7 Commits

Include renames

Author	SHA1	Message	Date
david	f37c1ac19b	Improve email verification flow and error handling ... - Send verification email before creating user to prevent orphaned accounts - Detect SMTP authentication errors and fail fast without retries - Add field-level validation errors for better frontend UX - Configure docker-compose with explicit environment variables - Document dollar sign escaping in .env.example (use $$) - Implement welcome email on successful verification - Clean up unnecessary comments	2025-11-28 11:32:51 +01:00
david	00f6b51228	Add optional email verification and registration control ... Implemented email service infrastructure with SMTP support and optional email verification for self-hosted deployments. Registration flow now supports open/closed modes and hardcoded Apocapoc branding. Key features: - Email service with SMTP and template rendering - Optional email verification (auto-verified without SMTP config) - Registration modes: open/closed for access control - Hardcoded Apocapoc branding (AppName, AppURL, DefaultFrom) - Separate registration and login flows (registration no longer returns tokens)	2025-11-28 08:21:51 +01:00
david	7cb2756b67	Implement Sprint 2 security enhancements ... Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests. Security improvements: - Rate limiting by user ID for /habits and /stats endpoints - X-RateLimit-Limit header in responses - Common password blacklist in password validation - Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)	2025-11-27 10:33:01 +01:00
david	358f844073	Remove unnecessary comments from codebase ... Clean up obvious and redundant comments that don't add value: - Remove step-by-step comments in command handlers - Remove obvious test setup comments - Keep only meaningful comments that explain why, not what	2025-11-27 00:48:50 +01:00
david	7768037724	Add robust input validation system and fix test suite ... - Add comprehensive validation package with email (RFC 5322), password strength, and IANA timezone validation - Implement strict password requirements: min 8 chars, uppercase, lowercase, digit, special character - Integrate validation into RegisterUserHandler with complete test coverage (59 validation tests + 25 handler tests) - Fix pre-existing test failures: - Remove tests for non-existent HabitEntry.DeletedAt and Delete() methods - Replace deprecated HabitTypeQuantity with HabitTypeValue - Add missing FindByHabitIDAndDateRange mock implementation - Remove hardcoded localhost:8080 from Swagger config for self-hosted flexibility	2025-11-27 00:17:18 +01:00
david	34ea1f718e	Implement Application Layer with TDD ... - Add date utilities for habit scheduling logic - Implement CreateHabitHandler with full validation - Implement GetTodaysHabitsHandler with carry-over support - Implement MarkHabitHandler for completing habits - All components developed following TDD methodology - Complete test coverage for commands and queries	2025-11-25 23:54:49 +01:00
david	64bfe80806	Implement domain layer (TDD - Green phase) ... Implementation to make all tests pass: Value Objects: - HabitType: BOOLEAN, COUNTER, VALUE with validation - Frequency: DAILY, WEEKLY, MONTHLY with validation Entities: - User: email, password hash, timezone with defaults - Habit: tracking habits with type, frequency, carry-over - HabitEntry: recording habit completions with soft delete Repositories (interfaces): - UserRepository: CRUD operations for users - HabitRepository: CRUD operations for habits - HabitEntryRepository: CRUD operations for entries Shared: - Common error definitions for domain layer All domain tests now pass.	2025-11-25 10:13:08 +01:00