- Implement strict password requirements:
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
- At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
Document new security and validation features:
- Rate limiting on auth endpoints
- Improved input validation
- Pagination limits
- Path validation
- Role normalization
Updates reflect the security improvements made to the application
- Add os package import for file system checks
- Validate that folder paths exist before adding to library
- Check folder accessibility to prevent invalid paths
- Return clear error messages for invalid folders
Improves user experience by catching path errors early
- Enforce maximum pagination limit of 1000 items per request
- Prevent negative offset values in pagination
- Apply limits to both /api/ebooks and /api/media-items endpoints
- Protect against DoS attacks from large limit values
Fixes security issue: No maximum pagination limit
- Trim whitespace from usernames and validate non-empty
- Normalize role values to lowercase for case-insensitive comparison
- Prevent registration with whitespace-only usernames
- Maintain backward compatibility with existing functionality
Fixes validation gap: Username whitespace handling
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records
Closes security issue: No rate limiting on auth endpoints
- Fix database authentication error by exposing actual database error messages
- Update error handling to follow pgx v5 standards with detailed error reporting
- Restore token environment variable management in Register User.bru for subsequent requests
- Enable proper debugging of database connection issues during user registration
The registration API now provides detailed error messages instead of generic 'failed to check existing users'
when database connection or authentication fails, making debugging easier.
- Convert all JSON tests to JavaScript functions for bruToJsonV2 compatibility
- Update authentication to use 'inherit' instead of manual headers
- Fix hardcoded URLs to use {{base_url}} variables
- Standardize variable syntax from {{ _.var }} to {{var}}
- Add comprehensive API documentation to all requests
- Update environment variables with missing required fields
- Apply consistent structure: meta, http method, headers, tests, vars, settings, docs
- Enhanced validation with proper error handling and field checks
This major update implements a complete user annotation system:
## 🎯 New Features
- User notes with position tracking for media items
- Text highlighting with customizable colors
- Highlight-note associations for detailed annotations
- Full CRUD API for both notes and highlights
- Backward compatibility with existing ebook endpoints
## 📊 Database Changes
- Add media_notes table (id, media_item_id, user_id, content, position, timestamps)
- Add media_highlights table (id, media_item_id, user_id, selection_text, start/end_position, color, optional note_id)
- Add foreign key relationships with CASCADE deletes
- Add proper indexes for performance
- Add database schema views for ebook backward compatibility
## 🔧 API Implementation
- Complete REST API endpoints for notes and highlights
- JWT authentication with proper middleware bypass
- Request validation with meaningful error responses
- UUID validation and type safety
- Support for hex color codes in highlights
## 🧪 Testing & Documentation
- Comprehensive test suite covering authentication scenarios
- Bruno API collection for manual testing
- Detailed testing guide with troubleshooting
- Updated documentation in README and TESTING.md
## 📁 Backward Compatibility
- Existing ebook endpoints continue working
- Database views maintain API contracts
- No breaking changes for existing integrations
The annotation system is now fully functional and ready for production use.
- Add detailed testing instructions in TESTING.md
- Include quick start commands for all test scenarios
- Document new notes and highlights test coverage
- Add coverage analysis and reporting commands
- Include troubleshooting guide for common issues
- Add test flag reference and workflow recommendations
- Document test categories and what they verify
- Fix undefined variable 'resp' errors in library_test.go (should be 'req')
- Fix authentication test expectations to match unauthorized response
- Fix TestUserVisibleLibraries to properly simulate user visibility filtering
- Remove hidden library from mock user response to test visibility correctly
- All tests now pass successfully
- Add testify/assert and testify/require for testing
- Update module dependencies after adding annotation features
- Ensure proper pgx v5 compatibility with new database operations
- Add notes and highlights to Media Management features section
- Document complete API endpoints for annotations (CRUD operations)
- Update database schema documentation with new tables
- Add backward compatibility endpoints for existing ebook API
- Update Bruno collection structure to show new test directories
- Document highlight-note association and color customization features
- Remove temporary DOCUMENTATION_UPDATES.md after merging content
- Add complete test suite for media notes API with validation
- Add complete test suite for media highlights API with color validation
- Add backward compatibility tests for ebook endpoints
- Test authentication scenarios (unauthorized access)
- Test request validation and error handling
- Fix existing test import issues and syntax errors
- Add test cases for highlight-note associations
- Add complete Bruno collection for notes API (5 endpoints)
- Add complete Bruno collection for highlights API (5 endpoints)
- Include detailed request/response documentation
- Add proper validation examples and error cases
- Support both media-items and ebook endpoint testing
- Add environment variable support for dynamic IDs
- Add complete CRUD API for media items notes (/api/media-items/:id/notes/*)
- Add complete CRUD API for media highlights (/api/media-items/:id/highlights/*)
- Add backward compatibility endpoints for ebooks (/api/ebooks/:id/notes/*, /api/ebooks/:id/highlights/*)
- Implement proper validation for request payloads and UUIDs
- Support hex color codes for highlights with default yellow (#ffff00)
- Support position tracking (page:offset or CFI formats)
- Support optional note association with highlights
- Add MediaNotes and MediaHighlights model structs with pgx v5 types
- Add EbookNotes and EbookHighlights for backward compatibility
- Add complete CRUD SQL queries for notes and highlights
- Add database connection pool function using pgx v5
- Generate sqlc code for new annotation functionality
- Add media_notes table for user annotations with position tracking
- Add media_highlights table for text highlighting with color customization
- Add optional note_id foreign key for highlight-note associations
- Add backward compatibility views (ebook_notes, ebook_highlights)
- Add proper indexes for performance optimization
- Update schema comments to document new annotation features
- Add authentication middleware tests for JWT validation
- Create library management tests for CRUD operations
- Add user visibility control tests
- Add JSON validation and error handling tests
- Add security testing for authorization bypasses
- Include tests for both success and failure scenarios
- Use httptest for isolated API testing
- Follow Go testing best practices
- Add comprehensive testing documentation
Tests verify multi-library system security and functionality before deployment.
Note: Database querier interface issues exist due to old user ebook folder references
in generated code and need resolution for full test suite operation.
- Add authentication middleware tests for JWT validation
- Add library creation tests for admin authorization
- Add library visibility control tests
- Add user management and error handling tests
- Add JSON validation and security tests
- Add tests for both success and failure scenarios
- Test edge cases like missing tokens, invalid data, unauthorized access
- Use httptest for isolated API testing without needing running server
- Include comprehensive test coverage for security and functionality
Tests verify application security and multi-library system works correctly before deployment.
- Document new multi-library architecture (ebooks, comics, manga)
- Detail per-library folder management and visibility controls
- Include comprehensive API documentation with Bruno examples
- Add pgx v5 compliance and security best practices
- Update deployment and development instructions
- Document JWT authentication and role-based access control
- Include future roadmap for audiobooks, video, podcasts, etc.
Provides complete overview of transformed system for users and developers
- Update JWT middleware to set complete user object in context
- Parse UUID correctly and convert to pgtype.UUID format
- Add missing imports for uuid and pgx/v5/pgtype
- Fix type conversion from UUID string to byte array
- Ensure compatibility with database.Users struct
Resolves authentication issues for library and user endpoints
- Replace with 410 Gone responses directing to libraries
- Maintain API contract for backward compatibility
- Remove old user folder management functionality
- Prepare for complete library system migration
Old folder management now handled through library system
- Redesign dashboard to show library selection first
- Add media browsing within selected library
- Implement library management interface
- Add user visibility controls for libraries
- Support library type icons and metadata
- Add create library modal with type selection
- Include folder management for each library
- Implement user-specific library access controls
Replaces single ebook library with flexible multi-library system
- Add library routes to main router configuration
- Implement media items API endpoints for library content
- Update existing ebook handlers to use new schema
- Add media rating and progress tracking
- Maintain backward compatibility with existing endpoints
- Support library-specific media item queries
Updates application to support new multi-library architecture
- Add LibraryHandler with full CRUD operations
- Implement library creation with type validation
- Add library folder management endpoints
- Implement library visibility control system
- Add user library access management
- Include library statistics endpoint
- Support for admin and user-level operations
Provides modular foundation for multi-library system
- Add library_types table with ebooks, comics, manga types
- Add libraries table for multiple library support
- Add library_folders table for multi-folder libraries
- Add library_visibility table for user access control
- Add media_items table replacing ebooks for broader media support
- Create backward compatibility views for existing API
- Implement library service with type validation and file extension handling
- Support modular extension for future media types
Manga type includes cbz/cbr archives as requested
- Remove complex CHECK constraint with subquery that PostgreSQL doesn't support
- Add comment explaining admin-only access is enforced at application level
- Update role system notes to clarify access control implementation
- Fix Bruno request failures due to missing database table
- Remove hardcoded folder_paths example from request body
- Allow flexible folder path configuration per request
- Improve request flexibility for different scan scenarios
- Add POST /api/ebooks for creating new ebook entries
- Add PUT /api/ebooks/:id for updating existing ebook metadata
- Add DELETE /api/ebooks/:id for deleting ebooks from database
- Include complete request/response examples with all metadata fields
- Support file path, metadata, and publication information updates
- Add POST /api/auth/ebook-folders for adding ebook folders
- Add GET /api/auth/ebook-folders for retrieving configured folders
- Add DELETE /api/auth/ebook-folders for removing ebook folders
- Include comprehensive documentation and request examples
- Support path normalization and admin-only access
- Implement numbered requirements for user account creation:
1. No users exist: First user becomes admin
2. Admins exist: Anyone can register as regular user
3. Admin logged in: Can create admins and regular users
4. User logged in: Cannot create any accounts
- Update registration logic in auth.go to validate roles based on existing admin accounts and authentication status
- Add comprehensive error handling for unauthorized user creation attempts
- Ensure security while maintaining usability for regular users
BREAKING CHANGES:
- User accounts creation now restricted based on authentication state
- Regular users cannot create accounts when logged in
- Admin privileges enforced for user management operations
- Document Bruno API testing collection with organized structure
- Include comprehensive setup and usage instructions
- Add reference to role-based registration restrictions
- Explain admin-only endpoints and authentication requirements
- Add comprehensive Bruno API testing collection section with organized structure
- Document new role-based registration restrictions for admin user creation
- Update API endpoint documentation to reflect admin-only access for user management
- Clarify admin override capabilities for account deletion
- Enhance API authentication and authorization details throughout documentation
- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules
BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure
- Fix database name reference in docker-compose.yml
- Update config.go to use consistent database name
- Ensure database connection string matches container setup
- Document first-user automatic admin assignment
- Update admin setup instructions with correct database name
- Add last-user protection documentation
- Update API endpoints with role field and protection notes
- Document Bruno collection reorganization and admin folder
- Clarify authentication flow and role-based access
- Update role permissions section with new protections
- Create separate admin folder for admin-only operations
- Move admin endpoints (Create/Update/Delete Ebook, Scanner, Folder Management) to /bruno/admin/
- Add admin dashboard, profile, and library page requests
- Add Register Admin User request with explicit admin role
- Update Register User request to include role field
- Remove empty scanner folder structure
API organization:
- Admin requests: /bruno/admin/ (require admin role)
- User requests: /bruno/user/ (available to all authenticated users)
- Environment: Single {{token}} variable works for both roles
- First registered user automatically becomes admin regardless of request
- Prevent deletion of the last user account to protect system
- Enhanced role validation and HTMX error handling
- Proper pgx 5 database standards throughout
Security improvements:
- Auto-admin for first user ensures system always has administrator
- Last-user protection prevents system from having zero users
- Role validation ensures only 'user' or 'admin' roles accepted
- Update CreateUser SQL query to accept role parameter
- Regenerate SQLC code to include Role field in CreateUserParams
- Support for explicit role assignment during user registration
- Update README.md with admin system documentation
- Add admin setup instructions and role permissions
- Update API endpoint documentation with access requirements
- Update Bruno collection to reflect admin-only operations
- Document shared library concept and security model
- Add comprehensive admin setup guide
- Update User type to include role field
- Modify dashboard template to conditionally show admin links
- Add protected dashboard route with user context
- Update main.go to serve dashboard with proper authentication
- Update ebook handlers to require admin role for CRUD operations
- Modify folder operations to be admin-only
- Update ebook scanner to associate books with admin who added them
- Add admin ID tracking to CreateEbook operations
- Restrict scanner operations to admin users only
- Add AdminMiddleware for protecting sensitive operations
- Update JWT generation to include user role and details
- Modify login/registration to use enhanced JWT claims
- Update main.go to set admin-protected routes
- Add user role to JWT context for downstream handlers
- Add role column to users table with admin/user constraint
- Add added_by_admin_id column to ebooks table for tracking
- Add constraint to ensure only admins can manage folders
- Update all SQL queries to include role field
- Regenerate database models with new schema
- Replace migration files with single schema.sql
- Include all current functionality in one file
- Add 10-point rating scale with half-star precision
- Remove old migration complexity for development
- Maintain all table constraints and indexes
- Add proper comments for rating system
- Prepare clean schema for first release deployment
- Change rating validation from 1-5 to 1-10
- Enable half-star precision support in backend
- Maintain compatibility with frontend conversion logic
- Support odd numbers for half-star ratings (1,3,5,7,9)
- Update rating examples to use 1-10 scale
- Document half-star precision in API collections
- Add rating conversion examples for testing
- Update Get Ebook Rating docs with scale explanation
- Update Create/Update Rating with new validation rules
- Update README.md with interactive rating system details
- Document zero-rating behavior in GET /api/ebooks/:id/rating
- Add comprehensive rating system documentation section
- Update Bruno collection files to reflect new API behavior
- Enhance API testing documentation with rating 0 fallback
- Remove string-based error checking for no rows
- Use proper pgx.ErrNoRows comparison only
- Improve error handling consistency in processEbookFile function
- Add pgx.ErrNoRows checks in GetEbook and GetReadingProgress
- Improve error handling in GetEbookRating with proper status codes
- Return consistent error responses across all endpoints
- Add missing pgx import for proper error comparison
- Add specific pgx.ErrNoRows checks in GetProfile
- Better error handling in UpdatePassword and GetScanSettings
- Return appropriate HTTP status codes for different error types
- Improve error message consistency
- Change schema path to use relative path from internal/database
- Update queries path to use current directory
- Modify output directory to current directory for better organization
- Reorder package installation to improve layer caching
- Add curl to runtime dependencies
- Use relative paths for sqlc and templ generation
- Copy static assets to final stage
- Improve build step organization
- Remove unnecessary Node.js and build tool entries
- Keep only relevant entries for Go web application
- Preserve Bruno collection, static assets, and Go template files
- Add clarifying comments for project-specific entries
- Add .env.example file with template for secure configuration
- Update Quick Start section with detailed environment setup
- Provide both .env file and docker-compose variable methods
- Add security notes and password generation commands
- Document default database credentials with security warning
- Include instructions for generating secure JWT secrets and passwords
- Add tailwind.config.js with theme color configuration
- Add package.json with build scripts and dependencies
- Add Dockerfile Node.js setup for CSS building
- Add input.css for Tailwind processing
- Update all templates to use local CSS and JS instead of CDN
- Add static file serving in main.go
- Download htmx during build process
- Enable CSS minification for production builds
- Update technical details to reflect local Tailwind build process
- Remove CDN references and document self-contained asset building
- Update build process documentation with Node.js integration
- Move migrations/ to database/schema/ for clarity on database schema definitions
- Move sqlc.yaml to internal/database/ to group with database code
- Move static/ to cmd/server/static/ to co-locate with server
- Update all configuration files and documentation
- Follow Go project conventions for better organization
- Add templ dependency for type-safe HTML rendering
- Convert index.html, login.html, register.html, dashboard.html, admin.html, admin_profile.html, admin_library.html to .templ files
- Generate Go code with templ generate for compile-time safety
- Update server routes to use templ components with proper rendering
- Refactor JavaScript in dashboard to avoid backtick parsing conflicts
- Delete old HTML template files
- Clean up project by removing unnecessary files and binaries
- Update CreateUser query to explicitly select only existing columns
- Update all user SELECT queries to explicitly select columns to avoid scan_frequency_minutes column issues
- Add GetUserForLogin query that includes password_hash for authentication
- Update login handler to use GetUserForLogin instead of GetUserByEmailOrUsername
- This prevents errors when migration hasn't been applied yet, allowing user registration to work
- Convert admin dashboard from single 2-column page to multi-page interface
- Create main admin dashboard (/admin) as overview with navigation sidebar
- Add separate profile settings page (/admin/profile) for user account management
- Add separate library management page (/admin/library) combining folder and scan settings
- Implement sidebar navigation pattern similar to Gitea, Jellyfin, Audiobookshelf
- Add dedicated templates: admin.html, admin_profile.html, admin_library.html
- Include quick actions and statistics on main dashboard
- Improve UI with better organization and visual hierarchy
- Maintain consistent navigation and theme across all admin pages
- Add folder management, scan settings, and library statistics to library page
- Add admin dashboard at /admin route consolidating all user settings
- Move user preferences (username, email, password, theme) from separate page
- Add ebook library preferences section with folder management
- Add scan settings (frequency and auto-scan toggle) with database persistence
- Create database migration for scan_frequency_minutes and auto_scan_enabled columns
- Add API endpoints for scan settings management:
- PUT /api/library/scan-settings - Update scan preferences
- GET /api/library/scan-settings - Get current scan settings
- Update dashboard navigation to link to admin dashboard
- Remove old preferences.html template (functionality moved to admin)
- Create Bruno API testing files for library endpoints
- Add real-time folder loading and management in admin interface
- Implement scan settings persistence and retrieval from database
- Add /preferences route and preferences.html template for user settings
- Implement username, email, password, and theme update functionality
- Add account deletion feature with confirmation
- Add navigation link to preferences from dashboard
- Create API endpoints:
- PUT /api/user/username - Update username
- PUT /api/user/email - Update email address
- PUT /api/user/password - Change password with verification
- DELETE /api/user/account - Delete user account
- Add database queries for user updates and account deletion
- Create Bruno API testing files for all user preference endpoints
- Add proper validation, error handling, and security checks
The auth folder now contains user management endpoints beyond just authentication:
- User registration/login (auth)
- Profile management (user)
- Theme settings (user preferences)
- Ebook folder management (user settings)
Renaming to 'user' better reflects the expanded scope covering user accounts, preferences, and settings management.
- Change Go module name back from 'shelf' to 'bookmann'
- Update all import paths back to 'bookmann' module
- Update README.md project name back to 'Bookmann'
- Update docker-compose.yml container names back to 'bookmann' and 'bookmann_db'
- Regenerate database code with restored module imports
- Rename project from 'bookmann' to 'shelf'
- Move all backend/ contents to root level (flatten structure)
- Update Go module name from 'bookmann' to 'shelf'
- Update all import paths to use new 'shelf' module
- Update Dockerfile to work without backend/ subdirectory
- Update docker-compose.yml to use new structure and rename containers
- Update .gitignore for new file paths
- Update README.md with new project name and structure
- Regenerate database code with new module imports
john-okeefe