feat: Add comprehensive backend validation, toast notifications, and Tokyo Night theme

- Backend: Add server-side validation with go-playground/validator/v10 - Frontend: Add toast notifications for API errors with @zerodevx/svelte-toast - UI: Complete Tokyo Night theme redesign with modern animations - Docs: Update COMPLETE_DOCUMENTATION.md and README.md with all enhancements - Validation: Email format, password strength, and input sanitization - UX: Real-time error feedback, loading states, and responsive design
2026-01-21 20:01:18 -05:00
parent 7448dfff30
commit 55c42f1f99
84 changed files with 7749 additions and 4 deletions
@@ -0,0 +1,166 @@
+package handlers
+
+import (
+	"bookmann/internal/database"
+	"net/http"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/labstack/echo/v4"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type AuthHandler struct {
+	db     *database.Queries
+	jwtKey []byte
+}
+
+func NewAuthHandler(db *database.Queries, jwtSecret string) *AuthHandler {
+	return &AuthHandler{
+		db:     db,
+		jwtKey: []byte(jwtSecret),
+	}
+}
+
+type RegisterRequest struct {
+	Email    string `json:"email" validate:"required,email"`
+	Username string `json:"username" validate:"required,min=3,max=50"`
+	Password string `json:"password" validate:"required,min=6"`
+}
+
+type LoginRequest struct {
+	Login    string `json:"login" validate:"required"` // email or username
+	Password string `json:"password" validate:"required"`
+}
+
+type AuthResponse struct {
+	Token string      `json:"token"`
+	User  UserProfile `json:"user"`
+}
+
+type UserProfile struct {
+	ID       string `json:"id"`
+	Email    string `json:"email"`
+	Username string `json:"username"`
+}
+
+// Register handles POST /api/auth/register
+func (h *AuthHandler) Register(c echo.Context) error {
+	var req RegisterRequest
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	// Check if user already exists
+	if _, err := h.db.GetUserByEmail(c.Request().Context(), req.Email); err == nil {
+		return c.JSON(http.StatusConflict, map[string]string{"error": "email already exists"})
+	}
+
+	if _, err := h.db.GetUserByUsername(c.Request().Context(), req.Username); err == nil {
+		return c.JSON(http.StatusConflict, map[string]string{"error": "username already exists"})
+	}
+
+	// Hash password
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to hash password"})
+	}
+
+	// Create user
+	user, err := h.db.CreateUser(c.Request().Context(), database.CreateUserParams{
+		Email:        req.Email,
+		Username:     req.Username,
+		PasswordHash: string(hashedPassword),
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	// Generate JWT
+	token, err := h.generateJWT(uuid.UUID(user.ID.Bytes).String())
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
+	}
+
+	return c.JSON(http.StatusCreated, AuthResponse{
+		Token: token,
+		User: UserProfile{
+			ID:       uuid.UUID(user.ID.Bytes).String(),
+			Email:    user.Email,
+			Username: user.Username,
+		},
+	})
+}
+
+// Login handles POST /api/auth/login
+func (h *AuthHandler) Login(c echo.Context) error {
+	var req LoginRequest
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	// Get user by email or username
+	user, err := h.db.GetUserByEmailOrUsername(c.Request().Context(), req.Login)
+	if err != nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
+	}
+
+	// Check password
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
+	}
+
+	// Generate JWT
+	token, err := h.generateJWT(uuid.UUID(user.ID.Bytes).String())
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
+	}
+
+	return c.JSON(http.StatusOK, AuthResponse{
+		Token: token,
+		User: UserProfile{
+			ID:       uuid.UUID(user.ID.Bytes).String(),
+			Email:    user.Email,
+			Username: user.Username,
+		},
+	})
+}
+
+// GetProfile handles GET /api/auth/profile
+func (h *AuthHandler) GetProfile(c echo.Context) error {
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user id"})
+	}
+
+	user, err := h.db.GetUser(c.Request().Context(), pgtype.UUID{Bytes: userUUID, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "user not found"})
+	}
+
+	return c.JSON(http.StatusOK, UserProfile{
+		ID:       uuid.UUID(user.ID.Bytes).String(),
+		Email:    user.Email,
+		Username: user.Username,
+	})
+}
+
+func (h *AuthHandler) generateJWT(userID string) (string, error) {
+	claims := jwt.MapClaims{
+		"user_id": userID,
+		"exp":     time.Now().Add(24 * time.Hour).Unix(),
+		"iat":     time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(h.jwtKey)
+}
@@ -0,0 +1,252 @@
+package handlers
+
+import (
+	"bookmann/internal/database"
+	"net/http"
+	"strconv"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/labstack/echo/v4"
+)
+
+type Handler struct {
+	db *database.Queries
+}
+
+func NewHandler(db *database.Queries) *Handler {
+	return &Handler{
+		db: db,
+	}
+}
+
+func SetupRoutes(g *echo.Group, db *database.Queries) {
+	h := NewHandler(db)
+
+	g.GET("/ebooks", h.ListEbooks)
+	g.GET("/ebooks/:id", h.GetEbook)
+	g.POST("/ebooks", h.CreateEbook)
+	g.PUT("/ebooks/:id", h.UpdateEbook)
+	g.DELETE("/ebooks/:id", h.DeleteEbook)
+
+	g.GET("/ebooks/:id/progress", h.GetReadingProgress)
+	g.PUT("/ebooks/:id/progress", h.UpdateReadingProgress)
+}
+
+// ListEbooks handles GET /api/ebooks
+func (h *Handler) ListEbooks(c echo.Context) error {
+	limitStr := c.QueryParam("limit")
+	offsetStr := c.QueryParam("offset")
+
+	limit := int32(20) // default
+	if limitStr != "" {
+		if l, err := strconv.Atoi(limitStr); err == nil {
+			limit = int32(l)
+		}
+	}
+
+	offset := int32(0)
+	if offsetStr != "" {
+		if o, err := strconv.Atoi(offsetStr); err == nil {
+			offset = int32(o)
+		}
+	}
+
+	ebooks, err := h.db.ListEbooks(c.Request().Context(), database.ListEbooksParams{
+		Limit:  limit,
+		Offset: offset,
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, ebooks)
+}
+
+// GetEbook handles GET /api/ebooks/:id
+func (h *Handler) GetEbook(c echo.Context) error {
+	idStr := c.Param("id")
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid id"})
+	}
+
+	ebook, err := h.db.GetEbook(c.Request().Context(), pgtype.UUID{Bytes: id, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, ebook)
+}
+
+// CreateEbookRequest represents the request for creating an ebook
+type CreateEbookRequest struct {
+	Title          string `json:"title" validate:"required,min=1,max=500"`
+	Author         string `json:"author"`
+	ISBN           string `json:"isbn"`
+	Description    string `json:"description"`
+	FilePath       string `json:"file_path" validate:"required"`
+	FileSize       int64  `json:"file_size" validate:"required,min=1"`
+	MimeType       string `json:"mime_type" validate:"required"`
+	CoverImagePath string `json:"cover_image_path"`
+}
+
+// CreateEbook handles POST /api/ebooks
+func (h *Handler) CreateEbook(c echo.Context) error {
+	var req CreateEbookRequest
+
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	ebook, err := h.db.CreateEbook(c.Request().Context(), database.CreateEbookParams{
+		Title:          req.Title,
+		Author:         pgtype.Text{String: req.Author, Valid: req.Author != ""},
+		Isbn:           pgtype.Text{String: req.ISBN, Valid: req.ISBN != ""},
+		Description:    pgtype.Text{String: req.Description, Valid: req.Description != ""},
+		FilePath:       req.FilePath,
+		FileSize:       pgtype.Int8{Int64: req.FileSize, Valid: req.FileSize > 0},
+		MimeType:       pgtype.Text{String: req.MimeType, Valid: req.MimeType != ""},
+		CoverImagePath: pgtype.Text{String: req.CoverImagePath, Valid: req.CoverImagePath != ""},
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusCreated, ebook)
+}
+
+// UpdateEbookRequest represents the request for updating an ebook
+type UpdateEbookRequest struct {
+	Title          string `json:"title" validate:"required,min=1,max=500"`
+	Author         string `json:"author"`
+	ISBN           string `json:"isbn"`
+	Description    string `json:"description"`
+	CoverImagePath string `json:"cover_image_path"`
+}
+
+// UpdateEbook handles PUT /api/ebooks/:id
+func (h *Handler) UpdateEbook(c echo.Context) error {
+	idStr := c.Param("id")
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid id"})
+	}
+
+	var req UpdateEbookRequest
+
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	ebook, err := h.db.UpdateEbook(c.Request().Context(), database.UpdateEbookParams{
+		ID:             pgtype.UUID{Bytes: id, Valid: true},
+		Title:          req.Title,
+		Author:         pgtype.Text{String: req.Author, Valid: req.Author != ""},
+		Isbn:           pgtype.Text{String: req.ISBN, Valid: req.ISBN != ""},
+		Description:    pgtype.Text{String: req.Description, Valid: req.Description != ""},
+		CoverImagePath: pgtype.Text{String: req.CoverImagePath, Valid: req.CoverImagePath != ""},
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, ebook)
+}
+
+// DeleteEbook handles DELETE /api/ebooks/:id
+func (h *Handler) DeleteEbook(c echo.Context) error {
+	idStr := c.Param("id")
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid id"})
+	}
+
+	err = h.db.DeleteEbook(c.Request().Context(), pgtype.UUID{Bytes: id, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}
+
+// GetReadingProgress handles GET /api/ebooks/:id/progress
+func (h *Handler) GetReadingProgress(c echo.Context) error {
+	ebookIdStr := c.Param("id")
+	userID := c.Get("user_id").(string)
+
+	ebookId, err := uuid.Parse(ebookIdStr)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid ebook id"})
+	}
+
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+
+	progress, err := h.db.GetReadingProgress(c.Request().Context(), database.GetReadingProgressParams{
+		EbookID: pgtype.UUID{Bytes: ebookId, Valid: true},
+		UserID:  pgtype.UUID{Bytes: userUUID, Valid: true},
+	})
+	if err != nil {
+		// If no progress found, return default
+		return c.JSON(http.StatusOK, map[string]interface{}{
+			"ebook_id":     ebookIdStr,
+			"user_id":      userID,
+			"current_page": 0,
+			"total_pages":  nil,
+		})
+	}
+
+	return c.JSON(http.StatusOK, progress)
+}
+
+// UpdateReadingProgressRequest represents the request for updating reading progress
+type UpdateReadingProgressRequest struct {
+	CurrentPage int32 `json:"current_page" validate:"required,min=0"`
+	TotalPages  int32 `json:"total_pages" validate:"omitempty,min=1"`
+}
+
+// UpdateReadingProgress handles PUT /api/ebooks/:id/progress
+func (h *Handler) UpdateReadingProgress(c echo.Context) error {
+	ebookIdStr := c.Param("id")
+	userID := c.Get("user_id").(string)
+
+	ebookId, err := uuid.Parse(ebookIdStr)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid ebook id"})
+	}
+
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+
+	var req UpdateReadingProgressRequest
+
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	progress, err := h.db.UpdateReadingProgress(c.Request().Context(), database.UpdateReadingProgressParams{
+		EbookID:     pgtype.UUID{Bytes: ebookId, Valid: true},
+		UserID:      pgtype.UUID{Bytes: userUUID, Valid: true},
+		CurrentPage: pgtype.Int4{Int32: req.CurrentPage, Valid: true},
+		TotalPages:  pgtype.Int4{Int32: req.TotalPages, Valid: req.TotalPages > 0},
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, progress)
+}