Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.
Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
Clean up obvious and redundant comments that don't add value:
- Remove step-by-step comments in command handlers
- Remove obvious test setup comments
- Keep only meaningful comments that explain why, not what
- Add date utilities for habit scheduling logic
- Implement CreateHabitHandler with full validation
- Implement GetTodaysHabitsHandler with carry-over support
- Implement MarkHabitHandler for completing habits
- All components developed following TDD methodology
- Complete test coverage for commands and queries
Implementation to make all tests pass:
Value Objects:
- HabitType: BOOLEAN, COUNTER, VALUE with validation
- Frequency: DAILY, WEEKLY, MONTHLY with validation
Entities:
- User: email, password hash, timezone with defaults
- Habit: tracking habits with type, frequency, carry-over
- HabitEntry: recording habit completions with soft delete
Repositories (interfaces):
- UserRepository: CRUD operations for users
- HabitRepository: CRUD operations for habits
- HabitEntryRepository: CRUD operations for entries
Shared:
- Common error definitions for domain layer
All domain tests now pass.
david