david/apocapoc-api
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
68 Commits 2 Branches 13 Tags
main
Commit Graph
4 Commits
Author SHA1 Message Date
david 8d631f8fab Improve README SEO and increase test coverage to 50% 
Optimized README for better discoverability with keywords: api, habits, self-hosted. Consolidated content to reduce redundancy while maintaining clarity.

Added comprehensive test coverage across multiple layers:
- Infrastructure: bcrypt hashing, JWT tokens, configuration validation
- Application commands: user deletion, password reset, token revocation, email verification
- Application queries: login, token refresh
- Domain entities: refresh tokens, password reset tokens

Coverage increased from 42.5% to 50.8% with meaningful business logic tests.

Fixed integration test handler initialization with correct parameters.
 2025-11-28 17:59:39 +01:00
david 00f6b51228 Add optional email verification and registration control 
Implemented email service infrastructure with SMTP support and optional email verification for self-hosted deployments. Registration flow now supports open/closed modes and hardcoded Apocapoc branding.

Key features:
- Email service with SMTP and template rendering
- Optional email verification (auto-verified without SMTP config)
- Registration modes: open/closed for access control
- Hardcoded Apocapoc branding (AppName, AppURL, DefaultFrom)
- Separate registration and login flows (registration no longer returns tokens)
 2025-11-28 08:21:51 +01:00
david 7cb2756b67 Implement Sprint 2 security enhancements
CI/CD Pipeline / Test (push) Has been cancelled
Details
CI/CD Pipeline / Lint (push) Has been cancelled
Details
CI/CD Pipeline / Build and Push Docker Image (push) Has been cancelled
Details 
Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
 2025-11-27 10:33:01 +01:00
david 64bfe80806 Implement domain layer (TDD - Green phase) 
Implementation to make all tests pass:

Value Objects:
- HabitType: BOOLEAN, COUNTER, VALUE with validation
- Frequency: DAILY, WEEKLY, MONTHLY with validation

Entities:
- User: email, password hash, timezone with defaults
- Habit: tracking habits with type, frequency, carry-over
- HabitEntry: recording habit completions with soft delete

Repositories (interfaces):
- UserRepository: CRUD operations for users
- HabitRepository: CRUD operations for habits
- HabitEntryRepository: CRUD operations for entries

Shared:
- Common error definitions for domain layer

All domain tests now pass.
 2025-11-25 10:13:08 +01:00