admin/honeyDueAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Close all 25 codex audit findings and add KMP contract tests

Browse Source 
Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Trey t
2026-02-18 13:15:07 -06:00
parent 215e7c895d
commit bb7493f033
23 changed files with 6549 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
internal/handlers/task_handler.go
View File

@@ -1,7 +1,6 @@
package handlers
import (
"mime/multipart"
"net/http"
"strconv"
"strings"
@@ -75,7 +74,12 @@ func (h *TaskHandler) GetTasksByResidence(c echo.Context) error {
}
daysThreshold := 30
if d := c.QueryParam("days_threshold"); d != "" {
// Support "days" param first, fall back to "days_threshold" for backward compatibility
if d := c.QueryParam("days"); d != "" {
if parsed, err := strconv.Atoi(d); err == nil {
daysThreshold = parsed
}
} else if d := c.QueryParam("days_threshold"); d != "" {
if parsed, err := strconv.Atoi(d); err == nil {
daysThreshold = parsed
}
@@ -331,23 +335,17 @@ func (h *TaskHandler) CreateCompletion(c echo.Context) error {
}
}
// Handle image upload (look for "images" or "image" or "photo" field)
var imageFile interface{}
for _, fieldName := range []string{"images", "image", "photo"} {
if file, err := c.FormFile(fieldName); err == nil {
imageFile = file
break
}
}
if imageFile != nil {
file := imageFile.(*multipart.FileHeader)
if h.storageService != nil {
result, err := h.storageService.Upload(file, "completions")
if err != nil {
return apperrors.BadRequest("error.failed_to_upload_image")
// Handle multiple image uploads from various field names
if h.storageService != nil && c.Request().MultipartForm != nil {
for _, fieldName := range []string{"images", "image", "photo", "files"} {
files := c.Request().MultipartForm.File[fieldName]
for _, file := range files {
result, err := h.storageService.Upload(file, "completions")
if err != nil {
return apperrors.BadRequest("error.failed_to_upload_image")
}
req.ImageURLs = append(req.ImageURLs, result.URL)
}
req.ImageURLs = append(req.ImageURLs, result.URL)
}
}
} else {
@@ -364,6 +362,26 @@ func (h *TaskHandler) CreateCompletion(c echo.Context) error {
return c.JSON(http.StatusCreated, response)
}
// UpdateCompletion handles PUT /api/task-completions/:id/
func (h *TaskHandler) UpdateCompletion(c echo.Context) error {
user := c.Get(middleware.AuthUserKey).(*models.User)
completionID, err := strconv.ParseUint(c.Param("id"), 10, 32)
if err != nil {
return apperrors.BadRequest("error.invalid_completion_id")
}
var req requests.UpdateTaskCompletionRequest
if err := c.Bind(&req); err != nil {
return apperrors.BadRequest("error.invalid_request")
}
response, err := h.taskService.UpdateCompletion(uint(completionID), user.ID, &req)
if err != nil {
return err
}
return c.JSON(http.StatusOK, response)
}
// DeleteCompletion handles DELETE /api/task-completions/:id/
func (h *TaskHandler) DeleteCompletion(c echo.Context) error {
user := c.Get(middleware.AuthUserKey).(*models.User)