Bookhoard/bookhoard
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity
922 Commits 5 Branches 13 Tags
0438ec4625b483919785d9ef88d7f96a5480eb2f
Commit Graph
21 Commits
Author SHA1 Message Date
john-okeefe 0438ec4625 refactor(middleware): fix type signatures for Echo v5 compatibility 
Update all middleware functions to use *echo.Context (pointer) instead of echo.Context (value) as required by Echo v5.

Changes in device_auth.go:
- Update DeviceAuthMiddleware() signature (line 38)
- Update validateDeviceAuth() signature (line 170)
- Update RequireDeviceAuth() signature (line 212)

Changes in error_handler.go:
- Update RespondWithError() signature (line 44)
- Update RespondWithHTTPError() signature (line 69)
- Update WrapHandler() to accept *echo.Context (line 82)
- Fix context passing in WrapHandler() (c is already pointer)

Changes in rate_limiter.go:
- Update RateLimiterMiddleware() signature (line 102)

Changes in request_tracing.go:
- Update RequestTracingMiddleware() signature (line 48)
- Fix Response() dereference for v5 API (line 264)
  - Use *c.Response() to get http.ResponseWriter

Changes in security.go:
- Update SecurityHeadersMiddleware() signature (line 14)

Changes in device_auth_test.go:
- Update test helper signatures

Changes in middleware_test.go:
- Remove unused import

All middleware now properly implements Echo v5's pointer-based context pattern.
 2026-03-06 14:00:05 -05:00
john-okeefe 02ff078adf fix: validate UUIDs in OPDS middleware before authentication 
- Add UUID validation in device_auth middleware for OPDS routes
- Return 400 Bad Request for invalid device/book IDs instead of 401
- Remove redundant UUID validation from OPDS handlers (middleware handles it)
 2026-02-14 00:12:15 -05:00
john-okeefe 289284522b test: add test reliability plan and device test coverage 
- Add TEST_RELIABILITY_PLAN.md documenting test strategy
- Add devices_test.go with device handler tests
- Add device_auth_test.go with device authentication middleware tests
 2026-02-13 16:37:54 -05:00
john-okeefe b1fcf2ce95 feat: support multiple device authentication methods 
- Bearer token in Authorization header (KOReader, API clients)
- URL path parameter (Kobo sync: /api/sync/kobo/:token/...)
- Query parameter (OPDS: ?token=...)
- Update Kobo sync routes to use token in path
- Add authentication method documentation to OPDS routes
 2026-02-13 12:12:36 -05:00
john-okeefe 82a5cf70f2 fix(middleware): Correct rate limit header type conversion 
- Fix string(rune(remaining)) to strconv.Itoa(remaining) in device_auth.go
- Prevents garbage characters in X-RateLimit-Remaining header
- No functionality changes, only fixes broken headers

Testing: Verified with code inspection that headers return proper integers
 2026-02-10 12:40:52 -05:00
john-okeefe 2200720537 fix(middleware): Correct rate limit header type conversion 2026-02-10 12:06:12 -05:00
john-okeefe d936311079 test: fix failing unit tests 
- Fix TestDeviceRateLimiter_GetRemainingRequests: use 'sync' instead of 'scan' request type (scan doesn't exist in device auth middleware)
- Fix TestHTTPError_ErrorWithInternal: update expectation to include internal error message
- Fix TestNormalizeISBN_SpecialCharacters: remove invalid ISBN test cases, update expectations to match actual function behavior
 2026-02-06 12:16:13 -05:00
john-okeefe 655ed9225f Update code references and tests: Bookmann → Bookhoard 
Code changes:
- main.go: Update cache directory path
- sidecar.go: Update file extension (.bookmann.json → .bookhoard.json)
- security.go: Update CORS example URLs
- queue_test.go: Update test database name
- feed_test.go: Update test assertions
- phase1_integration_test.go: Update test email addresses
- TEST_COVERAGE.md: Update project references

Part of project rename to Bookhoard.
 2026-02-01 16:21:10 -05:00
john-okeefe 00a083b60b Rename backend code references: Bookmann → Bookhoard 
Backend changes:
- Update import paths: bookmann/internal → bookhoard/internal
- Rename struct fields: BookmannUUID → BookhoardUUID
- Update handler function names: mapContentIdToBookmannUUID → mapContentIdToBookhoardUUID
- Update HTTP response headers: X-Bookmann-* → X-Bookhoard-*
- Update service and middleware references
- Update main.go imports and references

This is part 2 of the project rename to Bookhoard.
 2026-02-01 16:11:54 -05:00
john-okeefe 351c68b0b8 test: add comprehensive test coverage for API endpoints and services 2026-02-01 13:21:34 -05:00
john-okeefe 50c632babf Update SSL/TLS handling for Docker reverse proxy deployments 
- Disable HTTPSRedirectMiddleware (SSL handled by proxy)
- Keep SSLProxyMiddleware for X-Forwarded-* headers
- Add note about Docker deployment architecture
- Database connections use sslmode=disable
- No redirect needed for reverse proxy setup
 2026-01-31 13:06:50 -05:00
john-okeefe c9ec222945 feat: add ValidateDeviceToken method to device auth middleware 
Add device token validation method for WebSocket authentication:
- Validates device auth tokens against database
- Returns device information for valid tokens
- Used by WebSocket handler for device authentication

This enables devices to authenticate WebSocket connections
using their bearer tokens.
 2026-01-30 21:47:30 -05:00
john-okeefe f6124dc537 Phase 3 Week 7: Fix device auth middleware to set device object 
- Update device auth middleware to set actual device object
- Change from DeviceContext to database.Devices
- Fix RequirePermission to use database.Devices
- Ensures handlers can access full device information
- Required for KOReader sync handlers to function properly
 2026-01-30 20:55:13 -05:00
john-okeefe 1a769783dc Phase 2 Week 6: Device Authentication & Rate Limiting 
Implement per-device authentication with rate limiting and permissions.

Device Rate Limiter (device_rate_limiter.go):
- DeviceRateLimiter: Track requests per device and request type
- CheckRateLimit: Verify device hasn't exceeded limits
- GetRemainingRequests: Return remaining request quota
- Reset: Clear rate limit data for specific device
- cleanupOldEntries: Remove stale entries automatically
- Request Types: sync, progress, metadata
- Rate Limits:
  * Sync requests: 60/minute
  * Progress updates: 120/minute (page turns)
  * Metadata requests: 30/minute

Device Auth Middleware Updates:
- Add rateLimiter to DeviceAuthMiddleware
- Check rate limits during authentication
- Return 429 Too Many Requests when limits exceeded
- Set rate limit headers:
  * X-RateLimit-Limit: Request limit
  * X-RateLimit-Remaining: Quota remaining
  * X-RateLimit-Reset: Reset time
- getRequestType: Determine request type from URL path

Request Type Detection:
- /progress endpoints → progress type (120/min)
- /metadata, /library endpoints → metadata type (30/min)
- All other sync endpoints → sync type (60/min)

Benefits:
- Prevent device abuse and DoS attacks
- Fair resource allocation across devices
- Higher limits for frequent operations (page turns)
- Lower limits for expensive operations (metadata)
- Automatic cleanup of stale data
- Per-device isolation (one device can't affect others)

Integration with Device Auth:
- Rate limit check happens after token validation
- Before processing actual sync request
- Returns standard HTTP 429 with retry info
- Works seamlessly with existing device middleware

Device revocation still available via:
- DELETE /api/devices/:id endpoint
- Sets auth_token to NULL
- Disables sync_enabled flag
 2026-01-30 16:47:29 -05:00
john-okeefe 23ad70158c Phase 2 Week 5: Device Registration & Management 
Implement device registration and management system for universal sync.

Database Changes:
- Add device queries to queries.sql (CRUD operations, registration, auth)
- Add sync queue management queries
- Add conflict resolution queries
- Regenerate sqlc models with new device-related types

Device Handler (devices.go):
- InitiateRegistration: Start device registration with auth URL and QR code
- CheckRegistrationStatus: Poll for registration approval
- ListDevices: Get all devices for current user
- GetDevice: Get specific device details
- UpdateDevice: Update device settings (name, sync settings, frequency)
- DeleteDevice: Remove device from account
- ApproveDevice: User approves device registration via web
- RejectDevice: Reject pending device registration
- ListPendingRegistrations: Show all pending registrations
- generateDeviceToken: Generate secure Bearer token for devices

Device Authentication Middleware (device_auth.go):
- Authenticate: Validate device Bearer tokens
- RequirePermission: Check device permissions by type
- hasPermission: Define permissions per device type
- UpdateLastSeen: Auto-update device last_seen timestamp

Configuration:
- Add BaseURL field to Config for device setup URLs

API Endpoints:
POST /api/devices/register - Initiate device registration
POST /api/devices/register/status - Check registration status
GET /api/devices/approve/:id - Approve device (web UI)
POST /api/devices/reject/:id - Reject device
GET /api/devices - List user's devices
GET /api/devices/:id - Get device details
PUT /api/devices/:id - Update device settings
DELETE /api/devices/:id - Delete device
GET /api/devices/pending - List pending registrations

Bruno API Collection:
- Initiate Device Registration
- Check Registration Status
- List Devices
- Get Device
- Update Device
- Delete Device

Dependencies:
- github.com/skip2/go-qrcode for QR code generation

Device Types Supported:
- koreader: Calibre-compatible sync
- kobo: Kobo sync protocol
- web: Web interface
- mobile: Mobile apps

Device Permissions:
- sync:progress
- sync:annotations
- sync:metadata
- device:manage (web only)
 2026-01-30 16:45:10 -05:00
john-okeefe 4b8cb58c84 feat: add configurable test mode and rate limiting 
- Add TestMode, RateLimitEnabled, RequestsPerMinute to Config
- Add getEnvBool() and getEnvInt() helper functions
- Update rate limiter to support enabled/disabled state
- Pass test environment variables through docker-compose
- Configure rate limiter dynamically in main.go

This allows disabling rate limiting for integration testing while
maintaining security in production environments.
 2026-01-29 13:33:18 -05:00
john-okeefe 3cff30ea89 feat(middleware): add request tracing and logging middleware 
- Add RequestTracingMiddleware for comprehensive HTTP request logging
- Log request ID, timestamp, method, path, user info, duration, status code
- Generate and propagate unique request IDs for tracing
- Structured JSON logging for easy parsing and analysis
- Capture request body, headers, query params, and user context
 2026-01-29 09:49:56 -05:00
john-okeefe 2c560c411e feat(middleware): add transaction and error handling support 
- Add transaction manager for multi-step database operations
- Add standardized error response middleware
- Add HTTPError type for typed errors
- Add RespondWithError and RespondWithHTTPError helpers
- Support automatic rollback on errors
 2026-01-29 09:23:34 -05:00
john-okeefe 1e04ef4861 test(security): add comprehensive security tests 
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
 2026-01-29 09:23:34 -05:00
john-okeefe 311361a2ed feat(security): add password complexity validator 
- Implement strict password requirements:
  - Minimum 8 characters
  - At least one uppercase letter
  - At least one lowercase letter
  - At least one number
  - At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
 2026-01-29 09:23:34 -05:00
john-okeefe 7db8bde4bb feat: add rate limiting to authentication endpoints 
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records

Closes security issue: No rate limiting on auth endpoints
 2026-01-29 09:23:33 -05:00