popertots
89d848ee72
docs
2026-02-23 01:19:53 +00:00
popertots
970cc5554d
feat: add email verification, profile pictures, deposits, and calendar
...
export
Backend:
- Add email verification code generation and verification endpoints
- Add profile picture upload with S3 storage and image processing
- Add deposit_required field to users with 48h advance booking
requirement
- Add loyalty stamps that accumulate on completed bookings
- Auto-transition bookings: confirmed → in_progress → completed
- Add booking cancellation handler with no-show detection
- Add ICS calendar file download endpoint for bookings
- Sync bookings to CalDAV on confirmation
Frontend:
- Add schedule page route
- Add avatar and image-cropper UI components
- Update shadcn-svelte components (button, dialog)
- Add "Add to Calendar" button in booking modal
Database:
- Add verification_codes table
- Add profile_pic_url, loyalty_stamps, deposits_required to users
- Various schema updates
2026-02-21 18:48:29 +00:00
popertots
41dc839830
feat(booking): add service eligibility based on age and patch tests
...
- Add eligibility filtering to /api/services: exclude services below
user's
age, gray out services requiring patch tests that are missing/expired
- Add new endpoint /api/services/eligible-for/{user_id} for admin
booking
flows to check eligibility for a specific user
- Add image metadata stripping: uploads now strip all EXIF/GPS data
via imaging library (security improvement)
- Update ServiceCard frontend: show grayed-out state for ineligible
services with "contact us" link (public) or just warning (admin)
- Add 2 patch test services to seed data: Gel Polish Full Set,
Luxury Gel Manicure (48h each)
- Remove deprecated local-dev.sh script
2026-02-20 18:46:38 +00:00
popertots
b4d91d5dc0
Security pass
2026-02-20 12:59:10 +00:00
popertots
a5a2ffd83e
Security: add rate limiting, input validation, and filter category
...
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
2026-02-20 12:03:14 +00:00
popertots
9259de9393
Portfolio: add filtering, URL sharing, and improved tag input
...
- Add category filters with dynamic counts that reduce as filters
applied
- Add ?filter[category]=value URL params for filterable links
- Add ?img= timestamp param that bypasses filters to show specific image
- Update URL when opening/navigating/closing modal for shareable links
- Backend: add /api/portfolio/filters endpoint with filter logic
- Backend: add timestamp lookup fallback for GetImage endpoint
Frontend:
- Portfolio page: filter dropdowns, keyboard nav, mobile improvements
- ImageUpload: live tag suggestions from API, arrow/Tab navigation,
confirmation modal before upload, mobile-optimized touch targets
- Add scrollbar-hide utility and fix filter dropdown overflow
- Move Clear all button, add vertical separator on desktop
2026-02-20 00:32:09 +00:00
popertots
d43d7ebc5e
readme
2026-02-17 22:38:22 +00:00
popertots
e20263b717
Update readme
2026-02-17 21:47:11 +00:00
popertots
105831eeb3
Update readme
2026-02-12 22:29:42 +00:00
popertots
28815d3b25
Update readme
2025-11-06 16:05:33 +00:00
popertots