popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
190 Commits 1 Branch 0 Tags
fc69fec361dd3d1276b2da8ff987c8a20ab5fe37
Commit Graph
6 Commits
Author SHA1 Message Date
popertotsandSisyphus ce1a25f054 fix: remove double image processing in upload handler 
Frontend now compresses and strips metadata before upload.
Skip backend re-encoding to preserve quality and reduce latency.
Extract independent extensions for main file vs thumbnail.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
 2026-04-29 22:56:14 +01:00
popertots df3439bd70 fix: improve test infrastructure and add ID validation 
- Add TestMain to set test env vars and testdb.TruncateTables for test
  isolation
- Add chi routing context to test helpers for path parameter extraction
- Fix SQL error handling to use errors.Is() instead of ==
- Add validators package with ID validation
- Fix admin test middleware chain (RequireAdmin wrapper)
- Update test user inserts to include phone and date_of_birth fields
- Update service delete test to check soft-delete (is_active=false)
- Update holiday hours test to use new schema (weekday, is_open)
- Add phone number validation tests for UK mobile numbers
 2026-02-23 00:59:32 +00:00
popertots eb1a719fc3 Exif stripping 2026-02-20 17:22:43 +00:00
popertots a5a2ffd83e Security: add rate limiting, input validation, and filter category 
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
  limiter
- Apply rate limits per endpoint group:
  - Public read-only: 120/min
  - Registration: 10/min
  - Portfolio filters: 60/min
  - Authenticated users: 120/min
  - Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
  digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
  (0-168)
  Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
  password (72)
- Add maxlength=100 to service name input
 2026-02-20 12:03:14 +00:00
popertots 9259de9393 Portfolio: add filtering, URL sharing, and improved tag input 
- Add category filters with dynamic counts that reduce as filters
  applied
- Add ?filter[category]=value URL params for filterable links
- Add ?img= timestamp param that bypasses filters to show specific image
- Update URL when opening/navigating/closing modal for shareable links
- Backend: add /api/portfolio/filters endpoint with filter logic
- Backend: add timestamp lookup fallback for GetImage endpoint
  Frontend:
- Portfolio page: filter dropdowns, keyboard nav, mobile improvements
- ImageUpload: live tag suggestions from API, arrow/Tab navigation,
  confirmation modal before upload, mobile-optimized touch targets
- Add scrollbar-hide utility and fix filter dropdown overflow
- Move Clear all button, add vertical separator on desktop
 2026-02-20 00:32:09 +00:00
popertots 3a77e582e3 Split admin dashboard, implement user and booking search 2026-01-17 18:55:58 +00:00