- Created AccountLockoutService to track failed login attempts
- Accounts are locked after 5 failed attempts within 15 minutes
- Lockout duration: 30 minutes (auto-unlock)
- Service uses Redis for persistence (fail-open if Redis unavailable)
- Integrated into AuthService Login method:
* Check account lockout status before login
* Record failed attempts (even for non-existent users to prevent enumeration)
* Reset failed attempts counter on successful login
* Auto-unlock expired accounts
- Added SetAccountLockoutService method to AuthService
- Service initialized in router when Redis is available
Phase: PHASE-4
Priority: P1
Progress: 9/267 (3.4%)
- Applied RegisterRateLimit to POST /auth/register (3 attempts/hour)
- Applied PasswordResetRateLimit to password reset endpoints (3 attempts/hour)
- Added VerifyEmailRateLimit for POST /auth/verify-email (5 attempts/hour)
- Added ResendVerificationRateLimit for POST /auth/resend-verification (3 attempts/hour)
- Login endpoint already had rate limiting (5 attempts/15min)
- All rate limits are IP-based and use Redis for persistence
- Rate limiting disabled in test/e2e environments
Phase: PHASE-4
Priority: P1
Progress: 7/267 (2.6%)
- Standardized GetUserLikedTracks handler to use RespondSuccess/RespondWithAppError
- Added limit validation (max 100)
- Moved route from setupTrackRoutes to setupUserRoutes in protected group
- Handler uses existing TrackLikeService methods
- Handler returns paginated results with tracks, total, limit, and offset
- Handler uses standard API response format
Phase: PHASE-2
Priority: P1
Progress: 34/267 (12.7%)
- DeleteAvatar handler was already implemented and standardized
- Added route: DELETE /users/:userId/avatar
- Handler validates user authentication and ownership
- Handler deletes avatar file from storage and updates database
- Handler uses standard API response format
Phase: PHASE-2
Priority: P1
Progress: 31/267 (11.6%)
- Added GetStreamInfo method to HLSService
- Added GetStreamInfo handler in HLSHandler
- Standardized GetStreamStatus handler to use RespondSuccess/RespondWithAppError
- Added routes: GET /tracks/:id/hls/info and GET /tracks/:id/hls/status
- GetStreamInfo returns general stream information
- GetStreamStatus returns status with processing info if applicable
- Handlers use standard API response format
Phase: PHASE-2
Priority: P1
Progress: 29/267 (10.9%)
- Added BlockUser and UnblockUser methods to SocialService
- Added BlockUser and UnblockUser handlers in ProfileHandler
- Added routes: POST /users/:id/block and DELETE /users/:id/block
- Handlers use existing SocialService methods
- Includes validation to prevent users from blocking themselves
- Added IsBlocked helper method to check block status
- Handlers use standard API response format
Phase: PHASE-2
Priority: P2
Progress: 27/267 (10.1%)
- Added FollowUser and UnfollowUser handlers in ProfileHandler
- Added socialService field and SetSocialService method
- Initialized SocialService in setupUserRoutes
- Added routes: POST /users/:id/follow and DELETE /users/:id/follow
- Handlers use existing SocialService methods
- Includes validation to prevent users from following themselves
- Handlers use standard API response format
Phase: PHASE-2
Priority: P2
Progress: 26/267 (9.7%)
- Standardized API responses in notification handlers
- Replaced c.Get with GetUserIDUUID for consistent user ID extraction
- Added routes: GET /notifications, POST /notifications/:id/read, POST /notifications/read-all
- Initialized NotificationService and NotificationHandlers in router
- Handlers and service already existed, only routes and response standardization were needed
Phase: PHASE-2
Priority: P1
Progress: 25/267 (9.4%)
- Added UpdateRoom method to RoomService with ownership check
- Only room creator can update the room
- Added UpdateRoomRequest type
- Added UpdateRoom to RoomServiceInterface and RoomHandler
- Added PUT /conversations/:id route
- Handler uses standard API response format
- Service updates name and/or description fields
Phase: PHASE-2
Priority: P1
Progress: 21/267 (7.9%)
- Added RemoveMember method to RoomService and RoomServiceInterface
- Corrected RemoveMember in RoomRepository to use uuid.UUID
- Added AddParticipant and RemoveParticipant handlers
- Added POST /conversations/:id/participants route
- Added DELETE /conversations/:id/participants/:userId route
- Handlers use standard API response format
- Handlers reuse AddMember/RemoveMember service methods
Phase: PHASE-2
Priority: P1
Progress: 20/267 (7.5%)
- Added DeleteRoom method to RoomService with ownership check
- Only room creator can delete the room
- Added DeleteRoom to RoomServiceInterface and RoomHandler
- Added DELETE /conversations/:id route
- Handler uses standard API response format
- Service performs soft delete via GORM
Phase: PHASE-2
Priority: P1
Progress: 19/267 (7.1%)
- Added GET /tracks/search route in setupTrackRoutes
- Initialized TrackSearchService and set it in TrackHandler
- Handler SearchTracks and TrackSearchService already existed
- Supports query params: q, genre, artist, page, limit
- Service handles pagination, filtering, and returns tracks with pagination metadata
Phase: PHASE-2
Priority: P1
Progress: 18/267 (6.7%)
- Created SearchUsers method in UserService with pagination support
- SearchUsers searches by username, email, first_name, and last_name using ILIKE
- Added SearchUsers handler in ProfileHandler with query params (q, page, limit)
- Added GET /users/search route in setupUserRoutes
- Returns paginated results with total count
- Password hashes are excluded from results
Phase: PHASE-2
Priority: P1
Progress: 17/267 (6.4%)
- Standardized API responses in RoleHandler (RespondSuccess, RespondWithAppError)
- Added GET /api/v1/roles endpoint
- Added GET /api/v1/roles/:id endpoint
- Added POST /api/v1/users/:userId/roles endpoint
- Added DELETE /api/v1/users/:userId/roles/:roleId endpoint
- Created setupRoleRoutes function for role routes
- Handlers support both :id and :userId parameters
- All endpoints require authentication
Phase: PHASE-2
Priority: P1
Progress: 16/267 (6.0%)
- Added GetStats method to ChatService with database access
- Returns active_users (distinct users who sent messages in last 24h)
- Returns total_messages (non-deleted messages count)
- Returns rooms_active (rooms with messages in last 24h)
- Added GetStats handler and GET /chat/stats route
- Updated ChatService to use NewChatServiceWithDB for database access
Phase: PHASE-2
Priority: P1
Progress: 15/267 (5.6%)
- Added POST /playlists/:id/share route in router.go
- Initialized PlaylistShareService and set it in PlaylistService
- Handler CreateShareLink already existed and was fully implemented
- Standardized API response to return shareLink directly
- Route requires ownership or admin permission via middleware
Phase: PHASE-2
Priority: P1
Progress: 14/267 (5.2%)
- Added routes in router.go: POST, GET, PUT, DELETE /playlists/:id/collaborators
- Applied RequireOwnershipOrAdmin middleware to POST, PUT, DELETE routes
- GET route accessible to collaborators (service layer checks permissions)
- Fixed UpdateCollaboratorPermission handler to use RespondWithAppError
- All handlers already existed in playlist_handler.go
- All endpoints properly authenticated and ownership checks enforced
Phase: PHASE-1
Priority: P0
Progress: 5/267 (1.9%)
- Created TwoFactorHandler with SetupTwoFactor, VerifyTwoFactor, DisableTwoFactor, GetTwoFactorStatus
- Added routes: POST /auth/2fa/setup, POST /auth/2fa/verify, POST /auth/2fa/disable, GET /auth/2fa/status
- Updated LoginResponse DTO to include requires_2fa flag
- Updated Login handler to check 2FA status and return requires_2fa flag when enabled
- Reused existing TwoFactorService (already had QR generation and TOTP verification)
- Added VerifyTOTPCode helper method to TwoFactorService
- All endpoints properly authenticated with RequireAuth middleware
Phase: PHASE-1
Priority: P0
Progress: 4/267 (1.5%)
Backend Go:
- Remplacement complet des anciennes migrations par la base V1 alignée sur ORIGIN.
- Durcissement global du parsing JSON (BindAndValidateJSON + RespondWithAppError).
- Sécurisation de config.go, CORS, statuts de santé et monitoring.
- Implémentation des transactions P0 (RBAC, duplication de playlists, social toggles).
- Ajout d’un job worker structuré (emails, analytics, thumbnails) + tests associés.
- Nouvelle doc backend : AUDIT_CONFIG, BACKEND_CONFIG, AUTH_PASSWORD_RESET, JOB_WORKER_*.
Chat server (Rust):
- Refonte du pipeline JWT + sécurité, audit et rate limiting avancé.
- Implémentation complète du cycle de message (read receipts, delivered, edit/delete, typing).
- Nettoyage des panics, gestion d’erreurs robuste, logs structurés.
- Migrations chat alignées sur le schéma UUID et nouvelles features.
Stream server (Rust):
- Refonte du moteur de streaming (encoding pipeline + HLS) et des modules core.
- Transactions P0 pour les jobs et segments, garanties d’atomicité.
- Documentation détaillée de la pipeline (AUDIT_STREAM_*, DESIGN_STREAM_PIPELINE, TRANSACTIONS_P0_IMPLEMENTATION).
Documentation & audits:
- TRIAGE.md et AUDIT_STABILITY.md à jour avec l’état réel des 3 services.
- Cartographie complète des migrations et des transactions (DB_MIGRATIONS_*, DB_TRANSACTION_PLAN, AUDIT_DB_TRANSACTIONS, TRANSACTION_TESTS_PHASE3).
- Scripts de reset et de cleanup pour la lab DB et la V1.
Ce commit fige l’ensemble du travail de stabilisation P0 (UUID, backend, chat et stream) avant les phases suivantes (Coherence Guardian, WS hardening, etc.).
