- Update callers of createTestMediaItemID to not pass token
- Fix loginAdminUser to delete/recreate admin user for consistent state
- Fix TestListAllQueueItems_Admin to parse response as map with 'items' key
- Remove unused token variables from tests
- Update device_test.go with admin password hash constant
- createTestMediaItemID now gets fresh auth token to avoid stale tokens
- Use unique library names with timestamps to avoid conflicts
- Add t.Cleanup to delete libraries after tests
- Remove token parameter from function signature (not needed)
Remove the old phase1_example_test.go file that was renamed to
device_test_patterns_test.go. This file should have been removed
in the previous commit but was missed.
Clean up API documentation files by removing Phase X references:
Remove 'API Explorer will be inserted here in Phase X' placeholders from:
- 70+ API endpoint documentation files
- Authentication endpoints (login, logout, register, refresh)
- User endpoints (profile, settings, password)
- Device endpoints (registration, sync, shelves)
- Library endpoints (CRUD, folders, visibility)
- Media endpoints (items, progress, highlights, notes)
- Admin endpoints (users, analytics)
- Sync endpoints (Kobo, KOReader)
- OPDS endpoints
- Scanner endpoints
- Queue endpoints
These placeholders were from planning documents and have no meaning
to API consumers. The documentation is now clean and ready for use.
Test file renames for clarity:
- phase1_example_test.go → device_test_patterns_test.go
- universal_progress_integration_test.go → setup_integration_test.go
Fix broken TestConflictsBulkEscalate test:
- Comment out test for non-existent /api/conflicts/bulk-escalate endpoint
- Remove unused imports (context, time, pgtype, httptest)
- Add explanatory comment about why test is disabled
Clean up test helper comment:
- Remove Phase 6 reference from test_helpers.go
These changes remove planning document terminology from filenames and
fix compilation errors caused by tests for unimplemented endpoints.
Remove temporary planning documents that are no longer needed:
- IMPLEMENTATION_EXACT.md
- IMPLEMENTATION_PLAN.md
- TEST_RELIABILITY_PLAN.md
- baseline-results.txt
- cmd/server/tests/TEST_CLEANUP_PATTERN.md
- cmd/server/tests/TEST_COVERAGE.md
- cmd/server/tests/universal_progress_integration_test.go
These were internal planning documents and temporary test files that have
served their purpose and are now being cleaned up from the repository.
Add delay to allow queue processor to process sync queue items
before querying for escalated conflicts
Resolves race condition between queue item creation and conflict lookup
- Add LibraryTestData struct to TestDeviceSetup
- Implement CreateLibrary() for proper library creation in tests
- Implement CreateCollection() for test collection support
- Improve test isolation with dedicated library creation
This provides a more robust foundation for integration tests that need
proper library management support.
- Fix critical bug in createTestUserOnce() (dead code, wrong return type)
- Add test_helpers_db.go with 6 new helper functions
- Impact: All tests can now create users reliably
- Convert TestListDevices from map to handlers.DeviceListResponse
- Convert TestUpdateDevice to use handlers.DeviceUpdateRequest
- Add database verification after device update:
* Query DB to verify sync_enabled, sync_frequency actually updated
* Ensures data integrity - API says success, DB confirms it
- Impact: Compile-time safety for device endpoints, data integrity verification
Pattern: Replaces map[string]interface{} with type-safe structs,
ensures API changes caught at compile time, operations actually persist.
- Change Kobo sync endpoints to use URL token authentication
- Update OPDS tests to use device tokens instead of user tokens
- Support both Bearer and query parameter authentication methods
- Return error when test user already exists instead of deleting
- Prevent test interference from cleanup operations
- Improve test isolation and reliability
- Test successful token regeneration
- Verify old tokens are invalidated after regeneration
- Test unauthorized and forbidden access scenarios
- Test not found and device type-specific behavior
- Validate sync URLs contain new tokens
- Display sync URLs for Kobo devices with copy button
- Display auth tokens for KOReader devices with copy button
- Add regenerate token button with confirmation
- Show warning about token invalidation
- Add handler to regenerate device auth tokens
- Add PUT /api/devices/:id/regenerate-token route
- Returns new token and sync URLs for device configuration
- Add comment about BASE_URL in docker-compose.yml
- Document that BASE_URL should include protocol (http:// or https://)
- Provides guidance for users setting up device sync
- Kobo devices require actual network IP, not localhost
- Extract device validation logic into separate validateDevice() method
- Replace goto statements with direct function returns for clearer control flow
- Add security warning banner in device configuration UI
- Refactor Kobo tests to use table-driven pattern
- Add database schema note clarifying no schema changes required
- Improve code maintainability and testability
- Add IMPLEMENTATION_EXACT.md with exact code changes for all phases
- Update IMPLEMENTATION_PLAN.md with clarifications on two-field approach:
- device_identifier: Serial number (Kobo) or UUID (KOReader)
- auth_token: Auto-generated API key for authentication
- Resolve all user questions with ✅ marked decisions
- Add verification steps for documentation accuracy
- Document Kobo vs KOReader registration workflow differences
- Add SQL query for token regeneration (UpdateDeviceAuthToken)
- Include TypeScript device management code
- Add Bruno API test files for all new endpoints
- Update Kobo setup documentation for URL path token approach
- Add Section 16.1: Codebase investigation results
- Document that device_identifier was added in Phase 1 (commit 3b2075f)
- Clarify it's for device management, not authentication
- Show active usage in device registration (line 37: validate:"required,min=1,max=255")
- Identify dead code: GetDeviceByIdentifier query exists but not called
- Confirm OPDS uses device.id for lookup (not device_identifier)
- Distinguish authentication (auth_token) from device identification (device_identifier)
- Remove duplicate Go code block in Section 9.6 (line 676)
- Keep canonical version in Section 14.2 (line 1081)
- Eliminates ~25 lines of duplicate content
- Plan now has single source of truth for middleware implementation
- Add Section 16: Documentation Updates Required
- Detail specific line numbers and changes for koreader-setup.md:
- Line 126: Change "Basic Auth" to "Bearer Token"
- Lines 127-128: Remove username/password references
- Detail verification needed for kobo-setup.md:
- Lines 37-53: Confirm no serial number references
- Verify registration flow describes automatic token generation
- Update Phase 1 tasks with specific line number references
- Update Phase 2 Kobo documentation tasks with verification notes
- Add principle for extracting domain concepts/types only when clearly beneficial
- Emphasize YAGNI approach to avoid over-engineering TypeScript code
- Allow sensible extraction when it reduces duplication or complexity
- Replace serial number approach with API key in URL path for Kobo
- Add authentication strategy section documenting Kobo and KOReader methods
- Update unified authentication architecture to support URL path parameters
- Document Komga-proven approach for stock Kobo firmware
- Update feature matrix with new authentication methods
- Revise user flows for API key-based registration
- Clarify OPDS security (already using DeviceAuthMiddleware)
- Update security considerations to reflect revocable API keys
- Replace username/password authentication with API key in sync URL
- Update configuration examples to show API key in URL path
- Add instructions for copying API key from Device Management
- Update OPDS catalog URL to include token parameter
- Fix troubleshooting section for API key authentication
- Document where to find API key and sync URL in UI
- Update SSL/TLS examples with API key approach
Add detailed implementation plan covering:
- Enhanced authentication middleware (Bearer + serial)
- Kobo native sync with serial-based auth
- KOReader plugin development plan
- OPDS security hardening
- Parallel implementation tracks
- Complete historical context and decision rationale
This plan documents the strategy to transform Bookhoard into a
Kindle-replacement ecosystem with full sync support for both
Kobo (native) and KOReader (via plugin) devices.
Key decisions:
- Kobo: Serial number authentication (simplest UX)
- KOReader: Bearer token via plugin (most secure)
- Plugin: Separate repository under Bookhoard org
- Implementation: Parallel tracks for faster delivery
- Apply DeviceAuthMiddleware.Authenticate to /opds/devices/* routes
- OPDS now uses same authentication model as sync API (devices.auth_token)
- Removes security vulnerability allowing unauthorized device enumeration
- Update test expectations to require 401 for unauthenticated requests
- Fix query parameter name from 'query' to 'q' in search endpoints
- Update router comments to clarify authentication requirements
john-okeefe