes the inline Bearer token fallback in ServicesHandler — the OptionalAuth middleware (added to the public services route group in main.go) now handles auth context population. This eliminates duplicated token parsing logic and ensures consistent auth behavior across all routes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:00 +01:00
popertots	c2aa0b93cb	feat(api): add admin reservation cancel endpoint ... Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations. New handler AdminCancelReservationHandler targets only RESERVATION:admin:% entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes 12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx, walkin+callin coexistence, anon untouched, response format parity, overlapping reservations deleted, user reservations untouched, and idempotent double-cancel. Inverse-isolation tests in cancel_reservation_test.go prove the user-side DELETE /api/bookings/reserve does not touch admin or anon reservations.	2026-07-06 17:58:03 +01:00
popertotsandSisyphus	be22710f7b	test: add scheduling excludeUserID integration test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:40 +01:00
popertotsandSisyphus	2e0760f083	feat: add IP-based anon reservation cleanup to admin reserve handler ... Extend AdminReserveSlotHandler's pre-overlap DELETE to also clean up anonymous RESERVATION:anon entries matching the admin's IP address. This handles the edge case where an admin previously reserved a slot without authentication. Also reorganise imports to follow goimports conventions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:33 +01:00
popertotsandSisyphus	cc6ad7f00f	fix: remove t.Parallel from VAT lifecycle test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:12 +01:00
popertotsandSisyphus	30c9012562	fix: move dav.Service init from auth_test to user testmain ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:09 +01:00
popertotsandSisyphus	33c945159c	feat: add cancel reservation handler and background cleanup ... Add CancelReservationHandler (DELETE /api/bookings/reserve) to release authenticated user's active reservation. Register route in main.go. Add background goroutine for periodic reservation cleanup using CleanupOldReservations. Add idx_time_blockers_created_at index and extend anon cleanup to cover edit_request reservations in init-script.sql. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:47:54 +01:00
popertotsandSisyphus	2386bd0ca2	test: add tests for reservation self-block prevention ... Add TestReserveSlot_DoesNotSelfBlock, TestAdminReserveSlot_DoesNotSelfBlock and TestReserveSlot_CleansUpAnonReservation. Add UserIDKey context to admin approve edit request tests. Remove weekend-day adjustment in TestAdminApproveEditRequest_OverlapWithBooking_Regression and TestAdminApproveEditRequest_EvictsPendingRelease (no longer needed). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:47:43 +01:00
popertotsandSisyphus	c1a9f35ea5	feat: prevent reservation self-block in booking handlers ... Pass excludeUserID to CheckTimeBlockerOverlap in AdminReserveSlotHandler, CreateBookingHandler, EditBookingHandler, AdminRescheduleBookingHandler, AdminCreateBookingForUserHandler, AdminApproveEditRequestHandler, and ReserveSlotHandler. Also clean up stale reservations before overlap check in AdminReserveSlotHandler and ReserveSlotHandler via db.Conn.Exec for cross-connection visibility. Improve error handling in RequestEditHandler's service update block. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:45:02 +01:00
popertotsandSisyphus	920eb761fd	feat: add excludeUserID param to scheduling time blockers ... Add optional excludeUserID parameter to GetTimeBlockersInRange and CheckTimeBlockerOverlap so a user's own RESERVATION entries are excluded from overlap checks. This prevents users from self-blocking on their existing reservation when checking availability or confirming a booking. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 11:44:52 +01:00
popertots	766b5b7dbd	fix(vat): resolve non-deterministic ORDER BY in TestVAT_ToggleLifecycle ... The phase 3 payment query used ORDER BY created_at DESC LIMIT 1. Within a single transaction, NOW() returns the same timestamp for all inserts, making the ordering non-deterministic when other parallel tests insert payment rows with the same timestamp. Fix by parsing the response's payment ID and querying by it directly. Also revert eslint.config.js back to error-level rules for all categories (removing the previous 'warn' overrides).	2026-06-25 14:12:48 +01:00
popertotsandSisyphus	e4b9003439	refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns ... Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:50 +01:00
popertotsandSisyphus	7b24f8e484	refactor(payments): integrate VAT into gift card buy flow and wrap in transactions ... Refactor BuyGiftCard to insert pending payment before Square call with VAT applied. Add transaction wrapping to gift card handlers. Remove redundant Content-Type header sets. Migrate all time.Now() to clock.Now(). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:40 +01:00
popertotsandSisyphus	40bbd9ba49	refactor(bookings): migrate remaining handlers and tests to clock.Now() ... Replace time.Now() with clock.Now() in bookings handlers and all test files. Includes deposit, discount, dedup, overlap, and edit request test updates. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:32 +01:00
popertotsandSisyphus	0ea1bb64b4	feat(bookings): add closing_time validation and repo layer ... Extract closing hours check into reusable checkClosingHours helper. Add repo.go for shared DB query helpers. Update admin_reserve to use closing_time and move overlap check inside transaction with FOR UPDATE. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:23 +01:00
popertotsandSisyphus	37a9ba3517	fix(bookings): use transaction context for discount check in approve edit ... Use tx.QueryRow instead of db.Conn.QueryRow for discount count check in AdminApproveEditRequestHandler to ensure consistency within the transaction. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:06:18 +01:00
popertotsandSisyphus	80b9877686	feat(api): add public business info route and TotalVATCollected to daily summary ... Expose GET /business-info public endpoint for non-admin users. Add TotalVATCollected field to DailySummary and compute it in the aggregate query. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:06:12 +01:00
popertotsandSisyphus	7756f3af96	test(scheduling): add exhaustive blocker, gap, and cross-day tests ... Add comprehensive time blocker tests: multiple blockers, blocker+booking combination, all-day, non-overlapping, multi-day, boundary start/end, out-of-hours, recurring (cron), reservation, overlapping, adjacent, cross-day midnight, closed days, exceptional hours. Add subtractTimeSlots and normalizeTime unit tests. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:06:05 +01:00
popertotsandSisyphus	edc7d833ea	refactor(scheduling): split multi-day blockers and normalize time strings ... Split multi-day time blockers into per-day segments for subtractTimeSlots. Add normalizeTime helper to strip seconds from HH:MM:SS for consistent comparison. Subtract blockers for all users (not just non-admin) to prevent 409 errors on reserve. Move late-night lock logic to separate block. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:05:58 +01:00
popertotsandSisyphus	9d70d42bd4	test(admin): add settings validation, public info, and out_of_hours tests ... Add comprehensive tests for business settings validation (name length, phone, email, VAT number, URL, voucher type, VAT rate). Add GetPublicBusinessInfo tests verifying correct JSON shape. Add out_of_hours field search tests for admin booking search. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:05:52 +01:00