refactor: simplify architecture and harden lifecycle

Remove obsolete implementations, centralize background task ownership and terminal-state recovery, consolidate frontend routing and log streaming, and enforce project-wide verification in CI.

server/internal/security/jwt.go

@@ -1,60 +0,0 @@
-//go:build ignore
-
-package security
-
-import (
-	"fmt"
-	"time"
-
-	"backupx/server/internal/model"
-	"github.com/golang-jwt/jwt/v5"
-)
-
-type Claims struct {
-	UserID   uint   `json:"userId"`
-	Username string `json:"username"`
-	Role     string `json:"role"`
-	jwt.RegisteredClaims
-}
-
-type JWTManager struct {
-	secret   []byte
-	duration time.Duration
-}
-
-func NewJWTManager(secret string, duration time.Duration) *JWTManager {
-	return &JWTManager{secret: []byte(secret), duration: duration}
-}
-
-func (m *JWTManager) IssueToken(user *model.User) (string, error) {
-	now := time.Now().UTC()
-	claims := Claims{
-		UserID:   user.ID,
-		Username: user.Username,
-		Role:     user.Role,
-		RegisteredClaims: jwt.RegisteredClaims{
-			Subject:   fmt.Sprintf("%d", user.ID),
-			IssuedAt:  jwt.NewNumericDate(now),
-			ExpiresAt: jwt.NewNumericDate(now.Add(m.duration)),
-		},
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	return token.SignedString(m.secret)
-}
-
-func (m *JWTManager) Parse(tokenValue string) (*Claims, error) {
-	token, err := jwt.ParseWithClaims(tokenValue, &Claims{}, func(token *jwt.Token) (any, error) {
-		if token.Method != jwt.SigningMethodHS256 {
-			return nil, fmt.Errorf("unexpected signing method")
-		}
-		return m.secret, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	claims, ok := token.Claims.(*Claims)
-	if !ok || !token.Valid {
-		return nil, fmt.Errorf("invalid token")
-	}
-	return claims, nil
-}

server/internal/security/jwt_test.go

@@ -1,25 +0,0 @@
-//go:build ignore
-
-package security
-
-import (
-	"testing"
-	"time"
-
-	"backupx/server/internal/model"
-)
-
-func TestJWTManagerIssueAndParse(t *testing.T) {
-	manager := NewJWTManager("test-secret", time.Hour)
-	token, err := manager.IssueToken(&model.User{ID: 7, Username: "admin", Role: "admin"})
-	if err != nil {
-		t.Fatalf("IssueToken() error = %v", err)
-	}
-	claims, err := manager.Parse(token)
-	if err != nil {
-		t.Fatalf("Parse() error = %v", err)
-	}
-	if claims.UserID != 7 || claims.Username != "admin" {
-		t.Fatalf("unexpected claims: %+v", claims)
-	}
-}

server/internal/security/limiter.go

@@ -1,54 +0,0 @@
-//go:build ignore
-
-package security
-
-import (
-	"sync"
-	"time"
-)
-
-type limiterEntry struct {
-	Count   int
-	ResetAt time.Time
-}
-
-type LoginLimiter struct {
-	mu      sync.Mutex
-	window  time.Duration
-	max     int
-	records map[string]limiterEntry
-}
-
-func NewLoginLimiter(max int, window time.Duration) *LoginLimiter {
-	return &LoginLimiter{window: window, max: max, records: make(map[string]limiterEntry)}
-}
-
-func (l *LoginLimiter) Allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	entry, ok := l.records[key]
-	if !ok || time.Now().After(entry.ResetAt) {
-		delete(l.records, key)
-		return true
-	}
-	return entry.Count < l.max
-}
-
-func (l *LoginLimiter) RegisterFailure(key string) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	now := time.Now()
-	entry, ok := l.records[key]
-	if !ok || now.After(entry.ResetAt) {
-		l.records[key] = limiterEntry{Count: 1, ResetAt: now.Add(l.window)}
-		return
-	}
-	entry.Count++
-	l.records[key] = entry
-}
-
-func (l *LoginLimiter) Reset(key string) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	delete(l.records, key)
-}

server/internal/security/secret_store.go

@@ -1,93 +0,0 @@
-//go:build ignore
-
-package security
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"backupx/server/internal/config"
-)
-
-type PersistedSecrets struct {
-	JWTSecret     string `json:"jwtSecret"`
-	EncryptionKey string `json:"encryptionKey"`
-}
-
-func EnsureSecrets(cfg *config.Config) error {
-	if cfg.Security.JWTSecret != "" && cfg.Security.EncryptionKey != "" {
-		return nil
-	}
-
-	storePath := filepath.Join(filepath.Dir(cfg.Database.Path), "backupx.secrets.json")
-	current, err := loadSecrets(storePath)
-	if err != nil {
-		return err
-	}
-	if current == nil {
-		current = &PersistedSecrets{}
-	}
-	if current.JWTSecret == "" {
-		current.JWTSecret, err = randomHex(32)
-		if err != nil {
-			return err
-		}
-	}
-	if current.EncryptionKey == "" {
-		current.EncryptionKey, err = randomHex(32)
-		if err != nil {
-			return err
-		}
-	}
-	if err := saveSecrets(storePath, current); err != nil {
-		return err
-	}
-	if cfg.Security.JWTSecret == "" {
-		cfg.Security.JWTSecret = current.JWTSecret
-	}
-	if cfg.Security.EncryptionKey == "" {
-		cfg.Security.EncryptionKey = current.EncryptionKey
-	}
-	return nil
-}
-
-func loadSecrets(path string) (*PersistedSecrets, error) {
-	content, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("read secrets: %w", err)
-	}
-	var secrets PersistedSecrets
-	if err := json.Unmarshal(content, &secrets); err != nil {
-		return nil, fmt.Errorf("decode secrets: %w", err)
-	}
-	return &secrets, nil
-}
-
-func saveSecrets(path string, secrets *PersistedSecrets) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
-		return fmt.Errorf("create secrets dir: %w", err)
-	}
-	content, err := json.MarshalIndent(secrets, "", "  ")
-	if err != nil {
-		return fmt.Errorf("encode secrets: %w", err)
-	}
-	if err := os.WriteFile(path, content, 0o600); err != nil {
-		return fmt.Errorf("write secrets: %w", err)
-	}
-	return nil
-}
-
-func randomHex(size int) (string, error) {
-	bytes := make([]byte, size)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", fmt.Errorf("generate random secret: %w", err)
-	}
-	return hex.EncodeToString(bytes), nil
-}