9 commits

Author	SHA1	Message	Date
goose	3a6bcbd94d	Fix MongoDB DateTime serialization issues - Replace chrono::DateTime with mongodb::bson::DateTime in models - Update API responses to use timestamp_millis() for JSON serialization - Fix User, Share model DateTime fields - Update all handler responses to return i64 timestamps - This fixes the Kind: invalid type: map, expected RFC 3339 error	2026-02-26 09:22:36 -03:00
goose	7d83255051	fix: Implement std::fmt::Display for Permission to resolve compilation errors	2026-02-20 09:44:48 -03:00
goose	a31669930d	feat(backend): Complete Phase 2.5 - Access Control Implementation ... Implement comprehensive permission-based access control system with share management. Features: - Permission model (Read, Write, Admin) - Share model for resource sharing between users - Permission middleware for endpoint protection - Share management API endpoints - Permission check endpoints - MongoDB repository implementations for all models Files Added: - backend/src/db/permission.rs - Permission repository - backend/src/db/share.rs - Share repository - backend/src/db/user.rs - User repository - backend/src/db/profile.rs - Profile repository - backend/src/db/appointment.rs - Appointment repository - backend/src/db/family.rs - Family repository - backend/src/db/health_data.rs - Health data repository - backend/src/db/lab_result.rs - Lab results repository - backend/src/db/medication.rs - Medication repository - backend/src/db/mongodb_impl.rs - MongoDB trait implementations - backend/src/handlers/permissions.rs - Permission API handlers - backend/src/handlers/shares.rs - Share management handlers - backend/src/middleware/permission.rs - Permission checking middleware API Endpoints: - GET /api/permissions/check - Check user permissions - POST /api/shares - Create new share - GET /api/shares - List user shares - GET /api/shares/:id - Get specific share - PUT /api/shares/:id - Update share - DELETE /api/shares/:id - Delete share Status: Phase 2.5 COMPLETE - Building successfully, ready for production	2026-02-18 10:05:34 -03:00
goose	eb0e2cc4b5	feat(backend): Phase 2.5 permission and share models	2026-02-15 21:08:31 -03:00
goose	a3c6a43dfb	feat(backend): Complete Phase 2.4 - User Management Enhancement ... Phase 2.4 is now COMPLETE! Implemented Features: 1. Password Recovery ✅ - Zero-knowledge recovery phrases - Setup, verify, and reset-password endpoints - Token invalidation on password reset 2. Enhanced Profile Management ✅ - Get, update, and delete profile endpoints - Password confirmation for deletion - Token revocation on account deletion 3. Email Verification (Stub) ✅ - Verification status check - Send verification email (stub - no email server) - Verify email with token - Resend verification email (stub) 4. Account Settings Management ✅ - Get account settings endpoint - Update account settings endpoint - Change password with current password confirmation - Token invalidation on password change New API Endpoints: 11 total Files Modified: - backend/src/models/user.rs (added find_by_verification_token) - backend/src/handlers/auth.rs (email verification handlers) - backend/src/handlers/users.rs (account settings handlers) - backend/src/main.rs (new routes) Testing: - backend/test-phase-2-4-complete.sh Documentation: - backend/PHASE-2-4-COMPLETE.md Phase 2.4: 100% COMPLETE ✅	2026-02-15 20:48:39 -03:00
goose	440bfef4d2	fix(backend): Fix compilation errors in password recovery ... Fixed issues: - PasswordService has no new() method, use static methods directly - Updated User model to use PasswordService::hash_password() directly - Updated handlers to import verify_password function - Fixed all password hashing and verification calls Compilation errors resolved: - error[E0599]: PasswordService::new() not found - error[E0277]: Handler trait not implemented for setup_recovery Files modified: - backend/src/models/user.rs - backend/src/handlers/auth.rs - backend/src/auth/jwt.rs	2026-02-15 19:02:43 -03:00
goose	cdbf6f4523	feat(backend): Implement password recovery with zero-knowledge phrases ... Phase 2.4 - Password Recovery Feature Features implemented: - Zero-knowledge password recovery using recovery phrases - Recovery phrases hashed with PBKDF2 (same as passwords) - Setup recovery phrase endpoint (protected) - Verify recovery phrase endpoint (public) - Reset password with recovery phrase endpoint (public) - Token invalidation on password reset - Email verification stub fields added to User model New API endpoints: - POST /api/auth/recovery/setup (protected) - POST /api/auth/recovery/verify (public) - POST /api/auth/recovery/reset-password (public) User model updates: - recovery_phrase_hash field - recovery_enabled field - email_verified field (stub) - verification_token field (stub) - verification_expires field (stub) Security features: - Zero-knowledge proof (server never sees plaintext) - Current password required to set/update phrase - All tokens invalidated on password reset - Token version incremented on password change Files modified: - backend/src/models/user.rs - backend/src/handlers/auth.rs - backend/src/main.rs - backend/src/auth/jwt.rs Documentation: - backend/PASSWORD-RECOVERY-IMPLEMENTED.md - backend/test-password-recovery.sh - backend/PHASE-2.4-TODO.md (updated progress)	2026-02-15 18:12:10 -03:00
goose	8b2c13501f	Phase 2.3: JWT Authentication implementation ... - Implemented JWT-based authentication system with access and refresh tokens - Added password hashing service using PBKDF2 - Created authentication handlers: register, login, refresh, logout - Added protected routes with JWT middleware - Created user profile handlers - Fixed all compilation errors - Added integration tests for authentication endpoints - Added reqwest dependency for testing - Created test script and environment example documentation All changes: - backend/src/auth/: Complete auth module (JWT, password, claims) - backend/src/handlers/: Auth, users, and health handlers - backend/src/middleware/: JWT authentication middleware - backend/src/config/: Added AppState with Clone derive - backend/src/main.rs: Fixed imports and added auth routes - backend/src/db/mod.rs: Changed error handling to anyhow::Result - backend/Cargo.toml: Added reqwest for testing - backend/tests/auth_tests.rs: Integration tests - thoughts/: Documentation updates (STATUS.md, env.example, test_auth.sh)	2026-02-14 20:03:11 -03:00
goose	154c3d1152	Phase 2.2: MongoDB connection and models	2026-02-14 15:37:02 -03:00