- Add RequestTracingMiddleware to middleware chain
- Auto-start scheduler for auto-scanning on server boot
- Auto-start watch mode for all libraries with 2-second delay
- Update SetupRoutes to return handler for service management
- Update scanner to run asynchronously in background worker pool
- POST /api/scanner/scan now returns immediately with job ID (HTTP 202)
- Add GET /api/scanner/status/:jobId for checking scan job progress
- Integrate watch mode with library system for instant ebook detection
- Auto-start watch mode for all libraries on server startup
- Add endpoints for managing watch mode per library:
- POST /api/scanner/watch/start
- POST /api/scanner/watch/stop
- GET /api/scanner/watch/status
- Track which libraries are currently being watched
- Auto-start scheduler on server boot
- Add Worker service with configurable worker pool for async job processing
- Implement job queue with status tracking (pending, running, completed, failed, cancelled)
- Add Scheduler service for auto-scanning based on user scan settings
- Check scan settings every 5 minutes and schedule background scan jobs
- Support multiple libraries with individual scan frequencies (15-1440 minutes)
- Regenerate queries.sql.go with refresh token queries
- Update models.go with RefreshTokens type
- Update querier.go with new query methods
- Update db.go with generated code
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
- Implement strict password requirements:
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
- At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
Document new security and validation features:
- Rate limiting on auth endpoints
- Improved input validation
- Pagination limits
- Path validation
- Role normalization
Updates reflect the security improvements made to the application
- Add os package import for file system checks
- Validate that folder paths exist before adding to library
- Check folder accessibility to prevent invalid paths
- Return clear error messages for invalid folders
Improves user experience by catching path errors early
- Enforce maximum pagination limit of 1000 items per request
- Prevent negative offset values in pagination
- Apply limits to both /api/ebooks and /api/media-items endpoints
- Protect against DoS attacks from large limit values
Fixes security issue: No maximum pagination limit
- Trim whitespace from usernames and validate non-empty
- Normalize role values to lowercase for case-insensitive comparison
- Prevent registration with whitespace-only usernames
- Maintain backward compatibility with existing functionality
Fixes validation gap: Username whitespace handling
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records
Closes security issue: No rate limiting on auth endpoints
- Fix database authentication error by exposing actual database error messages
- Update error handling to follow pgx v5 standards with detailed error reporting
- Restore token environment variable management in Register User.bru for subsequent requests
- Enable proper debugging of database connection issues during user registration
The registration API now provides detailed error messages instead of generic 'failed to check existing users'
when database connection or authentication fails, making debugging easier.
- Convert all JSON tests to JavaScript functions for bruToJsonV2 compatibility
- Update authentication to use 'inherit' instead of manual headers
- Fix hardcoded URLs to use {{base_url}} variables
- Standardize variable syntax from {{ _.var }} to {{var}}
- Add comprehensive API documentation to all requests
- Update environment variables with missing required fields
- Apply consistent structure: meta, http method, headers, tests, vars, settings, docs
- Enhanced validation with proper error handling and field checks
This major update implements a complete user annotation system:
## 🎯 New Features
- User notes with position tracking for media items
- Text highlighting with customizable colors
- Highlight-note associations for detailed annotations
- Full CRUD API for both notes and highlights
- Backward compatibility with existing ebook endpoints
## 📊 Database Changes
- Add media_notes table (id, media_item_id, user_id, content, position, timestamps)
- Add media_highlights table (id, media_item_id, user_id, selection_text, start/end_position, color, optional note_id)
- Add foreign key relationships with CASCADE deletes
- Add proper indexes for performance
- Add database schema views for ebook backward compatibility
## 🔧 API Implementation
- Complete REST API endpoints for notes and highlights
- JWT authentication with proper middleware bypass
- Request validation with meaningful error responses
- UUID validation and type safety
- Support for hex color codes in highlights
## 🧪 Testing & Documentation
- Comprehensive test suite covering authentication scenarios
- Bruno API collection for manual testing
- Detailed testing guide with troubleshooting
- Updated documentation in README and TESTING.md
## 📁 Backward Compatibility
- Existing ebook endpoints continue working
- Database views maintain API contracts
- No breaking changes for existing integrations
The annotation system is now fully functional and ready for production use.
- Add detailed testing instructions in TESTING.md
- Include quick start commands for all test scenarios
- Document new notes and highlights test coverage
- Add coverage analysis and reporting commands
- Include troubleshooting guide for common issues
- Add test flag reference and workflow recommendations
- Document test categories and what they verify
- Fix undefined variable 'resp' errors in library_test.go (should be 'req')
- Fix authentication test expectations to match unauthorized response
- Fix TestUserVisibleLibraries to properly simulate user visibility filtering
- Remove hidden library from mock user response to test visibility correctly
- All tests now pass successfully
- Add testify/assert and testify/require for testing
- Update module dependencies after adding annotation features
- Ensure proper pgx v5 compatibility with new database operations
- Add notes and highlights to Media Management features section
- Document complete API endpoints for annotations (CRUD operations)
- Update database schema documentation with new tables
- Add backward compatibility endpoints for existing ebook API
- Update Bruno collection structure to show new test directories
- Document highlight-note association and color customization features
- Remove temporary DOCUMENTATION_UPDATES.md after merging content
- Add complete test suite for media notes API with validation
- Add complete test suite for media highlights API with color validation
- Add backward compatibility tests for ebook endpoints
- Test authentication scenarios (unauthorized access)
- Test request validation and error handling
- Fix existing test import issues and syntax errors
- Add test cases for highlight-note associations
- Add complete Bruno collection for notes API (5 endpoints)
- Add complete Bruno collection for highlights API (5 endpoints)
- Include detailed request/response documentation
- Add proper validation examples and error cases
- Support both media-items and ebook endpoint testing
- Add environment variable support for dynamic IDs
- Add complete CRUD API for media items notes (/api/media-items/:id/notes/*)
- Add complete CRUD API for media highlights (/api/media-items/:id/highlights/*)
- Add backward compatibility endpoints for ebooks (/api/ebooks/:id/notes/*, /api/ebooks/:id/highlights/*)
- Implement proper validation for request payloads and UUIDs
- Support hex color codes for highlights with default yellow (#ffff00)
- Support position tracking (page:offset or CFI formats)
- Support optional note association with highlights
- Add MediaNotes and MediaHighlights model structs with pgx v5 types
- Add EbookNotes and EbookHighlights for backward compatibility
- Add complete CRUD SQL queries for notes and highlights
- Add database connection pool function using pgx v5
- Generate sqlc code for new annotation functionality
- Add media_notes table for user annotations with position tracking
- Add media_highlights table for text highlighting with color customization
- Add optional note_id foreign key for highlight-note associations
- Add backward compatibility views (ebook_notes, ebook_highlights)
- Add proper indexes for performance optimization
- Update schema comments to document new annotation features
- Add authentication middleware tests for JWT validation
- Create library management tests for CRUD operations
- Add user visibility control tests
- Add JSON validation and error handling tests
- Add security testing for authorization bypasses
- Include tests for both success and failure scenarios
- Use httptest for isolated API testing
- Follow Go testing best practices
- Add comprehensive testing documentation
Tests verify multi-library system security and functionality before deployment.
Note: Database querier interface issues exist due to old user ebook folder references
in generated code and need resolution for full test suite operation.
- Add authentication middleware tests for JWT validation
- Add library creation tests for admin authorization
- Add library visibility control tests
- Add user management and error handling tests
- Add JSON validation and security tests
- Add tests for both success and failure scenarios
- Test edge cases like missing tokens, invalid data, unauthorized access
- Use httptest for isolated API testing without needing running server
- Include comprehensive test coverage for security and functionality
Tests verify application security and multi-library system works correctly before deployment.
- Document new multi-library architecture (ebooks, comics, manga)
- Detail per-library folder management and visibility controls
- Include comprehensive API documentation with Bruno examples
- Add pgx v5 compliance and security best practices
- Update deployment and development instructions
- Document JWT authentication and role-based access control
- Include future roadmap for audiobooks, video, podcasts, etc.
Provides complete overview of transformed system for users and developers
- Update JWT middleware to set complete user object in context
- Parse UUID correctly and convert to pgtype.UUID format
- Add missing imports for uuid and pgx/v5/pgtype
- Fix type conversion from UUID string to byte array
- Ensure compatibility with database.Users struct
Resolves authentication issues for library and user endpoints
- Replace with 410 Gone responses directing to libraries
- Maintain API contract for backward compatibility
- Remove old user folder management functionality
- Prepare for complete library system migration
Old folder management now handled through library system
- Redesign dashboard to show library selection first
- Add media browsing within selected library
- Implement library management interface
- Add user visibility controls for libraries
- Support library type icons and metadata
- Add create library modal with type selection
- Include folder management for each library
- Implement user-specific library access controls
Replaces single ebook library with flexible multi-library system
- Add library routes to main router configuration
- Implement media items API endpoints for library content
- Update existing ebook handlers to use new schema
- Add media rating and progress tracking
- Maintain backward compatibility with existing endpoints
- Support library-specific media item queries
Updates application to support new multi-library architecture
- Add LibraryHandler with full CRUD operations
- Implement library creation with type validation
- Add library folder management endpoints
- Implement library visibility control system
- Add user library access management
- Include library statistics endpoint
- Support for admin and user-level operations
Provides modular foundation for multi-library system
- Add library_types table with ebooks, comics, manga types
- Add libraries table for multiple library support
- Add library_folders table for multi-folder libraries
- Add library_visibility table for user access control
- Add media_items table replacing ebooks for broader media support
- Create backward compatibility views for existing API
- Implement library service with type validation and file extension handling
- Support modular extension for future media types
Manga type includes cbz/cbr archives as requested
- Remove complex CHECK constraint with subquery that PostgreSQL doesn't support
- Add comment explaining admin-only access is enforced at application level
- Update role system notes to clarify access control implementation
- Fix Bruno request failures due to missing database table
- Remove hardcoded folder_paths example from request body
- Allow flexible folder path configuration per request
- Improve request flexibility for different scan scenarios
- Add POST /api/ebooks for creating new ebook entries
- Add PUT /api/ebooks/:id for updating existing ebook metadata
- Add DELETE /api/ebooks/:id for deleting ebooks from database
- Include complete request/response examples with all metadata fields
- Support file path, metadata, and publication information updates
- Add POST /api/auth/ebook-folders for adding ebook folders
- Add GET /api/auth/ebook-folders for retrieving configured folders
- Add DELETE /api/auth/ebook-folders for removing ebook folders
- Include comprehensive documentation and request examples
- Support path normalization and admin-only access
- Implement numbered requirements for user account creation:
1. No users exist: First user becomes admin
2. Admins exist: Anyone can register as regular user
3. Admin logged in: Can create admins and regular users
4. User logged in: Cannot create any accounts
- Update registration logic in auth.go to validate roles based on existing admin accounts and authentication status
- Add comprehensive error handling for unauthorized user creation attempts
- Ensure security while maintaining usability for regular users
BREAKING CHANGES:
- User accounts creation now restricted based on authentication state
- Regular users cannot create accounts when logged in
- Admin privileges enforced for user management operations
- Document Bruno API testing collection with organized structure
- Include comprehensive setup and usage instructions
- Add reference to role-based registration restrictions
- Explain admin-only endpoints and authentication requirements
john-okeefe