Bookhoard/bookhoard
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity
142 Commits 5 Branches 13 Tags
305deac4fda99fcafce30d5c359f2867409893ab
Commit Graph
5 Commits
Author SHA1 Message Date
john-okeefe 3cff30ea89 feat(middleware): add request tracing and logging middleware 
- Add RequestTracingMiddleware for comprehensive HTTP request logging
- Log request ID, timestamp, method, path, user info, duration, status code
- Generate and propagate unique request IDs for tracing
- Structured JSON logging for easy parsing and analysis
- Capture request body, headers, query params, and user context
 2026-01-29 09:49:56 -05:00
john-okeefe 2c560c411e feat(middleware): add transaction and error handling support 
- Add transaction manager for multi-step database operations
- Add standardized error response middleware
- Add HTTPError type for typed errors
- Add RespondWithError and RespondWithHTTPError helpers
- Support automatic rollback on errors
 2026-01-29 09:23:34 -05:00
john-okeefe 1e04ef4861 test(security): add comprehensive security tests 
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
 2026-01-29 09:23:34 -05:00
john-okeefe 311361a2ed feat(security): add password complexity validator 
- Implement strict password requirements:
  - Minimum 8 characters
  - At least one uppercase letter
  - At least one lowercase letter
  - At least one number
  - At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
 2026-01-29 09:23:34 -05:00
john-okeefe 7db8bde4bb feat: add rate limiting to authentication endpoints 
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records

Closes security issue: No rate limiting on auth endpoints
 2026-01-29 09:23:33 -05:00