add step list for server creation

local/middleware/access_key.go

@@ -10,12 +10,10 @@ import (
 	"github.com/google/uuid"
 )
 
-// AccessKeyMiddleware provides authentication and permission middleware.
 type AccessKeyMiddleware struct {
 	userInfo CachedUserInfo
 }
 
-// NewAccessKeyMiddleware creates a new AccessKeyMiddleware.
 func NewAccessKeyMiddleware() *AccessKeyMiddleware {
 	auth := &AccessKeyMiddleware{
 		userInfo: CachedUserInfo{UserID: uuid.New().String(), Username: "access_key", RoleName: "Admin", Permissions: map[string]bool{
@@ -25,9 +23,7 @@ func NewAccessKeyMiddleware() *AccessKeyMiddleware {
 	return auth
 }
 
-// Authenticate is a middleware for JWT authentication with enhanced security.
 func (m *AccessKeyMiddleware) Authenticate(ctx *fiber.Ctx) error {
-	// Log authentication attempt
 	ip := ctx.IP()
 	userAgent := ctx.Get("User-Agent")
 

local/middleware/auth.go

@@ -16,7 +16,6 @@ import (
 	"github.com/google/uuid"
 )
 
-// CachedUserInfo holds cached user authentication and permission data
 type CachedUserInfo struct {
 	UserID      string
 	Username    string
@@ -25,7 +24,6 @@ type CachedUserInfo struct {
 	CachedAt    time.Time
 }
 
-// AuthMiddleware provides authentication and permission middleware.
 type AuthMiddleware struct {
 	membershipService *service.MembershipService
 	cache             *cache.InMemoryCache
@@ -34,7 +32,6 @@ type AuthMiddleware struct {
 	openJWTHandler    *jwt.OpenJWTHandler
 }
 
-// NewAuthMiddleware creates a new AuthMiddleware.
 func NewAuthMiddleware(ms *service.MembershipService, cache *cache.InMemoryCache, jwtHandler *jwt.JWTHandler, openJWTHandler *jwt.OpenJWTHandler) *AuthMiddleware {
 	auth := &AuthMiddleware{
 		membershipService: ms,
@@ -44,24 +41,20 @@ func NewAuthMiddleware(ms *service.MembershipService, cache *cache.InMemoryCache
 		openJWTHandler:    openJWTHandler,
 	}
 
-	// Set up bidirectional relationship for cache invalidation
 	ms.SetCacheInvalidator(auth)
 
 	return auth
 }
 
-// Authenticate is a middleware for JWT authentication with enhanced security.
 func (m *AuthMiddleware) AuthenticateOpen(ctx *fiber.Ctx) error {
 	return m.AuthenticateWithHandler(m.openJWTHandler.JWTHandler, true, ctx)
 }
 
-// Authenticate is a middleware for JWT authentication with enhanced security.
 func (m *AuthMiddleware) Authenticate(ctx *fiber.Ctx) error {
 	return m.AuthenticateWithHandler(m.jwtHandler, false, ctx)
 }
 
 func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isOpenToken bool, ctx *fiber.Ctx) error {
-	// Log authentication attempt
 	ip := ctx.IP()
 	userAgent := ctx.Get("User-Agent")
 
@@ -89,7 +82,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		})
 	}
 
-	// Validate token length to prevent potential attacks
 	token := parts[1]
 	if len(token) < 10 || len(token) > 2048 {
 		logging.Error("Authentication failed: invalid token length from IP %s", ip)
@@ -113,7 +105,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		})
 	}
 
-	// Additional security: validate user ID format
 	if claims.UserID == "" || len(claims.UserID) < 10 {
 		logging.Error("Authentication failed: invalid user ID in token from IP %s", ip)
 		return ctx.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
@@ -127,7 +118,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		ctx.Locals("userInfo", userInfo)
 		ctx.Locals("authTime", time.Now())
 	} else {
-		// Preload and cache user info to avoid database queries on permission checks
 		userInfo, err := m.getCachedUserInfo(ctx.UserContext(), claims.UserID)
 		if err != nil {
 			logging.Error("Authentication failed: unable to load user info for %s from IP %s: %v", claims.UserID, ip, err)
@@ -145,7 +135,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 	return ctx.Next()
 }
 
-// HasPermission is a middleware for checking user permissions with enhanced logging.
 func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		userID, ok := ctx.Locals("userID").(string)
@@ -160,7 +149,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			return ctx.Next()
 		}
 
-		// Validate permission parameter
 		if requiredPermission == "" {
 			logging.Error("Permission check failed: empty permission requirement")
 			return ctx.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
@@ -168,7 +156,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			})
 		}
 
-		// Use cached user info from authentication step - no database queries needed
 		userInfo, ok := ctx.Locals("userInfo").(*CachedUserInfo)
 		if !ok {
 			logging.Error("Permission check failed: no cached user info in context from IP %s", ctx.IP())
@@ -177,7 +164,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			})
 		}
 
-		// Check if user has permission using cached data
 		has := m.hasPermissionFromCache(userInfo, requiredPermission)
 
 		if !has {
@@ -192,16 +178,13 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 	}
 }
 
-// AuthRateLimit applies rate limiting specifically for authentication endpoints
 func (m *AuthMiddleware) AuthRateLimit() fiber.Handler {
 	return m.securityMW.AuthRateLimit()
 }
 
-// RequireHTTPS redirects HTTP requests to HTTPS in production
 func (m *AuthMiddleware) RequireHTTPS() fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		if ctx.Protocol() != "https" && ctx.Get("X-Forwarded-Proto") != "https" {
-			// Allow HTTP in development/testing
 			if ctx.Hostname() != "localhost" && ctx.Hostname() != "127.0.0.1" {
 				httpsURL := "https://" + ctx.Hostname() + ctx.OriginalURL()
 				return ctx.Redirect(httpsURL, fiber.StatusMovedPermanently)
@@ -211,11 +194,9 @@ func (m *AuthMiddleware) RequireHTTPS() fiber.Handler {
 	}
 }
 
-// getCachedUserInfo retrieves and caches complete user information including permissions
 func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (*CachedUserInfo, error) {
 	cacheKey := fmt.Sprintf("userinfo:%s", userID)
 
-	// Try cache first
 	if cached, found := m.cache.Get(cacheKey); found {
 		if userInfo, ok := cached.(*CachedUserInfo); ok {
 			logging.DebugWithContext("AUTH_CACHE", "User info for %s found in cache", userID)
@@ -223,13 +204,11 @@ func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (
 		}
 	}
 
-	// Cache miss - load from database
 	user, err := m.membershipService.GetUserWithPermissions(ctx, userID)
 	if err != nil {
 		return nil, err
 	}
 
-	// Build permission map for fast lookups
 	permissions := make(map[string]bool)
 	for _, p := range user.Role.Permissions {
 		permissions[p.Name] = true
@@ -243,34 +222,26 @@ func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (
 		CachedAt:    time.Now(),
 	}
 
-	// Cache for 15 minutes
 	m.cache.Set(cacheKey, userInfo, 15*time.Minute)
 	logging.DebugWithContext("AUTH_CACHE", "User info for %s cached with %d permissions", userID, len(permissions))
 
 	return userInfo, nil
 }
 
-// hasPermissionFromCache checks permissions using cached user info (no database queries)
 func (m *AuthMiddleware) hasPermissionFromCache(userInfo *CachedUserInfo, permission string) bool {
-	// Super Admin and Admin have all permissions
 	if userInfo.RoleName == "Super Admin" || userInfo.RoleName == "Admin" {
 		return true
 	}
 
-	// Check specific permission in cached map
 	return userInfo.Permissions[permission]
 }
 
-// InvalidateUserPermissions removes cached user info for a user
 func (m *AuthMiddleware) InvalidateUserPermissions(userID string) {
 	cacheKey := fmt.Sprintf("userinfo:%s", userID)
 	m.cache.Delete(cacheKey)
 	logging.InfoWithContext("AUTH_CACHE", "User info cache invalidated for user %s", userID)
 }
 
-// InvalidateAllUserPermissions clears all cached user info (useful for role/permission changes)
 func (m *AuthMiddleware) InvalidateAllUserPermissions() {
-	// This would need to be implemented based on your cache interface
-	// For now, just log that invalidation was requested
 	logging.InfoWithContext("AUTH_CACHE", "All user info caches invalidation requested")
 }

local/middleware/logging/request_logging.go

@@ -7,25 +7,20 @@ import (
 	"github.com/gofiber/fiber/v2"
 )
 
-// RequestLoggingMiddleware logs HTTP requests and responses
 type RequestLoggingMiddleware struct {
 	infoLogger *logging.InfoLogger
 }
 
-// NewRequestLoggingMiddleware creates a new request logging middleware
 func NewRequestLoggingMiddleware() *RequestLoggingMiddleware {
 	return &RequestLoggingMiddleware{
 		infoLogger: logging.GetInfoLogger(),
 	}
 }
 
-// Handler returns the middleware handler function
 func (rlm *RequestLoggingMiddleware) Handler() fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		// Record start time
 		start := time.Now()
 
-		// Log incoming request
 		userAgent := c.Get("User-Agent")
 		if userAgent == "" {
 			userAgent = "Unknown"
@@ -33,17 +28,13 @@ func (rlm *RequestLoggingMiddleware) Handler() fiber.Handler {
 
 		rlm.infoLogger.LogRequest(c.Method(), c.OriginalURL(), userAgent)
 
-		// Continue to next handler
 		err := c.Next()
 
-		// Calculate duration
 		duration := time.Since(start)
 
-		// Log response
 		statusCode := c.Response().StatusCode()
 		rlm.infoLogger.LogResponse(c.Method(), c.OriginalURL(), statusCode, duration.String())
 
-		// Log error if present
 		if err != nil {
 			logging.ErrorWithContext("REQUEST_MIDDLEWARE", "Request failed: %v", err)
 		}
@@ -52,10 +43,8 @@ func (rlm *RequestLoggingMiddleware) Handler() fiber.Handler {
 	}
 }
 
-// Global request logging middleware instance
 var globalRequestLoggingMiddleware *RequestLoggingMiddleware
 
-// GetRequestLoggingMiddleware returns the global request logging middleware
 func GetRequestLoggingMiddleware() *RequestLoggingMiddleware {
 	if globalRequestLoggingMiddleware == nil {
 		globalRequestLoggingMiddleware = NewRequestLoggingMiddleware()
@@ -63,7 +52,6 @@ func GetRequestLoggingMiddleware() *RequestLoggingMiddleware {
 	return globalRequestLoggingMiddleware
 }
 
-// Handler returns the global request logging middleware handler
 func Handler() fiber.Handler {
 	return GetRequestLoggingMiddleware().Handler()
 }

local/middleware/security/security.go

@@ -11,19 +11,16 @@ import (
 	"github.com/gofiber/fiber/v2"
 )
 
-// RateLimiter stores rate limiting information
 type RateLimiter struct {
 	requests map[string][]time.Time
 	mutex    sync.RWMutex
 }
 
-// NewRateLimiter creates a new rate limiter
 func NewRateLimiter() *RateLimiter {
 	rl := &RateLimiter{
 		requests: make(map[string][]time.Time),
 	}
 
-	// Use graceful shutdown for cleanup goroutine
 	shutdownManager := graceful.GetManager()
 	shutdownManager.RunGoroutine(func(ctx context.Context) {
 		rl.cleanupWithContext(ctx)
@@ -32,7 +29,6 @@ func NewRateLimiter() *RateLimiter {
 	return rl
 }
 
-// cleanup removes old entries from the rate limiter
 func (rl *RateLimiter) cleanupWithContext(ctx context.Context) {
 	ticker := time.NewTicker(5 * time.Minute)
 	defer ticker.Stop()
@@ -62,44 +58,29 @@ func (rl *RateLimiter) cleanupWithContext(ctx context.Context) {
 	}
 }
 
-// SecurityMiddleware provides comprehensive security middleware
 type SecurityMiddleware struct {
 	rateLimiter *RateLimiter
 }
 
-// NewSecurityMiddleware creates a new security middleware
 func NewSecurityMiddleware() *SecurityMiddleware {
 	return &SecurityMiddleware{
 		rateLimiter: NewRateLimiter(),
 	}
 }
 
-// SecurityHeaders adds security headers to responses
 func (sm *SecurityMiddleware) SecurityHeaders() fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		// Prevent MIME type sniffing
 		c.Set("X-Content-Type-Options", "nosniff")
-
-		// Prevent clickjacking
 		c.Set("X-Frame-Options", "DENY")
-
-		// Enable XSS protection
 		c.Set("X-XSS-Protection", "1; mode=block")
-
-		// Prevent referrer leakage
 		c.Set("Referrer-Policy", "strict-origin-when-cross-origin")
-
-		// Content Security Policy
 		c.Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'")
-
-		// Permissions Policy
 		c.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()")
 
 		return c.Next()
 	}
 }
 
-// RateLimit implements rate limiting for API endpoints
 func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ip := c.IP()
@@ -111,7 +92,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 		now := time.Now()
 		requests := sm.rateLimiter.requests[key]
 
-		// Remove requests older than duration
 		filtered := make([]time.Time, 0, len(requests))
 		for _, t := range requests {
 			if now.Sub(t) < duration {
@@ -119,7 +99,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 			}
 		}
 
-		// Check if limit is exceeded
 		if len(filtered) >= maxRequests {
 			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
 				"error":       "Rate limit exceeded",
@@ -127,7 +106,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 			})
 		}
 
-		// Add current request
 		filtered = append(filtered, now)
 		sm.rateLimiter.requests[key] = filtered
 
@@ -135,7 +113,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 	}
 }
 
-// AuthRateLimit implements stricter rate limiting for authentication endpoints
 func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ip := c.IP()
@@ -148,7 +125,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 		now := time.Now()
 		requests := sm.rateLimiter.requests[key]
 
-		// Remove requests older than 15 minutes
 		filtered := make([]time.Time, 0, len(requests))
 		for _, t := range requests {
 			if now.Sub(t) < 15*time.Minute {
@@ -156,7 +132,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 			}
 		}
 
-		// Check if limit is exceeded (5 requests per 15 minutes for auth)
 		if len(filtered) >= 5 {
 			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
 				"error":       "Too many authentication attempts",
@@ -164,7 +139,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 			})
 		}
 
-		// Add current request
 		filtered = append(filtered, now)
 		sm.rateLimiter.requests[key] = filtered
 
@@ -172,20 +146,16 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 	}
 }
 
-// InputSanitization sanitizes user input to prevent XSS and injection attacks
 func (sm *SecurityMiddleware) InputSanitization() fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		// Sanitize query parameters
 		c.Request().URI().QueryArgs().VisitAll(func(key, value []byte) {
 			sanitized := sanitizeInput(string(value))
 			c.Request().URI().QueryArgs().Set(string(key), sanitized)
 		})
 
-		// Store original body for processing
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
 			body := c.Body()
 			if len(body) > 0 {
-				// Basic sanitization - remove potentially dangerous patterns
 				sanitized := sanitizeInput(string(body))
 				c.Request().SetBodyString(sanitized)
 			}
@@ -195,7 +165,6 @@ func (sm *SecurityMiddleware) InputSanitization() fiber.Handler {
 	}
 }
 
-// sanitizeInput removes potentially dangerous patterns from input
 func sanitizeInput(input string) string {
 	dangerous := []string{
 		"<script",
@@ -236,7 +205,7 @@ func sanitizeInput(input string) string {
 
 	result := input
 	lowerInput := strings.ToLower(input)
-	
+
 	for _, pattern := range dangerous {
 		if strings.Contains(lowerInput, pattern) {
 			return ""
@@ -254,7 +223,6 @@ func sanitizeInput(input string) string {
 	return result
 }
 
-// ValidateContentType ensures only expected content types are accepted
 func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
@@ -265,7 +233,6 @@ func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.
 				})
 			}
 
-			// Check if content type is allowed
 			allowed := false
 			for _, allowedType := range allowedTypes {
 				if strings.Contains(contentType, allowedType) {
@@ -285,7 +252,6 @@ func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.
 	}
 }
 
-// ValidateUserAgent blocks requests with suspicious or missing user agents
 func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 	suspiciousAgents := []string{
 		"sqlmap",
@@ -296,21 +262,19 @@ func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 		"dirb",
 		"dirbuster",
 		"wpscan",
-		"curl/7.0", // Very old curl versions
-		"wget/1.0", // Very old wget versions
+		"curl/7.0",
+		"wget/1.0",
 	}
 
 	return func(c *fiber.Ctx) error {
 		userAgent := strings.ToLower(c.Get("User-Agent"))
 
-		// Block empty user agents
 		if userAgent == "" {
 			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
 				"error": "User-Agent header is required",
 			})
 		}
 
-		// Block suspicious user agents
 		for _, suspicious := range suspiciousAgents {
 			if strings.Contains(userAgent, suspicious) {
 				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
@@ -323,7 +287,6 @@ func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 	}
 }
 
-// RequestSizeLimit limits the size of incoming requests
 func (sm *SecurityMiddleware) RequestSizeLimit(maxSize int) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
@@ -340,19 +303,15 @@ func (sm *SecurityMiddleware) RequestSizeLimit(maxSize int) fiber.Handler {
 	}
 }
 
-// LogSecurityEvents logs security-related events
 func (sm *SecurityMiddleware) LogSecurityEvents() fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		start := time.Now()
 
-		// Process request
 		err := c.Next()
 
-		// Log suspicious activity
 		status := c.Response().StatusCode()
 		if status == 401 || status == 403 || status == 429 {
 			duration := time.Since(start)
-			// In a real implementation, you would send this to your logging system
 			fmt.Printf("[SECURITY] %s %s %s %d %v %s\n",
 				time.Now().Format(time.RFC3339),
 				c.IP(),
@@ -367,7 +326,6 @@ func (sm *SecurityMiddleware) LogSecurityEvents() fiber.Handler {
 	}
 }
 
-// TimeoutMiddleware adds request timeout
 func (sm *SecurityMiddleware) TimeoutMiddleware(timeout time.Duration) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ctx, cancel := context.WithTimeout(c.UserContext(), timeout)