popertots and Sisyphus
e4b9003439
refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns
...
Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-06-24 23:43:50 +01:00
popertots
bffb984ebb
feat(auth,security,scheduling): JWT revocation, S3 fix, notes validation, docs, tests
...
- JWT revocation with JTI (UUID v4): in-memory tracking, POST /api/logout,
refresh handler revokes old JTI, RequireAuth rejects revoked tokens
- Fix extractKey for S3 portfolio deletion: extracts full key path from URLs
instead of just filename, preventing orphaned storage files
- Notes validation: max=1000000 on all 13 Notes fields across 4 booking structs
- CharCounter: grapheme-aware counter (Intl.Segmenter), threshold 750K,
color-coded, integrated into 6 booking/admin components
- loginInProgress: timestamp-based tracking, 30s staleness, 20-entry cap (429),
ticker cleanup for stuck entries
- Profile picture 15MB client-side limit, portfolio 20MB backend limit
- Exceptional scheduling: expand query start to Monday of week
- TodayCalendar: week-range fetching, closing time indicator, short-day lunch skip
- NavBar: link reorder, mobile burger badge, slide transition, backdrop
- ImageUpload: 20MB limit with visual feedback
- formatDateISO: shared YYYY-MM-DD utility, shouldApplyLunchProtection helper
- Update README.md and all Obsidian docs (Overview, Technical, Admin, Future Work)
- Add 28 new tests: JWT (11), auth handlers (7), portfolio extractKey (5),
notes validation (5). go build + go vet clean with test,dev tags
2026-06-03 11:17:41 +01:00
popertots and Sisyphus
2ba7b85d0b
feat: add OptionalAuth middleware and slot reservation endpoint
...
OptionalAuth extracts user info from Bearer token if present,
otherwise passes through without requiring authentication.
ReserveSlotHandler creates temporary time_blockers reservations:
- Logged-in users: max 1 active, 1hr TTL, tracked by user_id
- Anonymous users: global cap of 50, 10min TTL, tracked by IP hash
- Validates slot availability (working hours, booking overlap, blocker overlap)
- Returns reservation ID, start_time, duration, and expires_at
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-29 22:56:53 +01:00
popertots
f9eec94f2f
Security: add rate limiting, input validation, and filter category
...
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
2026-02-20 12:03:05 +00:00
popertotsandSisyphus