3 Commits

Author	SHA1	Message	Date
david	5d92820591	Remove timezone from User model and pass as request parameter ... Timezone is now sent from the client on each request that needs it, instead of storing it in the database. This simplifies the model and allows timezone to be dynamic (useful for traveling users). Changes: - Remove timezone field from User entity - Remove timezone from user registration - GET /habits/today now requires ?timezone= query param - Add migration to drop timezone column from database - Update related tests	2025-11-29 16:18:04 +01:00
david	7cb2756b67	Implement Sprint 2 security enhancements ... Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests. Security improvements: - Rate limiting by user ID for /habits and /stats endpoints - X-RateLimit-Limit header in responses - Common password blacklist in password validation - Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)	2025-11-27 10:33:01 +01:00
david	7768037724	Add robust input validation system and fix test suite ... - Add comprehensive validation package with email (RFC 5322), password strength, and IANA timezone validation - Implement strict password requirements: min 8 chars, uppercase, lowercase, digit, special character - Integrate validation into RegisterUserHandler with complete test coverage (59 validation tests + 25 handler tests) - Fix pre-existing test failures: - Remove tests for non-existent HabitEntry.DeletedAt and Delete() methods - Replace deprecated HabitTypeQuantity with HabitTypeValue - Add missing FindByHabitIDAndDateRange mock implementation - Remove hardcoded localhost:8080 from Swagger config for self-hosted flexibility	2025-11-27 00:17:18 +01:00