573 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
popertots	6f557257bb	ci: fix nginx http.d dir, golangci-lint timeout, frontend major deps parallel ... - nginx-check: Alpine's nginx package includes /etc/nginx/conf.d at MAIN level and /etc/nginx/http.d at HTTP level. Use http.d so that proxy_cache_path, limit_req_zone, and server blocks are valid. - golangci-lint: add --timeout 5m to prevent timeout on first run when Go module cache is cold and many deps must be downloaded - frontend-deps-major: remove needs dependency so it runs in parallel with frontend-deps (provides visibility even when deps check fails)	2026-07-10 10:53:53 +01:00
popertots	e0f072b593	ci: split dev/prod jobs, add non-blocking frontend major deps check ... Split 3 multi-step jobs into separate dev and prod jobs for clearer parallel execution: - go-vet → go-vet-dev + go-vet-prod - go-staticcheck → go-staticcheck-dev + go-staticcheck-prod - go-gosec → go-gosec-dev + go-gosec-prod Each split job runs independently with its own setup and cache key. Updated test/race needs to reference all split job names. Added frontend-deps-major job (warn-only, exit 0): - Detects major/out-of-range npm updates (wanted !== latest) - Non-blocking informational check alongside the existing blocking frontend-deps job that catches in-range updates	2026-07-10 10:45:29 +01:00
popertots	2a0b81e565	ci: mkdir before cp for nginx config validation	2026-07-10 10:37:59 +01:00
popertots	9e3c9323c3	ci: fix nginx config check cp path, add R2_ENDPOINT to .env.example ... - nginx-check: cp needs trailing filename when copying to a directory - .env.example: uncomment R2_ENDPOINT as an active variable so the env-docs-check script detects it as documented	2026-07-10 10:33:33 +01:00
popertots	3d5b9350bc	ci: install git for gitleaks, use nginx default config for validation ... - secrets-scan: install git before gitleaks (gitleaks needs git in PATH to scan the repository; the node:22-alpine3.21 container lacks it) - nginx-check: copy site config into /etc/nginx/conf.d/ and use 'nginx -t' with default config instead of constructing a custom one (avoids fastcgi_params resolution issues with relative includes)	2026-07-10 10:27:48 +01:00
popertots	fbb8837981	ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope ... - secrets-scan: gitleaks module path was renamed from github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8 - docker-compose-check: create backend/.env from .env.example before running docker compose config (env file required by compose.yml) - nginx: move limit_req_zone directives outside server block to http level, where nginx requires them	2026-07-10 10:22:32 +01:00
popertots	d073172670	ci: fix infra failures — install go/python3/docker/nginx in job containers ... Four CI jobs failed because the runner's node:22-alpine3.21 container lacked required tooling (Go, Python3, Docker CLI, nginx): - secrets-scan: add actions/setup-go@v5 before gitleaks install - env-docs-check: apk add python3 before running check script - docker-compose-check: apk add docker-cli docker-compose - nginx-check: install nginx locally, validate with minimal config	2026-07-10 10:16:01 +01:00
popertotsandSisyphus	cbede4c267	hooks: add staticcheck, gosec, go mod tidy, and gitleaks to pre-commit ... Pre-commit now runs: prettier, eslint, go vet, staticcheck, gosec, go mod tidy check, and gitleaks (if installed). Matches the expanded CI pipeline. gitleaks is optional locally (skips gracefully if not installed). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:58:44 +01:00
popertotsandSisyphus	9a96a7a8a1	ci: add prod-tag variants to staticcheck and gosec ... Both tools now run under test,dev and test,!dev tags, matching go-vet pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:50:21 +01:00
popertotsandSisyphus	f532b05e72	ci: set coverage threshold to 100%, govulncheck gated behind go-build ... Coverage check now requires 100% (fail on any uncovered line). govulncheck (vulns) now has needs: [go-build], placing it in the gate block alongside vet/lint/staticcheck/gosec. Test and race already depended on vulns, so the chain is: go-build → gate jobs (incl vulns) → test+race. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:44:47 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	49ee167d69	chore: add missing env vars to .env.example ... Add 11 previously undocumented env vars: TEST_DB_HOST, TEST_DB_DSN, GO_TESTING, SQUARE_WEBHOOK_NOTIFICATION_URL, DAV_BASE_URL, DAV_ADMIN_PASSWORD, NO_COLOR, VITE_BACKEND_URL, RUSTFS_* Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:31:28 +01:00
popertotsandSisyphus	0668438ab0	fix: knip clean — delete remaining dead map files, add knip config, unexport internal types ... Delete 6 unused map components and use-map.svelte.ts hook. Create knip.json to handle worker entry points and dynamic imports. Unexport UserRole/DecodedToken types (only used internally). Remove resolved ignoreDependencies entries. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:45:14 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	9e6c415cc4	fix: run go mod tidy to sync go.sum after golangci-lint changes ... 2 stale checksum entries removed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:54:01 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	b26bf14419	ci: svelte strict check runs after typecheck QC, not before ... frontend-svelte-strict now needs frontend-qc. QC gates on build+knip. Strict runs after QC completes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:05:20 +01:00
popertotsandSisyphus	d272eb7cfe	ci: restructure Go gate into separate jobs, add knip and svelte strict check ... Go: go-build gates three parallel jobs (go-vet, golangci-lint, go-mod-tidy) which gate test+race. Frontend: add knip (between deps and QC) and svelte-check --fail-on-warnings (after build). QC now gates on build, knip, and svelte strict. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:03:04 +01:00
popertotsandSisyphus	b11dee1c49	ci: add golangci-lint and go-mod-tidy to Go gate job ... Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:57:37 +01:00
popertotsandSisyphus	53b0507148	ci: run frontend-deps and frontend-build in parallel, both gate QC ... frontend-deps (dep staleness check) and frontend-build now run concurrently. frontend-qc waits for both. Removed (gate) from build job name. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:54:50 +01:00
popertotsandSisyphus	93883602d9	ci: extract frontend deps checks into separate gating job ... frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:52:53 +01:00
popertotsandSisyphus	2604f9ab0d	ci: add stale override detection to frontend build gate ... Parses npm explain output for each overridden package. If the parent's required range already satisfies the override target, flags it as stale — dev must remove the override. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:51:32 +01:00
popertotsandSisyphus	4b5d3640bb	ci: add dependency staleness check to frontend build gate ... After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:46:54 +01:00
popertotsandSisyphus	96410c9f18	chore: remove minimatch override (no longer needed), keep cookie override (SvelteKit pinned dep) ... npm update resolved minimatch transitively. cookie still pinned via override because SvelteKit <= 2.69.2 depends on vulnerable cookie < 0.7.0. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:44:34 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	a17d6fd2e6	ci: fail npm audit on any vuln, not just high/critical ... Change audit-level from high to info so low and moderate findings also fail the CI step. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:35:23 +01:00
popertotsandSisyphus	29958620b6	ci: fix literal ${matrix.task} in step names (Gitea does not resolve them) ... Replace with static names. Job names still use matrix templates (those work). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:29:39 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	f59b7df97f	ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs ... 1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:07:17 +01:00
popertotsandSisyphus	7fd74dc65e	ci: bump Go from 1.25 to 1.25.12 to fix GO-2026-5856 ... govulncheck found crypto/tls vuln fixed in 1.25.12. Bump all 4 setup-go instances. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:03:45 +01:00
popertotsandSisyphus	0a73c07f09	ci: split frontend into build gate then parallel typecheck/lint/audit ... npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:02:21 +01:00
popertotsandSisyphus	e5f823eecd	ci: gate test and race behind both vet and vulns ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 16:58:18 +01:00
popertotsandSisyphus	8326b15e72	ci: split dev/prod test and race jobs into parallel matrix ... Extract Build & Vet into a separate gate job. Use matrix strategy for test and race jobs so dev and prod variants run concurrently after vet passes. Cache keys include label to avoid collisions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:15:25 +01:00
popertotsandSisyphus	f4969645c4	chore: update CI, DB init, and documentation ... Update CI workflow, PostgreSQL init script, README, and obsidian technical docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:18 +01:00
popertotsandSisyphus	27be7cea91	refactor: wire centralized job scheduler and custom request logging in main.go ... Replace inline cleanup goroutines and default chi logger with centralized jobs scheduler and custom colored request logger. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:09 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	a4fa75154d	refactor: centralize scheduling cleanup with row-count returns ... Convert all scheduling cleanup functions to return (int, error). Remove inline cleanup calls from GetAvailableHours. Add scheduled-cleanup.go for centralized job wrappers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:51 +01:00
popertotsandSisyphus	6064a06b7d	refactor: extract shared rate limiter types into ratelimit_shared.go ... Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:43 +01:00
popertotsandSisyphus	f78489ae00	feat: add logutil and jobs internal packages ... Add centralized jobs scheduler and logutil package with ANSI colors and duration formatting. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:34 +01:00
popertotsandSisyphus	72161e8c4f	docs(backend): clarify auth fallback rationale in reserve handler ... Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:08 +01:00
popertotsandSisyphus	e303c07f8d	refactor(backend): replace inline Bearer parsing with OptionalAuth middleware in services ... Removes the inline Bearer token fallback in ServicesHandler — the OptionalAuth middleware (added to the public services route group in main.go) now handles auth context population. This eliminates duplicated token parsing logic and ensures consistent auth behavior across all routes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:00 +01:00
popertotsandSisyphus	92124158bf	feat(frontend): add apiFetch wrapper for automatic auth token injection ... Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:21:34 +01:00
popertots	e831953e5b	fix(ui): improve reservation lifecycle in BookingFlow ... - Release reservation on service change, date change, and step-back navigation - Add synchronous double-click payment guard (isProcessingPaymentSync) - Immutable update for confirmedBooking to prevent race-condition overcharge - Generate fresh idempotency key per submission attempt (was reused across component lifetime, causing stale-booking illusion on re-submit) - Release reservation after successful booking submission - Extract releaseReservation() helper for DRY reservation cleanup - Race-condition guard in selectTimeWithValidation: pass clicked time explicitly so stale validation can't clobber a newer selection	2026-07-06 17:58:14 +01:00
popertots	98d561e8b6	docs: update API docs and test counts for admin cancel ... Update README and obsidian documentation with the new admin reservation cancel endpoint (DELETE /api/admin/bookings/reserve), updated API route tables, reservation TTL descriptions, and test count from 1,180 to 1,198.	2026-07-06 17:58:08 +01:00
popertots	c2aa0b93cb	feat(api): add admin reservation cancel endpoint ... Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations. New handler AdminCancelReservationHandler targets only RESERVATION:admin:% entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes 12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx, walkin+callin coexistence, anon untouched, response format parity, overlapping reservations deleted, user reservations untouched, and idempotent double-cancel. Inverse-isolation tests in cancel_reservation_test.go prove the user-side DELETE /api/bookings/reserve does not touch admin or anon reservations.	2026-07-06 17:58:03 +01:00
popertotsandSisyphus	1c09e4220b	fix: run eslint on every commit and restore gdpr navigation eslint-disable ... Pre-commit hook now runs eslint on all frontend files regardless of what's staged, catching pre-existing issues. Restore the necessary eslint-disable in gdpr page for the async goto call. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:43:48 +01:00
popertotsandSisyphus	878624e6f2	fix: resolve eslint warnings and error ... Remove unused eslint-disable directives in BookingCreateModal and GDPR page. Rename isMobile to _isMobile to match allowed unused vars pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:39:55 +01:00
popertotsandSisyphus	27f1f6f5cc	chore: add pre-commit hook with auto-format and lint checks ... Pre-commit hook runs prettier --write on staged frontend files, re-stages them, then checks eslint and go vet. Blocks the commit if eslint or vet fails. Stored in .githooks/ (version controlled) — enable with: git config core.hooksPath .githooks Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:37:08 +01:00