HostXtra/notely
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Updated admin panel providers list & modal

Browse Source
This commit is contained in:
domrichardson
2026-03-26 16:27:14 +00:00
parent 9cf71ab4a0
commit 005a8f4cf0
40 changed files with 2391 additions and 1051 deletions
Download Patch File Download Diff File Expand all files Collapse all files

215
ENV_SETUP.md
View File

@@ -1,98 +1,151 @@
# Environment Configuration # Environment Setup
Copy `.env.example` files and configure for your environment: Notely uses three different environment-file locations depending on how you run the app.
## Backend (.env) ## 1. Root `.env`
```env Use the root `.env` file when running `docker compose` from the repository root.
# MongoDB
MONGODB_URI=mongodb://admin:password@localhost:27017/noteapp?authSource=admin
# JWT Configuration Start from:
JWT_SECRET=your-super-secret-jwt-key-minimum-32-characters
JWT_ISSUER=noteapp ```bash
cp .env.example .env
# Encryption (32 bytes = 32 characters) ```
ENCRYPTION_KEY=00000000000000000000000000000000
### Variables Used By Docker Compose
# Server
PORT=8080 Required or commonly used:
ENV=development
LOG_LEVEL=info - `MONGODB_URI`
- `BACKEND_PORT`
# CORS (comma-separated for multiple origins) - `JWT_SECRET`
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3000 - `ENCRYPTION_KEY`
- `FRONTEND_URL`
# Rate Limiting - `VITE_API_BASE_URL`
RATE_LIMIT_REQUESTS=50 - `DEFAULT_ADMIN_EMAIL`
RATE_LIMIT_WINDOW=1s - `DEFAULT_ADMIN_USERNAME`
``` - `DEFAULT_ADMIN_PASSWORD`
- `NGINX_HTTP_PORT`
## Frontend (.env) - `NGINX_HTTPS_PORT`
```env Optional backend runtime values that Docker Compose will also pass through if present:
VITE_API_BASE_URL=http://localhost:8080
VITE_ENV=development - `REDIS_ADDR`
``` - `REDIS_USER`
- `REDIS_PASSWORD`
## Development vs Production - `REDIS_DB`
- `SESSION_TTL_HOURS`
### Development (.env.development)
### Current Defaults In The Checked-In Example
- Less strict security (for easier testing)
- Localhost CORS allowed - MongoDB container: `mongodb://admin:password@mongodb:27017/noteapp?authSource=admin`
- JWT secrets can be simple - Backend port: `8080`
- Logging more verbose - Public frontend URL: `http://localhost`
- Browser API base URL for container builds: `http://localhost`
### Production (.env.production)
## 2. `backend/.env`
- Strict security requirements
- Specific CORS origins only Use `backend/.env` for local backend development.
- Strong random JWT secrets
- Limited logging (performance) Start from:
- All environment variables must be set
```bash
## Generating Secrets cd backend
cp .env.example .env
```
### Variables Currently Read By The Backend Runtime
Read in `backend/cmd/server/main.go` or other active handlers:
- `MONGODB_URI`
- `JWT_SECRET`
- `ENCRYPTION_KEY`
- `PORT`
- `REDIS_ADDR`
- `REDIS_USER`
- `REDIS_PASSWORD`
- `REDIS_DB`
- `SESSION_TTL_HOURS`
- `DEFAULT_ADMIN_EMAIL`
- `DEFAULT_ADMIN_USERNAME`
- `DEFAULT_ADMIN_PASSWORD`
- `FRONTEND_URL`
### Variables Present In `backend/.env.example` But Not Currently Consumed By Runtime Code
These values exist in the example file, but the current code path does not read them yet:
- `JWT_ISSUER`
- `ENV`
- `LOG_LEVEL`
- `CORS_ALLOWED_ORIGINS`
- `RATE_LIMIT_REQUESTS`
- `RATE_LIMIT_WINDOW`
### Backend Defaults If A Variable Is Missing
- `MONGODB_URI`: `mongodb://localhost:27017`
- `JWT_SECRET`: `your-secret-key-change-in-production`
- `ENCRYPTION_KEY`: `00000000000000000000000000000000`
- `PORT`: `8080`
- `REDIS_ADDR`: `localhost:6379`
- `REDIS_DB`: `0`
- `SESSION_TTL_HOURS`: `168`
- `FRONTEND_URL`: falls back to `http://localhost:5173` for login redirects
## 3. `frontend/.env`
Use `frontend/.env` for local frontend development.
Start from:
```bash
cd frontend
cp .env.example .env
```
### Frontend Variables In `frontend/.env.example`
- `VITE_API_BASE_URL`
- `VITE_ENV`
- `VITE_ENABLE_ANALYTICS`
### Variables Currently Relevant To The Frontend App
- `VITE_API_BASE_URL`: used by the API client
The other example values are safe to keep, but the current checked-in frontend code does not actively consume them.
## Secret Generation
Examples:
```bash ```bash
# JWT Secret (32+ characters)
openssl rand -base64 32 openssl rand -base64 32
openssl rand -hex 16
# Encryption Key (32 bytes)
openssl rand -hex 16 # outputs 32 characters
# Random token
openssl rand -hex 32 openssl rand -hex 32
``` ```
## Docker Compose Use generated values for:
Environment variables are defined in `docker-compose.yml` and will override `.env` files. Update the file for your deployment: - `JWT_SECRET`
- `ENCRYPTION_KEY`
- provider secrets or other sensitive credentials stored through admin settings
```yaml ## Compose Vs Local Development
environment:
MONGODB_URI: mongodb://admin:password@mongodb:27017/noteapp?authSource=admin
JWT_SECRET: your-secret-key-change-in-production
# ... other vars
```
## Kubernetes Use the right env file for the right mode:
Use `kubectl create secret` for sensitive data: - root `.env`: Docker Compose
- `backend/.env`: local backend
- `frontend/.env`: local frontend
```bash Do not assume values from one location are automatically shared with the others.
# Create secret from literal values
kubectl create secret generic app-secrets \
--from-literal=mongodb-uri="..." \
--from-literal=jwt-secret="..." \
-n noteapp
# Or use ConfigMap for non-sensitive config ## Important Notes
kubectl create configmap app-config \
--from-file=config.yaml \
-n noteapp
```
--- - Do not commit real secrets
- Keep `ENCRYPTION_KEY` at 32 characters for the current AES-256 usage
**IMPORTANT**: Never commit .env files or secrets to version control! - If OAuth login is enabled, set `FRONTEND_URL` correctly so callback redirects go to the intended UI
- If Redis settings are omitted, the backend assumes a local Redis instance at `localhost:6379`

4
PERMISSIONS.md
View File

@@ -14,7 +14,7 @@ This file lists the permissions currently checked by the application.
- space.edit - space.edit
- Global space edit capability (used as fallback alongside space-scoped settings edit) - Global space edit capability (used as fallback alongside space-scoped settings edit)
- space.delete - space.delete
- Global space delete capability (used as fallback alongside space-scoped delete) - Global space delete capability (used as fallback alongside space-scoped settings.delete)
## Space-Scoped Permission Format ## Space-Scoped Permission Format
@@ -30,7 +30,7 @@ space.<space_permission_key>.<action>
### Space Management ### Space Management
- settings.edit - settings.edit
- delete - settings.delete
### Member Management ### Member Management

323
QUICKSTART.md
View File

@@ -1,304 +1,151 @@
# 🚀 Quick Start Guide # Quick Start
## Prerequisites This guide covers the fastest way to run Notely and the current local-development workflow.
- Docker and Docker Compose (recommended for quickest setup) ## Option 1: Docker Compose
- OR: Go 1.21+, Node.js 18+, MongoDB 7.0+
## Option 1: Docker Compose (Recommended - 1 Command) From the repository root:
```bash ```bash
# Clone/navigate to project cp .env.example .env
cd noteapp docker compose up -d --build
# Start everything
docker-compose up
# Wait for services to initialize (~30 seconds)
# Then open: http://localhost
``` ```
**Services running**: Open:
- Notely: http://localhost:8080 - App UI: `http://localhost`
- MongoDB: localhost:27017 - Backend health endpoint: `http://localhost:8080/health`
- Nginx Reverse Proxy: http://localhost:80 - MongoDB: `localhost:27017`
- Redis: `localhost:6379`
**Test user (after startup)**: Compose starts four services:
- Register a new account at http://localhost/register - `mongodb`
- Login and create a Space - `redis`
- Add Categories and Notes - `notely`
- `nginx`
## Option 2: Local Development ## Option 2: Local Development
### Backend Setup ### Prerequisites
- Go 1.25+
- Node.js 18+
- MongoDB
- Redis
If you do not already have MongoDB and Redis running locally, you can start just those services with Docker Compose:
```bash
docker compose up -d mongodb redis
```
### Backend
```bash ```bash
cd backend cd backend
# Copy environment file
cp .env.example .env cp .env.example .env
# Install dependencies
go mod download go mod download
# Ensure MongoDB is running
# Docker: docker run -d -p 27017:27017 -e MONGO_INITDB_ROOT_USERNAME=admin \
# -e MONGO_INITDB_ROOT_PASSWORD=password mongo:7.0-alpine
# Run backend
go run ./cmd/server/main.go go run ./cmd/server/main.go
# Logs should show: "Server starting on port 8080"
``` ```
### Frontend Setup The backend listens on `http://localhost:8080` by default.
### Frontend
```bash ```bash
cd frontend cd frontend
# Copy environment file
cp .env.example .env cp .env.example .env
# Install dependencies
npm install npm install
# Start dev server
npm run dev npm run dev
# Open: http://localhost:5173 in browser
``` ```
## 🧪 Testing The Vite dev server listens on `http://localhost:5173` and proxies `/api` to `http://localhost:8080`.
### Backend Tests ## Day-To-Day Commands
### Backend
```bash ```bash
cd backend cd backend
# Run all tests
go test ./... go test ./...
go test -v ./tests/unit/...
# Run with verbose output go test -v ./tests/integration/...
go test -v ./...
# Run specific test
go test -v -run TestRegisterUser ./tests/unit/...
# With coverage
go test -cover ./...
``` ```
### Frontend Tests ### Frontend
```bash ```bash
cd frontend cd frontend
npm run build
# Run tests npm run lint
npm run test npm run test
# Watch mode
npm run test:watch
# Coverage
npm run test:coverage
``` ```
## 📝 Key API Endpoints ## First Run Checklist
### Authentication 1. Register a user or set `DEFAULT_ADMIN_*` values in your env file before startup.
2. Sign in.
3. Create a space.
4. Create categories and notes.
5. Use the top search bar to verify note search.
```bash ## Useful Endpoints
# Register
curl -X POST http://localhost:8080/api/v1/auth/register \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"username": "myuser",
"password": "SecurePassword123",
"password_confirm": "SecurePassword123",
"first_name": "John",
"last_name": "Doe"
}'
# Login Authentication:
curl -X POST http://localhost:8080/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"password": "SecurePassword123"
}'
# Response contains: access_token, refresh_token, user data - `POST /api/v1/auth/register`
``` - `POST /api/v1/auth/login`
- `POST /api/v1/auth/refresh`
- `GET /api/v1/auth/me`
### Create Space Spaces:
```bash - `GET /api/v1/spaces`
curl -X POST http://localhost:8080/api/v1/spaces \ - `POST /api/v1/spaces`
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ - `PUT /api/v1/spaces/{spaceId}`
-H "Content-Type: application/json" \ - `DELETE /api/v1/spaces/{spaceId}`
-d '{
"name": "My First Space",
"description": "Notes for my project",
"icon": "📚",
"is_public": false
}'
```
### Create Note Notes:
```bash - `GET /api/v1/spaces/{spaceId}/notes`
curl -X POST http://localhost:8080/api/v1/spaces/{spaceId}/notes \ - `POST /api/v1/spaces/{spaceId}/notes`
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ - `GET /api/v1/spaces/{spaceId}/notes/search?q=<query>`
-H "Content-Type: application/json" \ - `POST /api/v1/spaces/{spaceId}/notes/{noteId}/unlock`
-d '{
"title": "My First Note",
"content": "# Markdown Heading\n\nThis is a note",
"tags": ["important", "work"],
"category_id": null,
"is_pinned": false,
"is_favorite": true
}'
```
### Search Notes Public access:
```bash - `GET /api/v1/public/spaces`
curl "http://localhost:8080/api/v1/spaces/{spaceId}/notes/search?q=important" \ - `GET /api/v1/public/spaces/{spaceId}/notes`
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
## 🔍 Troubleshooting ## Troubleshooting
### MongoDB Connection Error ### Backend cannot connect to MongoDB
``` Check `MONGODB_URI` in your selected env file and make sure MongoDB is reachable.
Error: Failed to connect to database
Solution: ### Backend cannot connect to Redis
docker run -d -p 27017:27017 \
-e MONGO_INITDB_ROOT_USERNAME=admin \
-e MONGO_INITDB_ROOT_PASSWORD=password \
mongo:7.0-alpine
```
### Port Already in Use Check `REDIS_ADDR`, `REDIS_PASSWORD`, and `REDIS_DB`. For local defaults, Redis should usually be reachable at `localhost:6379`.
```bash ### The browser cannot reach the API in local dev
# Find process on port 8080
lsof -i :8080
# Kill it Check:
kill -9 <PID>
# Or use different port - backend is running on port `8080`
PORT=8081 go run ./cmd/server/main.go - frontend `VITE_API_BASE_URL`
``` - Vite proxy settings in `frontend/vite.config.js`
### CORS Errors ### OAuth callback redirects to the wrong URL
Make sure frontend and backend URLs match in: Check `FRONTEND_URL` in your selected env file.
- Frontend: `VITE_API_BASE_URL` in `.env` ### Permission-denied behavior is unclear
- Backend: `CORS_ALLOWED_ORIGINS` in `.env`
### MongoDB Auth Failed Read `PERMISSIONS.md` and then inspect the relevant backend service in `backend/internal/application/services/`.
If using Docker Compose: ## Related Docs
- Username: `admin` - `README.md`
- Password: `password` - `ENV_SETUP.md`
- Connection string includes `?authSource=admin` - `PERMISSIONS.md`
## 📚 Project Structure
```
noteapp/
├── backend/ # Go REST API
│ ├── cmd/server/ # Entry point
│ ├── internal/
│ │ ├── domain/ # Business logic
│ │ ├── application/ # Services & DTOs
│ │ ├── infrastructure/ # DB, auth, security
│ │ └── interfaces/ # HTTP handlers
│ ├── tests/ # Test files
│ ├── go.mod & go.sum # Dependencies
│ └── README.md
│
├── frontend/ # Vue 3 SPA
│ ├── src/
│ │ ├── components/ # UI components
│ │ ├── pages/ # Page components
│ │ ├── stores/ # Pinia state
│ │ ├── services/ # API client
│ │ ├── router/ # Vue Router
│ │ ├── assets/ # Styles & images
│ │ └── main.js # Entry point
│ ├── tests/ # Test files
│ ├── package.json # Dependencies
│ └── vite.config.js # Vite configuration
│
├── devops/
│ ├── docker/
│ │ ├── Dockerfile.backend
│ │ ├── Dockerfile.frontend
│ │ └── nginx.conf
│ └── kubernetes/
│ └── deployment.yaml
│
├── docker-compose.yml # Local development setup
├── README.md # Project docs
├── ARCHITECTURE.md # Architecture overview
├── SECURITY.md # Security implementation
└── ENV_SETUP.md # Environment configuration
```
## 🎓 Learning Resources
### Understanding the Code
1. **Start here**: `ARCHITECTURE.md` - Clean architecture pattern
2. **Then read**: Backend `domain/entities/*.go` - Core models
3. **Next**: Backend `application/services/*.go` - Business logic
4. **UI**: Frontend `src/stores/authStore.js` - State management
5. **API**: Backend `interfaces/handlers/*.go` - HTTP layer
### Security Deep Dive
See `SECURITY.md` for:
- Password hashing (Argon2id)
- JWT authentication
- Authorization (RBAC)
- Input validation
- XSS prevention
- CSRF protection
## 🚀 Next Steps
1. **Explore the UI**: Create spaces, notes, categories
2. **Read the code**: Start with `index ARCHITECTURE.md`
3. **Run tests**: `go test ./...` and `npm test`
4. **Deploy**: Use `docker-compose.yml` or Kubernetes
5. **Extend**: Add OAuth2, WebSockets, more features
## 💡 Quick Tips
- **Hot reload**: Changes auto-reload in dev mode
- **Network tab**: Check API calls in browser DevTools
- **Logs**: Docker: `docker-compose logs -f service-name`
- **Database GUI**: MongoDB Compass (free tool to browse data)
- **API testing**: Postman or `curl` commands
## 📞 Support
- Check logs: `docker-compose logs`
- Review `SECURITY.md` for auth issues
- Check `ENV_SETUP.md` for config problems
- See `ARCHITECTURE.md` for code structure
---
**Now you're ready to explore and extend Notely! 🎉**

543
README.md
View File

@@ -1,306 +1,174 @@
# Notely - Secure Multi-Space Note-Taking Application # Notely
A production-ready, secure multi-tenant note-taking platform built with Go, Vue 3, and MongoDB. Notely is a multi-space note application built with Go, Vue 3, MongoDB, and Redis.
## 🚀 Quick Start The repository contains a Go backend, a Vue frontend, Docker Compose assets for local deployment, and Kubernetes manifests for cluster deployment. In containerized environments, the frontend is built into the backend image and served by the Go server. Docker Compose also places Nginx in front of the app for HTTP and HTTPS entry points.
### Prerequisites ## What Is In This Repo
- Docker & Docker Compose - Backend API in `backend/`
- Go 1.21+ (for local development) - Frontend SPA in `frontend/`
- Node.js 18+ (for frontend development) - Docker and Nginx assets in `devops/docker/`
- MongoDB 7.0+ (for local development) - Kubernetes manifests in `devops/kubernetes/`
- Root documentation in `README.md`, `QUICKSTART.md`, `ENV_SETUP.md`, and `PERMISSIONS.md`
### Development with Docker Compose ## Core Features
- Email/password authentication
- Session cookies backed by Redis, with bearer-token fallback for API clients
- Admin bootstrap from environment variables
- Permission-based authorization with wildcard support
- Spaces, categories, and notes
- Full-text note search
- Public spaces and public notes
- Password-protected notes
- OAuth/OIDC provider support
- Feature flags for registration, provider login, public sharing, and file explorer support
- Optional S3-compatible file explorer when enabled through feature flags
## Architecture Overview
### Backend
- Language: Go
- Module: `gitea.hostxtra.co.uk/mrhid6/notely/backend`
- Entry point: `backend/cmd/server/main.go`
- Architecture style: domain/application/infrastructure/interfaces split
- Storage: MongoDB
- Session store: Redis
### Frontend
- Framework: Vue 3
- Router: Vue Router
- State: Pinia
- Build tool: Vite
### Container Layout
- `devops/docker/Dockerfile` builds the frontend and backend into a single app image
- `docker-compose.yml` starts:
- `mongodb`
- `redis`
- `notely` (combined app image)
- `nginx`
## Documentation Map
- `README.md`: project overview and current architecture
- `QUICKSTART.md`: fast setup and day-to-day development commands
- `ENV_SETUP.md`: environment-variable reference and configuration layout
- `PERMISSIONS.md`: enforced permission model and naming
## Getting Started
### Docker Compose
1. Copy the root environment file:
```bash ```bash
# Start all services cp .env.example .env
docker-compose up
# Backend: http://localhost:8080
# Frontend: http://localhost:5173
# MongoDB: localhost:27017
# Nginx: http://localhost:80
``` ```
### Local Development Setup 2. Start the stack:
#### Backend ```bash
docker compose up -d --build
```
3. Open the app:
- UI through Nginx: `http://localhost`
- Backend health check: `http://localhost:8080/health`
- MongoDB: `localhost:27017`
- Redis: `localhost:6379`
### Local Development
Prerequisites:
- Go 1.25+
- Node.js 18+
- MongoDB
- Redis
Backend:
```bash ```bash
cd backend cd backend
cp .env.example .env
# Install dependencies
go mod download go mod download
# Set environment variables
export MONGODB_URI=mongodb://admin:password@localhost:27017/noteapp?authSource=admin
export JWT_SECRET=your-secret-key
export ENCRYPTION_KEY=00000000000000000000000000000000
# Run migrations and server
go run ./cmd/server/main.go go run ./cmd/server/main.go
``` ```
#### Frontend Frontend:
```bash ```bash
cd frontend cd frontend
cp .env.example .env
# Install dependencies
npm install npm install
# Start development server
npm run dev npm run dev
``` ```
## 📚 Architecture Local frontend development runs at `http://localhost:5173` and proxies `/api` requests to `http://localhost:8080`.
### Backend (GoClean Architecture) ## API Surface
``` The router in `backend/cmd/server/main.go` currently exposes these endpoint groups.
backend/
├── cmd/server/ # Entry point
├── internal/
│ ├── domain/ # Business logic (entities, interfaces)
│ ├── application/ # Use cases (services, DTOs)
│ ├── infrastructure/ # External dependencies (DB, auth)
│ └── interfaces/ # API handlers & middleware
├── pkg/ # Public packages
└── tests/ # Test suites
```
### Frontend (Vue 3 Composition API) ### Public Endpoints
``` - `GET /health`
frontend/ - `POST /api/v1/auth/register`
├── src/ - `POST /api/v1/auth/login`
│ ├── components/ # Reusable Vue components - `POST /api/v1/auth/refresh`
│ ├── pages/ # Page components - `POST /api/v1/auth/logout`
│ ├── stores/ # Pinia state management - `GET /api/v1/auth/providers`
│ ├── services/ # API client - `GET /api/v1/auth/providers/{providerId}/start`
│ ├── router/ # Vue Router config - `GET /api/v1/auth/providers/{providerId}/callback`
│ ├── assets/ # Styles and assets - `GET /api/v1/settings/feature-flags`
│ └── main.js # Entry point - `GET /api/v1/public/spaces`
├── index.html - `GET /api/v1/public/spaces/{spaceId}`
└── vite.config.js - `GET /api/v1/public/spaces/{spaceId}/notes`
``` - `GET /api/v1/public/spaces/{spaceId}/notes/{noteId}`
- `POST /api/v1/public/spaces/{spaceId}/notes/{noteId}/unlock`
## 🔐 Security Features ### Authenticated User Endpoints
### Authentication - `GET /api/v1/auth/me`
- Space CRUD under `/api/v1/spaces`
- Space member management under `/api/v1/spaces/{spaceId}/members`
- Note CRUD, search, and unlock under `/api/v1/spaces/{spaceId}/notes`
- Category CRUD and move under `/api/v1/spaces/{spaceId}/categories`
- File explorer operations under `/api/v1/spaces/{spaceId}/files`
- **Argon2id password hashing** - Industry-standard PBKDF2 ### Admin Endpoints
- **JWT tokens** with short expiration (1 hour)
- **HTTP-only secure cookies** for refresh tokens
- **CSRF protection** via SameSite cookies
- **Brute-force protection** via login attempt tracking
### Authorization Admin routes live under `/api/v1/admin` and cover:
- **Role-based access control (RBAC)** per space: - users
- Owner: Full control - groups
- Editor: Edit notes and categories - spaces
- Viewer: Read-only access - feature flags
- **Space-level data isolation** - all queries include space_id - auth providers
- **IDOR prevention** - middleware enforces ownership verification
### Data Security ## Permissions
- **Encryption at rest** for sensitive fields (OAuth secrets) Notely uses permission-based authorization, not fixed owner/editor/viewer roles.
- **HTTPS/TLS** in production (Nginx reverse proxy)
- **Content Security Policy (CSP)** headers
- **XSS protection** - DOMPurify for markdown sanitization
- **SQL injection prevention** - parameterized queries (MongoDB)
### API Security - Global permissions include `space.create`, `space.edit`, and `space.delete`
- Space-scoped permissions follow `space.<space_key>.<action>`
- Example: `space.product_docs.note.create`
- Example: `space.product_docs.settings.delete`
- Space deletion requires either:
- global `space.delete`, or
- space-scoped `space.<space_key>.settings.delete`
- **Rate limiting** - IP-based and user-based See `PERMISSIONS.md` for the current enforced permission set.
- **Security headers** - HSTS, X-Frame-Options, X-Content-Type-Options
- **CORS properly configured** - whitelist origin domains
- **Input validation** on all endpoints
## 📦 API Endpoints ## Testing And Quality Checks
### Authentication Backend:
```
POST /api/v1/auth/register - Register new user
POST /api/v1/auth/login - Login user
POST /api/v1/auth/refresh - Refresh access token
POST /api/v1/auth/logout - Logout user
GET /health - Health check
```
### Spaces
```
GET /api/v1/spaces - List user's spaces
POST /api/v1/spaces - Create space
GET /api/v1/spaces/{spaceId} - Get space details
PUT /api/v1/spaces/{spaceId} - Update space
DELETE /api/v1/spaces/{spaceId} - Delete space
```
### Notes
```
GET /api/v1/spaces/{spaceId}/notes - List notes
POST /api/v1/spaces/{spaceId}/notes - Create note
GET /api/v1/spaces/{spaceId}/notes/{noteId} - Get note
PUT /api/v1/spaces/{spaceId}/notes/{noteId} - Update note
DELETE /api/v1/spaces/{spaceId}/notes/{noteId} - Delete note
GET /api/v1/spaces/{spaceId}/notes/search?q= - Search notes
```
### Categories
```
GET /api/v1/spaces/{spaceId}/categories - List categories
POST /api/v1/spaces/{spaceId}/categories - Create category
PUT /api/v1/spaces/{spaceId}/categories/{id} - Update category
DELETE /api/v1/spaces/{spaceId}/categories/{id} - Delete category
```
## 🗄️ Database Design
### MongoDB Collections
#### users
```javascript
{
_id: ObjectId,
email: String (unique),
username: String (unique),
password_hash: String,
first_name: String,
last_name: String,
avatar: String,
is_active: Boolean,
email_verified: Boolean,
created_at: Date,
updated_at: Date,
last_login_at: Date
}
```
#### spaces
```javascript
{
_id: ObjectId,
name: String,
description: String,
icon: String,
owner_id: ObjectId,
is_public: Boolean,
created_at: Date,
updated_at: Date
}
```
#### memberships
```javascript
{
_id: ObjectId,
user_id: ObjectId,
space_id: ObjectId,
role: String (owner|editor|viewer),
joined_at: Date,
invited_by: ObjectId,
invited_at: Date
}
```
#### notes
```javascript
{
_id: ObjectId,
space_id: ObjectId,
category_id: ObjectId,
title: String,
content: String (Markdown),
tags: [String],
is_pinned: Boolean,
is_favorite: Boolean,
created_by: ObjectId,
updated_by: ObjectId,
created_at: Date,
updated_at: Date,
viewed_at: Date
}
```
#### categories
```javascript
{
_id: ObjectId,
space_id: ObjectId,
name: String,
description: String,
parent_id: ObjectId (for hierarchical structure),
icon: String,
order: Number,
created_by: ObjectId,
updated_by: ObjectId,
created_at: Date,
updated_at: Date
}
```
#### Indexes
```
users: { email: 1 (unique), username: 1 (unique) }
spaces: { owner_id: 1, created_at: -1 }
memberships: { user_id: 1, space_id: 1 (unique), space_id: 1 }
notes: { space_id: 1, category_id: 1, updated_at: -1, text: "text" }
categories: { space_id: 1, parent_id: 1, order: 1 }
```
## 🐳 Deployment
### Docker Compose (Development/Testing)
```bash
docker-compose up -d
```
Services:
- **MongoDB** (port 27017)
- **Backend API** (port 8080)
- **Frontend** (port 5173)
- **Nginx Reverse Proxy** (port 80)
### Kubernetes (Production)
```bash
# Create namespace and secrets
kubectl apply -f devops/kubernetes/deployment.yaml
# Verify deployment
kubectl get pods -n noteapp
kubectl port-forward svc/frontend 5173:5173 -n noteapp
kubectl port-forward svc/backend 8080:8080 -n noteapp
```
Features:
- **StatefulSet** for MongoDB with persistent storage
- **Deployments** for backend and frontend with horizontal scaling
- **Ingress** for routing (requires ingress controller)
- **HPA** (Horizontal Pod Autoscaler) for automatic scaling
- **Liveness & readiness probes** for health checks
- **Resource limits** for fair resource allocation
## 🧪 Testing
### Backend Tests
```bash ```bash
cd backend cd backend
@@ -309,118 +177,73 @@ go test -v ./tests/unit/...
go test -v ./tests/integration/... go test -v ./tests/integration/...
``` ```
### Frontend Tests Frontend:
```bash ```bash
cd frontend cd frontend
npm run build
npm run lint
npm run test npm run test
npm run test:watch
``` ```
## 🔧 Configuration ## Deployment Notes
### Environment Variables ### Docker Compose
#### Backend (.env) Docker Compose uses the combined application image plus Nginx, MongoDB, and Redis. Configuration is driven by the root `.env` file.
``` ### Kubernetes
MONGODB_URI=mongodb://admin:password@localhost:27017/noteapp
JWT_SECRET=your-secret-key-min-32-chars
ENCRYPTION_KEY=32-char-encryption-key-for-secrets
PORT=8080
LOG_LEVEL=info
ENV=development
```
#### Frontend (.env) The manifest at `devops/kubernetes/deployment.yaml` currently provisions:
``` - `noteapp` namespace
VITE_API_BASE_URL=http://localhost:8080 - MongoDB StatefulSet and PVC
``` - single `noteapp` Deployment for the combined app image
- ClusterIP services
- Ingress
- HorizontalPodAutoscaler
## 📝 Development Guidelines Apply it with:
### Code Structure
- Follow clean architecture principles
- Separate concerns: domain, application, infrastructure
- Use interfaces for dependency injection
- Keep services testable and focused
### Security Best Practices
1. **Never store secrets in code** - use environment variables
2. **Validate all inputs** on backend
3. **Sanitize outputs** before rendering
4. **Use HTTPS in production**
5. **Implement rate limiting** on APIs
6. **Log security events** (login attempts, permission denied)
7. **Audit trail** for sensitive operations
### Commit Message Format
```
[TYPE] Description
types: feat, fix, docs, style, refactor, test, chore
```
## 📖 API Documentation
### Request/Response Format
All API requests and responses use JSON.
```bash ```bash
# Example: Create Note kubectl apply -f devops/kubernetes/deployment.yaml
curl -X POST http://localhost:8080/api/v1/spaces/{spaceId}/notes \
-H "Authorization: Bearer {accessToken}" \
-H "Content-Type: application/json" \
-d '{
"title": "My Note",
"content": "# Markdown content",
"tags": ["tag1", "tag2"],
"category_id": null,
"is_pinned": false,
"is_favorite": false
}'
``` ```
## 🚨 Error Handling ## Current Repo Layout
All errors return appropriate HTTP status codes: ```text
noteapp/
├── backend/
│ ├── cmd/server/
│ ├── internal/
│ ├── pkg/
│ ├── tests/
│ └── .env.example
├── frontend/
│ ├── src/
│ ├── tests/
│ ├── package.json
│ ├── vite.config.js
│ ├── vitest.config.js
│ └── .env.example
├── devops/
│ ├── docker/
│ │ ├── Dockerfile
│ │ ├── nginx.conf
│ │ └── ssl/
│ └── kubernetes/
│ └── deployment.yaml
├── docker-compose.yml
├── .env.example
├── ENV_SETUP.md
├── PERMISSIONS.md
├── QUICKSTART.md
└── README.md
```
- `400` - Bad Request ## Notes For Contributors
- `401` - Unauthorized
- `403` - Forbidden (insufficient permissions)
- `404` - Not Found
- `409` - Conflict (e.g., duplicate email)
- `429` - Too Many Requests (rate limit exceeded)
- `500` - Internal Server Error
## 🎯 Future Enhancements - Check `PERMISSIONS.md` when changing authorization behavior
- Check `ENV_SETUP.md` when adding or changing configuration
- [ ] OAuth2/OIDC integration - Check `backend/cmd/server/main.go` before documenting routes
- [ ] Email notifications - Keep docs aligned with actual package scripts and checked-in files
- [ ] Real-time collaboration (WebSockets)
- [ ] Full-text search with Elasticsearch
- [ ] Export to PDF/Markdown
- [ ] Mobile applications
- [ ] Plugin system
- [ ] Advanced permissions management
## 📄 License
MIT License - See LICENSE file
## 👥 Contributing
1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Push to the branch
5. Create a Pull Request
---
**Built with ❤️ for secure, collaborative note-taking**

284
SECURITY.md
View File

@@ -1,284 +0,0 @@
# Security Implementation Guide
This document outlines the security measures implemented in Notely.
## 🔐 Authentication Security
### Password Hashing
- **Algorithm**: Argon2id (memory-hard, resistant to GPU attacks)
- **Configuration**:
- Memory: 64 MB
- Time: 1 iteration
- Parallelism: 4 threads
- Salt: 16 random bytes (cryptographically secure)
```go
// Generated hash format:
$argon2id$v=19$m=65536,t=1,p=4$salt_hex$hash_hex
```
### JWT Tokens
- **Algorithm**: HS256 (HMAC-SHA256)
- **Access Token TTL**: 1 hour
- **Refresh Token TTL**: 7 days (HTTP-only secure cookie)
- **Claims**:
- `user_id`: User's MongoDB ObjectID
- `email`: User's email address
- `username`: User's username
- `iat`: Issued at timestamp
- `exp`: Expiration timestamp
- `iss`: Issuer (verified against hardcoded value)
### Brute-Force Protection
- Track failed login attempts in `login_attempts` collection
- Rate limit: Max 5 failed attempts per IP per 15 minutes
- Account lockout: 15 minutes after 5 consecutive failures
- Cleanup: Expired records auto-deleted via TTL index
## 🛡️ Authorization Security
### Role-Based Access Control (RBAC)
```
Space Roles:
├── Owner (all permissions)
├── Editor (create/edit/delete notes)
└── Viewer (read-only)
```
### Space-Level Data Isolation
**ALL queries include mandatory `space_id` filter**
```go
// Correct query pattern:
db.notes.find({ space_id: spaceID, ... })
// Never allow:
db.notes.find({ user_id: userID }) // ❌ Cross-space leak possible
```
### Middleware Authorization Flow
```
1. Extract JWT token → Verify signature & expiration
2. Load user credentials → Verify user is active
3. Check space membership → Verify user_id + space_id + role
4. Execute request → With space_id context
```
## 🔑 Data Encryption
### At Rest
- OAuth client secrets encrypted with AES-256-GCM
- Stored in MongoDB with encryption key in environment variables
- Decryption happens only when reading from database
```go
plaintext, err := encryptor.Encrypt(clientSecret) // Stores encrypted blob
recovered, err := encryptor.Decrypt(plaintext) // Decrypts on retrieval
```
### In Transit
- HTTPS/TLS required in production (enforced via Nginx)
- Secure cookies: `Secure`, `HttpOnly`, `SameSite=Lax` flags
- All sensitive data transmitted over encrypted channels
## 🚨 Input Validation
### Backend Validation (MANDATORY)
Every endpoint validates:
1. **Type validation** - JSON schema validation
2. **Length limits** - min/max string lengths
3. **Format validation** - email, ObjectID, URL formats
4. **Range validation** - pagination limits
```go
type CreateNoteRequest struct {
Title string `validate:"required,min=1,max=255"`
Content string `validate:"max=50000"`
Tags []string `validate:"max=100,dive,max=50"`
}
```
### Frontend Validation
- **Input sanitization** - trim whitespace
- **Format validation** - regex patterns
- **Debounced searches** - prevent query spam
- **Client-side feedback** - improve UX
### Output Sanitization
Markdown → HTML conversion sanitized with DOMPurify:
```javascript
// XSS prevention
const dirty = marked.parse(userMarkdown);
const clean = DOMPurify.sanitize(dirty);
// Blocks: scripts, event handlers, dangerous attributes
```
## 🌐 Web Security Headers
Implemented via Nginx and Go middleware:
| Header | Value | Purpose |
| --------------------------- | --------------------------------- | ------------------------------- |
| `Strict-Transport-Security` | `max-age=31536000` | Force HTTPS |
| `X-Content-Type-Options` | `nosniff` | Prevent MIME sniffing |
| `X-Frame-Options` | `DENY` | Prevent clickjacking |
| `X-XSS-Protection` | `1; mode=block` | XSS protection (older browsers) |
| `Content-Security-Policy` | Restrictive policy | Prevent XSS attacks |
| `Referrer-Policy` | `strict-origin-when-cross-origin` | Referrer control |
**CSP Policy:**
```
default-src 'self'
script-src 'self' 'unsafe-inline' (for development only)
style-src 'self' 'unsafe-inline'
img-src 'self' data: https:
font-src 'self'
connect-src 'self'
frame-ancestors 'none'
```
## 🍪 Cookie Security
### Access Token (via Authorization header)
- Stored in **memory** (not localStorage)
- Passed via `Authorization: Bearer {token}`
### Refresh Token (HTTP-only cookie)
```go
http.SetCookie(w, &http.Cookie{
Name: "refresh_token",
Value: token,
Path: "/",
MaxAge: 7 * 24 * 60 * 60, // 7 days
HttpOnly: true, // ✅ Cannot access from JavaScript
Secure: true, // ✅ HTTPS only
SameSite: http.SameSiteLaxMode, // ✅ CSRF protection
})
```
## 🔄 Rate Limiting
### API Rate Limiting
- **General**: 50 requests / second per IP
- **Login**: 10 requests / second per IP
- **Burst allowance**: 20 additional requests
```nginx
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_req zone=api_limit burst=20 nodelay;
```
### Login Attempt Tracking
- Track per email + IP combination
- Maximum 5 attempts per 15 minutes
- Exponential backoff on repeated failures
## 🔒 Database Security
### MongoDB
- **Authentication**: Username/password with role-based access
- **Network**: Runs in secure Docker network (not exposed)
- **Admin credentials**: Stored in Kubernetes Secrets (not in code)
- **Backups**: TBD - use MongoDB Atlas or encrypted backups
### Connection String
```
mongodb://admin:password@mongodb:27017/dbname?authSource=admin
```
## 🚨 Logging & Monitoring
### Security Events Logged
- ✅ User registration attempts
- ✅ Login attempts (success/failure)
- ✅ Authorization failures
- ✅ Permission denied events
- ✅ Sensitive data access
### Data NOT logged
- ❌ Passwords/hashes
- ❌ JWT tokens
- ❌ Encryption keys
- ❌ OAuth secrets
## 🧪 Security Testing
### What to Test
1. **Authentication**: Register, login, token refresh, logout
2. **Authorization**: RBAC enforcement, space isolation
3. **Input validation**: Invalid data rejection
4. **XSS prevention**: Markdown sanitization
5. **CSRF protection**: Token validation
6. **Rate limiting**: Too many requests blocked
7. **SQL Injection**: MongoDB-specific (parameterized queries safe)
### Manual Testing Commands
```bash
# Test invalid input
curl -X POST http://localhost:8080/api/v1/auth/login \
-d '{"email":"not-an-email","password":""}'
# Test expired token
curl -H "Authorization: Bearer expired.token.here" \
http://localhost:8080/api/v1/spaces
# Test rate limiting
for i in {1..100}; do
curl http://localhost:8080/api/v1/auth/login &
done
```
## 🛠️ Production Checklist
- [ ] Change default JWT_SECRET (min 32 characters)
- [ ] Change default ENCRYPTION_KEY (32 bytes)
- [ ] Generate TLS certificates (Let's Encrypt recommended)
- [ ] Configure Nginx SSL/TLS
- [ ] Enable HTTPS redirect
- [ ] Set up database backups
- [ ] Configure logging & monitoring
- [ ] Implement CORS whitelist (specific domains)
- [ ] Set up rate limiting (tuned to your traffic)
- [ ] Enable database authentication
- [ ] Use Kubernetes Network Policies
- [ ] Set up Pod Security Policies
- [ ] Enable audit logging
- [ ] Configure Secrets encryption at rest
## 📚 References
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [MongoDB Security](https://docs.mongodb.com/manual/security/)
- [JWT Best Practices](https://tools.ietf.org/html/rfc8949)
- [Argon2 Specification](https://github.com/P-H-C/phc-winner-argon2)
- [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
---
**Last Updated**: March 2026
**Security Level**: Production-Grade

17
backend/cmd/server/main.go
View File

@@ -10,16 +10,16 @@ import (
"strings" "strings"
"time" "time"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/auth"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/database"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/handlers"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/joho/godotenv" "github.com/joho/godotenv"
"github.com/noteapp/backend/internal/application/services"
"github.com/noteapp/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories"
"github.com/noteapp/backend/internal/infrastructure/auth"
"github.com/noteapp/backend/internal/infrastructure/database"
"github.com/noteapp/backend/internal/infrastructure/security"
"github.com/noteapp/backend/internal/interfaces/handlers"
"github.com/noteapp/backend/internal/interfaces/middleware"
"github.com/redis/go-redis/v9" "github.com/redis/go-redis/v9"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )
@@ -316,6 +316,7 @@ func main() {
admin.HandleFunc("/feature-flags", adminHandler.GetFeatureFlags).Methods("GET") admin.HandleFunc("/feature-flags", adminHandler.GetFeatureFlags).Methods("GET")
admin.HandleFunc("/feature-flags", adminHandler.UpdateFeatureFlags).Methods("PUT") admin.HandleFunc("/feature-flags", adminHandler.UpdateFeatureFlags).Methods("PUT")
// manage identity providers — admin-only // manage identity providers — admin-only
admin.HandleFunc("/auth/providers", authHandler.ListProvidersForAdmin).Methods("GET")
admin.HandleFunc("/auth/providers", authHandler.CreateProvider).Methods("POST") admin.HandleFunc("/auth/providers", authHandler.CreateProvider).Methods("POST")
admin.HandleFunc("/auth/providers/{providerId}", authHandler.UpdateProvider).Methods("PUT") admin.HandleFunc("/auth/providers/{providerId}", authHandler.UpdateProvider).Methods("PUT")
admin.HandleFunc("/auth/providers/{providerId}", adminHandler.DeleteProvider).Methods("DELETE") admin.HandleFunc("/auth/providers/{providerId}", adminHandler.DeleteProvider).Methods("DELETE")

2
backend/go.mod
View File

@@ -1,4 +1,4 @@
module github.com/noteapp/backend module gitea.hostxtra.co.uk/mrhid6/notely/backend
go 1.25.0 go 1.25.0

2
backend/internal/application/dto/dto.go
View File

@@ -1,7 +1,7 @@
package dto package dto
import ( import (
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
) )
// ========== AUTH DTOs ========== // ========== AUTH DTOs ==========

8
backend/internal/application/services/admin_service.go
View File

@@ -7,10 +7,10 @@ import (
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"github.com/noteapp/backend/internal/infrastructure/security" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
) )
// AdminService handles admin-level operations // AdminService handles admin-level operations

29
backend/internal/application/services/auth_service.go
View File

@@ -12,11 +12,11 @@ import (
"strings" "strings"
"time" "time"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"github.com/noteapp/backend/internal/infrastructure/auth" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/auth"
"github.com/noteapp/backend/internal/infrastructure/security" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"golang.org/x/oauth2" "golang.org/x/oauth2"
) )
@@ -259,6 +259,25 @@ func (s *AuthService) ListProviders(ctx context.Context) ([]*dto.AuthProviderDTO
return result, nil return result, nil
} }
// ListProvidersForAdmin returns all OAuth/OIDC providers, including inactive ones.
func (s *AuthService) ListProvidersForAdmin(ctx context.Context) ([]*dto.AuthProviderDTO, error) {
if s.providerRepo == nil {
return []*dto.AuthProviderDTO{}, nil
}
providers, err := s.providerRepo.GetAllProvidersForAdmin(ctx)
if err != nil {
return nil, err
}
result := make([]*dto.AuthProviderDTO, 0, len(providers))
for _, provider := range providers {
result = append(result, dto.NewAuthProviderDTO(provider))
}
return result, nil
}
// GetFeatureFlags returns current app-wide feature flags. // GetFeatureFlags returns current app-wide feature flags.
func (s *AuthService) GetFeatureFlags(ctx context.Context) (*dto.FeatureFlagsDTO, error) { func (s *AuthService) GetFeatureFlags(ctx context.Context) (*dto.FeatureFlagsDTO, error) {
if s.featureFlagRepo == nil { if s.featureFlagRepo == nil {

6
backend/internal/application/services/category_service.go
View File

@@ -7,9 +7,9 @@ import (
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
) )
// CategoryService handles category operations // CategoryService handles category operations

4
backend/internal/application/services/file_service.go
View File

@@ -15,8 +15,8 @@ import (
"github.com/aws/aws-sdk-go-v2/service/s3/types" "github.com/aws/aws-sdk-go-v2/service/s3/types"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"github.com/noteapp/backend/internal/infrastructure/security" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
) )
// S3Object represents a file or folder entry with key relative to the space root. // S3Object represents a file or folder entry with key relative to the space root.

8
backend/internal/application/services/note_service.go
View File

@@ -6,10 +6,10 @@ import (
"strings" "strings"
"time" "time"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"github.com/noteapp/backend/internal/infrastructure/security" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

4
backend/internal/application/services/permission_service.go
View File

@@ -5,8 +5,8 @@ import (
"errors" "errors"
"strings" "strings"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

6
backend/internal/application/services/space_service.go
View File

@@ -5,9 +5,9 @@ import (
"errors" "errors"
"time" "time"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/domain/repositories" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/repositories"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

2
backend/internal/domain/repositories/additional.go
View File

@@ -3,7 +3,7 @@ package repositories
import ( import (
"context" "context"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

5
backend/internal/domain/repositories/interfaces.go
View File

@@ -3,7 +3,7 @@ package repositories
import ( import (
"context" "context"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )
@@ -174,6 +174,9 @@ type AuthProviderRepository interface {
// GetAllProviders retrieves all active providers // GetAllProviders retrieves all active providers
GetAllProviders(ctx context.Context) ([]*entities.AuthProvider, error) GetAllProviders(ctx context.Context) ([]*entities.AuthProvider, error)
// GetAllProvidersForAdmin retrieves all providers, including inactive ones
GetAllProvidersForAdmin(ctx context.Context) ([]*entities.AuthProvider, error)
// UpdateProvider updates a provider // UpdateProvider updates a provider
UpdateProvider(ctx context.Context, provider *entities.AuthProvider) error UpdateProvider(ctx context.Context, provider *entities.AuthProvider) error

19
backend/internal/infrastructure/database/additional_repositories.go
View File

@@ -9,7 +9,7 @@ import (
"go.mongodb.org/mongo-driver/v2/mongo" "go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options" "go.mongodb.org/mongo-driver/v2/mongo/options"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
) )
// AccountRecoveryRepository implements account recovery operations // AccountRecoveryRepository implements account recovery operations
@@ -222,6 +222,23 @@ func (r *AuthProviderRepository) GetAllProviders(ctx context.Context) ([]*entiti
return providers, nil return providers, nil
} }
// GetAllProvidersForAdmin retrieves all providers, including inactive ones
func (r *AuthProviderRepository) GetAllProvidersForAdmin(ctx context.Context) ([]*entities.AuthProvider, error) {
var providers []*entities.AuthProvider
cursor, err := r.collection.Find(ctx, bson.M{})
if err != nil {
return nil, err
}
defer cursor.Close(ctx)
if err = cursor.All(ctx, &providers); err != nil {
return nil, err
}
return providers, nil
}
// UpdateProvider updates a provider // UpdateProvider updates a provider
func (r *AuthProviderRepository) UpdateProvider(ctx context.Context, provider *entities.AuthProvider) error { func (r *AuthProviderRepository) UpdateProvider(ctx context.Context, provider *entities.AuthProvider) error {
provider.UpdatedAt = time.Now() provider.UpdatedAt = time.Now()

2
backend/internal/infrastructure/database/group_repository.go
View File

@@ -6,7 +6,7 @@ import (
"strings" "strings"
"time" "time"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"go.mongodb.org/mongo-driver/v2/mongo" "go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options" "go.mongodb.org/mongo-driver/v2/mongo/options"

2
backend/internal/infrastructure/database/note_repository.go
View File

@@ -9,7 +9,7 @@ import (
"go.mongodb.org/mongo-driver/v2/mongo" "go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options" "go.mongodb.org/mongo-driver/v2/mongo/options"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
) )
// NoteRepository implements the note repository interface // NoteRepository implements the note repository interface

2
backend/internal/infrastructure/database/space_repository.go
View File

@@ -9,7 +9,7 @@ import (
"go.mongodb.org/mongo-driver/v2/mongo" "go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options" "go.mongodb.org/mongo-driver/v2/mongo/options"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
) )
// SpaceRepository implements the space repository interface // SpaceRepository implements the space repository interface

2
backend/internal/infrastructure/database/user_repository.go
View File

@@ -9,7 +9,7 @@ import (
"go.mongodb.org/mongo-driver/v2/mongo" "go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options" "go.mongodb.org/mongo-driver/v2/mongo/options"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
) )
// UserRepository implements the user repository interface // UserRepository implements the user repository interface

6
backend/internal/interfaces/handlers/admin_handler.go
View File

@@ -4,12 +4,12 @@ import (
"encoding/json" "encoding/json"
"net/http" "net/http"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/noteapp/backend/internal/interfaces/middleware"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
) )
// AdminHandler handles admin-level HTTP requests // AdminHandler handles admin-level HTTP requests

18
backend/internal/interfaces/handlers/auth_handler.go
View File

@@ -7,10 +7,10 @@ import (
"os" "os"
"strings" "strings"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/auth"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/noteapp/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services"
"github.com/noteapp/backend/internal/infrastructure/auth"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )
@@ -121,6 +121,18 @@ func (h *AuthHandler) ListProviders(w http.ResponseWriter, r *http.Request) {
json.NewEncoder(w).Encode(map[string]interface{}{"providers": providers}) json.NewEncoder(w).Encode(map[string]interface{}{"providers": providers})
} }
// ListProvidersForAdmin returns all OAuth/OIDC providers, including inactive ones.
func (h *AuthHandler) ListProvidersForAdmin(w http.ResponseWriter, r *http.Request) {
providers, err := h.authService.ListProvidersForAdmin(r.Context())
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"providers": providers})
}
// CreateProvider stores a new OAuth/OIDC provider configuration. // CreateProvider stores a new OAuth/OIDC provider configuration.
func (h *AuthHandler) CreateProvider(w http.ResponseWriter, r *http.Request) { func (h *AuthHandler) CreateProvider(w http.ResponseWriter, r *http.Request) {
var req dto.CreateAuthProviderRequest var req dto.CreateAuthProviderRequest

6
backend/internal/interfaces/handlers/category_handler.go
View File

@@ -7,9 +7,9 @@ import (
"github.com/gorilla/mux" "github.com/gorilla/mux"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"github.com/noteapp/backend/internal/interfaces/middleware" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
) )
// CategoryHandler handles category endpoints // CategoryHandler handles category endpoints

4
backend/internal/interfaces/handlers/file_handler.go
View File

@@ -9,9 +9,9 @@ import (
"path" "path"
"strings" "strings"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/noteapp/backend/internal/application/services"
"github.com/noteapp/backend/internal/interfaces/middleware"
) )
const maxUploadSize = 100 << 20 // 100 MB const maxUploadSize = 100 << 20 // 100 MB

6
backend/internal/interfaces/handlers/note_handler.go
View File

@@ -8,9 +8,9 @@ import (
"github.com/gorilla/mux" "github.com/gorilla/mux"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"github.com/noteapp/backend/internal/interfaces/middleware" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
) )
// NoteHandler handles note endpoints // NoteHandler handles note endpoints

4
backend/internal/interfaces/handlers/public_handler.go
View File

@@ -8,8 +8,8 @@ import (
"github.com/gorilla/mux" "github.com/gorilla/mux"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
) )
// PublicHandler handles unauthenticated public read-only requests // PublicHandler handles unauthenticated public read-only requests

2
backend/internal/interfaces/handlers/settings_handler.go
View File

@@ -4,7 +4,7 @@ import (
"encoding/json" "encoding/json"
"net/http" "net/http"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
) )
// SettingsHandler handles public app settings endpoints. // SettingsHandler handles public app settings endpoints.

6
backend/internal/interfaces/handlers/space_handler.go
View File

@@ -4,10 +4,10 @@ import (
"encoding/json" "encoding/json"
"net/http" "net/http"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/interfaces/middleware"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/noteapp/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services"
"github.com/noteapp/backend/internal/interfaces/middleware"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

2
backend/internal/interfaces/middleware/auth.go
View File

@@ -6,7 +6,7 @@ import (
"net/http" "net/http"
"strings" "strings"
"github.com/noteapp/backend/internal/infrastructure/auth" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/auth"
) )
// ContextKey is a custom type for context keys // ContextKey is a custom type for context keys

2
backend/tests/integration/integration_test.go
View File

@@ -8,7 +8,7 @@ import (
"testing" "testing"
"time" "time"
"github.com/noteapp/backend/internal/infrastructure/database" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/database"
) )
// TestDatabaseConnection tests MongoDB connection // TestDatabaseConnection tests MongoDB connection

10
backend/tests/unit/auth_service_test.go
View File

@@ -4,11 +4,11 @@ import (
"context" "context"
"testing" "testing"
"github.com/noteapp/backend/internal/application/dto" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/dto"
"github.com/noteapp/backend/internal/application/services" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/application/services"
"github.com/noteapp/backend/internal/domain/entities" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/domain/entities"
"github.com/noteapp/backend/internal/infrastructure/auth" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/auth"
"github.com/noteapp/backend/internal/infrastructure/security" "gitea.hostxtra.co.uk/mrhid6/notely/backend/internal/infrastructure/security"
"go.mongodb.org/mongo-driver/v2/bson" "go.mongodb.org/mongo-driver/v2/bson"
) )

33
frontend/eslint.config.js Normal file
View File

@@ -0,0 +1,33 @@
import js from "@eslint/js";
import globals from "globals";
import pluginVue from "eslint-plugin-vue";
export default [
{
ignores: ["dist/**", "node_modules/**"],
},
js.configs.recommended,
...pluginVue.configs["flat/essential"],
{
files: ["**/*.{js,mjs,cjs,vue}"],
languageOptions: {
ecmaVersion: "latest",
sourceType: "module",
globals: {
...globals.browser,
...globals.node,
},
},
rules: {
"no-unused-vars": [
"warn",
{
argsIgnorePattern: "^_",
varsIgnorePattern: "^_",
},
],
"no-console": "off",
"vue/multi-word-component-names": "off",
},
},
];

1717
frontend/package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

9
frontend/package.json
View File

@@ -7,7 +7,9 @@
"dev": "vite", "dev": "vite",
"build": "vite build", "build": "vite build",
"preview": "vite preview", "preview": "vite preview",
"lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs" "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs",
"test": "vitest run",
"test:watch": "vitest"
}, },
"dependencies": { "dependencies": {
"@mdi/font": "^7.4.47", "@mdi/font": "^7.4.47",
@@ -23,8 +25,13 @@
"vue-router": "^4.2.0" "vue-router": "^4.2.0"
}, },
"devDependencies": { "devDependencies": {
"@eslint/js": "^9.22.0",
"@vitejs/plugin-vue": "^4.2.0", "@vitejs/plugin-vue": "^4.2.0",
"@vue/test-utils": "^2.4.0", "@vue/test-utils": "^2.4.0",
"eslint": "^9.22.0",
"eslint-plugin-vue": "^9.32.0",
"globals": "^16.0.0",
"jsdom": "^29.0.1",
"vite": "^4.3.0", "vite": "^4.3.0",
"vitest": "^0.34.0" "vitest": "^0.34.0"
} }

5
frontend/src/App.vue
View File

@@ -808,11 +808,6 @@ const createSpace = async (spaceData) => {
await spaceStore.createSpace(spaceData); await spaceStore.createSpace(spaceData);
}; };
const createCategory = async (categoryData) => {
showCreateCategoryModal.value = false;
await spaceStore.createCategory(currentSpace.value.id, categoryData);
};
const openCreateCategoryModal = () => { const openCreateCategoryModal = () => {
if (!canCreateCategories.value) { if (!canCreateCategories.value) {
return; return;

20
frontend/src/components/AdminProviderModal.vue
View File

@@ -60,6 +60,20 @@
<label for="provider-active" class="form-check-label">Provider is active</label> <label for="provider-active" class="form-check-label">Provider is active</label>
</div> </div>
</div> </div>
<div v-if="mode === 'edit'" class="col-12">
<div class="danger-zone border border-danger-subtle rounded p-3 mt-2">
<div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2">
<div>
<div class="fw-semibold text-danger">Danger Zone</div>
<div class="small text-muted">Permanently delete this provider configuration.</div>
</div>
<button type="button" class="btn btn-sm btn-outline-danger" :disabled="submitting || deleting" @click="emit('delete', props.provider)">
<i class="mdi mdi-trash-can-outline me-1" aria-hidden="true"></i>Delete Provider
</button>
</div>
</div>
</div>
</div> </div>
</div> </div>
<div class="modal-footer"> <div class="modal-footer">
@@ -92,9 +106,13 @@ const props = defineProps({
type: Boolean, type: Boolean,
default: false, default: false,
}, },
deleting: {
type: Boolean,
default: false,
},
}); });
const emit = defineEmits(["close", "submit"]); const emit = defineEmits(["close", "submit", "delete"]);
const form = ref({ const form = ref({
name: "", name: "",

22
frontend/src/pages/Admin.vue
View File

@@ -153,6 +153,12 @@
<div v-else class="list-group"> <div v-else class="list-group">
<div v-for="provider in providers" :key="provider.id" class="list-group-item d-flex justify-content-between align-items-center"> <div v-for="provider in providers" :key="provider.id" class="list-group-item d-flex justify-content-between align-items-center">
<div class="d-flex align-items-center gap-2"> <div class="d-flex align-items-center gap-2">
<i
class="mdi"
:class="provider.is_active ? 'mdi-check-circle text-success' : 'mdi-close-circle text-secondary'"
:title="provider.is_active ? 'Provider enabled' : 'Provider disabled'"
aria-hidden="true"
></i>
<span class="fw-semibold">{{ provider.name }}</span> <span class="fw-semibold">{{ provider.name }}</span>
</div> </div>
<div class="d-flex gap-2"> <div class="d-flex gap-2">
@@ -277,8 +283,10 @@
:mode="providerModalMode" :mode="providerModalMode"
:provider="selectedProvider" :provider="selectedProvider"
:submitting="submittingProviderModal" :submitting="submittingProviderModal"
:deleting="deletingProviderModal"
@close="closeProviderModal" @close="closeProviderModal"
@submit="submitProviderModal" @submit="submitProviderModal"
@delete="deleteProviderFromModal"
/> />
</template> </template>
@@ -335,6 +343,7 @@ const showProviderModal = ref(false);
const providerModalMode = ref("create"); const providerModalMode = ref("create");
const selectedProvider = ref(null); const selectedProvider = ref(null);
const submittingProviderModal = ref(false); const submittingProviderModal = ref(false);
const deletingProviderModal = ref(false);
const loadingFeatureFlags = ref(false); const loadingFeatureFlags = ref(false);
const savingFeatureFlags = ref(false); const savingFeatureFlags = ref(false);
@@ -584,6 +593,7 @@ const openEditProviderModal = (provider) => {
const closeProviderModal = () => { const closeProviderModal = () => {
showProviderModal.value = false; showProviderModal.value = false;
submittingProviderModal.value = false; submittingProviderModal.value = false;
deletingProviderModal.value = false;
selectedProvider.value = null; selectedProvider.value = null;
}; };
@@ -612,7 +622,7 @@ const loadProviders = async () => {
loadingProviders.value = true; loadingProviders.value = true;
clearMessages(); clearMessages();
try { try {
const res = await apiClient.get("/api/v1/auth/providers"); const res = await apiClient.get("/api/v1/admin/auth/providers");
providers.value = res.data.providers || []; providers.value = res.data.providers || [];
} catch (e) { } catch (e) {
error.value = e.response?.data || "Failed to load providers."; error.value = e.response?.data || "Failed to load providers.";
@@ -621,18 +631,26 @@ const loadProviders = async () => {
} }
}; };
const deleteProvider = async (provider) => { const deleteProviderFromModal = async (provider) => {
if (!provider?.id) {
return;
}
if (!confirm(`Delete identity provider "${provider.name}"? This action cannot be undone.`)) { if (!confirm(`Delete identity provider "${provider.name}"? This action cannot be undone.`)) {
return; return;
} }
deletingProviderModal.value = true;
clearMessages(); clearMessages();
try { try {
await apiClient.delete(`/api/v1/admin/auth/providers/${provider.id}`); await apiClient.delete(`/api/v1/admin/auth/providers/${provider.id}`);
providers.value = providers.value.filter((item) => item.id !== provider.id); providers.value = providers.value.filter((item) => item.id !== provider.id);
successMessage.value = `Provider "${provider.name}" deleted.`; successMessage.value = `Provider "${provider.name}" deleted.`;
closeProviderModal();
} catch (e) { } catch (e) {
error.value = e.response?.data || "Failed to delete provider."; error.value = e.response?.data || "Failed to delete provider.";
} finally {
deletingProviderModal.value = false;
} }
}; };

81
frontend/tests/auth.spec.js
View File

@@ -1,10 +1,22 @@
import { describe, it, expect, beforeEach, vi } from "vitest"; // @vitest-environment node
import { useAuthStore } from "../../src/stores/authStore";
import { beforeEach, describe, expect, it, vi } from "vitest";
import { createPinia, setActivePinia } from "pinia"; import { createPinia, setActivePinia } from "pinia";
vi.mock("../src/services/apiClient.js", () => ({
default: {
get: vi.fn(),
post: vi.fn(() => Promise.resolve({})),
},
}));
import apiClient from "../src/services/apiClient.js";
import { useAuthStore } from "../src/stores/authStore.js";
describe("Auth Store", () => { describe("Auth Store", () => {
beforeEach(() => { beforeEach(() => {
setActivePinia(createPinia()); setActivePinia(createPinia());
vi.clearAllMocks();
}); });
it("should initialize with no user", () => { it("should initialize with no user", () => {
@@ -13,27 +25,76 @@ describe("Auth Store", () => {
expect(store.user).toBeNull(); expect(store.user).toBeNull();
}); });
it("should store user data on login", () => { it("should store user data with setSession", () => {
const store = useAuthStore(); const store = useAuthStore();
// Mock user data
const mockUser = { const mockUser = {
id: "123", id: "123",
email: "test@example.com", email: "test@example.com",
username: "testuser", username: "testuser",
permissions: ["space.demo.note.create"],
}; };
// In a real test, you'd mock the API call store.setSession({ user: mockUser });
// For now, just test the store structure
expect(store.user).toBeNull(); expect(store.isAuthenticated).toBe(true);
expect(store.user).toEqual(mockUser);
expect(store.hasPermission("space.demo.note.create")).toBe(true);
}); });
it("should clear user data on logout", () => { it("should login and persist returned user", async () => {
const store = useAuthStore(); const store = useAuthStore();
apiClient.post.mockResolvedValueOnce({
data: {
user: {
id: "123",
email: "test@example.com",
username: "testuser",
permissions: [],
},
},
});
const result = await store.login(" test@example.com ", "password123");
expect(apiClient.post).toHaveBeenCalledWith("/api/v1/auth/login", {
email: "test@example.com",
password: "password123",
});
expect(result.user.username).toBe("testuser");
expect(store.user?.username).toBe("testuser");
});
it("should clear user data on logout", async () => {
const store = useAuthStore();
store.setSession({
user: {
id: "123",
email: "test@example.com",
username: "testuser",
permissions: ["space.demo.settings.delete"],
},
});
store.logout(); store.logout();
expect(store.isAuthenticated).toBe(false); expect(store.isAuthenticated).toBe(false);
expect(store.user).toBeNull(); expect(store.user).toBeNull();
expect(store.accessToken).toBeNull(); expect(apiClient.post).toHaveBeenCalledWith("/api/v1/auth/logout");
});
it("should evaluate space permissions using the space permission key", () => {
const store = useAuthStore();
store.setSession({
user: {
id: "123",
email: "test@example.com",
username: "testuser",
permissions: ["space.docs.settings.delete", "space.*.note.create"],
},
});
expect(store.hasSpacePermission({ permission_key: "docs" }, "settings.delete")).toBe(true);
expect(store.hasSpacePermission({ permission_key: "docs" }, "note.create")).toBe(true);
expect(store.hasSpacePermission({ permission_key: "docs" }, "note.delete")).toBe(false);
}); });
}); });