311 Commits

Include renames

Author	SHA1	Message	Date
popertotsandSisyphus	a3243fab27	fix: auto-set DAV_SKIP_INIT=1 in test init to match local GO_TESTING behavior ... The DAV_SKIP_INIT env var was only set in CI, not locally. db_test_init.go always auto-sets GO_TESTING=1 for local runs — now does the same for DAV_SKIP_INIT, so tests don't panic on DAV init failure. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-11 15:13:51 +01:00
popertots	4d87bf791f	fix: replace GO_TESTING with DAV_SKIP_INIT for DAV service initialization	2026-07-11 15:06:16 +01:00
popertots	f147be0b99	fix: add error logging to remaining nolint:errcheck scan sites for observability	2026-07-11 15:04:53 +01:00
popertots	ad15127777	fix: remove nonDepositPaymentType dead code, wire dead handlers to routes	2026-07-11 15:01:26 +01:00
popertots	df325487cf	fix: gift card admin notification uses NULL booking_id (not cardID), use tx not db.Conn	2026-07-11 14:59:09 +01:00
popertots	ac104e19c5	fix: remove rate limiter dev stub, consolidate tests under all build tags	2026-07-11 14:41:58 +01:00
popertots	9b235a1298	fix: add error logging to 3 non-aggregate nolint:errcheck sites (duration lookup, deposit-paid scans)	2026-07-11 14:41:06 +01:00
popertots	d410dce0e0	fix: gift card friend purchase notifies admin, frontend no longer falsely claims email sent	2026-07-11 14:39:54 +01:00
popertots	9f9f0eed98	fix: add error logging to discount campaign payment/times_redeemed execs	2026-07-11 14:37:47 +01:00
popertots	7a51bcc49a	fix: JTI revocation returns error, LogoutHandler returns 500 on failure	2026-07-11 14:35:34 +01:00
popertots	b549014a68	fix: add nolint:errcheck to AdminGetInProgressBookingHandler json.Encode	2026-07-11 13:30:09 +01:00
popertots	28620f69a5	fix: restore dead functions properly, match test expectations, fix vet/lint	2026-07-11 13:23:27 +01:00
popertots	a3c0be2890	fix: audit nolint:errcheck — fix dangerous suppression patterns	2026-07-11 12:57:41 +01:00
popertots	19be37171b	fix: remove 3 dead code blocks (UserCancelBookingHandler, AdminGetInProgressBookingHandler, processImage)	2026-07-11 12:51:42 +01:00
popertots	844df4c127	fix: use raw clock.Now()+40h for booking test times (avoids time-sensitive boundaries)	2026-07-11 10:35:59 +01:00
popertots	abd53baf35	fix: time-sensitive tests use savepoint pattern, avoid 48h auto-approval boundary	2026-07-11 10:14:12 +01:00
popertots	ae2acc45c3	chore: bump eslint 9.39.4 -> 9.39.5	2026-07-11 00:31:40 +01:00
popertots	de37b07233	fix: use savepoint pattern for today test (matches other tests in file)	2026-07-11 00:26:14 +01:00
popertots	fe47cb486a	fix: replace 3.5s sleep with poll loop in till checkout test	2026-07-10 20:53:42 +01:00
popertots	b91339ec56	fix: use targeted DELETE in DAV test instead of full table wipe	2026-07-10 20:53:04 +01:00
popertots	50ce98d729	fix: remove dead GenerateRefreshToken calls (tokens never consumed)	2026-07-10 20:52:47 +01:00
popertots	a4a80246d1	fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment ... - s3.go: restore error returns on prod Upload/Download/Delete stubs (silent nil was dangerous — callers would think writes succeeded) - CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env - handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal - validators.go: fix comment to include A-F (matched the regex)	2026-07-10 20:39:17 +01:00
popertots	609a099677	fix: data races in Square mock and scheduler hostname tests ... - square_dev.go: return a copy of CheckoutResult to the caller instead of sharing the map-stored pointer, preventing the goroutine from racing with the caller on Status field reads - scheduler_test.go: remove t.Parallel from TestInitHostname_* tests which modify a shared package-level hostname variable	2026-07-10 19:10:31 +01:00
popertots	2cd35ea84a	fix: S3-dependent tests skip in prod, add GO_TESTING to CI for dav init	2026-07-10 18:45:18 +01:00
popertots	cbaed41056	fix: restrict user_coverage_test build to test && dev	2026-07-10 18:24:39 +01:00
popertots	3029fd5179	test: add coverage tests across backend + fix mock for PENDING checkout support ... New test files cover previously untested paths across DAV, validators, S3, Square, mw, bookings, user, and payments packages. Includes mock fix: HoldCheckouts flag on MockClient allows tests to pause auto-complete goroutine for testing PENDING checkout states. Coverage: 50.4% → 65.0% (+14.6pp)	2026-07-10 18:13:44 +01:00
popertots	990c86495c	fix: suppress unused nonDepositPaymentType in prod-staticcheck	2026-07-10 13:00:33 +01:00
popertots	3d337b61b8	fix: remove t.Parallel from VAT tests to eliminate deadlock flakiness	2026-07-10 12:49:57 +01:00
popertots	19d1d8dd47	fix: correct prop names in Svelte templates after a11y cleanup	2026-07-10 12:27:08 +01:00
popertots	0c91482aac	fix: adjust upload limits to 20MB profile, 30MB portfolio	2026-07-10 12:25:25 +01:00
popertots	9ea929901a	fix: exclude RefreshToken from JSON response (G117)	2026-07-10 12:09:54 +01:00
popertots	cb09020b0d	fix: add http.Server timeouts to mitigate Slowloris (G112)	2026-07-10 12:08:08 +01:00
popertots	6599ef85fd	fix: suppress false positive G304 (hardcoded paths in test utility)	2026-07-10 12:07:11 +01:00
popertots	3a9bc02796	fix: check ParseMultipartForm errors, reduce maxMemory, handle 413 properly	2026-07-10 12:06:12 +01:00
popertots	ef3cfe8c4f	fix: replace crypto/md5 with crypto/sha256 for IP hashing	2026-07-10 12:04:49 +01:00
popertots	d1e85bb855	fix: add missing err checks and fix loop termination in tests	2026-07-10 12:03:11 +01:00
popertots	cf0cd8de15	fix: remove 10 unused test functions flagged by staticcheck U1000	2026-07-10 12:01:02 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	9e6c415cc4	fix: run go mod tidy to sync go.sum after golangci-lint changes ... 2 stale checksum entries removed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:54:01 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	27be7cea91	refactor: wire centralized job scheduler and custom request logging in main.go ... Replace inline cleanup goroutines and default chi logger with centralized jobs scheduler and custom colored request logger. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:09 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	a4fa75154d	refactor: centralize scheduling cleanup with row-count returns ... Convert all scheduling cleanup functions to return (int, error). Remove inline cleanup calls from GetAvailableHours. Add scheduled-cleanup.go for centralized job wrappers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:51 +01:00
popertotsandSisyphus	6064a06b7d	refactor: extract shared rate limiter types into ratelimit_shared.go ... Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:43 +01:00
popertotsandSisyphus	f78489ae00	feat: add logutil and jobs internal packages ... Add centralized jobs scheduler and logutil package with ANSI colors and duration formatting. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:34 +01:00
popertotsandSisyphus	72161e8c4f	docs(backend): clarify auth fallback rationale in reserve handler ... Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:08 +01:00