- Fix scheduler.go log.Printf calls to convert pgtype.UUID to string before formatting
- Fix ebook.go fmt.Printf calls to convert pgtype.UUID to string before formatting
- Add missing Enabled field to rate limiter config in security test
- Prevents format string errors when logging library IDs
This resolves compilation errors where pgtype.UUID was being formatted
with %s which expects a string, not a UUID struct.
- Change from htmx:beforeSwap to htmx:afterSwap event for better error timing
- Simplify event listener setup (removed duplicate handlers)
- Remove 'export {}' statement that was causing syntax errors
- Add proper TypeScript interface for HTMX event details
- Errors now detected after content swap, ensuring accurate error messages
- Toast notifications work correctly for all backend HTTP errors
Resolves JavaScript syntax error on page load and improves error handling.
- Change module setting from 'ES2020' to 'none'
- Remove resolveJsonModule and moduleResolution options (incompatible with module: none)
- Prevents TypeScript from adding 'export {}' statements to compiled JS
- Scripts are loaded as regular JavaScript, not ES modules
- Fixes 'Unexpected token export' error in browser
This allows TypeScript type checking while generating plain JavaScript
that works with traditional script tags in HTML.
- Extract inline JavaScript from index.templ
- Replace with external script include for theme.js
- All templates reference /static/ for assets
- Cleaner separation of concerns between markup and logic
- Create web/src/ for TypeScript source files
- Create web/static/ for compiled assets and runtime files
- Move input.css and style.css to web/static/
- Add toast.ts - Functional toast notification system
- Add theme.ts - Functional theme management system
- All code uses functional programming (no classes, no OOP)
- TypeScript provides full type safety
Separates frontend code from backend for better organization.
- Add node_modules/ and npm debug logs
- Add TypeScript build artifacts (*.tsbuildinfo)
- Ignore compiled JS files in web/static/
- Keep htmx.min.js (third-party library)
- Add IDE ignores (.idea, .vscode)
- Add OS ignores (DS_Store, Thumbs.db)
- Add database and uploads directories
- Ignore package-lock.json (use npm shrinkwrap for production if needed)
Standard ignore patterns for modern web development with Go backend.
- Add Makefile with convenient test targets (test, test-integration, test-env-up, test-env-down)
- Add .env.test with test-specific configuration
- Update .env.example with test configuration options and warnings
- Update README.md with comprehensive testing documentation
- Document all environment variables with safety warnings
This makes it easy to run tests without rate limiting issues while
keeping production security intact.
- Fix SetLibraryVisibility request format (library_ids -> library_id)
- Fix UpdateReadingProgress HTTP method (POST -> PUT)
- Fix DeleteMediaNote expected status (200 -> 204)
- Add cleanupTestData() helper for better test cleanup
- Improve Setup_CreateDuplicateTestUsers to handle existing data
- Add graceful handling of 409 and 429 responses
- Update password test to create/delete temporary user
- Add test requirements comment at top of file
These changes improve test reliability and reduce flakiness.
- Add TestMode, RateLimitEnabled, RequestsPerMinute to Config
- Add getEnvBool() and getEnvInt() helper functions
- Update rate limiter to support enabled/disabled state
- Pass test environment variables through docker-compose
- Configure rate limiter dynamically in main.go
This allows disabling rate limiting for integration testing while
maintaining security in production environments.
- ListLibraries now returns {"data": []} instead of []
- ListUsers now returns {"data": []} instead of []
- ListMediaItems now returns {"data": []} instead of []
This provides consistent response structure across all list endpoints
and aligns with integration test expectations.
- Fix type assertion panics in library.go (lines 58, 109, 237)
Changed from *database.Users to database.Users to match JWT middleware
- Fix ISBN type mismatch in ebook.go (lines 249, 308)
Changed from pgtype.Text to string to match database schema
- Fix ISBN type mismatch in ebook_scanner.go (line 421)
Changed from pgtype.Text to string to match database schema
These changes fix 500 errors in library creation and ebook operations.
- Add ISBN normalization documentation
- Document background scanning and watch mode features
- Add scan settings API endpoints
- Include integration testing section
- Update architecture section with new services
- Document auto-starting services
- Add recently added features section
- Update testing documentation with integration tests
- Enhance security section with ISBN validation
- Increase ISBN column from VARCHAR(13) to VARCHAR(17) to support ISBN-13 with hyphens
- Add normalize_isbn() database function to automatically remove hyphens and spaces
- Create trigger to auto-normalize ISBNs on INSERT/UPDATE operations
- Update all Ebook and MediaItem queries to use ISBN normalization
- Add GetEbookLibraryID query to check for existing ebook libraries
- Add graceful error handling when no ebook library exists
- Return helpful error message: 'no ebook library found. Please create an ebook library first'
- Create comprehensive tests for ISBN normalization and library selection
- Add Bruno test files for various ISBN formats and error scenarios
- Update documentation with ISBN normalization details
Standardize all Bruno environment variables to use snake_case convention
(aligned with Go naming practices) and remove duplicate camelCase variants.
Changes:
- Environment file cleanup:
- Remove: baseUrl, ebookid, fakebookid, libraryId, mediaItemId, isVisible, refreshToken
- Standardize: fakebookid → fake_book_id, isVisible → is_visible, refreshToken → refresh_token
- All variables now use consistent snake_case format
- Update all Bruno requests to use standardized variables:
- ebooks: {{ebookid}} → {{ebook_id}}
- library: {{libraryId}} → {{library_id}}
- media-items: {{mediaItemId}} → {{media_item_id}}
- visibility: {{isVisible}} → {{is_visible}}
- auth: {{refreshToken}} → {{refresh_token}}
Benefits:
- Single source of truth for each variable
- Consistent with Go naming conventions
- No ambiguity about which variable name to use
- Cleaner, more maintainable codebase
- Add missing variables to Bookmann environment:
- library_id (snake_case variant)
- media_item_id (snake_case variant)
- job_id for scan status tracking
- baseUrl (camelCase variant for compatibility)
- refreshToken to secret vars
- Remove invalid vars sections from request files
- Variables should be referenced directly from environment
- Vars sections are for request-specific overrides, not env references
- All variables now properly defined and accessible
- Update scan endpoint test to expect HTTP 202 with job ID
- Add tests for new scan job status endpoint
- Add tests for watch mode start/stop/status endpoints
- Update all scanner tests to reflect async behavior
- All tests passing
- Update Scan Ebooks.bru to reflect async background scanning
- Add Get Scan Status.bru for checking job progress
- Add Start Watch Mode.bru for instant file monitoring
- Add Stop Watch Mode.bru for stopping library monitoring
- Add Get Watch Mode Status.bru for checking watched libraries
- Document all new endpoints with examples and status codes
- Add RequestTracingMiddleware to middleware chain
- Auto-start scheduler for auto-scanning on server boot
- Auto-start watch mode for all libraries with 2-second delay
- Update SetupRoutes to return handler for service management
- Update scanner to run asynchronously in background worker pool
- POST /api/scanner/scan now returns immediately with job ID (HTTP 202)
- Add GET /api/scanner/status/:jobId for checking scan job progress
- Integrate watch mode with library system for instant ebook detection
- Auto-start watch mode for all libraries on server startup
- Add endpoints for managing watch mode per library:
- POST /api/scanner/watch/start
- POST /api/scanner/watch/stop
- GET /api/scanner/watch/status
- Track which libraries are currently being watched
- Auto-start scheduler on server boot
- Add Worker service with configurable worker pool for async job processing
- Implement job queue with status tracking (pending, running, completed, failed, cancelled)
- Add Scheduler service for auto-scanning based on user scan settings
- Check scan settings every 5 minutes and schedule background scan jobs
- Support multiple libraries with individual scan frequencies (15-1440 minutes)
- Regenerate queries.sql.go with refresh token queries
- Update models.go with RefreshTokens type
- Update querier.go with new query methods
- Update db.go with generated code
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
- Implement strict password requirements:
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
- At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
Document new security and validation features:
- Rate limiting on auth endpoints
- Improved input validation
- Pagination limits
- Path validation
- Role normalization
Updates reflect the security improvements made to the application
- Add os package import for file system checks
- Validate that folder paths exist before adding to library
- Check folder accessibility to prevent invalid paths
- Return clear error messages for invalid folders
Improves user experience by catching path errors early
- Enforce maximum pagination limit of 1000 items per request
- Prevent negative offset values in pagination
- Apply limits to both /api/ebooks and /api/media-items endpoints
- Protect against DoS attacks from large limit values
Fixes security issue: No maximum pagination limit
- Trim whitespace from usernames and validate non-empty
- Normalize role values to lowercase for case-insensitive comparison
- Prevent registration with whitespace-only usernames
- Maintain backward compatibility with existing functionality
Fixes validation gap: Username whitespace handling
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records
Closes security issue: No rate limiting on auth endpoints
- Fix database authentication error by exposing actual database error messages
- Update error handling to follow pgx v5 standards with detailed error reporting
- Restore token environment variable management in Register User.bru for subsequent requests
- Enable proper debugging of database connection issues during user registration
The registration API now provides detailed error messages instead of generic 'failed to check existing users'
when database connection or authentication fails, making debugging easier.
- Convert all JSON tests to JavaScript functions for bruToJsonV2 compatibility
- Update authentication to use 'inherit' instead of manual headers
- Fix hardcoded URLs to use {{base_url}} variables
- Standardize variable syntax from {{ _.var }} to {{var}}
- Add comprehensive API documentation to all requests
- Update environment variables with missing required fields
- Apply consistent structure: meta, http method, headers, tests, vars, settings, docs
- Enhanced validation with proper error handling and field checks
This major update implements a complete user annotation system:
## 🎯 New Features
- User notes with position tracking for media items
- Text highlighting with customizable colors
- Highlight-note associations for detailed annotations
- Full CRUD API for both notes and highlights
- Backward compatibility with existing ebook endpoints
## 📊 Database Changes
- Add media_notes table (id, media_item_id, user_id, content, position, timestamps)
- Add media_highlights table (id, media_item_id, user_id, selection_text, start/end_position, color, optional note_id)
- Add foreign key relationships with CASCADE deletes
- Add proper indexes for performance
- Add database schema views for ebook backward compatibility
## 🔧 API Implementation
- Complete REST API endpoints for notes and highlights
- JWT authentication with proper middleware bypass
- Request validation with meaningful error responses
- UUID validation and type safety
- Support for hex color codes in highlights
## 🧪 Testing & Documentation
- Comprehensive test suite covering authentication scenarios
- Bruno API collection for manual testing
- Detailed testing guide with troubleshooting
- Updated documentation in README and TESTING.md
## 📁 Backward Compatibility
- Existing ebook endpoints continue working
- Database views maintain API contracts
- No breaking changes for existing integrations
The annotation system is now fully functional and ready for production use.
- Add detailed testing instructions in TESTING.md
- Include quick start commands for all test scenarios
- Document new notes and highlights test coverage
- Add coverage analysis and reporting commands
- Include troubleshooting guide for common issues
- Add test flag reference and workflow recommendations
- Document test categories and what they verify
- Fix undefined variable 'resp' errors in library_test.go (should be 'req')
- Fix authentication test expectations to match unauthorized response
- Fix TestUserVisibleLibraries to properly simulate user visibility filtering
- Remove hidden library from mock user response to test visibility correctly
- All tests now pass successfully
- Add testify/assert and testify/require for testing
- Update module dependencies after adding annotation features
- Ensure proper pgx v5 compatibility with new database operations
- Add notes and highlights to Media Management features section
- Document complete API endpoints for annotations (CRUD operations)
- Update database schema documentation with new tables
- Add backward compatibility endpoints for existing ebook API
- Update Bruno collection structure to show new test directories
- Document highlight-note association and color customization features
- Remove temporary DOCUMENTATION_UPDATES.md after merging content
- Add complete test suite for media notes API with validation
- Add complete test suite for media highlights API with color validation
- Add backward compatibility tests for ebook endpoints
- Test authentication scenarios (unauthorized access)
- Test request validation and error handling
- Fix existing test import issues and syntax errors
- Add test cases for highlight-note associations
- Add complete Bruno collection for notes API (5 endpoints)
- Add complete Bruno collection for highlights API (5 endpoints)
- Include detailed request/response documentation
- Add proper validation examples and error cases
- Support both media-items and ebook endpoint testing
- Add environment variable support for dynamic IDs
- Add complete CRUD API for media items notes (/api/media-items/:id/notes/*)
- Add complete CRUD API for media highlights (/api/media-items/:id/highlights/*)
- Add backward compatibility endpoints for ebooks (/api/ebooks/:id/notes/*, /api/ebooks/:id/highlights/*)
- Implement proper validation for request payloads and UUIDs
- Support hex color codes for highlights with default yellow (#ffff00)
- Support position tracking (page:offset or CFI formats)
- Support optional note association with highlights
john-okeefe