19 Commits

Include renames

Author	SHA1	Message	Date
popertotsandSisyphus	049c361e16	fix: adminnotify observability — money-critical rows sort first, flood-cap suppression surfaced to operator, stale coordination doc fixed ... - notifications priority ordering: money-critical reasons (webhooks, sweeps, refunds, gift-card, manual-refund failures) above routine - admin notifications page exposes the flood-cap suppressed count - adminnotify.go contract doc: removed stale 2FA reissue-fail site, current insert-site list Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)	2026-08-22 00:34:51 +01:00
popertots	01e7cc575d	fix: frontend payment surfaces — SCA wire shapes (explicit token precedence), mock token parity, infinite-loop guard, money display, delete-account re-auth, admin progress UI, mobile touch targets ... - new_card_token uses explicit newCardToken ?? verificationToken precedence on every charge surface (BookingFlow, UserPaymentModal, TipPayment, PaymentModal, TillPurchases, account gift-card buy); dead verification_code/consent fields + ScaFallbackConsentDialog removed from payment flows - mock mints cnon:sca-... tokenize-results and tokenizeWithVerification returns verificationToken:null for new cards (real-SDK parity so save-card works in dev) - UserPaymentModal infinite /payment-methods fetch loop guarded; formatCurrency(totalPaid) no longer 100x too small - delete-account dialog collects current_password + fresh 2FA code; admin 'Begin appointment'/'Complete' wired to /admin/bookings/{id}/progress - mobile: 44px touch targets, active: feedback, TimeSlotPicker 50dvh, dialog close sizing, .no-scrollbar utility, CSP meta, receipt fields escaped - vitest: policy.ts cross-check + ScaFallbackConsentDialog component tests (svelte project via happy-dom)	2026-08-22 00:34:50 +01:00
popertots	6d82535780	fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs ... Addresses the adversarial fresh-eyes audit (findings A1-A20) plus review-round fixes: - CRITICAL A1: replay-by-key rescue cross-checks replayed CreatedAt; ccof blind-fail leaves pending with CRITICAL + notification instead of clawing back - A2/A3/A4: till idempotency key restored to unconditional hash; tip rejected in CreateBookingPayment; campaign discount now reduces the charged amount (deposit credit) - A5: admin notifications on blind-fail, manual-refund re-arm, cap-stranded charge-group, webhook FAILED/REJECTED refunds - A6/A10: BuyGiftCard idempotency user-scoped; gift-card slot scan advances past failed rows - A7/A14/A15: 2FA user+IP limiter, SNAPSHOT_ENC_KEY startup validation, accurate pepper/log-delivery docs - A8/A9: snapshot encryption on all write+reuse sites; MPV->SPV effective voucher type (single VAT point) - A11/A12/A13/A16: amount-aware refund reconciliation; completed-booking refund re-validation; till retry dedup; PaymentWasRefunded on SquareClient interface - A17/A18/A19/A20: CI runs npm test; confirm_overflow_tip frontend dialog; unknown-event admin notification; mock token redaction - M7 ConfirmOverflowTip, M9 snapshot encryption, C1 discount ordering regression test - Frontend vitest framework (41 tests), backend coverage for fixed functions, docs corrected (2,269 tests, SUPPORT_EMAIL tokens, resolution status) All 25 backend packages pass; frontend 41/41; build + env-docs green.	2026-08-22 00:34:50 +01:00
popertots	8ae592d0c5	fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper	2026-07-11 17:38:50 +01:00
popertots	ae2acc45c3	chore: bump eslint 9.39.4 -> 9.39.5	2026-07-11 00:31:40 +01:00
popertots	a2b4f84503	chore: bump @eslint/js 9.39.4 → 9.39.5	2026-07-10 21:25:22 +01:00
popertots	e896591098	chore: upgrade npm deps — vite 8, prettier plugins, @types/node, @eslint/compat ... Upgrades applied: @types/node: 22.20.1 → 26.1.1 @eslint/compat: 1.4.1 → 2.1.0 prettier-plugin-tailwindcss: 0.7.4 → 0.8.0 prettier-plugin-svelte: 3.5.2 → 4.1.1 (formatted textarea.svelte) vite: 7.3.6 → 8.1.4 @sveltejs/vite-plugin-svelte: 6.2.4 → 7.2.0 Left at current (blocked by deps chain): eslint / @eslint/js — typescript-eslint needs eslint 10 support typescript — typescript-eslint needs TS 7 support Added CI TODO note for when vite-plugin-svelte-inspector catches up.	2026-07-10 20:03:41 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	407de74b51	fix: restore test-used functions, silence tx.Rollback closed errors, prune knip dead code ... Restore processImage (images.go) and nonDepositPaymentType (handlers.go) with //nolint:unused — used in test files. Fix 97 tx.Rollback defers to silently discard expected "tx is closed" error after commit. Frontend: remove 44 unused shadcn-svelte files, 2 dead components, 9 stale npm deps, prune unused exports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 19:20:25 +01:00
popertotsandSisyphus	96410c9f18	chore: remove minimatch override (no longer needed), keep cookie override (SvelteKit pinned dep) ... npm update resolved minimatch transitively. cookie still pinned via override because SvelteKit <= 2.69.2 depends on vulnerable cookie < 0.7.0. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:44:34 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	194aacf68c	feat(frontend): add test deps, VAT types, and business info store ... Add jsdom and vitest dev dependencies. Add total_vat_amount and total_net_amount to PaymentSummary type. Create shared businessInfo store for caching public business settings. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-22 17:06:31 +01:00
popertotsandSisyphus	39ac944994	chore(frontend): add @types/geojson dependency ... Add GeoJSON type definitions for TypeScript support. - Add @types/geojson package dependency - Add 'geojson' to tsconfig types array Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-20 16:59:51 +01:00
popertots	d77f330bda	chore: commit pending changes before custom services implementation	2026-06-13 11:27:47 +01:00
popertotsandSisyphus	584c02ac6c	feat(frontend): ImageVariant component and WASM encoder workers ... Add client-side multi-format image encoding via Web Workers using @jsquash and @discourse/jxl libraries. ImageVariant Svelte component renders <picture> elements with format-aware fallback. Vite configured for WASM asset inclusion and encoder dependency exclusion. Portfolio page updated to use multi-format URLs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-04 01:07:00 +01:00
popertots	970cc5554d	feat: add email verification, profile pictures, deposits, and calendar ... export Backend: - Add email verification code generation and verification endpoints - Add profile picture upload with S3 storage and image processing - Add deposit_required field to users with 48h advance booking requirement - Add loyalty stamps that accumulate on completed bookings - Auto-transition bookings: confirmed → in_progress → completed - Add booking cancellation handler with no-show detection - Add ICS calendar file download endpoint for bookings - Sync bookings to CalDAV on confirmation Frontend: - Add schedule page route - Add avatar and image-cropper UI components - Update shadcn-svelte components (button, dialog) - Add "Add to Calendar" button in booking modal Database: - Add verification_codes table - Add profile_pic_url, loyalty_stamps, deposits_required to users - Various schema updates	2026-02-21 18:48:29 +00:00
popertots	1dd37a8d22	Added booking approvals	2026-01-19 22:32:25 +00:00
popertots	b474b8a41c	WIP admin page	2025-10-13 22:35:37 +01:00
popertots	708b741a32	Initial commit. Working login, example UI with prototype and demo, connections to DB and DAV, local and prod setups.	2025-10-12 22:13:19 +01:00