- refactor: move HTTP status and DTO concerns out of model and service
layers into API and handler code.
- feat: add admin service boundary and route auth through services
instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
architecture and roadmap notes.
- refactor: replace inline AppError literals with model.New*Error
constructors in service and handler layers
- feat: PromoteStaged falls back to copy/delete when os.Rename returns
EXDEV (cross-device link)
- fix: upload error messages no longer leak internal multipart field
names or parser implementation details
- fix: upload size violations are converted to domain error
ErrUploadTooLarge at the handler boundary
- fix: download logs error and size mismatch when io.Copy fails or
writes fewer bytes than expected
- test: add tests for field name leak prevention, parser error
sanitization, read errors after response start, and EXDEV fallback
- fix: replace multipart form parsing with streaming multipart reads and
apply request body limits when max_upload_size is configured.
- refactor: route uploads through staging paths before promotion to
long-term data paths, keeping incomplete uploads out of durable
storage records.
- test: cover oversized uploads, unlimited uploads, staged cleanup, and
local storage promotion boundaries.
- docs: document the staged upload model and multipart parent_id query
parameter.
Replace known development JWT secret placeholders with an ephemeral runtime secret during config loading.
Return LoadInfo so startup can warn when token persistence depends on a stable configured secret.
Update config docs and tests for default, legacy placeholder, custom, env, and empty secret behavior.
Delete now performs soft-delete (status='user_deleted') instead of physical deletion.
Removes storage content deletion — files are preserved on disk after soft-delete.
Second delete on already-deleted file returns nil (idempotent).
Add tests: SoftDelete, SoftDeleteKeepsStorage, SoftDeleteIdempotent, SoftDeleteForbidden.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
AdminRequired gates admin endpoints by checking user IsAdmin flag.
Placed AFTER AuthRequired; fetches user from repository, returns 403 for non-admins.
Soft-deleted users are rejected with 401 since FindByID excludes them.
Tests: admin passes, non-admin forbidden, soft-deleted admin rejected, missing user ID.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
File repository now filters by status=active in all query methods (FindByID, FindByUserID, FindByParentID, FindByNameAndParent).
Delete now performs soft-delete by setting status to 'user_deleted' instead of physical row deletion.
Add ListIncludeDeleted to UserRepository for admin views of all users.
Add tests: StatusFilter, SoftDelete, DeleteIdempotent, StatusFilterCount.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add Status field (gorm, indexed, default active) to both User and File models.
Add User status constants: StatusActive, StatusAdminDeleted.
Add File status constant: StatusUserDeleted.
Add tests verifying Status field is excluded from JSON serialization.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Initialize slog in the serve command with terminal/file support
- Introduce `AppError` with HTTP status for unified service-layer errors
- Replace ad-hoc `api.Error` calls with `api.RespondError`
- Wrap internal errors with `model.NewInternalError` and add reference
IDs
- Add `RequestID` middleware and switch router from `gin.Default` to
`gin.New`
- Fix: replace repeated authorization checks in handlers with the new
MustGetUserID helper, which panics if the user ID is missing. This
simplifies handler code by eliminating redundant error handling.
- Tests: update auth tests to verify the panic behavior in unprotected
routes.
- Implement FileHandler with CRUD operations for files/directories
- Add FileService with business logic and SHA-256 hashing
- Create LocalStorage backend for filesystem persistence
- Add database repository with pagination and name uniqueness
constraints
- Configure max upload size in storage settings
- Include comprehensive tests for all layers
- fix: The AccessTTL and RefreshTTL fields in JWTConfig now use
time.Duration type directly instead of string with ParseDuration
methods. The config validation now checks for positive durations
rather than parsing strings.
- Add TokenType enum and include in Claims struct
- GenerateRefreshToken now creates tokens with TokenRefresh type
- AuthRequired middleware rejects refresh tokens
- AuthService.Refresh validates token type
- Tests verify type validation
- Add GORM dependencies for SQLite and PostgreSQL
- Create domain models (User, Session, File) with common errors
- Implement repository interfaces and database layer with migrations
- Update WebApp to bootstrap with database and repositories
- Add comprehensive unit tests for repository methods
- Update config structure to support multiple database drivers
- Extend AGENTS.md with debugging principles and dependency rules
Add application container, Gin router, graceful shutdown handler,
and version endpoint. This establishes the skeleton for the WebDisk
HTTP API as described in the architecture.
- Add internal/app/WebApp for runtime dependencies and version
- Add internal/server/router with GET /api/v1/version route
- Add graceful shutdown runner with signal handling in cmd/serve
- Add internal/api/ErrorResponse for standard HTTP error body
- Update roadmap, architecture, and decisions documentation
- The mapstructure library is no longer needed for direct duration
parsing since we now store TTLs as string durations (e.g., "15m",
"168h") and parse them on demand via helper methods.
- This allows more flexible duration formats in configuration and moves
the parsing responsibility to the JWT config struct itself.
Add initial project structure including:
- Go module with Cobra CLI dependency
- Root command and main entrypoint
- Basic documentation (README, AGENTS.md, architecture, decisions,
development, roadmap)
- Configuration example and gitignore
- Tool version management with mise
- Comprehensive project rules and conventions
ld