- Remove Domains field from UserResponse struct
- Login and Me endpoints no longer return domains
- Domains should be fetched separately from /api/domains
- Move GenerateRandomPassword to auth package for reuse
- Make password optional in user creation (generates 16-char if empty)
- Return generated password in response for user to copy
- Add Generate/Copy UI with show/hide toggle
- Remove GORM dependency, use sqlc for type-safe SQL queries
- Update all handlers to use sqlc patterns (context, value types)
- Fix N+1 query problem in domain listing with JOIN query
- Enable SQL query logging in debug mode (USE_EMBEDDED=false)
- Add comprehensive comments for non-Go developers
Authentication now works only via hashed passwords in imc_users table.
Users must be created through the password reset flow or directly in the database.
- Migrate all pages to daisyUI components
- Add data-theme="light" to app.html for proper theme
- Fix config to load .env from multiple locations
- Update avatar to use avatar-placeholder pattern
- Use @tailwindcss/vite plugin instead of PostCSS
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup
Updated .env.example with TRUSTED_PROXIES setting
- Add mail.GetQuota() using doveadm quota get
- Fix UserWithQuota response struct
- Fix frontend NaN display with Unknown fallback
- Update field names to camelCase (usedQuota)
- Remove dots from character class (handled separately)
- Check username doesn't start/end with dot
- Check for no consecutive dots (..)
- Valid chars: a-zA-Z0-9!#$%&'*+-/=?^_`{|}~-
- Validate domain name format: letters, numbers, dots, hyphens only
- Must have at least one dot (TLD required)
- Cannot start/end with dot or hyphen
- Label length 1-63 characters
- Return ValidationError with descriptive message
- Added gin-gonic v1.10.0 dependency
- Refactored router.go: clean route groups with middleware chains
- Refactored all handlers to use gin.Context instead of http.ResponseWriter/*http.Request
- Simplified response helpers (JSON, Error, Success, Created, NoContent)
- Clean auth middleware using Gin's c.Set() for context
- Cleaner route definitions with path parameters (e.g., /domains/:name/users/:id)
- Admin routes moved to /api/admin group with RequireAdmin middleware
- Comments explain what each function does and why
- Fixed unused strconv import in queue.go
- Better documentation for SMTP email service
- Explained journalctl log parsing in logs.go
- Clarified queue operations in queue.go
- Add --setup flag to create admin user
- Add --admin-user and --admin-password for setup
- Generate cryptographically random passwords for --setup
- Add --bind and --port flags for server binding
- Add BIND env var support
- Add SMTP email service for password reset
- Add password reset token storage
- Add auth header to queue/logs frontend pages
- Fix journalctl timestamp format
- Fix logs to return empty array instead of error when no entries
- Fix queue handler to return proper error message
- Hide Users/Aliases nav links when no domain selected