659 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
popertotsandSisyphus	9e6c415cc4	fix: run go mod tidy to sync go.sum after golangci-lint changes ... 2 stale checksum entries removed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:54:01 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	b26bf14419	ci: svelte strict check runs after typecheck QC, not before ... frontend-svelte-strict now needs frontend-qc. QC gates on build+knip. Strict runs after QC completes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:05:20 +01:00
popertotsandSisyphus	d272eb7cfe	ci: restructure Go gate into separate jobs, add knip and svelte strict check ... Go: go-build gates three parallel jobs (go-vet, golangci-lint, go-mod-tidy) which gate test+race. Frontend: add knip (between deps and QC) and svelte-check --fail-on-warnings (after build). QC now gates on build, knip, and svelte strict. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:03:04 +01:00
popertotsandSisyphus	b11dee1c49	ci: add golangci-lint and go-mod-tidy to Go gate job ... Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:57:37 +01:00
popertotsandSisyphus	53b0507148	ci: run frontend-deps and frontend-build in parallel, both gate QC ... frontend-deps (dep staleness check) and frontend-build now run concurrently. frontend-qc waits for both. Removed (gate) from build job name. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:54:50 +01:00
popertotsandSisyphus	93883602d9	ci: extract frontend deps checks into separate gating job ... frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:52:53 +01:00
popertotsandSisyphus	2604f9ab0d	ci: add stale override detection to frontend build gate ... Parses npm explain output for each overridden package. If the parent's required range already satisfies the override target, flags it as stale — dev must remove the override. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:51:32 +01:00
popertotsandSisyphus	4b5d3640bb	ci: add dependency staleness check to frontend build gate ... After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:46:54 +01:00
popertotsandSisyphus	96410c9f18	chore: remove minimatch override (no longer needed), keep cookie override (SvelteKit pinned dep) ... npm update resolved minimatch transitively. cookie still pinned via override because SvelteKit <= 2.69.2 depends on vulnerable cookie < 0.7.0. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:44:34 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	a17d6fd2e6	ci: fail npm audit on any vuln, not just high/critical ... Change audit-level from high to info so low and moderate findings also fail the CI step. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:35:23 +01:00
popertotsandSisyphus	29958620b6	ci: fix literal ${matrix.task} in step names (Gitea does not resolve them) ... Replace with static names. Job names still use matrix templates (those work). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:29:39 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	f59b7df97f	ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs ... 1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:07:17 +01:00
popertotsandSisyphus	7fd74dc65e	ci: bump Go from 1.25 to 1.25.12 to fix GO-2026-5856 ... govulncheck found crypto/tls vuln fixed in 1.25.12. Bump all 4 setup-go instances. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:03:45 +01:00
popertotsandSisyphus	0a73c07f09	ci: split frontend into build gate then parallel typecheck/lint/audit ... npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:02:21 +01:00
popertotsandSisyphus	e5f823eecd	ci: gate test and race behind both vet and vulns ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 16:58:18 +01:00
popertotsandSisyphus	8326b15e72	ci: split dev/prod test and race jobs into parallel matrix ... Extract Build & Vet into a separate gate job. Use matrix strategy for test and race jobs so dev and prod variants run concurrently after vet passes. Cache keys include label to avoid collisions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:15:25 +01:00
popertotsandSisyphus	f4969645c4	chore: update CI, DB init, and documentation ... Update CI workflow, PostgreSQL init script, README, and obsidian technical docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:18 +01:00
popertotsandSisyphus	27be7cea91	refactor: wire centralized job scheduler and custom request logging in main.go ... Replace inline cleanup goroutines and default chi logger with centralized jobs scheduler and custom colored request logger. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:09 +01:00
popertotsandSisyphus	e86248b27c	refactor: move auth, GDPR, and booking cleanup to centralized scheduler ... Convert CleanupRevokedJTIs to return (int, error) and remove StartJTICleanup goroutine. Add CleanupStaleLoginEntries and CleanupGDPRExportCache for centralized scheduler. Add clock.London timezone location. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:00 +01:00
popertotsandSisyphus	a4fa75154d	refactor: centralize scheduling cleanup with row-count returns ... Convert all scheduling cleanup functions to return (int, error). Remove inline cleanup calls from GetAvailableHours. Add scheduled-cleanup.go for centralized job wrappers. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:51 +01:00
popertotsandSisyphus	6064a06b7d	refactor: extract shared rate limiter types into ratelimit_shared.go ... Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:43 +01:00
popertotsandSisyphus	f78489ae00	feat: add logutil and jobs internal packages ... Add centralized jobs scheduler and logutil package with ANSI colors and duration formatting. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:34 +01:00
popertotsandSisyphus	72161e8c4f	docs(backend): clarify auth fallback rationale in reserve handler ... Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:08 +01:00
popertotsandSisyphus	e303c07f8d	refactor(backend): replace inline Bearer parsing with OptionalAuth middleware in services ... Removes the inline Bearer token fallback in ServicesHandler — the OptionalAuth middleware (added to the public services route group in main.go) now handles auth context population. This eliminates duplicated token parsing logic and ensures consistent auth behavior across all routes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:22:00 +01:00
popertotsandSisyphus	92124158bf	feat(frontend): add apiFetch wrapper for automatic auth token injection ... Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-06 19:21:34 +01:00
popertots	e831953e5b	fix(ui): improve reservation lifecycle in BookingFlow ... - Release reservation on service change, date change, and step-back navigation - Add synchronous double-click payment guard (isProcessingPaymentSync) - Immutable update for confirmedBooking to prevent race-condition overcharge - Generate fresh idempotency key per submission attempt (was reused across component lifetime, causing stale-booking illusion on re-submit) - Release reservation after successful booking submission - Extract releaseReservation() helper for DRY reservation cleanup - Race-condition guard in selectTimeWithValidation: pass clicked time explicitly so stale validation can't clobber a newer selection	2026-07-06 17:58:14 +01:00
popertots	98d561e8b6	docs: update API docs and test counts for admin cancel ... Update README and obsidian documentation with the new admin reservation cancel endpoint (DELETE /api/admin/bookings/reserve), updated API route tables, reservation TTL descriptions, and test count from 1,180 to 1,198.	2026-07-06 17:58:08 +01:00
popertots	c2aa0b93cb	feat(api): add admin reservation cancel endpoint ... Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations. New handler AdminCancelReservationHandler targets only RESERVATION:admin:% entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes 12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx, walkin+callin coexistence, anon untouched, response format parity, overlapping reservations deleted, user reservations untouched, and idempotent double-cancel. Inverse-isolation tests in cancel_reservation_test.go prove the user-side DELETE /api/bookings/reserve does not touch admin or anon reservations.	2026-07-06 17:58:03 +01:00
popertotsandSisyphus	1c09e4220b	fix: run eslint on every commit and restore gdpr navigation eslint-disable ... Pre-commit hook now runs eslint on all frontend files regardless of what's staged, catching pre-existing issues. Restore the necessary eslint-disable in gdpr page for the async goto call. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:43:48 +01:00
popertotsandSisyphus	878624e6f2	fix: resolve eslint warnings and error ... Remove unused eslint-disable directives in BookingCreateModal and GDPR page. Rename isMobile to _isMobile to match allowed unused vars pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:39:55 +01:00
popertotsandSisyphus	27f1f6f5cc	chore: add pre-commit hook with auto-format and lint checks ... Pre-commit hook runs prettier --write on staged frontend files, re-stages them, then checks eslint and go vet. Blocks the commit if eslint or vet fails. Stored in .githooks/ (version controlled) — enable with: git config core.hooksPath .githooks Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:37:08 +01:00
popertotsandSisyphus	9c0b189b73	style: fix prettier formatting in 3 admin files ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:30:42 +01:00
popertotsandSisyphus	5f1f6c4b44	style: standardise select styling in DiscountsManagement, HolidayHours, TodayCalendar ... Update select element classes to consistent h-9, shadow-xs, bg-background, focus-visible ring styling. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:38 +01:00
popertotsandSisyphus	5616357269	style: standardise input styling in booking create, business settings, custom services, patch test, walk-in create ... Update input element classes to consistent h-9, py-1, shadow-xs, focus-visible border-ring with ring-[3px] and ring-ring/50 for visual consistency across admin components. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:28 +01:00
popertotsandSisyphus	b7fa22b018	refactor: accept defaultHours prop in WeeklySchedule and TimeBlockers ... Add optional defaultHours prop to accept pre-fetched data from parent page. Standardise select element styling with shadow-xs, focus-visible ring, and consistent padding. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:18 +01:00
popertotsandSisyphus	56eda0ead5	refactor: accept services prop in PatchTestsManagement and ServicesManagement ... Add optional services prop so the page can pass pre-fetched data, avoiding duplicate API calls. Fall back to self-fetching when prop is not provided. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:26:08 +01:00
popertotsandSisyphus	42c3b65a27	feat: add collapsible sections and lifted data fetching to admin page ... Add independently toggleable collapsible sections for scheduling, customers, services, promotions, settings. Lift services and default-hours fetching to page level to avoid duplicate API calls. Add responsive breakpoint detection — sections default expanded on desktop, collapsed on mobile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 22:25:49 +01:00
popertotsandSisyphus	b1b6607ca1	docs: note caching speed improvement in README ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:50:25 +01:00
popertotsandSisyphus	016d302212	docs: document CI caching setup in README ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:45:36 +01:00
popertotsandSisyphus	d8dfad2b32	ci: add Go and npm dependency caching via actions/cache ... Add actions/cache@v4 to all four CI jobs. Go module cache (go/pkg/mod + go-build) keyed on go.sum for test, race, and vulns jobs. npm cache (~/.npm + node_modules) keyed on package-lock.json for frontend job. Cuts dependency download time to near-zero on cache hit. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:37:59 +01:00
popertotsandSisyphus	1c1fc6a921	docs: update README and obsidian docs with reservation improvements ... Document self-blocking prevention (excludeUserID), explicit reservation cancellation endpoint, background cleanup goroutine, and edit_request reservation scrubbing. Bump test counts from 1,169 to 1,180 and package count from 19 to 20. Add race detector command to README. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:47 +01:00
popertotsandSisyphus	be22710f7b	test: add scheduling excludeUserID integration test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:40 +01:00
popertotsandSisyphus	2e0760f083	feat: add IP-based anon reservation cleanup to admin reserve handler ... Extend AdminReserveSlotHandler's pre-overlap DELETE to also clean up anonymous RESERVATION:anon entries matching the admin's IP address. This handles the edge case where an admin previously reserved a slot without authentication. Also reorganise imports to follow goimports conventions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:26:33 +01:00
popertotsandSisyphus	cc6ad7f00f	fix: remove t.Parallel from VAT lifecycle test ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:12 +01:00
popertotsandSisyphus	30c9012562	fix: move dav.Service init from auth_test to user testmain ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:08:09 +01:00