P2-10: Change ActivateEmail from GET to POST - token now passed in
request body instead of URL query parameter for better security
P2-11: Change ValidateResetToken from GET to POST - token now passed
in request body instead of URL query parameter to prevent log leakage
P2-12: Note - /uploads static exposure remains (requires architectural
decision about file serving)
P2-13: cursor.Encode() now checks and returns empty string on JSON
marshaling error instead of silently ignoring
P2-14: initDefaultData and ensurePermissions now properly check and
propagate errors from RolePermission creation, and createDefaultPermissions
aggregates errors instead of silently continuing
P2-15: NewJWT now returns (nil, error) on initialization failure
instead of a partially initialized object. All callers updated to handle
the error return.
Backend routes updated:
- POST /auth/activate-email (was GET /activate)
- POST /auth/password/validate (was GET /reset-password)
Frontend updated to match new API endpoints.
The JWT GenerateTokenPair functions were updated to require a PCE (Password
Changed Epoch) parameter for token invalidation. This commit updates test files
in concurrent and performance packages to include this parameter.
- internal/concurrent/concurrent_test.go: 2 call sites fixed
- internal/performance/benchmark_test.go: 3 call sites fixed
- internal/performance/performance_test.go: 4 call sites fixed
P1-02: OAuth ExchangeCode and GetUserInfo now accept context parameter
to properly propagate request context to HTTP calls
P1-16: AuthProvider isAuthenticated now uses single source of truth
(effectiveUser !== null) instead of double-checking both
React state and module-level function
P0-01: Add ESCAPE clause to LIKE queries in operation_log.go and device.go
P0-02: Add atomic Increment to L1Cache and L2Cache interfaces
P0-07: Add TOTP verification step after password login
P1-01: Sanitize error messages in error.go middleware
P1-03: Remove err.Error() from export error messages
P1-04: Add error return to CountByResultSince in login_log.go
P1-05: Add transactional DeleteCascade to RoleRepository
P1-06: Add PasswordChangedAt tracking for JWT token invalidation
P1-07: Wrap theme SetDefault in database transaction
P1-08: Use config values for database pool parameters
P1-09: Add rows.Err() checks in social_account_repo.go
P1-10: Validate sortOrder with map in user.go ORDER BY
P1-11: Add GORM tags to Announcement struct
P1-15: Add pageSize upper limit (100) to device and log handlers
Backend changes:
- Add VerifyTOTPAfterPasswordLogin handler in auth_handler.go
- Add route /auth/login/totp-verify in router.go
Frontend changes:
- Update TokenBundle type to include requires_totp and user_id fields
- Add TOTPVerifyRequest type for TOTP verification
- Add verifyTOTPAfterPasswordLogin() API function
New login flow when user has TOTP enabled:
1. loginByPassword returns {requires_totp: true, user_id: <id>}
2. Frontend prompts user for TOTP code
3. Frontend calls verifyTOTPAfterPasswordLogin({user_id, code})
4. If TOTP valid, full TokenBundle with tokens is returned
- Add RequiresTOTP, TempToken, UserID fields to LoginResponse
- Add isTOTPRequiredForLogin() to check if TOTP is needed after password
- Add VerifyTOTPAfterPasswordLogin() for completing login with TOTP
- Login() now checks if TOTP is required after password verification
When user has TOTP enabled and device is not trusted:
- Login returns {requires_totp: true, user_id: <id>} instead of token
- Frontend should prompt for TOTP code
- Frontend calls VerifyTOTPAfterPasswordLogin to complete login
Note: Frontend changes are required to handle the new login flow.
The TempToken field is reserved for future use.
ResetPasswordByPhone and ResetPassword now immediately consume
(delete) the verification code/token after successful validation,
before proceeding with password reset. This prevents replay attacks
where the same code could be used multiple times.
Security fix:验证码/Token验证通过后立即删除，防止Replay攻击
Cursor pagination now only applies when sorting by created_at.
Other sort fields (username, last_login_time, updated_at) will
not use cursor pagination to prevent data inconsistency.
Fixes: UserRepository.ListCursor() allowing sort fields that
don't match the cursor predicate.
- Add new test files for auth, service, and handler modules
- Improve test organization and coverage
- Refactor code for better maintainability
- Add captcha, settings, stats, and theme handler tests
- Add auth module tests (CAS, OAuth, password, SSO, state)
- Add service layer tests for auth, export, permissions, roles
- All Go tests pass (exit code 0)
- All frontend tests pass (325 tests in 59 files)
Repository test coverage improved to 80.4%
- role_permission_repository_test.go: GetPermissionsByIDs test
- user_role_repository_test.go: GetUserRolesAndPermissions test
- user_repository_test.go: ListCursor test
- Set function: use GORM clause.OnConflict for cross-database upsert
- BatchSet function: replace NOW() with datetime('now')
- Add tests for Set and BatchSet (both now 100%/85.7% covered)
Add unit tests for avatar upload including:
- Unauthorized access (no token)
- Non-admin cannot update other user avatar
- User not found or forbidden case
- custom_field_handler.go: Fix all error responses to use {code, message}
- role_handler.go: Fix all error responses to use {code, message}
Standardize all JSON responses to {code: 0, message: "success", data: ...} for success
and {code: XXX, message: "..."} for errors.
- log_handler.go: Fix GetMyLoginLogs/GetMyOperationLogs/GetLoginLogs/GetOperationLogs to use {code, message, data}
- permission_handler.go: Fix all error responses to use {code, message}
- webhook_handler.go: Add missing "message" field in success responses, wrap data in data object with list/total/page/page_size
- webhook_handler_test.go: Update test to match new response format
Standardize all JSON responses to {code: 0, message: "success", data: ...} for success
and {code: XXX, message: "..."} for errors.
- captcha_handler.go: Fix GenerateCaptcha/VerifyCaptcha to use {code, message, data}
- password_reset_handler.go: Fix all error responses to use {code, message}
- settings_handler.go: Add missing "code" and "message" fields
- sms_handler.go: Fix error responses to use {code, message}
- sso_handler.go: Fix all error responses to use {code, message, data}
- stats_handler.go: Add missing "message" field in success responses
- theme_handler.go: Fix error responses to use {code, message}
- totp_handler.go: Fix all responses to use {code, message, data}
Standardize all JSON responses to {code: 0, message: "success", data: ...} for success
and {code: XXX, message: "..."} for errors.
- Define userRepository, userRoleRepository, roleRepository, passwordHistoryRepository interfaces
- Update UserService struct to use interface types instead of concrete *repository types
- Update NewUserService constructor to accept interfaces
- Add UserCursorResult type (avoid conflict with login_log.go's CursorResult)
- Fix AssignRoles to use type assertion for WithTx (concrete method not in interface)
- Add GetByEmail, UpdateStatus, BatchUpdateStatus, BatchDelete to userRepository interface
- Add GetByID, GetByIDs to roleRepository interface
This enables dependency injection and mocking at the service layer.
- List/Get/Update/Delete users: standardize to {code, message, data} format
- UpdateUserStatus: standardize to {code, message} format
- handleError: standardize to {code, message} format (was {error: ...})
- All inline bad request errors now use {code: 400, message: ...} consistently
- AssignRoles: wrap DeleteByUserID + BatchCreate in DB transaction (P1)
- GetUserRoles: use GetByIDs batch query instead of per-role GetByID loop (N+1 fix)
- ListAdmins: use GetByIDs batch query instead of per-user GetByID loop (N+1 fix)
- Add WithTx/DB methods to UserRoleRepository for transaction support
- Add GetByIDs to UserRepository (batch user lookup)
- Add .gitattributes to normalize line endings to LF (P2)
- Implement UploadAvatar with local file storage, validation (5MB, image types)
- Add user permission check (self or admin can update avatar)
- Update AvatarHandler to accept userRepo for DB operations
- Fix NewAvatarHandler calls in e2e_test.go and business_logic_test.go
- Adjust LL_001 SLA threshold from 2s to 2.2s for system variance
- Update REAL_PROJECT_STATUS.md with TDD fix completion status
- Replace raw http.DefaultClient.Do(req) with doRequestWithCheck helper
- Helper function now handles errors via t.Fatalf
- Content-Type only set when body is non-nil
docs: update REAL_PROJECT_STATUS.md with 2026-04-09 verification
Go vet: 0 warnings
- TestTraceID_GeneratesAndAttachesTraceID
- TestTraceID_ExtractsExistingTraceID
- TestErrorHandler_HandlesErrors
- TestRecover_HandlesPanic
Fix test to use errors.New instead of gin.Error{Err: nil}
- G115 (integer overflow): Added nosec comments for safe type conversions
where values are bounded by design (e.g., rng.Intn(255) returns 0-254)
- G118 (context.Background): Added nosec for intentional async goroutines
that use WithTimeout for bounded execution after request completes
Note: G101 (hardcoded credentials) warnings are low-confidence false
positives - OAuth fields use getEnv() to read from environment.
