MyGO/mygo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
52 Commits 2 Branches 0 Tags
f8494a44cacbc9f3c500517fefd8e3fc11bdb4bb
Commit Graph

5 Commits

Author SHA1 Message Date
ld a18f96912d feat(repository): refactor query/mutation ports with capability-safe 
interfaces

- refactor: split UserRepository into AuthUserRepository and
  AdminUserRepository capabilities
- refactor: split SessionRepository into AuthSessionRepository and
  repository-owned CLI/admin methods
- refactor: replace generic Repository Update/Delete with
  operation-specific params and ownership predicates
- refactor: replace CredentialRepository generic CRUD with
  passkey-specific methods
- refactor: replace FileRepository generic Create/Update/Delete with
  UploadedFileParams, DirectoryParams, and owned soft-delete
- refactor: remove repository fields from WebApp struct; repositories
  are now composition-time wiring only
- feat: add domain error kinds ErrParentNotFound, ErrParentNotDir,
  ErrDirectoryNotEmpty, ErrInvalidMove
- feat: add CredentialTypeAppPasskey constant
- feat: add testutil.SetUserAdmin for test fixture setup that bypasses
  production service ports
- test: add architecture test banning GORM Save in repository package
- test: add capability interface contract tests ensuring each service
  receives the minimal interface
- test: add blockingStorage helper for concurrent promotion tests
- test: add preserved DSN parameter test for sqliteImmediateDSN
- docs: update architecture decisions with repository write rules and
  capability separation
- docs: update roadmap to clarify atomic single-use refresh sessions
- docs: add -race test target to development docs
 2026-07-16 12:24:36 +08:00
ld 6604ecb026 feat(file): conceal file resource existence from other users 
- feat: cross-user file access returns not-found instead of
  permission-denied
- fix: repository delete now only affects active rows and returns
  ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
  conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
  assert not-found behavior for cross-user and missing file operations
 2026-07-16 00:06:31 +08:00
ld bb86950632 feat(server): add file route integration tests with ownership 
enforcement

- test: cover authenticated register, login, upload, list, and download
  flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
  tokens
- test: verify cross-user ownership isolation for all file CRUD
  operations
- refactor: rename test-only header constant to clarify it is not used
  in production
 2026-07-15 23:48:20 +08:00
ld 99e5758d4c test(server): cover authenticated file transfer flow 
- test: exercise register, login, empty listing, small-file upload, updated listing, and authenticated download through the HTTP router.
- docs: mark the small-file integration flow as covered in the server roadmap.
 2026-07-15 20:06:40 +08:00
ld 9f13c0a23a docs: reorganize documentation into server/ and web/ directories 
- docs: move server docs to docs/server/ and update all cross-references
- docs: move web-roadmap.md to docs/web/roadmap.md and create
  docs/web/decisions.md
- docs: update AGENTS.md with separate Server and Web sections
 2026-07-14 17:07:42 +08:00