ld
bb86950632
enforcement - test: cover authenticated register, login, upload, list, and download flow - test: verify file API routes reject test identity header injection - test: verify file API routes reject invalid, expired, and malformed tokens - test: verify cross-user ownership isolation for all file CRUD operations - refactor: rename test-only header constant to clarify it is not used in production
41 lines
2.0 KiB
Markdown
41 lines
2.0 KiB
Markdown
# Roadmap
|
|
|
|
## v0
|
|
|
|
| Feature | Status | Notes |
|
|
|---------|--------|-------|
|
|
| CLI config management | ✅ | Viper YAML + env + flags, typed Duration config |
|
|
| JWT authentication | ✅ | access + refresh tokens, refresh token in DB, app passkey support |
|
|
| Web API foundation | ✅ | WebApp composition, Gin router, graceful shutdown, `GET /api/v1/version` |
|
|
| File upload/download/manage APIs | 🛠 WIP | REST API via Gin |
|
|
| Admin endpoints | 🛠 WIP | user service boundary in place for superusers |
|
|
| WebDAV | 🛠 WIP | future v0 or v1 |
|
|
|
|
## Implementation Tasks
|
|
|
|
Package-level implementation order (each task includes unit tests):
|
|
|
|
1. `internal/config` — Viper loader, config struct ✅
|
|
2. `internal/app` — runtime dependency container ✅
|
|
3. `internal/model` — domain types, error codes ✅
|
|
4. `internal/api` — protocol-neutral error kind to REST response mapping ✅
|
|
5. `internal/auth` — JWT utils ✅
|
|
6. `internal/storage` — backend interface + local fs with staged upload promotion
|
|
7. `internal/repository` — interfaces + GORM/SQLite impl ✅
|
|
8. `internal/service` — auth, file, admin services ✅
|
|
9. `internal/middleware` — logger, cors, auth ✅ (auth done; principal boundary enforced)
|
|
10. `internal/handler` — auth, account, file, admin handlers 🛠 (HTTP DTO mapping in place)
|
|
11. `internal/server` — Gin router, route registration, graceful shutdown ✅
|
|
12. `cmd/serve.go`, `cmd/config.go`, `cmd/status.go` ✅ (serve done)
|
|
13. Integration tests 🛠 (authenticated register → login → upload → list → download route flow covered with a small file; file API authentication bypass, invalid token, and cross-user isolation boundaries covered)
|
|
14. Architecture boundary tests ✅
|
|
|
|
## Future
|
|
|
|
| Feature | Status | Notes |
|
|
|---------|--------|-------|
|
|
| Image server | ⬜ plan | thumbnail generation |
|
|
| Pastebin & code snippets | ⬜ plan | in sharing context |
|
|
| S3 storage backend | ⬜ plan | new storage impl |
|
|
| Nextcloud-compatible API | ⬜ plan | new handler layer on existing services |
|