MyGO/mygo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
53 Commits 2 Branches 0 Tags
519aa35f1ff9c94d43786d6a07ee79b93b484c4d
Commit Graph

3 Commits

Author SHA1 Message Date
ld a18f96912d feat(repository): refactor query/mutation ports with capability-safe 
interfaces

- refactor: split UserRepository into AuthUserRepository and
  AdminUserRepository capabilities
- refactor: split SessionRepository into AuthSessionRepository and
  repository-owned CLI/admin methods
- refactor: replace generic Repository Update/Delete with
  operation-specific params and ownership predicates
- refactor: replace CredentialRepository generic CRUD with
  passkey-specific methods
- refactor: replace FileRepository generic Create/Update/Delete with
  UploadedFileParams, DirectoryParams, and owned soft-delete
- refactor: remove repository fields from WebApp struct; repositories
  are now composition-time wiring only
- feat: add domain error kinds ErrParentNotFound, ErrParentNotDir,
  ErrDirectoryNotEmpty, ErrInvalidMove
- feat: add CredentialTypeAppPasskey constant
- feat: add testutil.SetUserAdmin for test fixture setup that bypasses
  production service ports
- test: add architecture test banning GORM Save in repository package
- test: add capability interface contract tests ensuring each service
  receives the minimal interface
- test: add blockingStorage helper for concurrent promotion tests
- test: add preserved DSN parameter test for sqliteImmediateDSN
- docs: update architecture decisions with repository write rules and
  capability separation
- docs: update roadmap to clarify atomic single-use refresh sessions
- docs: add -race test target to development docs
 2026-07-16 12:24:36 +08:00
ld 6604ecb026 feat(file): conceal file resource existence from other users 
- feat: cross-user file access returns not-found instead of
  permission-denied
- fix: repository delete now only affects active rows and returns
  ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
  conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
  assert not-found behavior for cross-user and missing file operations
 2026-07-16 00:06:31 +08:00
ld bb86950632 feat(server): add file route integration tests with ownership 
enforcement

- test: cover authenticated register, login, upload, list, and download
  flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
  tokens
- test: verify cross-user ownership isolation for all file CRUD
  operations
- refactor: rename test-only header constant to clarify it is not used
  in production
 2026-07-15 23:48:20 +08:00