- Modified internal/core/auth/service.go to make token generation non-blocking
- If token generation/storage fails, registration still succeeds
- User can request a new verification token later
- Backend needs to be restarted for changes to take effect
Note: This fixes the 'Failed to create user' error when email verification
service fails. The registration will now succeed even if token generation fails.
- Implement slug uniqueness check before creating user
- Add numeric suffix if slug already exists (e.g., username1, username2)
- Fallback to timestamp-based slug if too many collisions
- Prevents database constraint violations for duplicate slugs
- Matches the logic used in OAuth service for consistency
- Set Role to 'user' explicitly
- Set IsActive to true explicitly
- Set IsVerified to false explicitly
- Prevents database constraint errors when creating new users
- Ensures all required fields are set even if database defaults are missing
- Add user-friendly error messages for password, email, and username validation
- Translate technical validation errors to clear French messages
- Specifically handle 'min' validation for password (12 chars) and username (3 chars)
- Handle 'eqfield' validation for password confirmation
- Handle 'email' validation for email format
- Handle 'required' validation for all fields
- Improves error messages shown to users during registration
- Disable RegisterRateLimit when APP_ENV=development
- Add development mode check in endpoint_limiter.go
- Prevents rate limit errors during development and testing
- Endpoint rate limiting still active in production/staging
- Fixes 429 errors when creating accounts in development
- Disable rate limiting when APP_ENV=development
- Add development mode check in router.go
- Prevents rate limit errors during development and testing
- Rate limiting still active in production/staging
- Exclude critical routes as backup measure
- Exclude auth routes (/register, /login, /refresh) from rate limiting
- Exclude CSRF token endpoint from rate limiting
- Exclude health check endpoints from rate limiting
- Exclude Swagger/docs endpoints from rate limiting
- Prevents rate limit errors during registration and login
- Applied to both SimpleRateLimiter and RateLimiter (Redis)
- Increase IP rate limit from 100 to 200 requests per minute
- Increase IP burst from 10 to 20
- Increase SimpleRateLimiter limit from 100 to 200
- Allows frontend to make multiple requests during initial load (CSRF, state hydration, etc.)
- Can be overridden via RATE_LIMIT_IP_PER_MINUTE and RATE_LIMIT_LIMIT env vars
Frontend fixes:
- Stop retrying 429 rate limit errors to prevent infinite loops
- Show user-friendly error message for rate limit with retry-after duration
- Remove 429 from retryable status codes
- Clean up rate limit error handling logic
Backend fixes:
- Fix Swagger /docs route to use same handler as /swagger/*any
- Remove redirect that was causing 404 errors
Frontend fixes:
- Fix 'require is not defined' error in stateHydration.ts
Replace require('react') with ES6 import statement
- Fix DataCloneError in broadcastSync.ts
Serialize state before sending via BroadcastChannel (functions can't be cloned)
Backend fixes:
- Fix Swagger /docs route not found
Redirect /docs to /swagger/index.html for better compatibility
- Change :userId to :id in avatar routes for consistency
- Fixes panic: ':userId' conflicts with existing wildcard ':id'
- All routes now use consistent :id parameter
- Created comprehensive unit tests for marketplaceService (11 tests)
- Created comprehensive unit tests for profileService (12 tests)
- Created comprehensive unit tests for avatarService (9 tests)
- Created comprehensive unit tests for 2fa-service (8 tests)
- All 40 tests pass successfully
- Tests cover success cases, error handling, edge cases, and validation scenarios
Files modified:
- apps/web/src/services/marketplaceService.test.ts (new)
- apps/web/src/features/profile/services/profileService.test.ts (new)
- apps/web/src/features/profile/services/avatarService.test.ts (new)
- apps/web/src/services/2fa-service.test.ts (new)
- VEZA_COMPLETE_MVP_TODOLIST.json
- Created APIMonitoringMiddleware to track API failures (5xx errors), slow requests, and timeouts
- Created HealthCheckMonitoring middleware for health check endpoints
- Integrated MonitoringAlertingService into router with automatic initialization
- Service starts monitoring in background with default alert rules
- Provides comprehensive monitoring and alerting for API health and failures
- Monitoring activates when PROMETHEUS_URL is configured
Files modified:
- veza-backend-api/internal/middleware/monitoring.go (new)
- veza-backend-api/internal/api/router.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Created DeprecationInfo structure for managing deprecation metadata
- Enhanced DeprecationWarning middleware with custom deprecation information support
- Added standardized deprecation headers (Deprecated, Sunset, Link per RFC 8594)
- Added X-API-* custom headers for compatibility
- Created MarkEndpointDeprecated helper for easy endpoint deprecation
- System provides clear warnings, sunset dates, and migration guidance
Files modified:
- veza-backend-api/internal/middleware/general.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Created ValidateRequiredEnvironmentVariables function
- Validates required vars (JWT_SECRET, DATABASE_URL) in all environments
- Production-specific validations: CORS_ALLOWED_ORIGINS required, no wildcard, no DEBUG log level, RabbitMQ URL if enabled
- Integrated validation at startup in NewConfig() to fail-fast if required variables are missing
- Provides clear error messages for missing or invalid environment variables
Files modified:
- veza-backend-api/internal/config/config.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Enhanced ValidateCORSConfiguration to accept environment parameter
- Enforce strict validation in production (fail-fast on wildcard or empty CORS)
- In production, startup fails if CORS is misconfigured
- In development/staging, warnings are logged but startup continues
- Updated router to use environment-aware validation
Files modified:
- veza-backend-api/internal/middleware/cors.go
- veza-backend-api/internal/api/router.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Fixed GetSessions handler to identify current session by comparing token hash
- Added session creation during token refresh to ensure sessions are tracked
- Sessions are now correctly identified as current in the frontend
- Updated Refresh handler to accept sessionService parameter
Files modified:
- veza-backend-api/internal/handlers/session.go
- veza-backend-api/internal/handlers/auth.go
- veza-backend-api/internal/api/router.go
- VEZA_COMPLETE_MVP_TODOLIST.json
- Added comprehensive integration tests for CSRF protection middleware:
* GET/HEAD/OPTIONS pass without token (safe methods)
* POST/PUT/DELETE require valid CSRF token
* Requests without token are rejected (403)
* Requests with invalid token are rejected (403)
* Requests with valid token pass
* CSRF token generation endpoint
* Unauthenticated users are not blocked by CSRF
* Public endpoints are not blocked
* Each user has their own token
* Same token can be used multiple times
- Tests use Redis for token storage and validation
- All tests tagged with integration build tag
- Added comprehensive integration tests for rate limiting middleware:
* Global rate limiting (IP-based, 5 requests/minute)
* Endpoint-specific rate limiting (login: 3 attempts, register: 2 attempts)
* Different IPs have separate limits
* Rate limit headers presence and correctness
* Endpoint-specific headers (X-LoginLimit-*, etc.)
* Unauthenticated rate limiting
* Multiple endpoints with separate limits
- Tests use SimpleRateLimiter and EndpointLimiter without Redis for integration testing
- All tests tagged with integration build tag
- Enhanced existing integration tests for playlist collaboration
- Added tests for CreateShareLink endpoint:
* Create share link as owner
* Create share link as non-owner (should fail)
* Create share link for non-existent playlist (should fail)
* Create share link as admin collaborator
- Existing tests already covered:
* AddCollaborator (with different permissions)
* RemoveCollaborator
* UpdateCollaboratorPermission
* GetCollaborators
* CheckPermission
* CompleteFlow
- All tests use real services and in-memory database for end-to-end testing
- Added comprehensive integration tests for complete track upload flow:
* Simple upload (multipart form with metadata)
* Chunked upload (Initiate -> Upload chunks -> Complete)
* Get upload status
* Get upload quota
* Resume interrupted upload
- Tests use real services and in-memory database for end-to-end testing
- All tests tagged with integration build tag
- Enhanced chat_handler_test.go with comprehensive unit tests
- Added tests for GetStats endpoint (success and no messages scenarios)
- Added tests for GetToken edge cases (invalid user ID, nil user ID, user not found)
- Uses in-memory SQLite database with real services for realistic testing
- All tests compile successfully
Phase: PHASE-5
Priority: P2
Progress: 125/267 (46.8%)
- Added APIKey field to Webhook model with unique index
- Implemented GenerateAPIKey() method using crypto/rand for secure key generation
- Implemented ValidateAPIKey() method to authenticate webhook requests
- Implemented RegenerateAPIKey() method to rotate API keys
- Created WebhookAPIKeyMiddleware for validating API keys in requests
- Middleware supports X-API-Key header and Authorization: Bearer format
- Added endpoint POST /api/v1/webhooks/:id/regenerate-key
- API keys are prefixed with 'whk_' for identification
- Comprehensive unit tests for all API key functionality
- Inactive webhooks cannot authenticate with their API keys
Phase: PHASE-4
Priority: P2
Progress: 119/267 (44.57%)
- Created DataExportService for comprehensive user data export (GDPR compliance)
- Exports all user data: profile, settings, tracks, playlists, comments, likes, analytics, federated identities, roles
- Added ExportUserData method to retrieve all user data from database
- Added ExportUserDataAsJSON method to export as downloadable JSON file
- Added endpoint GET /api/v1/users/me/export that returns JSON file download
- Comprehensive unit tests for export service
- Proper error handling and logging
Phase: PHASE-6
Priority: P2
Progress: 118/267 (44.19%)
- Created recovery package with comprehensive retry logic
- Implemented Retry and RetryWithResult with configurable strategies
- Added exponential backoff with jitter support
- Created multiple recovery strategies:
- RetryRecoveryStrategy: retry with backoff
- FallbackRecoveryStrategy: fallback function
- CircuitBreakerRecoveryStrategy: wait for circuit breaker
- CompositeRecoveryStrategy: combine multiple strategies
- Added helper functions: IsRetryableError, IsTemporaryError, IsPermanentError
- Support for context cancellation and timeout
- Comprehensive unit tests for all recovery mechanisms
Phase: PHASE-6
Priority: P2
Progress: 117/267 (43.82%)
- Created VersionManager for managing API versions
- Added VersionMiddleware for automatic version detection:
- X-API-Version header
- Accept header (application/vnd.veza.v1+json)
- URL path (/api/v1/...)
- Added support for deprecated versions with sunset dates
- Added /api/versions endpoint for version information
- Added helpers: GetAPIVersion, GetAPIVersionInfo
- Comprehensive unit tests for versioning system
- Integrated version manager in APIRouter
Phase: PHASE-6
Priority: P2
Progress: 115/267 (43.07%)
- Created TraceContext struct for distributed tracing
- Implemented W3C Trace Context format support (traceparent header)
- Added backward compatibility with legacy X-Trace-ID and X-Span-ID headers
- Created HTTPClientWithTracing for automatic trace propagation in outgoing requests
- Enhanced Tracing middleware to use new trace context system
- Added context propagation helpers (WithTraceContext, FromContext)
- Added child span creation for nested operations
- Comprehensive unit tests for trace context and HTTP client
Phase: PHASE-6
Priority: P2
Progress: 114/267 (42.70%)
- Created ShutdownManager for coordinated graceful shutdown of all services
- Added Shutdowner interface for services that need graceful shutdown
- Implemented parallel shutdown with individual timeouts (10s per service)
- Added global shutdown timeout (30s total)
- Integrated shutdown manager in main.go for:
- HTTP server shutdown
- JobWorker cancellation
- Config.Close() (DB, Redis, RabbitMQ)
- Logger sync
- Sentry flush
- Added comprehensive unit tests for shutdown manager
- Prevents registration of new services during shutdown
Phase: PHASE-6
Priority: P2
Progress: 113/267 (42.32%)
- Enhanced HealthCheck struct with Details field for additional metrics
- Added detailed database pool statistics (open connections, in use, idle, wait counts)
- Added health checks for S3 storage service (if enabled)
- Added health checks for Job Worker with job queue statistics
- Added health checks for Email Sender (SMTP configuration)
- Updated HealthHandler to accept additional services
- Updated router to pass S3, JobWorker, and EmailSender to health handler
Phase: PHASE-6
Priority: P2
Progress: 112/267 (41.95%)
- Added HTTP writer for centralized log collection (Loki-compatible)
- Created AggregationConfig with batch processing and flush intervals
- Integrated with existing zap logger using multi-core approach
- Added environment variables for configuration (LOG_AGGREGATION_ENABLED, LOG_AGGREGATION_ENDPOINT, etc.)
- Added unit tests for aggregation functionality
- Updated config.go to initialize logger with aggregation if enabled
Phase: PHASE-6
Priority: P2
Progress: 111/267 (41.57%)
