- Extract inline JavaScript from index.templ
- Replace with external script include for theme.js
- All templates reference /static/ for assets
- Cleaner separation of concerns between markup and logic
- Create web/src/ for TypeScript source files
- Create web/static/ for compiled assets and runtime files
- Move input.css and style.css to web/static/
- Add toast.ts - Functional toast notification system
- Add theme.ts - Functional theme management system
- All code uses functional programming (no classes, no OOP)
- TypeScript provides full type safety
Separates frontend code from backend for better organization.
- Add node_modules/ and npm debug logs
- Add TypeScript build artifacts (*.tsbuildinfo)
- Ignore compiled JS files in web/static/
- Keep htmx.min.js (third-party library)
- Add IDE ignores (.idea, .vscode)
- Add OS ignores (DS_Store, Thumbs.db)
- Add database and uploads directories
- Ignore package-lock.json (use npm shrinkwrap for production if needed)
Standard ignore patterns for modern web development with Go backend.
- Add Makefile with convenient test targets (test, test-integration, test-env-up, test-env-down)
- Add .env.test with test-specific configuration
- Update .env.example with test configuration options and warnings
- Update README.md with comprehensive testing documentation
- Document all environment variables with safety warnings
This makes it easy to run tests without rate limiting issues while
keeping production security intact.
- Fix SetLibraryVisibility request format (library_ids -> library_id)
- Fix UpdateReadingProgress HTTP method (POST -> PUT)
- Fix DeleteMediaNote expected status (200 -> 204)
- Add cleanupTestData() helper for better test cleanup
- Improve Setup_CreateDuplicateTestUsers to handle existing data
- Add graceful handling of 409 and 429 responses
- Update password test to create/delete temporary user
- Add test requirements comment at top of file
These changes improve test reliability and reduce flakiness.
- Add TestMode, RateLimitEnabled, RequestsPerMinute to Config
- Add getEnvBool() and getEnvInt() helper functions
- Update rate limiter to support enabled/disabled state
- Pass test environment variables through docker-compose
- Configure rate limiter dynamically in main.go
This allows disabling rate limiting for integration testing while
maintaining security in production environments.
- ListLibraries now returns {"data": []} instead of []
- ListUsers now returns {"data": []} instead of []
- ListMediaItems now returns {"data": []} instead of []
This provides consistent response structure across all list endpoints
and aligns with integration test expectations.
- Fix type assertion panics in library.go (lines 58, 109, 237)
Changed from *database.Users to database.Users to match JWT middleware
- Fix ISBN type mismatch in ebook.go (lines 249, 308)
Changed from pgtype.Text to string to match database schema
- Fix ISBN type mismatch in ebook_scanner.go (line 421)
Changed from pgtype.Text to string to match database schema
These changes fix 500 errors in library creation and ebook operations.
- Add ISBN normalization documentation
- Document background scanning and watch mode features
- Add scan settings API endpoints
- Include integration testing section
- Update architecture section with new services
- Document auto-starting services
- Add recently added features section
- Update testing documentation with integration tests
- Enhance security section with ISBN validation
- Increase ISBN column from VARCHAR(13) to VARCHAR(17) to support ISBN-13 with hyphens
- Add normalize_isbn() database function to automatically remove hyphens and spaces
- Create trigger to auto-normalize ISBNs on INSERT/UPDATE operations
- Update all Ebook and MediaItem queries to use ISBN normalization
- Add GetEbookLibraryID query to check for existing ebook libraries
- Add graceful error handling when no ebook library exists
- Return helpful error message: 'no ebook library found. Please create an ebook library first'
- Create comprehensive tests for ISBN normalization and library selection
- Add Bruno test files for various ISBN formats and error scenarios
- Update documentation with ISBN normalization details
Standardize all Bruno environment variables to use snake_case convention
(aligned with Go naming practices) and remove duplicate camelCase variants.
Changes:
- Environment file cleanup:
- Remove: baseUrl, ebookid, fakebookid, libraryId, mediaItemId, isVisible, refreshToken
- Standardize: fakebookid → fake_book_id, isVisible → is_visible, refreshToken → refresh_token
- All variables now use consistent snake_case format
- Update all Bruno requests to use standardized variables:
- ebooks: {{ebookid}} → {{ebook_id}}
- library: {{libraryId}} → {{library_id}}
- media-items: {{mediaItemId}} → {{media_item_id}}
- visibility: {{isVisible}} → {{is_visible}}
- auth: {{refreshToken}} → {{refresh_token}}
Benefits:
- Single source of truth for each variable
- Consistent with Go naming conventions
- No ambiguity about which variable name to use
- Cleaner, more maintainable codebase
- Add missing variables to Bookmann environment:
- library_id (snake_case variant)
- media_item_id (snake_case variant)
- job_id for scan status tracking
- baseUrl (camelCase variant for compatibility)
- refreshToken to secret vars
- Remove invalid vars sections from request files
- Variables should be referenced directly from environment
- Vars sections are for request-specific overrides, not env references
- All variables now properly defined and accessible
- Update scan endpoint test to expect HTTP 202 with job ID
- Add tests for new scan job status endpoint
- Add tests for watch mode start/stop/status endpoints
- Update all scanner tests to reflect async behavior
- All tests passing
- Update Scan Ebooks.bru to reflect async background scanning
- Add Get Scan Status.bru for checking job progress
- Add Start Watch Mode.bru for instant file monitoring
- Add Stop Watch Mode.bru for stopping library monitoring
- Add Get Watch Mode Status.bru for checking watched libraries
- Document all new endpoints with examples and status codes
- Add RequestTracingMiddleware to middleware chain
- Auto-start scheduler for auto-scanning on server boot
- Auto-start watch mode for all libraries with 2-second delay
- Update SetupRoutes to return handler for service management
- Update scanner to run asynchronously in background worker pool
- POST /api/scanner/scan now returns immediately with job ID (HTTP 202)
- Add GET /api/scanner/status/:jobId for checking scan job progress
- Integrate watch mode with library system for instant ebook detection
- Auto-start watch mode for all libraries on server startup
- Add endpoints for managing watch mode per library:
- POST /api/scanner/watch/start
- POST /api/scanner/watch/stop
- GET /api/scanner/watch/status
- Track which libraries are currently being watched
- Auto-start scheduler on server boot
- Add Worker service with configurable worker pool for async job processing
- Implement job queue with status tracking (pending, running, completed, failed, cancelled)
- Add Scheduler service for auto-scanning based on user scan settings
- Check scan settings every 5 minutes and schedule background scan jobs
- Support multiple libraries with individual scan frequencies (15-1440 minutes)
- Regenerate queries.sql.go with refresh token queries
- Update models.go with RefreshTokens type
- Update querier.go with new query methods
- Update db.go with generated code
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
- Implement strict password requirements:
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
- At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation
Document new security and validation features:
- Rate limiting on auth endpoints
- Improved input validation
- Pagination limits
- Path validation
- Role normalization
Updates reflect the security improvements made to the application
- Add os package import for file system checks
- Validate that folder paths exist before adding to library
- Check folder accessibility to prevent invalid paths
- Return clear error messages for invalid folders
Improves user experience by catching path errors early
- Enforce maximum pagination limit of 1000 items per request
- Prevent negative offset values in pagination
- Apply limits to both /api/ebooks and /api/media-items endpoints
- Protect against DoS attacks from large limit values
Fixes security issue: No maximum pagination limit
- Trim whitespace from usernames and validate non-empty
- Normalize role values to lowercase for case-insensitive comparison
- Prevent registration with whitespace-only usernames
- Maintain backward compatibility with existing functionality
Fixes validation gap: Username whitespace handling
- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records
Closes security issue: No rate limiting on auth endpoints
- Fix database authentication error by exposing actual database error messages
- Update error handling to follow pgx v5 standards with detailed error reporting
- Restore token environment variable management in Register User.bru for subsequent requests
- Enable proper debugging of database connection issues during user registration
The registration API now provides detailed error messages instead of generic 'failed to check existing users'
when database connection or authentication fails, making debugging easier.
- Convert all JSON tests to JavaScript functions for bruToJsonV2 compatibility
- Update authentication to use 'inherit' instead of manual headers
- Fix hardcoded URLs to use {{base_url}} variables
- Standardize variable syntax from {{ _.var }} to {{var}}
- Add comprehensive API documentation to all requests
- Update environment variables with missing required fields
- Apply consistent structure: meta, http method, headers, tests, vars, settings, docs
- Enhanced validation with proper error handling and field checks
This major update implements a complete user annotation system:
## 🎯 New Features
- User notes with position tracking for media items
- Text highlighting with customizable colors
- Highlight-note associations for detailed annotations
- Full CRUD API for both notes and highlights
- Backward compatibility with existing ebook endpoints
## 📊 Database Changes
- Add media_notes table (id, media_item_id, user_id, content, position, timestamps)
- Add media_highlights table (id, media_item_id, user_id, selection_text, start/end_position, color, optional note_id)
- Add foreign key relationships with CASCADE deletes
- Add proper indexes for performance
- Add database schema views for ebook backward compatibility
## 🔧 API Implementation
- Complete REST API endpoints for notes and highlights
- JWT authentication with proper middleware bypass
- Request validation with meaningful error responses
- UUID validation and type safety
- Support for hex color codes in highlights
## 🧪 Testing & Documentation
- Comprehensive test suite covering authentication scenarios
- Bruno API collection for manual testing
- Detailed testing guide with troubleshooting
- Updated documentation in README and TESTING.md
## 📁 Backward Compatibility
- Existing ebook endpoints continue working
- Database views maintain API contracts
- No breaking changes for existing integrations
The annotation system is now fully functional and ready for production use.
- Add detailed testing instructions in TESTING.md
- Include quick start commands for all test scenarios
- Document new notes and highlights test coverage
- Add coverage analysis and reporting commands
- Include troubleshooting guide for common issues
- Add test flag reference and workflow recommendations
- Document test categories and what they verify
- Fix undefined variable 'resp' errors in library_test.go (should be 'req')
- Fix authentication test expectations to match unauthorized response
- Fix TestUserVisibleLibraries to properly simulate user visibility filtering
- Remove hidden library from mock user response to test visibility correctly
- All tests now pass successfully
- Add testify/assert and testify/require for testing
- Update module dependencies after adding annotation features
- Ensure proper pgx v5 compatibility with new database operations
- Add notes and highlights to Media Management features section
- Document complete API endpoints for annotations (CRUD operations)
- Update database schema documentation with new tables
- Add backward compatibility endpoints for existing ebook API
- Update Bruno collection structure to show new test directories
- Document highlight-note association and color customization features
- Remove temporary DOCUMENTATION_UPDATES.md after merging content
- Add complete test suite for media notes API with validation
- Add complete test suite for media highlights API with color validation
- Add backward compatibility tests for ebook endpoints
- Test authentication scenarios (unauthorized access)
- Test request validation and error handling
- Fix existing test import issues and syntax errors
- Add test cases for highlight-note associations
- Add complete Bruno collection for notes API (5 endpoints)
- Add complete Bruno collection for highlights API (5 endpoints)
- Include detailed request/response documentation
- Add proper validation examples and error cases
- Support both media-items and ebook endpoint testing
- Add environment variable support for dynamic IDs
- Add complete CRUD API for media items notes (/api/media-items/:id/notes/*)
- Add complete CRUD API for media highlights (/api/media-items/:id/highlights/*)
- Add backward compatibility endpoints for ebooks (/api/ebooks/:id/notes/*, /api/ebooks/:id/highlights/*)
- Implement proper validation for request payloads and UUIDs
- Support hex color codes for highlights with default yellow (#ffff00)
- Support position tracking (page:offset or CFI formats)
- Support optional note association with highlights
- Add MediaNotes and MediaHighlights model structs with pgx v5 types
- Add EbookNotes and EbookHighlights for backward compatibility
- Add complete CRUD SQL queries for notes and highlights
- Add database connection pool function using pgx v5
- Generate sqlc code for new annotation functionality
- Add media_notes table for user annotations with position tracking
- Add media_highlights table for text highlighting with color customization
- Add optional note_id foreign key for highlight-note associations
- Add backward compatibility views (ebook_notes, ebook_highlights)
- Add proper indexes for performance optimization
- Update schema comments to document new annotation features
- Add authentication middleware tests for JWT validation
- Create library management tests for CRUD operations
- Add user visibility control tests
- Add JSON validation and error handling tests
- Add security testing for authorization bypasses
- Include tests for both success and failure scenarios
- Use httptest for isolated API testing
- Follow Go testing best practices
- Add comprehensive testing documentation
Tests verify multi-library system security and functionality before deployment.
Note: Database querier interface issues exist due to old user ebook folder references
in generated code and need resolution for full test suite operation.
- Add authentication middleware tests for JWT validation
- Add library creation tests for admin authorization
- Add library visibility control tests
- Add user management and error handling tests
- Add JSON validation and security tests
- Add tests for both success and failure scenarios
- Test edge cases like missing tokens, invalid data, unauthorized access
- Use httptest for isolated API testing without needing running server
- Include comprehensive test coverage for security and functionality
Tests verify application security and multi-library system works correctly before deployment.
- Document new multi-library architecture (ebooks, comics, manga)
- Detail per-library folder management and visibility controls
- Include comprehensive API documentation with Bruno examples
- Add pgx v5 compliance and security best practices
- Update deployment and development instructions
- Document JWT authentication and role-based access control
- Include future roadmap for audiobooks, video, podcasts, etc.
Provides complete overview of transformed system for users and developers
- Update JWT middleware to set complete user object in context
- Parse UUID correctly and convert to pgtype.UUID format
- Add missing imports for uuid and pgx/v5/pgtype
- Fix type conversion from UUID string to byte array
- Ensure compatibility with database.Users struct
Resolves authentication issues for library and user endpoints
- Replace with 410 Gone responses directing to libraries
- Maintain API contract for backward compatibility
- Remove old user folder management functionality
- Prepare for complete library system migration
Old folder management now handled through library system
- Redesign dashboard to show library selection first
- Add media browsing within selected library
- Implement library management interface
- Add user visibility controls for libraries
- Support library type icons and metadata
- Add create library modal with type selection
- Include folder management for each library
- Implement user-specific library access controls
Replaces single ebook library with flexible multi-library system
- Add library routes to main router configuration
- Implement media items API endpoints for library content
- Update existing ebook handlers to use new schema
- Add media rating and progress tracking
- Maintain backward compatibility with existing endpoints
- Support library-specific media item queries
Updates application to support new multi-library architecture
- Add LibraryHandler with full CRUD operations
- Implement library creation with type validation
- Add library folder management endpoints
- Implement library visibility control system
- Add user library access management
- Include library statistics endpoint
- Support for admin and user-level operations
Provides modular foundation for multi-library system
- Add library_types table with ebooks, comics, manga types
- Add libraries table for multiple library support
- Add library_folders table for multi-folder libraries
- Add library_visibility table for user access control
- Add media_items table replacing ebooks for broader media support
- Create backward compatibility views for existing API
- Implement library service with type validation and file extension handling
- Support modular extension for future media types
Manga type includes cbz/cbr archives as requested
- Remove complex CHECK constraint with subquery that PostgreSQL doesn't support
- Add comment explaining admin-only access is enforced at application level
- Update role system notes to clarify access control implementation
- Fix Bruno request failures due to missing database table
- Remove hardcoded folder_paths example from request body
- Allow flexible folder path configuration per request
- Improve request flexibility for different scan scenarios
- Add POST /api/ebooks for creating new ebook entries
- Add PUT /api/ebooks/:id for updating existing ebook metadata
- Add DELETE /api/ebooks/:id for deleting ebooks from database
- Include complete request/response examples with all metadata fields
- Support file path, metadata, and publication information updates
- Add POST /api/auth/ebook-folders for adding ebook folders
- Add GET /api/auth/ebook-folders for retrieving configured folders
- Add DELETE /api/auth/ebook-folders for removing ebook folders
- Include comprehensive documentation and request examples
- Support path normalization and admin-only access
- Implement numbered requirements for user account creation:
1. No users exist: First user becomes admin
2. Admins exist: Anyone can register as regular user
3. Admin logged in: Can create admins and regular users
4. User logged in: Cannot create any accounts
- Update registration logic in auth.go to validate roles based on existing admin accounts and authentication status
- Add comprehensive error handling for unauthorized user creation attempts
- Ensure security while maintaining usability for regular users
BREAKING CHANGES:
- User accounts creation now restricted based on authentication state
- Regular users cannot create accounts when logged in
- Admin privileges enforced for user management operations
- Document Bruno API testing collection with organized structure
- Include comprehensive setup and usage instructions
- Add reference to role-based registration restrictions
- Explain admin-only endpoints and authentication requirements
- Add comprehensive Bruno API testing collection section with organized structure
- Document new role-based registration restrictions for admin user creation
- Update API endpoint documentation to reflect admin-only access for user management
- Clarify admin override capabilities for account deletion
- Enhance API authentication and authorization details throughout documentation
- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules
BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure
- Fix database name reference in docker-compose.yml
- Update config.go to use consistent database name
- Ensure database connection string matches container setup
- Document first-user automatic admin assignment
- Update admin setup instructions with correct database name
- Add last-user protection documentation
- Update API endpoints with role field and protection notes
- Document Bruno collection reorganization and admin folder
- Clarify authentication flow and role-based access
- Update role permissions section with new protections
- Create separate admin folder for admin-only operations
- Move admin endpoints (Create/Update/Delete Ebook, Scanner, Folder Management) to /bruno/admin/
- Add admin dashboard, profile, and library page requests
- Add Register Admin User request with explicit admin role
- Update Register User request to include role field
- Remove empty scanner folder structure
API organization:
- Admin requests: /bruno/admin/ (require admin role)
- User requests: /bruno/user/ (available to all authenticated users)
- Environment: Single {{token}} variable works for both roles
- First registered user automatically becomes admin regardless of request
- Prevent deletion of the last user account to protect system
- Enhanced role validation and HTMX error handling
- Proper pgx 5 database standards throughout
Security improvements:
- Auto-admin for first user ensures system always has administrator
- Last-user protection prevents system from having zero users
- Role validation ensures only 'user' or 'admin' roles accepted
- Update CreateUser SQL query to accept role parameter
- Regenerate SQLC code to include Role field in CreateUserParams
- Support for explicit role assignment during user registration
- Update README.md with admin system documentation
- Add admin setup instructions and role permissions
- Update API endpoint documentation with access requirements
- Update Bruno collection to reflect admin-only operations
- Document shared library concept and security model
- Add comprehensive admin setup guide
- Update User type to include role field
- Modify dashboard template to conditionally show admin links
- Add protected dashboard route with user context
- Update main.go to serve dashboard with proper authentication
- Update ebook handlers to require admin role for CRUD operations
- Modify folder operations to be admin-only
- Update ebook scanner to associate books with admin who added them
- Add admin ID tracking to CreateEbook operations
- Restrict scanner operations to admin users only
- Add AdminMiddleware for protecting sensitive operations
- Update JWT generation to include user role and details
- Modify login/registration to use enhanced JWT claims
- Update main.go to set admin-protected routes
- Add user role to JWT context for downstream handlers
- Add role column to users table with admin/user constraint
- Add added_by_admin_id column to ebooks table for tracking
- Add constraint to ensure only admins can manage folders
- Update all SQL queries to include role field
- Regenerate database models with new schema
- Replace migration files with single schema.sql
- Include all current functionality in one file
- Add 10-point rating scale with half-star precision
- Remove old migration complexity for development
- Maintain all table constraints and indexes
- Add proper comments for rating system
- Prepare clean schema for first release deployment
- Change rating validation from 1-5 to 1-10
- Enable half-star precision support in backend
- Maintain compatibility with frontend conversion logic
- Support odd numbers for half-star ratings (1,3,5,7,9)
- Update rating examples to use 1-10 scale
- Document half-star precision in API collections
- Add rating conversion examples for testing
- Update Get Ebook Rating docs with scale explanation
- Update Create/Update Rating with new validation rules
- Update README.md with interactive rating system details
- Document zero-rating behavior in GET /api/ebooks/:id/rating
- Add comprehensive rating system documentation section
- Update Bruno collection files to reflect new API behavior
- Enhance API testing documentation with rating 0 fallback
- Remove string-based error checking for no rows
- Use proper pgx.ErrNoRows comparison only
- Improve error handling consistency in processEbookFile function
- Add pgx.ErrNoRows checks in GetEbook and GetReadingProgress
- Improve error handling in GetEbookRating with proper status codes
- Return consistent error responses across all endpoints
- Add missing pgx import for proper error comparison
- Add specific pgx.ErrNoRows checks in GetProfile
- Better error handling in UpdatePassword and GetScanSettings
- Return appropriate HTTP status codes for different error types
- Improve error message consistency
- Change schema path to use relative path from internal/database
- Update queries path to use current directory
- Modify output directory to current directory for better organization
- Reorder package installation to improve layer caching
- Add curl to runtime dependencies
- Use relative paths for sqlc and templ generation
- Copy static assets to final stage
- Improve build step organization
john-okeefe