- Fixed GetSessions handler to identify current session by comparing token hash
- Added session creation during token refresh to ensure sessions are tracked
- Sessions are now correctly identified as current in the frontend
- Updated Refresh handler to accept sessionService parameter
Files modified:
- veza-backend-api/internal/handlers/session.go
- veza-backend-api/internal/handlers/auth.go
- veza-backend-api/internal/api/router.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Added APIKey field to Webhook model with unique index
- Implemented GenerateAPIKey() method using crypto/rand for secure key generation
- Implemented ValidateAPIKey() method to authenticate webhook requests
- Implemented RegenerateAPIKey() method to rotate API keys
- Created WebhookAPIKeyMiddleware for validating API keys in requests
- Middleware supports X-API-Key header and Authorization: Bearer format
- Added endpoint POST /api/v1/webhooks/:id/regenerate-key
- API keys are prefixed with 'whk_' for identification
- Comprehensive unit tests for all API key functionality
- Inactive webhooks cannot authenticate with their API keys
Phase: PHASE-4
Priority: P2
Progress: 119/267 (44.57%)
- Created DataExportService for comprehensive user data export (GDPR compliance)
- Exports all user data: profile, settings, tracks, playlists, comments, likes, analytics, federated identities, roles
- Added ExportUserData method to retrieve all user data from database
- Added ExportUserDataAsJSON method to export as downloadable JSON file
- Added endpoint GET /api/v1/users/me/export that returns JSON file download
- Comprehensive unit tests for export service
- Proper error handling and logging
Phase: PHASE-6
Priority: P2
Progress: 118/267 (44.19%)
- Created VersionManager for managing API versions
- Added VersionMiddleware for automatic version detection:
- X-API-Version header
- Accept header (application/vnd.veza.v1+json)
- URL path (/api/v1/...)
- Added support for deprecated versions with sunset dates
- Added /api/versions endpoint for version information
- Added helpers: GetAPIVersion, GetAPIVersionInfo
- Comprehensive unit tests for versioning system
- Integrated version manager in APIRouter
Phase: PHASE-6
Priority: P2
Progress: 115/267 (43.07%)
- Enhanced HealthCheck struct with Details field for additional metrics
- Added detailed database pool statistics (open connections, in use, idle, wait counts)
- Added health checks for S3 storage service (if enabled)
- Added health checks for Job Worker with job queue statistics
- Added health checks for Email Sender (SMTP configuration)
- Updated HealthHandler to accept additional services
- Updated router to pass S3, JobWorker, and EmailSender to health handler
Phase: PHASE-6
Priority: P2
Progress: 112/267 (41.95%)
- Added AWS SDK v2 dependency for S3 support
- Created S3StorageService implementing S3Service interface
- Support for AWS S3 and MinIO (S3-compatible storage)
- Added S3 configuration in config.go with environment variables
- Implemented upload, delete, presigned URL, and public URL methods
- Added unit tests for service validation and URL generation
- Service integrates with existing TrackStorageService
- Created AccountLockoutService to track failed login attempts
- Accounts are locked after 5 failed attempts within 15 minutes
- Lockout duration: 30 minutes (auto-unlock)
- Service uses Redis for persistence (fail-open if Redis unavailable)
- Integrated into AuthService Login method:
* Check account lockout status before login
* Record failed attempts (even for non-existent users to prevent enumeration)
* Reset failed attempts counter on successful login
* Auto-unlock expired accounts
- Added SetAccountLockoutService method to AuthService
- Service initialized in router when Redis is available
Phase: PHASE-4
Priority: P1
Progress: 9/267 (3.4%)
- Applied RegisterRateLimit to POST /auth/register (3 attempts/hour)
- Applied PasswordResetRateLimit to password reset endpoints (3 attempts/hour)
- Added VerifyEmailRateLimit for POST /auth/verify-email (5 attempts/hour)
- Added ResendVerificationRateLimit for POST /auth/resend-verification (3 attempts/hour)
- Login endpoint already had rate limiting (5 attempts/15min)
- All rate limits are IP-based and use Redis for persistence
- Rate limiting disabled in test/e2e environments
Phase: PHASE-4
Priority: P1
Progress: 7/267 (2.6%)
- Standardized GetUserLikedTracks handler to use RespondSuccess/RespondWithAppError
- Added limit validation (max 100)
- Moved route from setupTrackRoutes to setupUserRoutes in protected group
- Handler uses existing TrackLikeService methods
- Handler returns paginated results with tracks, total, limit, and offset
- Handler uses standard API response format
Phase: PHASE-2
Priority: P1
Progress: 34/267 (12.7%)
- DeleteAvatar handler was already implemented and standardized
- Added route: DELETE /users/:userId/avatar
- Handler validates user authentication and ownership
- Handler deletes avatar file from storage and updates database
- Handler uses standard API response format
Phase: PHASE-2
Priority: P1
Progress: 31/267 (11.6%)
- Added GetStreamInfo method to HLSService
- Added GetStreamInfo handler in HLSHandler
- Standardized GetStreamStatus handler to use RespondSuccess/RespondWithAppError
- Added routes: GET /tracks/:id/hls/info and GET /tracks/:id/hls/status
- GetStreamInfo returns general stream information
- GetStreamStatus returns status with processing info if applicable
- Handlers use standard API response format
Phase: PHASE-2
Priority: P1
Progress: 29/267 (10.9%)
- Added BlockUser and UnblockUser methods to SocialService
- Added BlockUser and UnblockUser handlers in ProfileHandler
- Added routes: POST /users/:id/block and DELETE /users/:id/block
- Handlers use existing SocialService methods
- Includes validation to prevent users from blocking themselves
- Added IsBlocked helper method to check block status
- Handlers use standard API response format
Phase: PHASE-2
Priority: P2
Progress: 27/267 (10.1%)
- Added FollowUser and UnfollowUser handlers in ProfileHandler
- Added socialService field and SetSocialService method
- Initialized SocialService in setupUserRoutes
- Added routes: POST /users/:id/follow and DELETE /users/:id/follow
- Handlers use existing SocialService methods
- Includes validation to prevent users from following themselves
- Handlers use standard API response format
Phase: PHASE-2
Priority: P2
Progress: 26/267 (9.7%)
- Standardized API responses in notification handlers
- Replaced c.Get with GetUserIDUUID for consistent user ID extraction
- Added routes: GET /notifications, POST /notifications/:id/read, POST /notifications/read-all
- Initialized NotificationService and NotificationHandlers in router
- Handlers and service already existed, only routes and response standardization were needed
Phase: PHASE-2
Priority: P1
Progress: 25/267 (9.4%)
- Added UpdateRoom method to RoomService with ownership check
- Only room creator can update the room
- Added UpdateRoomRequest type
- Added UpdateRoom to RoomServiceInterface and RoomHandler
- Added PUT /conversations/:id route
- Handler uses standard API response format
- Service updates name and/or description fields
Phase: PHASE-2
Priority: P1
Progress: 21/267 (7.9%)
- Added RemoveMember method to RoomService and RoomServiceInterface
- Corrected RemoveMember in RoomRepository to use uuid.UUID
- Added AddParticipant and RemoveParticipant handlers
- Added POST /conversations/:id/participants route
- Added DELETE /conversations/:id/participants/:userId route
- Handlers use standard API response format
- Handlers reuse AddMember/RemoveMember service methods
Phase: PHASE-2
Priority: P1
Progress: 20/267 (7.5%)
- Added DeleteRoom method to RoomService with ownership check
- Only room creator can delete the room
- Added DeleteRoom to RoomServiceInterface and RoomHandler
- Added DELETE /conversations/:id route
- Handler uses standard API response format
- Service performs soft delete via GORM
Phase: PHASE-2
Priority: P1
Progress: 19/267 (7.1%)
- Added GET /tracks/search route in setupTrackRoutes
- Initialized TrackSearchService and set it in TrackHandler
- Handler SearchTracks and TrackSearchService already existed
- Supports query params: q, genre, artist, page, limit
- Service handles pagination, filtering, and returns tracks with pagination metadata
Phase: PHASE-2
Priority: P1
Progress: 18/267 (6.7%)
- Created SearchUsers method in UserService with pagination support
- SearchUsers searches by username, email, first_name, and last_name using ILIKE
- Added SearchUsers handler in ProfileHandler with query params (q, page, limit)
- Added GET /users/search route in setupUserRoutes
- Returns paginated results with total count
- Password hashes are excluded from results
Phase: PHASE-2
Priority: P1
Progress: 17/267 (6.4%)
- Standardized API responses in RoleHandler (RespondSuccess, RespondWithAppError)
- Added GET /api/v1/roles endpoint
- Added GET /api/v1/roles/:id endpoint
- Added POST /api/v1/users/:userId/roles endpoint
- Added DELETE /api/v1/users/:userId/roles/:roleId endpoint
- Created setupRoleRoutes function for role routes
- Handlers support both :id and :userId parameters
- All endpoints require authentication
Phase: PHASE-2
Priority: P1
Progress: 16/267 (6.0%)
- Added GetStats method to ChatService with database access
- Returns active_users (distinct users who sent messages in last 24h)
- Returns total_messages (non-deleted messages count)
- Returns rooms_active (rooms with messages in last 24h)
- Added GetStats handler and GET /chat/stats route
- Updated ChatService to use NewChatServiceWithDB for database access
Phase: PHASE-2
Priority: P1
Progress: 15/267 (5.6%)
- Added POST /playlists/:id/share route in router.go
- Initialized PlaylistShareService and set it in PlaylistService
- Handler CreateShareLink already existed and was fully implemented
- Standardized API response to return shareLink directly
- Route requires ownership or admin permission via middleware
Phase: PHASE-2
Priority: P1
Progress: 14/267 (5.2%)
- Added routes in router.go: POST, GET, PUT, DELETE /playlists/:id/collaborators
- Applied RequireOwnershipOrAdmin middleware to POST, PUT, DELETE routes
- GET route accessible to collaborators (service layer checks permissions)
- Fixed UpdateCollaboratorPermission handler to use RespondWithAppError
- All handlers already existed in playlist_handler.go
- All endpoints properly authenticated and ownership checks enforced
Phase: PHASE-1
Priority: P0
Progress: 5/267 (1.9%)
- Created TwoFactorHandler with SetupTwoFactor, VerifyTwoFactor, DisableTwoFactor, GetTwoFactorStatus
- Added routes: POST /auth/2fa/setup, POST /auth/2fa/verify, POST /auth/2fa/disable, GET /auth/2fa/status
- Updated LoginResponse DTO to include requires_2fa flag
- Updated Login handler to check 2FA status and return requires_2fa flag when enabled
- Reused existing TwoFactorService (already had QR generation and TOTP verification)
- Added VerifyTOTPCode helper method to TwoFactorService
- All endpoints properly authenticated with RequireAuth middleware
Phase: PHASE-1
Priority: P0
Progress: 4/267 (1.5%)
