popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
755 Commits 1 Branch 0 Tags
e9b0f0f2a7fa18db5ec60d0fb26c91bc7db81087
Commit Graph
397 Commits
Author SHA1 Message Date
popertotsandSisyphus 56d91ba4ef chore(tests): add advisory locks and statement parser for test infrastructure 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-11 22:08:23 +01:00
popertotsandSisyphus 6de0371e1d feat(user): add email check endpoint for registered user detection 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-11 22:08:22 +01:00
popertotsandSisyphus b750b3c203 feat(scheduling): add gift card expiry and idle account cleanup 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-11 22:08:21 +01:00
popertotsandSisyphus 44895a3697 feat(admin): add business settings API and routing for gift card config 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-11 22:08:21 +01:00
popertotsandSisyphus 30ded0bb95 feat(payments): add gift card system v2 with management, expiry, inventory, audit log 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-11 22:08:18 +01:00
popertots 4e174a6123 Fixes for giftcards and phone input 2026-06-06 15:10:48 +01:00
popertots 5258f90b06 Add giftcard management 2026-06-06 14:26:42 +01:00
popertots 310e6aaa80 Add giftcard management 2026-06-06 14:26:33 +01:00
popertots 0d4a74bd4a feat: caret preservation and Luhn validation in card inputs 
- Added generic formatAndPreserveCursor() helper on frontend to track
  and restore selection caret position during dynamic input sanitization
- Applied to all card inputs, gift card code inputs, and expiry inputs
- Added Luhn validation (isValidLuhn) for saved cards and gift cards
- Rebuilt payments test DB and got 100% green tests
 2026-06-05 21:05:36 +01:00
popertots f4a6033715 feat: financial data retention & aggregation system 
Add CleanupExpiredFinancialRecords to enforce HMRC + Limitation Act
compliance (7-year retention, 1-year post-anonymization buffer).

- financial_aggregates table: monthly totals by payment method/type (no PII)
- CleanupExpiredFinancialRecords(): aggregates expired payments/refunds,
  deletes granular records, idempotent via ON CONFLICT DO UPDATE
- Wired into GET /api/availability alongside existing cleanup functions
- 8 tests: 7yr expiry, 1yr buffer, 9yr override, aggregation totals,
  idempotency, active user protection, both-thresholds elapsed, refunds
- testdb.go: financial_aggregates in drop-order and truncate lists
- README + Technical Manual updated
 2026-06-05 16:37:04 +01:00
popertotsandSisyphus f88854e5c2 feat(scheduling): add expired loyalty cleanup and extend guest anonymization 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-05 15:40:38 +01:00
popertotsandSisyphus b460c2ec20 fix(scheduling): extend AnonymizeStaleGuestAccounts with additional field scrubbing 
AnonymizeStaleGuestAccounts now additionally scrubs profile_pic_url (NULL), referral_code (NULL), notes (NULL), and data_retention_consent (FALSE) for stale guest accounts. Previously only scrubbed name, email, phone, and date_of_birth. Ensures comprehensive PII removal for guests with no active/pending bookings and last booking over 6 months old.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-05 12:12:38 +01:00
popertotsandSisyphus 40840c0458 feat(user): extend DeleteAccountHandler with external system scrubbing 
DeleteAccountHandler now scrubs external systems BEFORE SQL-level anonymization. S3: deletes profile picture from S3/R2 (profiles/{userID}.jpg) when s3.Client is configured. Square: iterates user's saved cards and calls DeleteCardOnFile for each non-deleted card when payments.SquareClient is configured. Both run in background goroutines (non-blocking, best-effort with warning logs). CardDAV contact deletion remains as existing best-effort goroutine.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-05 12:12:12 +01:00
popertotsandSisyphus f58a4bd2a9 feat(user): add async GDPR export endpoint with 12h cache and 25 tests 
Add GET /api/user/gdpr-export handler (GetGDPRExportHandler) with async background generation — navigation away doesn't cancel. 12h in-memory cache with 5-minute cleanup ticker. Three cache states: MISS (triggers generation), HIT (returns cached data), GENERATING (concurrent request while building). Route registered without RequireVerified middleware so unverified users can export. 25 tests covering: auth rejection, cache miss/hit/generating/expired states, anonymize_user child table scrubbing (social logins, saved cards, verification codes, time blockers, edit notes, notification prefs), export_all_user_data 16-section export, AnonymizeStaleGuestAccounts field scrubbing.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-05 12:11:45 +01:00
popertots 6d4bc4d637 feat(loyalty-discount): implement loyalty and discount system 
- Add discount campaign management and validation logic
- Update booking handlers with discount application flow
- Add customer relationship endpoints for loyalty tracking
- Update frontend modals (booking, approval, payment, reschedule)
- Add DiscountsManagement and loyalty reference documentation
- Update dev scripts and database init for discount tables
- Clean up completed plan files
 2026-06-04 23:13:02 +01:00
popertotsandSisyphus 8a1da43131 test(auth): add referral code case-insensitivity tests 
Tests lowercase, uppercase, mixed case, and all caps referral codes against a lowercase stored code. All 4 sub-tests pass, confirming the strings.ToLower fix in RegisterHandler.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-04 12:05:20 +01:00
popertotsandSisyphus 7d1b90a5be fix(auth): lowercase referral code before validation and lookup 
Defense-in-depth: referral codes are generated as hex (lowercase only) by the DB. The frontend already lowercases on input, but direct API calls with uppercase would fail the DB lookup. Normalize to lowercase on the backend to prevent capslock situations.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-04 12:02:39 +01:00
popertotsandSisyphus 486173c5ff fix(user): profile handler and main router updates 
Minor adjustments to profile handler imports and main router configuration.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-04 11:25:41 +01:00
popertotsandSisyphus db78b5186e chore: update S3 dev configuration with AWS SDK v2 
S3 dev implementation now uses AWS SDK v2 for RustFS local storage. Prod stub remains placeholder. Both implement Uploader interface with Upload, Download, Delete, GetURL methods.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-04 01:09:15 +01:00
popertotsandSisyphus 0da7498ad7 feat(images): multi-format portfolio pipeline (AVIF/WebP/JPEG/JXL) 
Backend now stores AVIF, WebP, JPEG, and optional JXL variants for both full-size and thumbnail images. Database schema extended with 7 new columns. Image validation supports AVIF and JXL magic bytes. Comprehensive test coverage for all format URL fields and magic byte detection. Legacy single-URL images remain backward-compatible.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-06-04 01:06:33 +01:00
popertots bffb984ebb feat(auth,security,scheduling): JWT revocation, S3 fix, notes validation, docs, tests 
- JWT revocation with JTI (UUID v4): in-memory tracking, POST /api/logout,
  refresh handler revokes old JTI, RequireAuth rejects revoked tokens
- Fix extractKey for S3 portfolio deletion: extracts full key path from URLs
  instead of just filename, preventing orphaned storage files
- Notes validation: max=1000000 on all 13 Notes fields across 4 booking structs
- CharCounter: grapheme-aware counter (Intl.Segmenter), threshold 750K,
  color-coded, integrated into 6 booking/admin components
- loginInProgress: timestamp-based tracking, 30s staleness, 20-entry cap (429),
  ticker cleanup for stuck entries
- Profile picture 15MB client-side limit, portfolio 20MB backend limit
- Exceptional scheduling: expand query start to Monday of week
- TodayCalendar: week-range fetching, closing time indicator, short-day lunch skip
- NavBar: link reorder, mobile burger badge, slide transition, backdrop
- ImageUpload: 20MB limit with visual feedback
- formatDateISO: shared YYYY-MM-DD utility, shouldApplyLunchProtection helper
- Update README.md and all Obsidian docs (Overview, Technical, Admin, Future Work)
- Add 28 new tests: JWT (11), auth handlers (7), portfolio extractKey (5),
  notes validation (5). go build + go vet clean with test,dev tags
 2026-06-03 11:17:41 +01:00
popertots 169d7dc6e3 feat(scheduling,admin,today): week-range queries, file size limits, mobile nav UX 
- Expand exceptional application query to Monday of start week
- Add 20MB file size limit with visual feedback in ImageUpload
- Reorder admin nav links, add burger badge, slide transition + backdrop
- Fetch week-range working/available hours, add closing time indicator
- Skip lunch protection for days <= 5h via shouldApplyLunchProtection
- Extract formatDateISO to shared utils
 2026-06-03 10:22:16 +01:00
popertotsandSisyphus b1847b4cfc fix(payments,portfolio,scheduling): add ID validation hardening 
Add validators.IsValidID() checks on URL param IDs to return 404 instead of 400 for invalid IDs. Add offset cap and query length limit in portfolio images handler.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:49:16 +01:00
popertotsandSisyphus 1d8247e655 fix(auth,services,profile): add request struct validation 
Add validate tags and validators.Validate.Struct() calls on request structs for auth verification, service creation, and user patch test endpoints.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:49:12 +01:00
popertotsandSisyphus 577cceb304 fix(bookings): add request struct validation and fix patch test notice logic 
Add validators.Validate.Struct() calls across booking handlers. Fix patch test notice period check to compare against booking start time (not current time) and fix expiry check similarly. Update test to match new error message.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:49:07 +01:00
popertotsandSisyphus 304a54c283 fix(admin): replace string(rune) with strconv.Itoa and validate status param 
Fix query parameter construction by using strconv.Itoa instead of string(rune('0'+argNum)). Add status filter validation against allowed values.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:49:02 +01:00
popertotsandSisyphus 253d8785a4 fix(main): add request body size limits to API routes 
Add limitBody(defaultBodyLimit) middleware to register, login, verify, booking, guest user, and admin routes.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:48:57 +01:00
popertotsandSisyphus 306f942d00 feat(mw): add dev-mode rate limiting bypass 
Add build tag split: real rate limiter under !dev, no-op under dev build tag.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 18:48:53 +01:00
popertotsandSisyphus d7857766fb chore: configure env-based DAV_ADMIN_PASSWORD and add security headers 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:55:43 +01:00
popertotsandSisyphus 1a6947a9b6 fix: enforce request body size limits across the API 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:55:33 +01:00
popertotsandSisyphus 700b7c1152 fix: extract client IP via net.SplitHostPort consistently 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:55:23 +01:00
popertotsandSisyphus a38fda612e fix: harden notification pagination and ID validation 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:55:19 +01:00
popertotsandSisyphus 453fd0dc1d feat: validate image type on server-side upload 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:55:09 +01:00
popertotsandSisyphus 965b8b2794 feat: validate admin and time-blocker request structs 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:54:59 +01:00
popertotsandSisyphus 605c1422b9 feat: validate auth and user request structs 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:54:48 +01:00
popertotsandSisyphus 8b72c3fbef deps: add go-playground/validator/v10 and update crypto deps 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-31 10:54:40 +01:00
popertots ef650e013a feat: implement patch test management and validation improvements 2026-05-29 20:21:26 +01:00
popertots f5c2c26fe4 fix: resolve compilation errors in frontend and backend 2026-05-29 17:46:15 +01:00
popertots f36497090a feat: migrate to dedicated patch test management 2026-05-29 17:19:02 +01:00
popertots 9d8015f1b8 feat: add comprehensive test suite for recent backend changes 2026-05-29 17:13:16 +01:00
popertotsandSisyphus aa75217898 refactor: bookings and services handlers with shared formatting 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-29 16:06:40 +01:00
popertotsandSisyphus 9deae1b0d7 feat: referral code validation in registration with tests 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-29 16:06:19 +01:00
popertotsandSisyphus c442c150c0 feat: scheduling exceptional hours support and default hours validation 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-28 16:29:17 +01:00
popertotsandSisyphus 3bda86e910 feat: GetBookingsByCreatedRange endpoint for admin booking queries 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-28 16:28:52 +01:00
popertots 8574bf2221 feat: enriched edit request system with side-by-side snapshots, calendar preloading, and admin review UI 
Backend:
- Add enriched response types (EditSnapshot, EnrichedEditRequest) with original vs proposed snapshots
- Add 4 new GET endpoints for viewing edit requests (user and admin scoped)
- Remove github.com/lib/pq dependency — use native PostgreSQL array scanning
- Clean up edit requests, time blockers, and notifications on booking cancellation
- Validate exceptional closed hours on admin approve (409 Conflict)
- Notification upsert on edit request replace (no duplicate admin notifications)

Frontend:
- New user EditRequestModal with time/services/both modes and lunch protection
- New admin EditRequestModal with side-by-side diff (date/time, services, notes)
- Integrate edit requests into PendingApprovals card and notifications page
- Preload 3 months of availability to prevent calendar snap-back
- Apply lunch protection to isDateUnavailable in BookingFlow and BookingCreateModal
- Fix accessibility: card list items use <button> instead of <div>

Dev & Docs:
- Seed edit requests in local-dev-2.sh
- Update all Obsidian manuals with enriched edit request documentation
- 42 new tests (438/441 passing)
 2026-05-26 11:59:07 +01:00
popertotsandSisyphus f553ebad99 fix: booking duration calculation, tip page auth, and UI polish across frontend 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-25 18:04:43 +01:00
popertotsandSisyphus 25ece1e0b4 feat: Square client dev mock for online payments and type additions 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-25 18:04:04 +01:00
popertotsandSisyphus 4a37fd6396 fix: payment API amount precision (pence), partial validation, and create payment method endpoint 
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-05-25 18:03:55 +01:00
popertots 2e1ab9d745 feat: Square payment integration, booking flow redesign, and timezone/weekday fixes 
- Add Square payment integration (mock + handlers + UI): terminal/online payments,
  refunds, tips, saved cards, webhooks. Build-tagged dev/prod clients.
- Redesign booking flow: Step 4 conditional (deposit only), Step 5 confirmation
  screen with booking ID, auto-submit on transition.
- Redesign schedule modal: 2x3 button grid with Pay Deposit/Pay Early logic.
- Add deposit warning banner at Step 1 for users with outstanding deposits.
- Fix weekday conversion bug: Go 0=Sunday vs DB 0=Monday mismatch in 6 locations.
- Fix timezone bug: UTC vs London time in closing hours validation.
- Fix frontend error parsing: plain text backend errors now displayed correctly.
- Fix crypto.randomUUID fallback for environments without Web Crypto.
- Add 7 new regression tests: closing hours, advance check, active booking limit,
  weekday conversion, UTC/London, deposit snapshot, exceptional hours.
- Fix 3 flaky tests: dynamic dates instead of fixed, no-show timing.
 2026-05-23 11:29:34 +01:00
popertots b08df624a8 feat: user notification preferences UI and API endpoints 
GET/PUT /api/user/notification-preferences with partial update support.
Toggle section in /account Admin tab (Email, SMS, Browser push).
3 new tests: defaults, full update, partial update.
Fix pre-existing timezone bug in exceptional hours tests (Truncate vs time.Date).
Update README, Technical Manual, and gap backlog (#15 struck out).
 2026-05-17 00:24:13 +01:00