Fixed 4 issues identified during PROJECT_GUIDELINES.md compliance review:
1. Fixed test assertions to use s.T() instead of t in test suite methods
2. Replaced non-existent createTestLibraryWithFolder() helper with:
- Existing setup.CreateLibrary() method from test_helpers.go
- Manual folder creation via POST /api/libraries/{id}/folders API
3. Replaced weak unit test with comprehensive tests:
- TestWorker_JobResult_HasStatsFields: Verifies stats fields are stored
- TestWorker_ProgressCallback_UpdatesJobResult: Verifies real-time updates
4. Documented database pool configuration (setupTestServer already uses max_conns=1)
Changes ensure integration tests will work correctly when implemented:
- Use TestServerSetup.CreateLibrary() for library creation
- Create folders via API call before triggering scans
- Use proper s.T() test reference in all assertions
- Include both unit and integration tests for full coverage
Verified against PROJECT_GUIDELINES.md:
- Uses setupTestServer() from test_helpers.go ✓
- Database pool uses max_conns=1 ✓
- Follows service layer pattern ✓
- No database schema changes ✓
- All assertions use correct test reference ✓
Updated TASKS-scanning-progress.md Part 1 with critical fixes and
clarifications for implementing the admin page scan button functionality.
Fixes Applied:
- Converted inline JavaScript to TypeScript using existing web/src/admin.ts
- Fixed animation implementation to use TailwindCSS classes instead of custom CSS
- Added missing implementation steps:
* Include admin.js in admin.templ
* Remove old quickScan() function after migration
* Build frontend assets step
- Fixed animation trigger by removing opacity/transform classes that prevented display
- Corrected API endpoint usage (/api/libraries/{id}/scan not /api/scanner/scan)
Root Cause Analysis:
- Original quickScan() sent empty folder_paths array causing 400 errors
- No "scan all libraries" endpoint exists - must scan each library individually
- Frontend had admin.ts but wasn't including it in templates
Implementation Approach:
- Fetch all libraries via GET /api/libraries
- Trigger scan for each library via POST /api/libraries/{id}/scan
- Display consolidated progress UI with animation
- Handle errors gracefully per library
- Use TypeScript for type safety
- Leverage TailwindCSS for all styling (no custom CSS)
Documentation Structure:
- Part 1: Admin scan button implementation (frontend)
- Part 2: Dashboard diagnosis and fixes (to be completed after backend work)
This plan is now ready for implementation after backend progress tracking
is completed (as documented in TASKS-backend-progress-tracking.md).
Created detailed implementation guide (704 lines) for adding real-time progress
reporting to the scanning system, addressing user request to track files_scanned,
new_items, and errors during scan operations.
Problem:
- Current scan API only returns 0% then 100% progress
- No visibility into how many files have been scanned
- No tracking of new items discovered or errors encountered
- Frontend cannot display meaningful progress to users
Solution Overview:
- Extend JobResult with progress details: TotalFiles, FilesScanned, NewItems, Errors
- Add progress callback to MediaScanner for real-time updates
- Implement batching (every 10 files) to reduce mutex contention
- Update scan status API to expose new metrics
- Add comprehensive integration tests using test_helpers.go
Implementation Plan (8 steps):
1. Extend JobResult struct with new fields
2. Add progress callback mechanism to WorkerService
3. Track scan statistics in MediaScanner
4. Report progress in real-time during scan
5. Update scan status API response
6. Update unit tests
7. Add integration tests with test_helpers.go
8. Build and test in container
Key Design Decisions:
- Batch progress updates every 10 files for performance (reduces mutex contention)
- Use callback pattern to decouple scanner from job management
- Maintain backward compatibility with existing scan API
- Follow service layer pattern (no business logic in handlers)
- All integration tests use setupTestServer() from test_helpers.go
Testing Strategy:
- Unit tests for WorkerService progress tracking
- Integration tests for end-to-end scan with progress updates
- Container-only testing for scanner functionality
- Verified against PROJECT_GUIDELINES.md constraints
Document is ready for immediate implementation - all code examples included
and validated against project standards.
Fixed a critical bug where watch mode failed to start automatically during container
initialization, despite comments in app.go:79 claiming it would start "after 2-second delay."
Root Cause:
- StartWatchModeForAllLibraries() function existed but was never invoked
- Comment in app.go claimed watch mode started automatically, but no startup code existed
Changes:
- Added "context" import to internal/router/router.go
- Added goroutine in configureRouter() that:
* Waits 2 seconds after server initialization
* Calls StartWatchModeForAllLibraries() to activate monitoring
* Logs startup status or errors
This ensures watch mode begins scanning for new media files automatically when the
container starts, rather than requiring manual intervention.
Testing: Verified watch mode now activates automatically in container logs.
Remove outdated planning documents that have been implemented or are no
longer relevant. All features have been completed and documented elsewhere.
Removed Files:
- THEME_FIX_PLAN.md
- WOOD_PANELING_FONT_FIX_PLAN.md
- WOOD_PANELING_PLAN.md
Reason:
- Wood paneling feature is complete and in production
- Theme fixes have been implemented
- Font color issues resolved
- Documentation consolidated into TASKS-scanning-progress.md
Migration:
- See TASKS-scanning-progress.md for current implementation plans
- Wood paneling is documented in code comments
- Theme system is functional with multiple color schemes
Impact:
- Cleaner repository structure
- Reduced documentation maintenance burden
- Single source of truth for pending work
Update Bruno environment configuration with current library and job IDs
to support API testing workflows.
Changes:
- Update library_id to current active library
- Update job_id to recent scan job
- Add collection_id variable for collection testing
Variables Updated:
- library_id: 551ac19c-896a-4406-b479-353fc489b295
- job_id: 450094c6-a8f1-4125-aea7-77df80223877
- collection_id: 11e8d915-ef95-4257-98b3-b8eeacfd59b9 (new)
Impact:
- Bruno requests reference current test data
- Supports testing scan functionality
- Enables collection endpoint testing
- Maintains test environment consistency
File: bruno/environments/Bookhoard.yml
Fix text color display issues on wood gradient backgrounds in the
dashboard's collections container, ensuring small text matches big text
and "View All" links stand out with proper wood-specific colors.
Changes:
- Remove .text-sm from grey text rule to match big text colors
- Keep .text-secondary as only grey text class
- Links maintain wood-specific standout colors via specific selectors
Problem:
- Small text (.text-sm) was forced to grey (--wood-text-secondary)
- "View All" links inherited grey instead of wood link colors
- Inconsistent text sizing created visual hierarchy issues
Root Cause:
input.css:243-247 applied --wood-text-secondary to .text-sm
This overrode wood-specific link colors at lines 250-257
Solution:
Remove .text-sm and p.text-sm from the grey text rule:
- Before: .text-sm, .text-secondary, p.text-sm → grey
- After: .text-secondary only → grey
- .text-sm now uses --wood-text-primary (matches big text)
- Links (including "View All") use wood-specific blue colors
Impact:
- All small text now matches big text color on wood backgrounds
- "View All" links stand out with proper colors (#0066cc for light wood, #66ccff for dark)
- Improved readability and visual consistency
- Better user experience on wood gradient themes
Wood Theme Colors:
- Wood Light: #0066cc (dark blue for contrast on light background)
- Wood Dark: #66ccff (light blue for visibility on dark background)
- Wood Mahogany: #66ccff (light blue for visibility on dark background)
Files: web/static/input.css
Lines Modified: 243-247 (removed selectors)
Related: templates/dashboard.templ:100 (View All link)
Fix critical bug where library_id variable was not quoted in the request
body, causing invalid JSON that was rejected by the API parser.
Changes:
- Quote library_id variable: {{library_id}} → "{{library_id}}"
- Add explicit Content-Type header
- Update request body format to use proper YAML multi-line string
Root Cause:
- Unquoted UUID in JSON: {"library_id": 551ac19c-896a-...}
- Produced invalid JSON that failed c.Bind() in scanner handler
- Handler returned 400 "invalid request" error
Impact:
- Bruno requests for scanning now work correctly
- API scan endpoint accepts request successfully
- Enables proper testing of scan functionality via Bruno
Testing:
- Verified scan request completes successfully
- Job ID returned correctly
- Scanner processes files as expected
File: bruno/scanner/Scan Media Items.yml
- Fix View All link flashing by preserving data-wood attribute when dashboard re-renders
- Update wood-dark text color to match wood-mahogany (#f5f5f5) for better consistency
- Add smart link colors for wood paneling (#0066cc for light wood, #66ccff for dark woods)
- Fix carousel arrow gradients to be less harsh on wood backgrounds (0.6 for light, 0.3 for dark)
- Remove accent color preservation rule that was conflicting with wood-specific link colors
- Add data-wood attribute to collections container for CSS targeting
- Update woodPaneling.ts and woodPanelingInit.ts to set/remove attribute
- Add CSS variables for wood-specific text colors (dark text on light wood, light text on dark wood)
- Add !important rules to override theme colors when wood is active
- Replace wood-dark and wood-mahogany textures with darker variants
- Add subtle borders to book cards on wood backgrounds
- Create comprehensive implementation plan for smart font colors on wood paneling backgrounds
- Addresses readability issues where current theme colors don't contrast well with wood textures
- Includes CSS strategy, TypeScript changes, texture replacements, and testing checklist
- Ready to implement when needed
- Fix library edit form to use type_name instead of library_type_id for type dropdown
- Clear library-id input after successful delete to prevent create-then-delete bug
- This fixes the issue where creating a new library after deleting one would fail with 'Unknown error' due to stale library-id
- Remove wood themes (wood-light, wood-dark, wood-mahogany) from profile theme selector
- Add wood paneling as separate section in header theme dropdown
- Update script references to include new theme management files
- Change header layout to full-width design
- Replace inline ternary operators with activeClass helper function
- Change layout containers from max-w-7xl to w-full for full-width design
- Update file path references in error messages for better debugging
- Document all available color themes with descriptions
- Explain wood paneling feature and available textures
- Provide step-by-step instructions for changing themes
- Add tips for theme/texture pairing
- Remove max-w-7xl containers from all page templates
- Replace with w-full for full-screen width utilization
- Maintain padding for readability
- Admin templates: modify inner content div only (preserve sidebar layout)
- Remove max-w-7xl constraints from library selector and collections
- Include woodPanelingInit.js script for early paneling application
- Prevent flash of wrong background on page load
- Wood paneling applied only to #collections-container
- Add bg-theme-active/inactive for theme buttons
- Add bg-wood-active/inactive for wood paneling buttons
- Use CSS variables already defined in input.css
- Use !important to override inline styles
- Create themeDropdown.ts to manage active state highlighting
- Show which theme/wood option is currently selected
- Use CSS classes instead of inline styles for indicators
- Wrap existing functions to update indicators on toggle
- Auto-initialize indicators on DOM ready
- Add woodPaneling.ts with localStorage-based paneling preferences
- Add woodPanelingInit.ts for early initialization (prevents flash)
- Support none, wood-light, wood-dark, wood-mahogany options
- Apply paneling to #collections-container only (not full body)
- Use Tailwind utility classes for backgrounds
- Use CSS variable classes for active indicators
- Export functions for HTML onclick handlers
- Auto-initialize on DOM ready
- Remove wood-light, wood-dark, wood-mahogany from theme dropdown
- Wood paneling is now browser-only (localStorage preference)
- Users select wood paneling from header dropdown, not profile
- Profile form only controls server-synced color themes
- Remove wood-light, wood-dark, wood-mahogany from ThemeType
- Remove wood theme gradient logic from applyTheme()
- Wood themes will be reimplemented as separate paneling feature
- Paneling will target dashboard bookshelf background only
- Phase 5: Change line number to structural reference (before closing brace)
- Fix all TypeScript build commands from 'npm run build' to 'npm run build:ts'
- Ensures plan aligns with actual package.json scripts
- Prevents execution failures during implementation
- Add Phase 1b to remove wood themes from profile_form.templ
- Add woodPanelingInit.ts to Phase 2 for early initialization
- Remove inline JavaScript from Phase 7, use TypeScript instead
- Update Critical Requirements to prohibit inline scripts entirely
- Update Files Summary with new files and modifications
- All changes align with PROJECT_GUIDELINES.md requirements
- Add .zed/ to gitignore (Zed editor config)
- Add .opencode/ to gitignore (opencode tool data)
- Remove .zed/settings.json from version control
- Keeps repository clean of IDE-specific files
- Add theme.js script include to header template
- Fixes theme selector not working on pages using Header component
- Ensures applyTheme() is defined before changeThemeTo() calls it
- Update admin.templ to use @AdminSidebar component
- Update admin_library.templ to use @AdminSidebar component
- Update admin_users.templ to use @AdminSidebar component
- Add sidebar layout wrapper to admin_users.templ (previously missing)
- Fix theme rendering to use user.Theme in all admin templates
- Remove duplicated sidebar markup across admin pages
- Create AdminSidebar component for admin panel navigation
- Support active state highlighting based on currentPath
- Consistent navigation across all admin pages
- Replaces duplicated sidebar markup in admin templates
- Add THEME_FIX_PLAN.md: comprehensive plan for theme system consistency
- Add ADMIN_SIDEBAR_PLAN.md: reusable admin sidebar component plan
- Add WOOD_PANELING_PLAN.md: wood paneling and full-width layout plan
- Document root cause of theme flashing issue
- Detail implementation plan for server-side theme rendering
- Include testing checklist and rollback strategy
- Cover wood theme gradient persistence fix
-- Rename 'build' to 'rebuild' for clarity (rebuilds all containers)
-- Rename 'build-force' to 'rebuild-force' for consistency
-- Add 'rebuild-app-force' target for app-only rebuild without cache
-- Add 'rebuild-force-db' target that DELETES database for clean rebuild
-- Improve help text to clarify what each target does
-- Remove circular dependency (rebuild no longer depends on clean)
-- All rebuild targets now preserve database unless explicitly stated
-- Reformat all generated template Go files with consistent indentation
-- Standardize code style across templates/
-- No functional changes, formatting only
-- Generated by templ tool during development
-- Add dedicated delete confirmation modal to admin/library page
-- Refactor deleteLibrary() to use modal instead of inline confirm()
-- Add showDeleteModal(), hideDeleteModal(), confirmDeleteLibrary() functions
-- Modal displays clear warning about what gets deleted
-- Improves UX by making the confirmation dialog more prominent and informative
- Create bruno/library/browse-folders.yml
- Single manual test case for admin context
- Unit/integration tests cover all scenarios (no auth, user, admin)
- Bruno provides quick manual API contract verification
Fixes: Issue 2 (manual testing)
- Add unit tests in internal/services/library_service_test.go
- Test path traversal protection
- Test non-existent path handling
- Test file vs directory validation
- Test successful directory listing
- Add integration tests in cmd/server/tests/library_browse_test.go
- Use setupTestServer() helper from test_helpers.go
- Test no authentication returns 401
- Test regular user returns 403 forbidden
- Test admin can browse directories
- Test path traversal blocking
- All tests use table-driven approach with t.Run()
Fixes: Issue 2 (tests)
- Add BrowseDirectories() to library service with path traversal protection
- Add BrowseDirectories handler with proper error handling
- Register GET /api/libraries/browse endpoint (admin-only)
- Returns current path, parent path, and list of subdirectories
- Security: blocks "..", validates path exists, checks is directory
Fixes: Issue 2 (backend)
- Add optional data parameter to apiDelete() with generic type safety
- Enables DELETE requests with request bodies (needed for folder deletion)
- 100% backward compatible (optional parameter)
- Supports type-safe request body passing
Part of: Issue 1
- Reuse Create Library modal for edit mode
- Add hidden library-id input to track create vs edit
- Update handleCreateLibrarySubmit to detect mode and use PUT vs POST
- Implement editLibrary() to populate modal with existing data
- Pass library data to Edit button via data attributes
- Reset modal title when opening for create mode
Fixes: Issue 3
Complete refactor of /admin/library page to use server-side rendering
and TypeScript, fixing broken Create Library button and improving UX.
Backend Integration:
- Update template signature to accept libraries and users parameters
- Add SSR rendering of library list (no empty state)
- Add SSR rendering of user select dropdown
- Data fetched in router handler and passed to template
TypeScript Conversion:
- Create web/src/library.ts (394 lines) - complete rewrite of inline JS
- Convert all inline JavaScript to TypeScript
- Fix critical data.data API response bug
- Replace broken HTMX form with fetch() API calls
- Implement event delegation for dynamic button clicks
- Add missing editLibrary() function (placeholder)
- Add proper error handling with toast notifications
Template Changes:
- Remove 229 lines of inline JavaScript
- Update Create Library button: onclick → data-action
- Update form: remove HTMX attributes, add onsubmit handler
- Remove duplicate script tags from <head> section
- Keep all script loading at end of <body> for performance
Bug Fixes:
- Fix API response handling: data → data.data
- Replace broken hx-headers (JavaScript not supported in HTMX)
- Fix modal z-index and visibility classes
Progressive Enhancement:
- Page works without JavaScript (SSR content visible)
- JavaScript enhances with interactive features
- Follows PROJECT_GUIDELINES: procedural style, no OOP
Update the /admin/library route handler to fetch and pass data to
template for server-side rendering, improving page load performance.
Changes:
- Fetch all libraries using ListLibrariesData() helper
- Fetch all users for visibility management
- Convert database rows to template types (LibraryData, User)
- Pass data to AdminLibrary template for SSR
- Follows existing pattern from dashboard and custom-section pages
Benefits:
- Faster initial page load (no AJAX fetch)
- Better UX (content visible immediately)
- Progressive enhancement (works without JS)
Add ListLibrariesData() method to LibraryHandler to support
server-side rendering of all libraries on the /admin/library page.
This follows the existing pattern of GetUserVisibleLibrariesData() and
GetLibraryTypeData() methods, which return data structures instead of
JSON for template rendering.
Changes:
- Add ListLibrariesData() method (3 lines)
- Returns []database.ListLibrariesRow for template consumption
- Called by frontend route handler for SSR
Update admin dashboard sidebar to point to user administration page
instead of profile settings:
- Change link from /profile to /admin/users
- Update label from 'Profile Settings' to 'User Administration'
This completes the admin navigation refactoring to use dedicated
admin pages instead of the main user profile page.
Add --force-recreate flag to all build targets that create containers:
- build: Force recreation when building all containers
- rebuild-app: Force recreation of app container only (fixes template update issue)
- build-force: Force recreation even when using --no-cache
- test-env-up: Force recreation in test environment
This fixes a critical issue where 'make rebuild-app' would build a new image
but continue running the old container, causing template changes to not appear.
Root cause: podman-compose up --build doesn't recreate containers if they're
already running, even when a new image is built. The --force-recreate flag
ensures containers are recreated with the new image.
BuildKit caching still works as expected - cache is used during image build,
while --force-recreate ensures the new image is actually deployed.
Changes:
- build: Add --force-recreate flag
- rebuild-app: Add --force-recreate flag, update success message
- build-force: Add --force-recreate flag
- test-env-up: Add --force-recreate flag
Verified: Template changes now appear immediately after rebuild.
- Add password requirements checklist with visual indicators (✓/○)
- Implement real-time validation for length, case, numbers, special chars
- Add confirm password field with matching validation
- Disable submit button until all requirements are met
- Add TypeScript client-side validation with password manager compatibility
- Replace inline nav code with @Header component in admin.templ
- Replace inline nav code with @Header component in admin_library.templ
- DRY up navigation, theme switcher, and user menu across admin pages
- Optimize Dockerfile layer caching with --mount=type=cache for Go modules and npm
- Reorganize Dockerfile layers for better cache hit rates
- Improve .dockerignore organization with categorized comments
- Add Makefile targets: up, down, rebuild-app, restart, ps
- Enhance Makefile help output with categorized sections
- Add theme.js script for proper theme support
- Update form to use CSS variables (--bg-primary, --text-secondary, etc.)
- Replace hardcoded colors with theming system
- Add optional first_name and last_name fields
- Update button to use .btn-primary class
- All form inputs now properly themed
Vendored the sevenzip package to eliminate dependency chain:
- sevenzip -> go4.org -> 25+ Google/Cloud/telemetry packages
Changes:
- Added internal/sevenzip/ with full package source
- Inlined go4.org/readerutil into multireaderat.go
- Updated all internal imports to use bookhoard/internal/sevenzip
- Preserved .cb7 comic archive support
This reduces bloat by ~4.9 MB and removes unused telemetry
dependencies while maintaining all functionality.
Add explicit check to verify target user exists in database before
attempting deletion. Previously, the handler would return 200 OK when
trying to delete non-existent users.
Changes:
- Add userFound flag to track if target user was found in user list
- Explicitly check pgtype.UUID.Bytes against all users' IDs
- Return 404 Not Found if user doesn't exist (before last admin check)
- Supports both JSON and HTML (HTMX) response formats
This fixes the failing test:
- TestDeleteUserConsolidated/DELETE_/api/auth/profile/:id_-_Delete_non-existent_user
The check uses the existing ListUsers result, so no additional database
query is required. The pgtype.UUID.Bytes comparison ensures exact
16-byte UUID matching.
The test was using simple passwords ('password1', 'password2') that
failed complexity validation before the mismatch check could run.
Changed to use valid complex passwords that don't match:
- new_password: 'NewPassword123!'
- confirm_password: 'DifferentPass123!'
This properly tests the mismatch validation path. All 4 subtests in
TestUpdatePasswordAdminMode now pass.
Add comprehensive testing documentation covering:
- Test email domain usage (@tests.bookhoard.internal)
- Standard test users and their credentials
- Test lifecycle and cleanup process
- How to write tests properly
- Running tests (make targets, specific tests)
- Test organization and helper functions
This helps developers understand the testing infrastructure and
prevents accidental data loss when running tests.
Update test email domain in Bruno API collection files:
- Login User.yml
- Register User.yml
- Update Profile.yml
Ensures API tests use the dedicated test domain and won't conflict
with real user data when developers run tests.
Update email domain in remaining test files:
- device_cap_test.go
- device_test.go
- queue_test.go
- refresh_token_test.go
- seven_day_session_test.go
All test files now consistently use the dedicated test domain
to prevent conflicts with real user data.
- Fix username conflict: use unique name 'updateduser-admin-test'
- Fix 'last admin' test: explicitly delete regular user and verify admin count
- Add missing Content-Type header to PUT request
- Fix assertion: match actual validator error message ('oneof')
- Update email domain references to @tests.bookhoard.internal
All 5 subtests now pass:
- Admin update username ✓
- Admin promote user to admin ✓
- Try to demote last admin ✓
- Non-admin tries update ✓
- Invalid role ✓
- Change test email domain from @example.com to @tests.bookhoard.internal
- This prevents accidental deletion of real user data when self-hosters run tests
- Improve test cleanup: delete ALL users with test domains before each test
- Ensures complete test isolation by cleaning up users from previous tests
- Handles edge cases where tests promote users to admin or modify accounts
The @tests.bookhoard.internal domain is clearly for testing only and
won't conflict with real user emails.
Add collections for Delete User, Reset User Password, and Update User
endpoints. Remove obsolete collections for individual profile update
operations. Update Update Profile collection to reflect new consolidated
API structure.
Add documentation for delete_user and reset_user_password endpoints.
Update update_profile to reflect consolidated endpoint. Remove obsolete
documentation for individual update operations. Add profile guide for
end-users. Update API_CONSOLIDATION_PLAN.md with implementation status.
Add admin_users.templ for user management interface with delete, password
reset, and edit capabilities. Add profile.templ and related components for
user profile management. Remove admin_profile.templ. Update all templates
to use new consolidated API endpoints.
Add DELETE /api/auth/users/:id, PUT /api/auth/users/:id/password, and
PUT /api/auth/users/:id routes. Remove individual profile update routes
in favor of consolidated endpoints.
Implement DeleteUser, ResetUserPassword, and UpdateUserAdmin handlers.
Update collections handler to check soft-deleted users. Update dashboard
service to exclude deleted users from statistics.
Add delete_user, reset_user_password, and update_user endpoints to replace
individual update operations. Update database schema to include deleted_at
column for soft deletion. Add DeleteUser, ResetUserPassword, and
UpdateUserAdmin queries. Update Querier with new methods for user management.
Restructure TestOPDSEndpoints and TestOPDSConversion to follow the Kobo
test pattern. Create all media items at parent level before any subtests
run, avoiding token invalidation when setupDeviceTest is called. Subtests
now use pre-created media IDs and device.AuthToken for authentication.
Add Token and RegularToken fields to TestServerSetup for pre-authenticated
access. Update setupTestServer to create fresh users with valid tokens at
initialization time. Simplify createTestMediaItemID to use setup.Token.
Remove loginTestUser, loginRegularUser, loginAdminUser functions in favor
of setup.Token/setup.RegularToken. Update createTestUserOnce and
getTestUserID/getRegularUserID to be idempotent. Update all test files to
use setup.Token instead of calling login helpers.
- Move header.js script from individual templates to header.templ
- Removes duplicate script tags from bookshelf, collections, progress, etc.
- Fixes indentation in docs.templ
Removed unit tests that couldn't work without a database (nil db would
panic). Added comprehensive integration tests for the PreviewCollection
endpoint covering:
- Authentication (no auth, valid auth)
- Input validation (missing/invalid library ID, invalid JSON)
- Manual book selection
- Rule-based filtering
- Limit parameter handling
- Duplicate and invalid book ID handling
The PreviewCollection endpoint was missing authentication verification,
allowing unauthenticated access to the preview functionality. Added
check for user in context, returning 401 Unauthorized if missing.
The TokenLookup config was missing the Bearer prefix stripper, causing
all authenticated requests to fail with 'token is malformed'. The JWT
library was trying to decode 'Bearer eyJh...' as a token, failing at
the space character.
Changed from: 'cookie:token,header:Authorization'
Changed to: 'cookie:token,header:Authorization:Bearer '
This fixes all integration tests that use Bearer token authentication.
- Add renderErrorPage helper for consistent error rendering
- Add ensureUserExistsMiddleware to detect deleted users and redirect to login
- Add catch-all 404 handler for unknown routes
- Gracefully handle data loading failures with error messages instead of crashing
- Log errors for debugging while still rendering pages
john-okeefe