- Send verification email before creating user to prevent orphaned accounts
- Detect SMTP authentication errors and fail fast without retries
- Add field-level validation errors for better frontend UX
- Configure docker-compose with explicit environment variables
- Document dollar sign escaping in .env.example (use $$)
- Implement welcome email on successful verification
- Clean up unnecessary comments
Implemented email service infrastructure with SMTP support and optional email verification for self-hosted deployments. Registration flow now supports open/closed modes and hardcoded Apocapoc branding.
Key features:
- Email service with SMTP and template rendering
- Optional email verification (auto-verified without SMTP config)
- Registration modes: open/closed for access control
- Hardcoded Apocapoc branding (AppName, AppURL, DefaultFrom)
- Separate registration and login flows (registration no longer returns tokens)
- Replace mattn/go-sqlite3 with modernc.org/sqlite (pure-Go, no CGO required)
- Update GoReleaser config to disable CGO for ARM64 builds
- Change driver name from 'sqlite3' to 'sqlite' in all sql.Open calls
- Enables successful cross-compilation for ARM64 without cross-compiler toolchain
- All tests passing with new driver
- Add GoReleaser configuration for Linux binaries (amd64, arm64)
- Add release job to GitHub Actions for tagged versions
- Remove github.server_url validations (Gitea CI disabled)
- Update README with binary download instructions
- Releases will include compiled binaries and changelogs
- Replace 'stable' tag with semver-based tags (1.2.3, 1.2, 1)
- Use 'edge' tag for main branch instead of 'latest'
- Reserve 'latest' tag only for tagged releases
- Remove version from Swagger docs (tracked via git tags instead)
- Document available image tags in README
Update test passwords from 'password123' to 'Password123!' to meet security requirements (uppercase, lowercase, digit, special char).
Fix migrations test to match actual habit_entries schema (removed non-existent deleted_at column).
- Add github.server_url check to prevent workflow execution on Gitea
- Implement clear separation between development (latest) and production (stable) tags
- Use stable tag only for versioned releases (v*)
- Add sha- prefix to commit-based tags for better clarity
- Remove redundant branch name tags
Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.
Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)
COUNTER type:
- Only accepts integer values (rejects decimals)
- Auto-increment behavior: each mark adds to existing value
- Supports decrement via negative values (e.g., -2)
- Enforces minimum value of 0 (never negative)
- Default increment is 1 if no value provided
VALUE type:
- Accepts decimal values
- Replaces value (no auto-increment)
IsNegative field:
- New boolean field on Habit entity
- Persisted in database (is_negative column)
- Available in all DTOs and HTTP responses
- Marks habits as "negative" (e.g., candy consumption)
Examples:
- COUNTER: 5 + (-2) = 3, 2 + (-3) = 0, 0 + (-1) = 0
- VALUE: 5000 → 12000 = 12000 (replacement)
Clean up obvious and redundant comments that don't add value:
- Remove step-by-step comments in command handlers
- Remove obvious test setup comments
- Keep only meaningful comments that explain why, not what
Replace generic string types with strongly-typed value objects throughout
the application layer. This change ensures compile-time type checking and
automatic validation during JSON deserialization.
Changes:
- Add JSON marshaling/unmarshaling to HabitType and Frequency value objects
- Update all DTOs to use typed fields instead of strings
- Update commands and queries to use proper types
- Remove unnecessary string conversions
- Add comprehensive JSON serialization tests
- Fix existing tests to work with typed fields
Benefits:
- Type safety: compiler catches invalid usage
- Automatic validation: invalid values rejected during JSON parsing
- Better code documentation and self-explanatory APIs
- Reduced runtime errors
- Create PasswordHasher interface in domain layer
- Implement BcryptHasher in infrastructure layer
- Update RegisterUserHandler and LoginUserHandler to use interface
- Remove bcrypt dependency from application layer
- Update main.go and integration tests with dependency injection
- Enhance CI/CD workflow with test and lint jobs
- Add code coverage check (minimum 50%)
- Add go vet and gofmt validation
- Configure build job to depend on test and lint passing
- Update GitHub Actions to latest versions (v4→v5)
This achieves 100% SOLID compliance (DIP) and ensures Clean Architecture
by removing external library dependencies from application/domain layers.
- Implement comprehensive health check with database ping
- Track and report server uptime
- Return proper HTTP status codes (503 if database is down)
- Add Swagger documentation for health endpoint
- Add httprate dependency for rate limiting
- Apply 10 requests per minute limit on auth endpoints
- Prevent brute force attacks on login/register
- Update README with security features
- Implement GetHabitStatsHandler with streak calculations
- Calculate current streak, longest streak, and completion rate
- Track completions this week and this month
- Add stats HTTP handler and route at /api/v1/stats/habits/{id}
- Add Swagger documentation for stats endpoint
- Add Swagger dependencies to go.mod
- Annotate all API endpoints with Swagger comments
- Add Swagger UI at /api/v1/docs endpoint
- Auto-generate Swagger docs in Dockerfile build
- Update README with API documentation link
- Create Dockerfile with multi-stage build for optimized image size
- Add GitHub Actions workflow for automatic image publishing to ghcr.io
- Add PORT and HOST fallback defaults in config (8080 and 0.0.0.0)
- Update README with Docker Compose installation instructions
Remove soft delete from HabitEntry:
- Eliminate DeletedAt field from entity and database
- Change UnmarkHabit from soft delete to hard delete
- Simplify all queries removing deleted_at checks
- Update migration to remove deleted_at column
Add date filtering and smart pagination to GetHabitEntries:
- Support optional from/to date parameters
- Implement intelligent pagination rules:
* No date range: pagination required
* Date range > 1 year: pagination required
* Date range ≤ 1 year: pagination optional
- Pagination defaults (page=1, limit=50) only when required
- Return metadata with total count, page, and limit
Technical improvements:
- Cleaner codebase without soft delete complexity
- Better performance (no filtering in queries)
- More intuitive API with flexible pagination
- Comprehensive test coverage for validation rules
Implement all missing endpoints for full habit management:
- GET /api/v1/habits - List all user habits
- GET /api/v1/habits/{id} - Get specific habit
- PUT /api/v1/habits/{id} - Update habit
- DELETE /api/v1/habits/{id} - Archive habit (soft delete)
- GET /api/v1/habits/{id}/entries - Get habit entry history
- DELETE /api/v1/habits/{id}/entries/{date} - Unmark habit (soft delete entry)
All endpoints include:
- TDD approach with comprehensive test coverage
- JWT authentication and ownership validation
- Proper error handling (404, 403, 400, 500)
- Clean architecture with separated commands/queries
Update module name and all imports from habit-tracker-api to apocapoc-api.
This reflects the project's new branding as part of the apocapoc ecosystem
(apocapoc-api, apocapoc-web, apocapoc-android).
- Create register and login use cases
- Implement JWT service for token generation and validation
- Add authentication middleware to protect habit endpoints
- Create auth HTTP handlers (register, login)
- Update habit handlers to extract userID from JWT token
- Register/login endpoints: POST /auth/register, POST /auth/login
- Habit endpoints now require Bearer token in Authorization header
- Tested: register -> create habit -> list habits works correctly
- Create DTOs for HTTP requests and responses
- Implement habit handlers (create, get today's, mark)
- Register routes in router: POST /habits, GET /habits/today, POST /habits/{id}/mark
- Add missing repository methods (FindByID, FindByHabitID, FindPendingByHabitID, Delete)
- Wire up dependencies in main.go
- Tested with curl: create, list, mark habits work correctly
- Add strict configuration management (no fallbacks)
- Create HTTP router with Chi and CORS middleware
- Implement health check endpoint
- Add main entry point with database initialization
- Server runs on configurable host and port
- Add date utilities for habit scheduling logic
- Implement CreateHabitHandler with full validation
- Implement GetTodaysHabitsHandler with carry-over support
- Implement MarkHabitHandler for completing habits
- All components developed following TDD methodology
- Complete test coverage for commands and queries
- Add SQLite and UUID dependencies (go-sqlite3, google/uuid)
- Create database connection with automatic migrations
- Implement UserRepository with full CRUD operations
- Implement HabitRepository with JSON serialization for arrays
- Implement HabitEntryRepository with date range queries
- Add comprehensive test coverage for all repositories
- Fix User entity to default timezone to UTC when empty
- All tests passing with TDD approach (Red-Green-Refactor)
Implementation to make all tests pass:
Value Objects:
- HabitType: BOOLEAN, COUNTER, VALUE with validation
- Frequency: DAILY, WEEKLY, MONTHLY with validation
Entities:
- User: email, password hash, timezone with defaults
- Habit: tracking habits with type, frequency, carry-over
- HabitEntry: recording habit completions with soft delete
Repositories (interfaces):
- UserRepository: CRUD operations for users
- HabitRepository: CRUD operations for habits
- HabitEntryRepository: CRUD operations for entries
Shared:
- Common error definitions for domain layer
All domain tests now pass.
Following TDD principles, adding tests before implementation:
- Add HabitType value object tests (validation)
- Add Frequency value object tests (validation)
- Add User entity tests (creation, default timezone)
- Add Habit entity tests (creation, archive, active status)
- Add HabitEntry entity tests (creation, soft delete)
Tests cover core domain logic and business rules.
All tests will fail until implementation is added.
- Add MIT License (Copyright 2025 David Folch Agulles)
- Add README with project description
- Add .gitignore for Go project
- Add .env.example for configuration
- Initialize Go module
david