17 Commits

Include renames

Author	SHA1	Message	Date
popertots	ce0bb43ebf	fix: auth and ratelimit middleware return JSON errors instead of text/plain	2026-07-11 16:05:56 +01:00
popertots	ac104e19c5	fix: remove rate limiter dev stub, consolidate tests under all build tags	2026-07-11 14:41:58 +01:00
popertots	3029fd5179	test: add coverage tests across backend + fix mock for PENDING checkout support ... New test files cover previously untested paths across DAV, validators, S3, Square, mw, bookings, user, and payments packages. Includes mock fix: HoldCheckouts flag on MockClient allows tests to pause auto-complete goroutine for testing PENDING checkout states. Coverage: 50.4% → 65.0% (+14.6pp)	2026-07-10 18:13:44 +01:00
popertotsandSisyphus	ed9cb1489c	fix: resolve golangci-lint violations (errcheck, unused, gosimple, ineffassign) ... errcheck: add proper error handling with slog.Error for tx.Rollback, key generation, and s3/dav operations. Add nolint comments for intentionally discarded DB scan errors and HTTP write errors. unused: remove dead code (svcRow type, processImage, nonDepositPaymentType, generateSecureCode, colorBold, nGreen, nRed) gosimple S1021: merge var declaration with assignment in manage.go ineffassign: remove dead assignments in settings.go, till.go, images.go Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:53:51 +01:00
popertotsandSisyphus	510828c924	chore: run go fix for Go 1.26 modernization ... 106 files: interface{}→any, strings.Split→SplitSeq, CutPrefix/Cut, strings.Builder, slices.Contains, remove redundant // +build directives, gofmt import ordering and indentation. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:25:23 +01:00
popertotsandSisyphus	6064a06b7d	refactor: extract shared rate limiter types into ratelimit_shared.go ... Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:09:43 +01:00
popertotsandSisyphus	e4b9003439	refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns ... Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:43:50 +01:00
popertotsandSisyphus	da0e64c02b	feat(mw): add content-type and response middleware ... Add Content-Type enforcement middleware and generic JSON response helpers to standardize API responses. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-24 23:42:57 +01:00
popertotsandSisyphus	b253ab9732	feat(backend): update rate limiting middleware ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-18 16:26:06 +01:00
popertotsandSisyphus	37e1069404	feat(backend): update auth middleware ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-06-18 16:26:02 +01:00
popertots	bffb984ebb	feat(auth,security,scheduling): JWT revocation, S3 fix, notes validation, docs, tests ... - JWT revocation with JTI (UUID v4): in-memory tracking, POST /api/logout, refresh handler revokes old JTI, RequireAuth rejects revoked tokens - Fix extractKey for S3 portfolio deletion: extracts full key path from URLs instead of just filename, preventing orphaned storage files - Notes validation: max=1000000 on all 13 Notes fields across 4 booking structs - CharCounter: grapheme-aware counter (Intl.Segmenter), threshold 750K, color-coded, integrated into 6 booking/admin components - loginInProgress: timestamp-based tracking, 30s staleness, 20-entry cap (429), ticker cleanup for stuck entries - Profile picture 15MB client-side limit, portfolio 20MB backend limit - Exceptional scheduling: expand query start to Monday of week - TodayCalendar: week-range fetching, closing time indicator, short-day lunch skip - NavBar: link reorder, mobile burger badge, slide transition, backdrop - ImageUpload: 20MB limit with visual feedback - formatDateISO: shared YYYY-MM-DD utility, shouldApplyLunchProtection helper - Update README.md and all Obsidian docs (Overview, Technical, Admin, Future Work) - Add 28 new tests: JWT (11), auth handlers (7), portfolio extractKey (5), notes validation (5). go build + go vet clean with test,dev tags	2026-06-03 11:17:41 +01:00
popertotsandSisyphus	306f942d00	feat(mw): add dev-mode rate limiting bypass ... Add build tag split: real rate limiter under !dev, no-op under dev build tag. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-31 18:48:53 +01:00
popertotsandSisyphus	700b7c1152	fix: extract client IP via net.SplitHostPort consistently ... Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-05-31 10:55:23 +01:00
popertotsandSisyphus	2ba7b85d0b	feat: add OptionalAuth middleware and slot reservation endpoint ... OptionalAuth extracts user info from Bearer token if present, otherwise passes through without requiring authentication. ReserveSlotHandler creates temporary time_blockers reservations: - Logged-in users: max 1 active, 1hr TTL, tracked by user_id - Anonymous users: global cap of 50, 10min TTL, tracked by IP hash - Validates slot availability (working hours, booking overlap, blocker overlap) - Returns reservation ID, start_time, duration, and expires_at Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-04-29 22:56:53 +01:00
popertots	b4d91d5dc0	Security pass	2026-02-20 12:59:10 +00:00
popertots	f9eec94f2f	Security: add rate limiting, input validation, and filter category ... validation Backend: - Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP limiter - Apply rate limits per endpoint group: - Public read-only: 120/min - Registration: 10/min - Portfolio filters: 60/min - Authenticated users: 120/min - Admin: none (trusted) - Add 256 char input length validation on portfolio endpoints - Validate filter categories exist in DB before querying - Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20 digits) - Remove pattern-based image lookup to prevent enumeration - Add services validation: name (100), duration (1-480), patch test (0-168) Frontend: - Add maxlength=256 to portfolio tag/search inputs - Add maxlength to registration: name (50), email (255), phone (20), password (72) - Add maxlength=100 to service name input	2026-02-20 12:03:05 +00:00
popertots	708b741a32	Initial commit. Working login, example UI with prototype and demo, connections to DB and DAV, local and prod setups.	2025-10-12 22:13:19 +01:00