Commit Graph

12 Commits

Author SHA1 Message Date
juanatsap f3842a3486 fix: connect EmailService to contact form handler
The contact form was logging submissions but never actually sending emails.
This commit:
- Adds EmailService field to CVHandler
- Initializes EmailService in main.go with SMTP config
- Calls SendContactForm in HandleContact handler
- Updates all test files to pass nil for emailService parameter
2025-12-02 14:27:03 +00:00
juanatsap 58c1237326 feat: Add secure contact form with comprehensive security features
- Add contact form dialog with HTMX integration (hx-post)
- Implement browser-only access middleware (blocks curl/Postman/wget)
- Add rate limiting (5 requests/hour per IP) for contact endpoint
- Implement honeypot and timing-based bot detection
- Add input validation (email format, message length 10-5000 chars)
- Create contact button in desktop and mobile navigation (last position)

Security features:
- Browser-only middleware validates User-Agent, Referer/Origin, HX-Request headers
- Honeypot field returns fake success to fool bots while logging spam
- Timing validation rejects forms submitted < 2 seconds
- All security events logged for monitoring

Documentation:
- docs/SECURITY.md - Comprehensive security documentation
- docs/HACK-CHALLENGE.md - "Try to Hack Me!" challenge for security researchers
- docs/SECURITY-AUDIT-REPORT.md - Full security audit report
- docs/CONTACT-FORM-QUICKSTART.md - Integration guide

Form fields: email (required), name, company, subject, message (required)
2025-11-30 14:31:58 +00:00
juanatsap f91a24ea9b feat: Add plain text CV endpoint and contact form with security
Plain text endpoint:
- Add /text route for plain text CV (for curl/AI crawlers)
- Use k3a/html2text library for HTML-to-text conversion
- Add Plain Text button to hamburger menu with UI translations

Contact form feature:
- Add ContactHandler with proper email service integration
- Add CSRF protection middleware
- Add rate limiting (5 submissions/hour per IP)
- Add honeypot and timing-based bot protection
- Add input validation with detailed error messages
- Add security logging middleware
- Add browser-only middleware for API protection

Code quality:
- Fix all golangci-lint errcheck warnings for w.Write calls
- Remove duplicate getClientIP functions
- Wire up ContactHandler in routes.Setup
2025-11-30 13:47:49 +00:00
juanatsap 29a00f432b improve: Enhance UI appearance and startup logs
UI improvements:
- Remove CV page borders for cleaner look in both themes
- Soften light theme shadow (0.06 opacity, 24px blur)
- Set light theme border color to white for seamless appearance

Server improvements:
- Add descriptive icons to startup logs (📂 🇬🇧 🇪🇸 ⚙️ 📦 📋 🌐 ⏹️)
- Improve visual clarity of server initialization sequence
2025-11-20 16:52:30 +00:00
juanatsap 211fd05462 feat: simplify architecture by removing cache layer and centralizing routes
- Removed over-engineered cache system for static CV data that only changes on deployment
- Extracted all route configuration to internal/routes/routes.go for better organization
- Implemented rate limiting and cache control middleware for PDF endpoint protection
2025-11-12 17:53:24 +00:00
juanatsap d9b909bd7e fix: restore rate limiting and fix language switch links
Security:
- Restore PDF endpoint rate limiting (3 requests/minute)
- Keep security headers middleware (CSP, HSTS, X-Frame-Options)
- Keep origin checker for PDF endpoint
- Restore recovery and logger middleware

Links:
- Fix 'CV in [language]' links to use relative URLs (/?lang=)
- Now correctly navigates to page instead of downloading
- PDF download links remain as full URLs for direct download

Simplifications:
- Remove unused advanced middleware (not yet implemented)
- Use simpler 2-parameter rate limiter constructor
- Remove unused strconv import
2025-11-12 09:51:38 +00:00
juanatsap 6eee66e3e2 refactor: simplify middleware chain and update documentation
- Remove unused rate limiting and security validation middleware
- Rename improvement summary to aspirational goals
- Add current project status documentation
2025-11-12 09:42:46 +00:00
juanatsap 92dffe8c60 feat: add comprehensive testing infrastructure and security hardening
- Enhanced CI/CD pipeline with coverage reporting, benchmarks, and artifact uploads
- Implemented rate limiter IP validation with proxy support and spoofing protection
- Added extensive Makefile test targets for coverage, benchmarks, and continuous testing
- Expanded middleware chain with request validation, size limits, and suspicious activity logging
2025-11-11 21:43:12 +00:00
juanatsap 1f5aeb1c4c feat: exclude PSD files from version control 2025-11-11 13:53:14 +00:00
juanatsap 24b2401519 feat: add origin validation and rate limiting for PDF endpoint
- Implemented origin checker middleware to prevent external sites from hotlinking the PDF generation endpoint
- Added rate limiter (3 requests per minute per IP) to protect resource-intensive PDF operations
- Configured allowed origins via ALLOWED_ORIGINS environment variable with localhost defaults for development
2025-11-09 14:00:10 +00:00
juanatsap 2c372eee49 feat: add social links to footer and optional company logo toggle
**Social Links in Footer (Page 2):**
- Replace address/phone with LinkedIn, GitHub, and Behance links
- Maintain email@ link
- All links are clickable and open in new tabs
- Footer displays social media profiles prominently

**Company Logo Toggle Feature:**
- Add "Show logos" toggle switch in top action bar
- Toggle displays company logos (48x48px) to the left of each experience item
- LinkedIn-style layout when logos are shown
- Logos hidden by default, optional display via toggle
- Graceful fallback: missing logos don't break layout (onerror handler)
- Logos directory created at static/images/logos/ with README

**Technical Implementation:**
- New CSS file: logo-toggle.css for toggle switch and logo layout
- JavaScript: toggleLogos() function for show/hide functionality
- Template updates: experience items now support flex layout with logos
- Action bar grid updated to accommodate 4 columns
- Logo display uses CSS class `.show-logos` on `.cv-paper`
- Print CSS: logos hidden in PDF exports by default

**User Experience:**
- Clean toggle switch UI with smooth animations
- Mobile responsive design
- Accessibility: proper ARIA labels for toggle
- Optional feature that doesn't clutter default view
- Professional LinkedIn-style appearance when enabled

Logos can be added to static/images/logos/ directory using filenames
from the companyLogo field in CV JSON data.
2025-11-05 12:15:43 +00:00
juanatsap dab68f34f2 Initial commit: Go + HTMX CV Site
- Minimal, professional CV design with paper-on-gray layout
- Bilingual support (Spanish/English) with HTMX language switching
- JSON-based content management (cv-en.json, cv-es.json)
- Print-optimized CSS for PDF export
- Responsive design for all devices
- Go backend with stdlib net/http
- Clean, maintainable codebase

Features:
- 18+ years professional experience
- SAP CDC expertise
- Complete project history
- Education, certifications, awards
- Multi-language support

Tech stack: Go, HTMX, vanilla CSS
2025-10-20 08:54:21 +01:00