enforcement
- test: cover authenticated register, login, upload, list, and download
flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
tokens
- test: verify cross-user ownership isolation for all file CRUD
operations
- refactor: rename test-only header constant to clarify it is not used
in production
- test: exercise register, login, empty listing, small-file upload, updated listing, and authenticated download through the HTTP router.
- docs: mark the small-file integration flow as covered in the server roadmap.
- refactor: move HTTP status and DTO concerns out of model and service
layers into API and handler code.
- feat: add admin service boundary and route auth through services
instead of direct repository access.
- test: add architecture and error tests covering package boundaries,
redaction, and service behavior.
- docs: record the protocol-neutral boundary decision and update
architecture and roadmap notes.
- Implement FileHandler with CRUD operations for files/directories
- Add FileService with business logic and SHA-256 hashing
- Create LocalStorage backend for filesystem persistence
- Add database repository with pagination and name uniqueness
constraints
- Configure max upload size in storage settings
- Include comprehensive tests for all layers
- fix: The AccessTTL and RefreshTTL fields in JWTConfig now use
time.Duration type directly instead of string with ParseDuration
methods. The config validation now checks for positive durations
rather than parsing strings.
- Add GORM dependencies for SQLite and PostgreSQL
- Create domain models (User, Session, File) with common errors
- Implement repository interfaces and database layer with migrations
- Update WebApp to bootstrap with database and repositories
- Add comprehensive unit tests for repository methods
- Update config structure to support multiple database drivers
- Extend AGENTS.md with debugging principles and dependency rules
Add application container, Gin router, graceful shutdown handler,
and version endpoint. This establishes the skeleton for the WebDisk
HTTP API as described in the architecture.
- Add internal/app/WebApp for runtime dependencies and version
- Add internal/server/router with GET /api/v1/version route
- Add graceful shutdown runner with signal handling in cmd/serve
- Add internal/api/ErrorResponse for standard HTTP error body
- Update roadmap, architecture, and decisions documentation
ld