- Enhance `test-auth.sh` with SQL injection, XSS, and credential validation tests.
- Extend `test-roles-permissions.sh` to include unauthorized access and duplicate role creation tests.
- Improve `test-users.sh` with checks for invalid emails, duplicate users, and unauthorized actions.
- Introduce `test-security.sh` for thorough security assessments including CSRF, SQL injection, XSS, rate limiting, and session management.
- Add `.serena.gitignore` and `.serena/project.yml` for project configuration and file management.
- Implemented tests for Events and Testimonials endpoints in `test-cms.sh`
- Added common functions and variables for API testing in `test-common.sh`
- Created tests for Mentor endpoints in `test-mentors.sh`
- Developed tests for Gacha endpoints in `test-gacha.sh`
- Established tests for Hackathon endpoints in `test-hackathon.sh`
- Implemented tests for Authentication endpoints in `test-auth.sh`
- Added tests for Roles and Permissions endpoints in `test-roles-permissions.sh`
- Created tests for Teams endpoints in `test-teams.sh`
- Developed tests for User Management endpoints in `test-users.sh`
- Updated HackathonTimelineCreateRequestDto to accept optional title and name fields.
- Added custom validators for HackathonPhase and date checks in hackathon_dto.rs.
- Implemented admin-sensitive data management DTOs for handling user scores and personal info.
- Introduced new admin routes for managing users, roles, and permissions in IAM module.
- Added timeline enforcement middleware to restrict access based on hackathon phases.
- Created tests for timeline enforcement and admin permissions to ensure proper access control.
- Implemented payment middleware as a placeholder for future payment processing logic.
- Enhanced audit logging middleware for improved error handling and logging.
- Added audit logging middleware to track admin actions and save logs to SurrealDB.
- Introduced rate limiting middleware for public endpoints and authentication endpoints.
- Enhanced security headers middleware with nonce generation for CSP in development.
- Created utility functions for extracting real client IP addresses from headers.
- Updated Cargo.toml and Cargo.lock to include new dependencies.
- Added new schemas for audit logs and rate limiting in the entities module.
- Refactored permissions middleware to support new permission checks.
- Updated HackathonSubmissionsSchema to use Option types for team_id, project_name, description, technologies, submission_status, and submitted_at.
- Modified seed_hackathons and seed_test_submission scripts to accommodate new optional fields.
- Added routes for participant registration and listing in hackathon_controller.
- Implemented register_participant and list_participants functions in hackathon_controller.
- Introduced HackathonParticipantSchema and corresponding DTOs for participant management.
- Enhanced HackathonRepository with CRUD operations for hackathon participants.
- Updated HackathonService to include methods for participant registration and listing.
- Refactored TeamsService to allow admin-level updates and invitations, bypassing leader-only restrictions.
- Added validation for member emails in TeamsCreateRequestDto and TeamInviteRequestDto.
- Introduced a new test module for hackathon-related functionality.
- Implemented a basic test for creating a hackathon using a mock repository.
- Enhanced the test utilities in `lib.rs` for better request handling and response extraction.
- Added a `ServiceClient` struct to facilitate HTTP requests in tests.
- Created a `RequestBuilder` to streamline building and sending requests with headers and JSON bodies.
- Updated event controller to specify public and admin access levels in response descriptions.
- Modified testimonials controller to indicate public access for list and detail responses.
- Enhanced mentors controller with admin access labels for various responses.
- Adjusted gacha claims and items controllers to reflect admin access in response descriptions.
- Updated hackathon controller to clarify public and admin access levels in response messages.
- Revised authentication controller to specify public access for login and registration responses.
- Enhanced admin teams controller with admin access labels for team-related responses.
- Updated users controller to clarify admin and user access levels in response descriptions.
- Added assertions to check for non-empty fields in TokenDto, UsersSchema, PermissionsSchema, and RolesDetailItemDto.
- Ensured that all necessary fields are validated in team-related DTOs, including TeamsCreateResponseDto and TeamsDetailResponseDto.
- Improved checks for user details in UsersDetailItemDto and UsersListItemDto to ensure data integrity.
- Verified that sensitive fields are present in admin team responses and member details.
- Updated tests to ensure that created and updated timestamps are present and valid across various entities.
- Updated gacha claims service tests to parse and verify error JSON content for various scenarios.
- Improved gacha credits controller tests by adding checks for success messages in JSON responses.
- Enhanced gacha items service tests to validate response data structure and content.
- Modified IAM auth controller and service tests to ensure token data integrity and presence of required fields.
- Refined permissions controller and service tests to assert response data correctness.
- Improved roles controller and service tests to validate response data and ensure non-empty fields.
- Enhanced teams controller tests to verify sensitive data exposure and required fields in responses.
- Updated users controller and service tests to ensure response data integrity and presence of required fields.
- Introduced a new common module with response helper functions to streamline response parsing across tests.
- Updated role controller tests to assert success messages in responses for create, update, and delete operations.
- Enhanced role service tests to validate response structures and ensure proper error handling.
- Modified team controller and service tests to check for success messages and validate response data formats.
- Improved user controller and service tests to include success message assertions and error handling for invalid inputs.
- Ensured all tests utilize the new response parsing functions for consistency and maintainability.
- Implemented tests for creating, retrieving, updating, and deleting hackathons.
- Added validation tests for hackathon creation and updates.
- Included tests for hackathon events and timelines, ensuring proper handling of edge cases.
- Created tests for hackathon submissions, including validation and submission status updates.
- Organized tests into a dedicated module for better structure and maintainability.
- Updated all references from `enviroment` to `environment` across the codebase.
- Removed the old `enviroment` module and replaced it with a new `environment` module that includes centralized configuration management.
- Enhanced OTP generation to include secure hashing and expiration handling.
- Improved CSRF token generation and validation with better error handling.
- Cleaned up logging statements in various modules for clarity and consistency.
- Updated response formatting to include versioning from Cargo.toml.
- Removed unused mock test module from utils.
- Updated `lib.rs` to selectively expose specific entities and services for better clarity.
- Improved SurrealDB client initialization with detailed logging in `surrealdb/mod.rs`.
- Enhanced resource definitions in `resource.rs` with additional utility methods for better resource management.
- Refactored user data retrieval logic in `auth_middleware/mod.rs` for improved readability and efficiency.
- Cleaned up middleware exports in `lib.rs` for clearer API surface.
- Added detailed comments and documentation throughout the SurrealDB module for better maintainability.
- Updated tests to ensure compatibility with new changes and improved structure.
- Introduced new permissions module structure in `imphnen-utils` for future enhancements.
- Updated permissions_repository.rs to import PermissionsItemDto from imphnen_entities.
- Modified permissions_schema.rs to import PermissionsItemDto and PermissionsQueryDto from imphnen_entities.
- Changed roles_dto.rs to import PermissionsItemDto and PermissionsQueryDto from imphnen_entities.
- Updated users_dto.rs to import ExperienceDto, EducationDto, UsersDetailQueryDto, RolesDetailQueryDto, and RolesDetailItemDto from imphnen_entities, and removed redundant struct definitions.
- Refactored users_repository.rs to import UsersDetailQueryDto from imphnen_entities.
- Updated users_schema.rs to import UsersDetailQueryDto, ExperienceDto, and EducationDto from imphnen_entities.
- Modified users_service.rs to use UsersDetailQueryDto from imphnen_entities and added UserLookupService implementation.
- Updated Cargo.toml in imphnen-libs to include async-trait as a workspace dependency.
- Refactored axum module to remove redundant imports and streamline code.
- Updated lib.rs to include AppState struct with user_lookup_service and auth_repository fields.
- Refactored surrealdb module to define SurrealWsClient and SurrealMemClient types.
- Removed imphnen-iam dependency from middleware's Cargo.toml.
- Updated auth_middleware to use UsersDetailQueryDto from imphnen_entities and refactored user retrieval logic.
- Refactored permissions_middleware to use PermissionsEnum from imphnen_entities and updated user retrieval logic.
- Updated mock_test.rs to create AppState with user_lookup_service and auth_repository.
- Added permissions.rs and users.rs to imphnen_entities with necessary DTOs and enums.
- Created services.rs in imphnen-libs to define UserLookupService and AuthRepositoryTrait traits.
- Implement tests for GachaCreditsService including creation, retrieval, updating, and deletion of gacha credits.
- Add tests for AuthController covering user login, registration, email verification, and error handling for invalid credentials.
- Enhance AuthService tests to include login, registration, email verification, OTP resend, password reset, and token refresh functionalities.
- Create tests for UsersService to validate user creation, retrieval, updating, deletion, and fetching by email.
- Ensure all tests utilize a consistent setup and teardown process for database interactions.
- Implemented unit tests for PermissionsController and PermissionsService, covering create, read, update, and delete operations.
- Added tests for RolesController and RolesService, including handling of duplicates and retrieval by ID.
- Developed tests for TeamsController, including creation, retrieval, updating, deletion, and search functionality.
- Created tests for UsersController, ensuring user creation and validation of attributes.
- Each test includes setup, execution, and cleanup to maintain database integrity.
- Implement tests for team creation, retrieval, updating, and deletion in TeamsRepository.
- Add tests for team member management including adding and removing members.
- Create tests for team invitations and searching teams.
- Ensure proper cleanup of test data after each test case.
- Validate unauthorized operations for team management.
- Updated various dependencies in Cargo.toml to their latest versions for improved performance and security.
- Refactored the Google OAuth service to streamline the creation of the OAuth client and improve code readability.
- Changed the way WebSocket messages are sent in clear_db_test.rs to use `into()` for better type handling.
- Enhanced error handling and logging in the Google OAuth callback method.
- Added Default trait to UsersDetailItemDto for easier instantiation.
- Refactored UsersServiceTrait to use Pin<Box<dyn Future<...>> for async functions, improving compatibility with async/await.
- Updated all service methods to return futures instead of using async_trait.
- Improved error handling and logging in upload_file method, ensuring proper handling of multipart data.
- Masked sensitive information in Env struct's Debug implementation for better security in logs.
- Cleaned up Cargo.toml by removing unnecessary async-trait workspace dependency.
feat: Define unique index on users table for email and fix minor syntax error
refactor: Update permissions_guard to use claims from JWT and improve user retrieval
refactor: Modify user-related service methods to accept user details directly
fix: Update token generation functions to include user ID and permissions
test: Update Google OAuth flow tests to reflect changes in token generation
- Added new dependencies for HMAC, hex, and urlencoding in Cargo.toml.
- Introduced FileUploadSchema for handling multipart file uploads.
- Enhanced UsersService with upload_file method to handle file uploads to MinIO.
- Implemented MinioService for managing MinIO interactions, including file uploads and presigned URL generation.
- Updated environment configuration to include MinIO region and secure settings.
- Added validation for file types and sizes during upload.
- Improved error handling and logging for file upload processes.
- Created utility functions for base64 decoding and content type extraction.
- Updated `async-channel` to version 2.5.0 and added new dependencies in `Cargo.lock`.
- Introduced `minio` crate for file upload functionality.
- Added `career_status` field to user-related DTOs and schemas.
- Implemented file upload endpoint in `users_controller.rs` with multipart support.
- Created `MinioService` for handling file uploads to MinIO.
- Updated user seeding and test cases to accommodate new `career_status` field.
- Refactored permissions guard to return user details.
- Updated `seed_mentor_user.rs` to include additional fields in the `app_users` creation and removed redundant fields from `app_mentors`.
- Modified `seed_users.rs` to initialize new user fields including legal name, domicile, and professional links.
- Adjusted `mentors_dto.rs` to remove personal data fields from `MentorDetailWithUserDto` and `MentorDetailResponseDto`, now sourced from `UsersSchema`.
- Updated `mentors_repository.rs` to search for user data through `user_id` instead of mentor fields.
- Refined `mentors_schema.rs` to remove personal data fields, now managed in `UsersSchema`.
- Enhanced `mentors_service.rs` to populate mentor responses with user data from `UsersSchema`.
- Removed identity document URL and related fields from various DTOs and schemas across the codebase.
- Updated tests to reflect the removal of identity document URL and ensure compatibility with the new schema structure.
feat(auth): Add error handling for authentication and validation errors
feat(auth): Implement default role assignment for new users in Google OAuth flow
feat(utils): Introduce CSRF token generation and validation utilities
fix(dependencies): Update Cargo.toml to include base64 and sha2 dependencies
- Added Google OAuth controller and service to handle authentication via Google.
- Introduced DTOs for Google user and token responses.
- Updated AuthService and UsersService traits to support new Google OAuth functionality.
- Implemented logic to create a new user if they do not exist in the system after Google authentication.
- Enhanced existing user retrieval and JWT generation upon successful login.
- Added tests for Google OAuth flow, including login redirection and callback handling for both new and existing users.
- Updated environment configuration to include Google OAuth credentials.
MythEclipse