david/apocapoc-api
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
58 Commits 2 Branches 13 Tags
feature/offline-sync
Commit Graph
4 Commits
Author SHA1 Message Date
david f780c69806 Add tests for RequestPasswordResetHandler and fix test compilation errors 
- Add comprehensive tests for RequestPasswordResetHandler covering success and error cases
- Fix timezone-related test failures after removal of User.Timezone field:
  - Remove Timezone assertions from login_user_test.go
  - Remove Timezone field from RegisterRequest in integration tests
  - Update ValidateRegistration test cases (no longer validates timezone)
  - Update migrations_test to check current user table schema
- Fix syntax errors in user_repository_test.go (duplicate closing braces on lines 114 and 210)
 2025-12-01 23:04:40 +01:00
david 5d92820591 Remove timezone from User model and pass as request parameter 
Timezone is now sent from the client on each request that needs it,
instead of storing it in the database. This simplifies the model and
allows timezone to be dynamic (useful for traveling users).

Changes:
- Remove timezone field from User entity
- Remove timezone from user registration
- GET /habits/today now requires ?timezone= query param
- Add migration to drop timezone column from database
- Update related tests
 2025-11-29 16:18:04 +01:00
david 7cb2756b67 Implement Sprint 2 security enhancements
CI/CD Pipeline / Test (push) Has been cancelled
Details
CI/CD Pipeline / Lint (push) Has been cancelled
Details
CI/CD Pipeline / Build and Push Docker Image (push) Has been cancelled
Details 
Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
 2025-11-27 10:33:01 +01:00
david 7768037724 Add robust input validation system and fix test suite 
- Add comprehensive validation package with email (RFC 5322), password strength, and IANA timezone validation
- Implement strict password requirements: min 8 chars, uppercase, lowercase, digit, special character
- Integrate validation into RegisterUserHandler with complete test coverage (59 validation tests + 25 handler tests)
- Fix pre-existing test failures:
  - Remove tests for non-existent HabitEntry.DeletedAt and Delete() methods
  - Replace deprecated HabitTypeQuantity with HabitTypeValue
  - Add missing FindByHabitIDAndDateRange mock implementation
- Remove hardcoded localhost:8080 from Swagger config for self-hosted flexibility
 2025-11-27 00:17:18 +01:00