- Create pagination package with Params and Response structs
- Add FindActiveByUserIDWithPagination and CountActiveByUserID methods to HabitRepository interface
- Implement pagination in SQLite repository using LIMIT and OFFSET
- Update GetUserHabitsHandler to support optional pagination parameters
- Modify HTTP endpoint to parse 'page' and 'page_size' query params (default: page=1, page_size=50, max=100)
- Add GetUserHabitsResponse DTO with pagination metadata
- Maintain backward compatibility - endpoint works with and without pagination params
- Add comprehensive tests for pagination logic in repository, handler, and pagination package
- Update all mock repositories to implement new pagination methods
- Add comprehensive tests for RequestPasswordResetHandler covering success and error cases
- Fix timezone-related test failures after removal of User.Timezone field:
- Remove Timezone assertions from login_user_test.go
- Remove Timezone field from RegisterRequest in integration tests
- Update ValidateRegistration test cases (no longer validates timezone)
- Update migrations_test to check current user table schema
- Fix syntax errors in user_repository_test.go (duplicate closing braces on lines 114 and 210)
Timezone is now sent from the client on each request that needs it,
instead of storing it in the database. This simplifies the model and
allows timezone to be dynamic (useful for traveling users).
Changes:
- Remove timezone field from User entity
- Remove timezone from user registration
- GET /habits/today now requires ?timezone= query param
- Add migration to drop timezone column from database
- Update related tests
- Send verification email before creating user to prevent orphaned accounts
- Detect SMTP authentication errors and fail fast without retries
- Add field-level validation errors for better frontend UX
- Configure docker-compose with explicit environment variables
- Document dollar sign escaping in .env.example (use $$)
- Implement welcome email on successful verification
- Clean up unnecessary comments
Implemented email service infrastructure with SMTP support and optional email verification for self-hosted deployments. Registration flow now supports open/closed modes and hardcoded Apocapoc branding.
Key features:
- Email service with SMTP and template rendering
- Optional email verification (auto-verified without SMTP config)
- Registration modes: open/closed for access control
- Hardcoded Apocapoc branding (AppName, AppURL, DefaultFrom)
- Separate registration and login flows (registration no longer returns tokens)
Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.
Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
Clean up obvious and redundant comments that don't add value:
- Remove step-by-step comments in command handlers
- Remove obvious test setup comments
- Keep only meaningful comments that explain why, not what
- Add date utilities for habit scheduling logic
- Implement CreateHabitHandler with full validation
- Implement GetTodaysHabitsHandler with carry-over support
- Implement MarkHabitHandler for completing habits
- All components developed following TDD methodology
- Complete test coverage for commands and queries
Implementation to make all tests pass:
Value Objects:
- HabitType: BOOLEAN, COUNTER, VALUE with validation
- Frequency: DAILY, WEEKLY, MONTHLY with validation
Entities:
- User: email, password hash, timezone with defaults
- Habit: tracking habits with type, frequency, carry-over
- HabitEntry: recording habit completions with soft delete
Repositories (interfaces):
- UserRepository: CRUD operations for users
- HabitRepository: CRUD operations for habits
- HabitEntryRepository: CRUD operations for entries
Shared:
- Common error definitions for domain layer
All domain tests now pass.
david