fixup! fixes

.github/workflows/release.yaml

@@ -20,15 +20,10 @@ permissions:
 
 jobs:
   release:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-release-cgo.yaml@main
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
     with:
       go-version: "1.25"
-      # Enable frontend build
-      node-enabled: true
-      node-version: "20"
-      node-build-script: "cd frontend && npm install -g pnpm && pnpm install --frozen-lockfile && pnpm run build"
-      node-output-path: "frontend/dist"
-      node-cache-dependency-path: "frontend/pnpm-lock.yaml"
+      docker-enabled: true
     secrets: inherit
 
   benchmark:

.gitignore

@@ -79,4 +79,3 @@ tests/fixtures/temp/
 test-go-proxy
 frontend/node_modules
 data/storage
-*.pid

.goreleaser.yaml

@@ -7,91 +7,30 @@ project_name: gohoarder
 before:
   hooks:
     - go mod tidy
-    # Download and setup Zig for cross-compilation (Linux only)
-    - bash -c 'if [ "$(uname -s)" = "Linux" ]; then wget https://ziglang.org/download/0.15.2/zig-x86_64-linux-0.15.2.tar.xz -O /tmp/zig.tar.xz && ls -lh /tmp/zig.tar.xz && tar -xvf /tmp/zig.tar.xz -C /tmp && echo "/tmp/zig-x86_64-linux-0.15.2" >> $GITHUB_PATH; fi'
+    # Generate semantic version if not provided via git tag
+    # This script can be used by CI/CD to inject custom versions
+    # Usage: export GORELEASER_CURRENT_TAG=$(./script/generate-version.sh)
+    # - ./script/generate-version.sh
 
 # Build configuration
-# All binaries built using Zig for consistent cross-compilation
-# Zig handles CGO cross-compilation without platform-specific toolchains
-# Binaries are injected into Docker images (no Docker compilation)
 builds:
   - id: gohoarder
     main: ./cmd/gohoarder
     binary: gohoarder
     env:
-      - CGO_ENABLED=1
-    tags:
-      - fts5
-    flags:
-      - -trimpath
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
     ldflags:
       - -s -w
       - -X github.com/lukaszraczylo/gohoarder/internal/version.Version={{.Version}}
       - -X github.com/lukaszraczylo/gohoarder/internal/version.GitCommit={{.ShortCommit}}
       - -X github.com/lukaszraczylo/gohoarder/internal/version.BuildTime={{.Date}}
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    ignore:
-      - goos: darwin
-        goarch: amd64
-    overrides:
-      # Use Zig only for Linux cross-compilation
-      - goos: linux
-        goarch: amd64
-        env:
-          - CGO_ENABLED=1
-          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target x86_64-linux-musl
-          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target x86_64-linux-musl
-      - goos: linux
-        goarch: arm64
-        env:
-          - CGO_ENABLED=1
-          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target aarch64-linux-musl
-          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target aarch64-linux-musl
-      # darwin/arm64 builds natively on macOS runner (no Zig)
-
-  - id: migrate
-    main: ./cmd/migrate
-    binary: migrate
-    env:
-      - CGO_ENABLED=1
-    tags:
-      - fts5
-    flags:
-      - -trimpath
-    ldflags:
-      - -s -w
-      - -X main.Version={{.Version}}
-      - -X main.GitCommit={{.ShortCommit}}
-      - -X main.BuildTime={{.Date}}
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    ignore:
-      - goos: darwin
-        goarch: amd64
-    overrides:
-      # Use Zig only for Linux cross-compilation
-      - goos: linux
-        goarch: amd64
-        env:
-          - CGO_ENABLED=1
-          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target x86_64-linux-musl
-          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target x86_64-linux-musl
-      - goos: linux
-        goarch: arm64
-        env:
-          - CGO_ENABLED=1
-          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target aarch64-linux-musl
-          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target aarch64-linux-musl
-      # darwin/arm64 builds natively on macOS runner (no Zig)
 
 # Archives for releases
 archives:
@@ -148,13 +87,8 @@ release:
   prerelease: auto
 
 # Docker images (v2 - modern syntax)
-# Uses PRE-BUILT binaries from native builds (no Docker compilation - much faster!)
-# GoReleaser injects the platform-specific binary into each Docker image automatically
-# This avoids slow QEMU emulation for cross-architecture builds
 dockers_v2:
   # 1. Application Engine - Main GoHoarder server
-  # Uses pre-built binary from 'gohoarder' build (no Docker compilation)
-  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
   - id: gohoarder-server
     ids:
       - gohoarder
@@ -167,21 +101,21 @@ dockers_v2:
       - linux/amd64
       - linux/arm64
     dockerfile: Dockerfile.server
-    flags:
-      - "--pull"
-      - "--label=org.opencontainers.image.title=GoHoarder Server"
-      - "--label=org.opencontainers.image.description=Universal package cache proxy server"
-      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.version={{ .Version }}"
-      - "--label=org.opencontainers.image.created={{ .Date }}"
-      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    labels:
+      org.opencontainers.image.title: GoHoarder Server
+      org.opencontainers.image.description: Universal package cache proxy server
+      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
     extra_files:
       - config.yaml.example
 
   # 2. Website - Frontend Dashboard
-  # Note: Frontend is pre-built on CI runner and injected via frontend/dist
   - id: gohoarder-frontend
+    ids:
+      - gohoarder
     images:
       - ghcr.io/lukaszraczylo/gohoarder-frontend
     tags:
@@ -191,21 +125,18 @@ dockers_v2:
       - linux/amd64
       - linux/arm64
     dockerfile: Dockerfile.frontend
-    flags:
-      - "--pull"
-      - "--label=org.opencontainers.image.title=GoHoarder Frontend"
-      - "--label=org.opencontainers.image.description=GoHoarder web dashboard"
-      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.version={{ .Version }}"
-      - "--label=org.opencontainers.image.created={{ .Date }}"
-      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    labels:
+      org.opencontainers.image.title: GoHoarder Frontend
+      org.opencontainers.image.description: GoHoarder web dashboard
+      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
     extra_files:
-      - frontend/dist
+      - frontend
 
   # 3. Scanning Engine - Background scanner worker
-  # Uses pre-built binary from 'gohoarder' build (no Docker compilation)
-  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
   - id: gohoarder-scanner
     ids:
       - gohoarder
@@ -218,44 +149,38 @@ dockers_v2:
       - linux/amd64
       - linux/arm64
     dockerfile: Dockerfile.scanner
-    flags:
-      - "--pull"
-      - "--label=org.opencontainers.image.title=GoHoarder Scanner"
-      - "--label=org.opencontainers.image.description=GoHoarder vulnerability scanning engine"
-      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.version={{ .Version }}"
-      - "--label=org.opencontainers.image.created={{ .Date }}"
-      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    labels:
+      org.opencontainers.image.title: GoHoarder Scanner
+      org.opencontainers.image.description: GoHoarder vulnerability scanning engine
+      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
     extra_files:
       - config.yaml.example
 
-  # 4. Migration Engine - Database migration tool
-  # Uses pre-built binary from 'migrate' build (no Docker compilation)
-  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
-  - id: gohoarder-migrate
+  # 4. Gateway - Nginx reverse proxy for unified deployment
+  - id: gohoarder-gateway
     ids:
-      - migrate
+      - gohoarder
     images:
-      - ghcr.io/lukaszraczylo/gohoarder-migrate
+      - ghcr.io/lukaszraczylo/gohoarder-gateway
     tags:
       - "{{ .Version }}"
       - latest
     platforms:
       - linux/amd64
       - linux/arm64
-    dockerfile: Dockerfile.migrate
-    flags:
-      - "--pull"
-      - "--label=org.opencontainers.image.title=GoHoarder Migrate"
-      - "--label=org.opencontainers.image.description=Database migration tool for GoHoarder V2 schema"
-      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
-      - "--label=org.opencontainers.image.version={{ .Version }}"
-      - "--label=org.opencontainers.image.created={{ .Date }}"
-      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
-    extra_files:
-      - migrations
+    dockerfile: Dockerfile.gateway
+    labels:
+      org.opencontainers.image.title: GoHoarder Gateway
+      org.opencontainers.image.description: Nginx reverse proxy for unified GoHoarder deployment
+      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
 
 # Artifact signing with cosign
 signs:

Dockerfile.frontend

@@ -1,15 +1,28 @@
-# Website - Frontend Dashboard with integrated reverse proxy
-# Combines frontend serving and backend proxy (previously separate gateway)
-# EXPECTS: Pre-built frontend files in frontend/dist/ directory
+# Website - Frontend Dashboard
+# Build stage
+FROM node:20-alpine AS builder
 
+WORKDIR /build
+
+# Copy frontend source
+COPY frontend/package.json frontend/pnpm-lock.yaml ./
+COPY frontend/ ./
+
+# Install pnpm and dependencies
+RUN npm install -g pnpm && \
+    pnpm install --frozen-lockfile
+
+# Build the frontend
+RUN pnpm run build
+
+# Production stage
 FROM nginx:alpine
 
 # Install envsubst for runtime configuration
 RUN apk add --no-cache gettext
 
-# Copy pre-built frontend files
-# These are built on the CI runner and injected via extra_files
-COPY frontend/dist /usr/share/nginx/html
+# Copy built frontend
+COPY --from=builder /build/dist /usr/share/nginx/html
 
 # Create runtime config injection script
 RUN cat > /docker-entrypoint.d/40-inject-config.sh <<'EOF'
@@ -35,121 +48,21 @@ EOF
 
 RUN chmod +x /docker-entrypoint.d/40-inject-config.sh
 
-# Create nginx templates directory and configuration template with backend proxy support
-RUN mkdir -p /etc/nginx/templates && \
-    cat > /etc/nginx/templates/default.conf.template <<'EOF'
-# Upstream backend server
-upstream backend {
-    server ${BACKEND_HOST}:${BACKEND_PORT};
-    keepalive 32;
-}
-
-# Cache configuration
-proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:10m max_size=100m inactive=60m use_temp_path=off;
-
+# Copy nginx configuration
+RUN cat > /etc/nginx/conf.d/default.conf <<'EOF'
 server {
     listen 80;
-    server_name ${SERVER_NAME};
+    server_name _;
     root /usr/share/nginx/html;
     index index.html;
 
-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
-    # Client body size for package uploads
-    client_max_body_size 500M;
-    client_body_timeout 300s;
-
-    # Logging
-    access_log /var/log/nginx/access.log combined;
-    error_log /var/log/nginx/error.log warn;
-
     # Compression
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript;
 
-    # API endpoints - proxy to backend
-    location /api/ {
-        # Proxy settings
-        proxy_pass http://backend;
-        proxy_http_version 1.1;
-
-        # Headers
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header Connection "";
-
-        # Timeouts for long-running operations
-        proxy_connect_timeout 60s;
-        proxy_send_timeout 300s;
-        proxy_read_timeout 300s;
-
-        # Buffer settings
-        proxy_buffering on;
-        proxy_buffer_size 4k;
-        proxy_buffers 8 4k;
-        proxy_busy_buffers_size 8k;
-    }
-
-    # Health check endpoint
-    location /health {
-        proxy_pass http://backend/health;
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-        access_log off;
-    }
-
-    # Metrics endpoint
-    location /metrics {
-        proxy_pass http://backend/metrics;
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-    }
-
-    # Package download endpoints
-    location ~ ^/(npm|pypi|go)/ {
-        proxy_pass http://backend;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Connection "";
-
-        # Extended timeouts for package downloads
-        proxy_connect_timeout 60s;
-        proxy_send_timeout 600s;
-        proxy_read_timeout 600s;
-
-        # Large buffer for package downloads
-        proxy_buffering on;
-        proxy_buffer_size 128k;
-        proxy_buffers 4 256k;
-        proxy_busy_buffers_size 256k;
-    }
-
-    # WebSocket support
-    location /ws/ {
-        proxy_pass http://backend/ws/;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # WebSocket timeouts
-        proxy_connect_timeout 7d;
-        proxy_send_timeout 7d;
-        proxy_read_timeout 7d;
+    # SPA routing
+    location / {
+        try_files $uri $uri/ /index.html;
     }
 
     # Runtime configuration endpoint
@@ -159,23 +72,19 @@ server {
         add_header Expires "0";
     }
 
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
     # Cache static assets
     location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
-
-    # Frontend SPA - serve index.html for all other routes
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
 }
 EOF
 
-# Create cache directory
-RUN mkdir -p /var/cache/nginx/static && \
-    chown -R nginx:nginx /var/cache/nginx
-
 # Expose port
 EXPOSE 80
 
@@ -186,10 +95,6 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
 # Environment variables with defaults
 ENV API_BASE_URL=/api \
     APP_VERSION=unknown \
-    APP_NAME=GoHoarder \
-    BACKEND_HOST=gohoarder-server \
-    BACKEND_PORT=8080 \
-    SERVER_NAME=_
+    APP_NAME=GoHoarder
 
-# Use nginx template substitution and start nginx
-CMD ["/bin/sh", "-c", "envsubst '$$BACKEND_HOST $$BACKEND_PORT $$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
+CMD ["nginx", "-g", "daemon off;"]

Dockerfile.gateway

@@ -0,0 +1,197 @@
+# Gateway - Nginx reverse proxy for unified deployment
+# Routes traffic between frontend and backend under single vhost
+FROM nginx:alpine
+
+# Install envsubst for runtime configuration
+RUN apk add --no-cache gettext
+
+# Copy nginx configuration template
+COPY <<'EOF' /etc/nginx/templates/default.conf.template
+# Upstream servers
+upstream backend {
+    server ${BACKEND_HOST}:${BACKEND_PORT};
+    keepalive 32;
+}
+
+upstream frontend {
+    server ${FRONTEND_HOST}:${FRONTEND_PORT};
+    keepalive 32;
+}
+
+# Rate limiting zones
+limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+limit_req_zone $binary_remote_addr zone=download_limit:10m rate=5r/s;
+
+# Cache configuration
+proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:10m max_size=100m inactive=60m use_temp_path=off;
+
+server {
+    listen 80;
+    server_name ${SERVER_NAME};
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Client body size for package uploads
+    client_max_body_size 500M;
+    client_body_timeout 300s;
+
+    # Logging
+    access_log /var/log/nginx/access.log combined;
+    error_log /var/log/nginx/error.log warn;
+
+    # API endpoints - proxy to backend
+    location /api/ {
+        # Rate limiting
+        limit_req zone=api_limit burst=20 nodelay;
+
+        # Proxy settings
+        proxy_pass http://backend/;
+        proxy_http_version 1.1;
+
+        # Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+
+        # Connection reuse
+        proxy_set_header Connection "";
+
+        # Timeouts for long-running operations
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+
+        # Buffer settings
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+        proxy_busy_buffers_size 8k;
+    }
+
+    # Health check endpoint
+    location /health {
+        proxy_pass http://backend/health;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        access_log off;
+    }
+
+    # Metrics endpoint (optional - may want to restrict access)
+    location /metrics {
+        # Uncomment to restrict to internal networks
+        # allow 10.0.0.0/8;
+        # allow 172.16.0.0/12;
+        # allow 192.168.0.0/16;
+        # deny all;
+
+        proxy_pass http://backend/metrics;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+    }
+
+    # Package download endpoints with rate limiting
+    location ~ ^/(npm|pypi|go)/ {
+        limit_req zone=download_limit burst=10 nodelay;
+
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Extended timeouts for package downloads
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 600s;
+        proxy_read_timeout 600s;
+
+        # Large buffer for package downloads
+        proxy_buffering on;
+        proxy_buffer_size 128k;
+        proxy_buffers 4 256k;
+        proxy_busy_buffers_size 256k;
+    }
+
+    # Frontend - serve SPA
+    location / {
+        proxy_pass http://frontend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Cache static assets
+        proxy_cache static_cache;
+        proxy_cache_valid 200 1h;
+        proxy_cache_bypass $http_cache_control;
+        add_header X-Cache-Status $upstream_cache_status;
+    }
+
+    # WebSocket support (if needed for future features)
+    location /ws/ {
+        proxy_pass http://backend/ws/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket timeouts
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+    }
+}
+
+# HTTPS server (uncomment and configure SSL certificates)
+# server {
+#     listen 443 ssl http2;
+#     server_name ${SERVER_NAME};
+#
+#     ssl_certificate /etc/nginx/ssl/cert.pem;
+#     ssl_certificate_key /etc/nginx/ssl/key.pem;
+#
+#     # SSL configuration
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers HIGH:!aNULL:!MD5;
+#     ssl_prefer_server_ciphers on;
+#     ssl_session_cache shared:SSL:10m;
+#     ssl_session_timeout 10m;
+#
+#     # Include all location blocks from above
+#     # ... (copy from HTTP server block)
+# }
+EOF
+
+# Create cache directory
+RUN mkdir -p /var/cache/nginx/static && \
+    chown -R nginx:nginx /var/cache/nginx
+
+# Expose port
+EXPOSE 80 443
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD wget --quiet --tries=1 --spider http://localhost/health || exit 1
+
+# Environment variables with defaults
+ENV BACKEND_HOST=gohoarder-server \
+    BACKEND_PORT=8080 \
+    FRONTEND_HOST=gohoarder-frontend \
+    FRONTEND_PORT=80 \
+    SERVER_NAME=_
+
+# Use nginx with template substitution
+CMD ["/bin/sh", "-c", "envsubst '$$BACKEND_HOST $$BACKEND_PORT $$FRONTEND_HOST $$FRONTEND_PORT $$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]

Dockerfile.migrate

@@ -1,37 +0,0 @@
-# Migration Engine - Database Migration Tool
-# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
-# GoReleaser injects the platform-specific binary automatically
-
-FROM --platform=$TARGETPLATFORM alpine:latest
-
-ARG TARGETARCH
-
-# Install runtime dependencies (including CGO/SQLite dependencies)
-RUN apk add --no-cache \
-    ca-certificates \
-    postgresql-client \
-    mysql-client \
-    busybox-extras \
-    sqlite-libs \
-    musl \
-    && update-ca-certificates
-
-# Create non-root user
-RUN addgroup -g 1000 gohoarder && \
-    adduser -D -u 1000 -G gohoarder gohoarder
-
-# Copy pre-built binary from GoReleaser
-# GoReleaser will automatically inject the correct binary for the target platform
-# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
-COPY linux/${TARGETARCH}/migrate /usr/local/bin/migrate
-RUN chmod +x /usr/local/bin/migrate
-
-# Copy migration SQL files
-COPY migrations /migrations
-
-WORKDIR /app
-USER gohoarder
-
-# Run migrations
-ENTRYPOINT ["/usr/local/bin/migrate"]
-CMD ["--action=migrate"]

Dockerfile.scanner

@@ -1,12 +1,7 @@
 # Scanning Engine - Background Scanner Worker
-# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
-# GoReleaser injects the platform-specific binary automatically
+FROM alpine:latest
 
-FROM --platform=$TARGETPLATFORM alpine:latest
-
-ARG TARGETARCH
-
-# Install scanning tools and runtime dependencies (including CGO/SQLite dependencies)
+# Install scanning tools and runtime dependencies
 RUN apk add --no-cache \
     ca-certificates \
     tzdata \
@@ -14,54 +9,34 @@ RUN apk add --no-cache \
     curl \
     wget \
     bash \
-    sqlite-libs \
-    musl \
-    python3 \
-    py3-pip \
-    npm \
-    go \
     && update-ca-certificates
 
 # Install Trivy for container scanning
-RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+RUN wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | \
+    wget -O /tmp/trivy.tar.gz https://github.com/aquasecurity/trivy/releases/latest/download/trivy_$(uname -s)_$(uname -m).tar.gz && \
+    tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin && \
+    rm /tmp/trivy.tar.gz && \
+    chmod +x /usr/local/bin/trivy
 
 # Install Grype for vulnerability scanning
-RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
-
-# Install govulncheck for Go vulnerability scanning
-RUN go install golang.org/x/vuln/cmd/govulncheck@latest && \
-    mv /root/go/bin/govulncheck /usr/local/bin/
-
-# Install pip-audit for Python package vulnerability scanning
-RUN pip3 install --no-cache-dir pip-audit --break-system-packages
+RUN wget -qO - https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
 
 # Create non-root user
 RUN addgroup -g 1000 scanner && \
     adduser -D -u 1000 -G scanner scanner
 
-# Create necessary directories with proper permissions
-RUN mkdir -p /var/cache/gohoarder \
-             /var/lib/gohoarder/metadata \
-             /var/lib/trivy \
-             /tmp/gohoarder && \
-    chown -R scanner:scanner /var/cache/gohoarder \
-                              /var/lib/gohoarder \
-                              /var/lib/trivy \
-                              /tmp/gohoarder && \
-    chmod -R 750 /var/cache/gohoarder \
-                 /var/lib/gohoarder \
-                 /var/lib/trivy
+# Create necessary directories
+RUN mkdir -p /data/cache /data/scans && \
+    chown -R scanner:scanner /data
 
-# Copy pre-built binary from GoReleaser
-# GoReleaser will automatically inject the correct binary for the target platform
-# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
-COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
+# Copy binary
+COPY gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder
 
 # Copy example config
 COPY config.yaml.example /etc/gohoarder/config.yaml.example
 
-WORKDIR /var/cache/gohoarder
+WORKDIR /data
 USER scanner
 
 # Expose metrics port
@@ -77,7 +52,7 @@ ENV SCANNER_MODE=true \
     SCANNER_INTERVAL=300
 
 # Run the scanner in background mode
-# The scanner runs the same serve command but uses SCANNER_MODE env var
-# and configuration to determine its role
+# Note: You may need to add a scanner-specific command to your CLI
+# For now, this assumes the serve command can run in scanner mode
 ENTRYPOINT ["/usr/local/bin/gohoarder"]
-CMD ["serve"]
+CMD ["serve", "--scanner-only"]

Dockerfile.server

@@ -1,43 +1,28 @@
-# Application Engine - Main GoHoarder Server
-# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
-# GoReleaser injects the platform-specific binary automatically
+# Application Engine - GoHoarder Server
+FROM alpine:latest
 
-FROM --platform=$TARGETPLATFORM alpine:latest
-
-ARG TARGETARCH
-
-# Install runtime dependencies (CGO/SQLite requires these)
+# Install runtime dependencies
 RUN apk add --no-cache \
     ca-certificates \
     tzdata \
-    sqlite-libs \
-    musl \
     && update-ca-certificates
 
 # Create non-root user
 RUN addgroup -g 1000 gohoarder && \
     adduser -D -u 1000 -G gohoarder gohoarder
 
-# Create necessary directories with proper permissions
-RUN mkdir -p /var/cache/gohoarder \
-             /var/lib/gohoarder/metadata \
-             /tmp/gohoarder && \
-    chown -R gohoarder:gohoarder /var/cache/gohoarder \
-                                  /var/lib/gohoarder \
-                                  /tmp/gohoarder && \
-    chmod -R 750 /var/cache/gohoarder \
-                 /var/lib/gohoarder
+# Create necessary directories
+RUN mkdir -p /data/cache /data/metadata && \
+    chown -R gohoarder:gohoarder /data
 
-# Copy pre-built binary from GoReleaser
-# GoReleaser will automatically inject the correct binary for the target platform
-# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
-COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
+# Copy binary
+COPY gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder
 
 # Copy example config
 COPY config.yaml.example /etc/gohoarder/config.yaml.example
 
-WORKDIR /var/cache/gohoarder
+WORKDIR /data
 USER gohoarder
 
 # Expose ports

Makefile

@@ -78,24 +78,17 @@ clean: ## Clean build artifacts
 	@rm -f *.db *.db-shm *.db-wal
 	@echo "Clean complete"
 
-clean-db: ## Clean all local cache and database files (requires confirmation)
+clean-db: ## Clean all local cache and database files (from config.yaml paths)
 	@echo "WARNING: This will delete all cached packages and scan results!"
-	@echo "Paths to be cleaned:"
+	@echo "Paths from config.yaml:"
 	@echo "  - ./data/storage (package cache)"
-	@echo "  - ./data/gohoarder.db and gohoarder.db (metadata database)"
+	@echo "  - ./data/gohoarder.db (metadata database)"
 	@echo "  - /tmp/trivy (Trivy cache)"
 	@echo ""
-	@printf "Are you sure you want to continue? [y/N] " && read confirm && [ "$$confirm" = "y" ] || (echo "Cancelled." && exit 1)
+	@read -p "Are you sure you want to continue? [y/N] " confirm && [ "$$confirm" = "y" ] || exit 1
 	@echo "Cleaning database and cache..."
-	@rm -rf ./data/storage ./data
-	@rm -f gohoarder.db gohoarder.db-shm gohoarder.db-wal
-	@rm -rf /tmp/trivy
-	@echo "Database and cache cleaned successfully"
-
-clean-db-force: ## Clean all local cache and database files (no confirmation)
-	@echo "Cleaning database and cache..."
-	@rm -rf ./data/storage ./data
-	@rm -f gohoarder.db gohoarder.db-shm gohoarder.db-wal
+	@rm -rf ./data/storage
+	@rm -f ./data/gohoarder.db ./data/gohoarder.db-shm ./data/gohoarder.db-wal
 	@rm -rf /tmp/trivy
 	@echo "Database and cache cleaned successfully"
 

README.md

@@ -467,7 +467,7 @@ npm config set registry http://localhost:8080/npm
 pip config set global.index-url http://localhost:8080/pypi/simple
 
 # Install with credentials in request (pip handles auth)
-pip install --index-url http://username:password@localhost:8080/pypi/simple private-package //trufflehog:ignore
+pip install --index-url http://username:password@localhost:8080/pypi/simple private-package
 ```
 
 **AWS CodeArtifact:**
@@ -484,7 +484,7 @@ pip install --index-url http://aws:$CODEARTIFACT_AUTH_TOKEN@localhost:8080/pypi/
 
 ```bash
 # Configure pip to use GitHub Packages through GoHoarder
-pip install --index-url http://USERNAME:GITHUB_TOKEN@localhost:8080/pypi/simple your-private-package //trufflehog:ignore
+pip install --index-url http://USERNAME:GITHUB_TOKEN@localhost:8080/pypi/simple your-private-package
 ```
 
 #### Go Private Modules

cmd/migrate/main.go

@@ -1,258 +0,0 @@
-package main
-
-import (
-	"context"
-	"database/sql"
-	"flag"
-	"fmt"
-	stdlog "log"
-	"os"
-	"time"
-
-	"github.com/go-gormigrate/gormigrate/v2"
-	_ "github.com/go-sql-driver/mysql"
-	_ "github.com/lib/pq"
-	"github.com/lukaszraczylo/gohoarder/pkg/metadata/gormstore"
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"gorm.io/driver/mysql"
-	"gorm.io/driver/postgres"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
-)
-
-type MigrationConfig struct {
-	Driver   string
-	DSN      string
-	Timeout  time.Duration
-	Action   string // migrate, rollback, rollback-to, list
-	TargetID string // For rollback-to
-	LogLevel string
-}
-
-func main() {
-	cfg := MigrationConfig{}
-
-	flag.StringVar(&cfg.Driver, "driver", os.Getenv("DB_DRIVER"), "Database driver (postgres, mysql, sqlite)")
-	flag.StringVar(&cfg.DSN, "dsn", os.Getenv("DATABASE_URL"), "Database connection string")
-	flag.DurationVar(&cfg.Timeout, "timeout", 10*time.Minute, "Migration timeout")
-	flag.StringVar(&cfg.Action, "action", "migrate", "Action: migrate, rollback, rollback-to, list")
-	flag.StringVar(&cfg.TargetID, "target", "", "Target migration ID (for rollback-to)")
-	flag.StringVar(&cfg.LogLevel, "log-level", "info", "Log level: debug, info, warn, error")
-	flag.Parse()
-
-	// Setup logging
-	setupLogging(cfg.LogLevel)
-
-	log.Info().
-		Str("driver", cfg.Driver).
-		Str("action", cfg.Action).
-		Msg("Starting database migration")
-
-	if err := RunMigration(cfg); err != nil {
-		log.Fatal().Err(err).Msg("Migration failed")
-	}
-
-	log.Info().Msg("Migration completed successfully")
-}
-
-func setupLogging(level string) {
-	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
-	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stdout, TimeFormat: time.RFC3339})
-
-	switch level {
-	case "debug":
-		zerolog.SetGlobalLevel(zerolog.DebugLevel)
-	case "info":
-		zerolog.SetGlobalLevel(zerolog.InfoLevel)
-	case "warn":
-		zerolog.SetGlobalLevel(zerolog.WarnLevel)
-	case "error":
-		zerolog.SetGlobalLevel(zerolog.ErrorLevel)
-	default:
-		zerolog.SetGlobalLevel(zerolog.InfoLevel)
-	}
-}
-
-func RunMigration(cfg MigrationConfig) error {
-	// Validate config
-	if cfg.Driver == "" {
-		return fmt.Errorf("driver is required (set DB_DRIVER or --driver)")
-	}
-	if cfg.DSN == "" {
-		return fmt.Errorf("DSN is required (set DATABASE_URL or --dsn)")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), cfg.Timeout)
-	defer cancel()
-
-	// Connect to database
-	db, err := connectToDatabase(cfg.Driver, cfg.DSN)
-	if err != nil {
-		return fmt.Errorf("failed to connect to database: %w", err)
-	}
-
-	sqlDB, err := db.DB()
-	if err != nil {
-		return fmt.Errorf("failed to get sql.DB: %w", err)
-	}
-	defer sqlDB.Close()
-
-	// Wait for database to be ready
-	if err := waitForDB(ctx, sqlDB, 60*time.Second); err != nil {
-		return fmt.Errorf("database not ready: %w", err)
-	}
-
-	// Initialize gormigrate with custom options
-	opts := gormigrate.DefaultOptions
-	opts.TableName = "gohoarder_migrations"
-	m := gormigrate.New(db, opts, gormstore.GetMigrations())
-
-	log.Info().
-		Str("table", "gohoarder_migrations").
-		Msg("Migration tracking table initialized")
-
-	// Execute action
-	switch cfg.Action {
-	case "migrate":
-		return runMigrate(m)
-	case "rollback":
-		return runRollback(m)
-	case "rollback-to":
-		if cfg.TargetID == "" {
-			return fmt.Errorf("target migration ID required for rollback-to")
-		}
-		return runRollbackTo(m, cfg.TargetID)
-	case "list":
-		return listMigrations(db)
-	default:
-		return fmt.Errorf("unknown action: %s (use: migrate, rollback, rollback-to, list)", cfg.Action)
-	}
-}
-
-func connectToDatabase(driver, dsn string) (*gorm.DB, error) {
-	// Configure GORM logger using standard library log
-	gormLogger := logger.New(
-		stdlog.New(os.Stdout, "\r\n", stdlog.LstdFlags),
-		logger.Config{
-			SlowThreshold:             200 * time.Millisecond,
-			LogLevel:                  logger.Info,
-			IgnoreRecordNotFoundError: true,
-			Colorful:                  true,
-		},
-	)
-
-	var dialector gorm.Dialector
-	switch driver {
-	case "sqlite":
-		dialector = sqlite.Open(dsn)
-	case "postgres", "postgresql":
-		dialector = postgres.Open(dsn)
-	case "mysql":
-		dialector = mysql.Open(dsn)
-	default:
-		return nil, fmt.Errorf("unsupported driver: %s", driver)
-	}
-
-	db, err := gorm.Open(dialector, &gorm.Config{
-		Logger:                 gormLogger,
-		SkipDefaultTransaction: false, // Migrations should be transactional
-		PrepareStmt:            true,
-	})
-
-	if err != nil {
-		return nil, err
-	}
-
-	return db, nil
-}
-
-func waitForDB(ctx context.Context, db *sql.DB, timeout time.Duration) error {
-	deadline := time.Now().Add(timeout)
-	attempt := 0
-
-	for {
-		attempt++
-		if time.Now().After(deadline) {
-			return fmt.Errorf("timeout waiting for database after %d attempts", attempt)
-		}
-
-		if err := db.PingContext(ctx); err == nil {
-			log.Info().
-				Int("attempts", attempt).
-				Msg("Database is ready")
-			return nil
-		}
-
-		log.Debug().
-			Int("attempt", attempt).
-			Msg("Waiting for database...")
-		time.Sleep(2 * time.Second)
-	}
-}
-
-func runMigrate(m *gormigrate.Gormigrate) error {
-	log.Info().Msg("Running migrations...")
-
-	if err := m.Migrate(); err != nil {
-		return fmt.Errorf("migration failed: %w", err)
-	}
-
-	log.Info().Msg("✓ All migrations applied successfully")
-	return nil
-}
-
-func runRollback(m *gormigrate.Gormigrate) error {
-	log.Warn().Msg("Rolling back last migration...")
-
-	if err := m.RollbackLast(); err != nil {
-		return fmt.Errorf("rollback failed: %w", err)
-	}
-
-	log.Info().Msg("✓ Rollback completed")
-	return nil
-}
-
-func runRollbackTo(m *gormigrate.Gormigrate, targetID string) error {
-	log.Warn().
-		Str("target_id", targetID).
-		Msg("Rolling back to migration...")
-
-	if err := m.RollbackTo(targetID); err != nil {
-		return fmt.Errorf("rollback to %s failed: %w", targetID, err)
-	}
-
-	log.Info().
-		Str("target_id", targetID).
-		Msg("✓ Rollback completed")
-	return nil
-}
-
-func listMigrations(db *gorm.DB) error {
-	log.Info().Msg("Applied migrations:")
-
-	type Migration struct {
-		ID string
-	}
-
-	var migrations []Migration
-	if err := db.Table("gohoarder_migrations").Find(&migrations).Error; err != nil {
-		return fmt.Errorf("failed to list migrations: %w", err)
-	}
-
-	if len(migrations) == 0 {
-		log.Info().Msg("  (no migrations applied yet)")
-		return nil
-	}
-
-	for _, m := range migrations {
-		log.Info().Str("id", m.ID).Msg("  ✓")
-	}
-
-	log.Info().
-		Int("total", len(migrations)).
-		Msg("Applied migrations")
-
-	return nil
-}

config.yaml.example

@@ -40,53 +40,20 @@ storage:
     domain: ""
 
 metadata:
-  # Backend: sqlite, postgresql, mysql, mariadb, file
-  #
-  # Choose based on your deployment:
-  # - sqlite: Single instance, local storage (NOT for network filesystems like SMB/NFS!)
-  # - postgresql: Production, multiple replicas, works with any storage including SMB/NFS
-  # - mysql: Production alternative to PostgreSQL
-  # - file: Simple file-based metadata (limited features)
-  #
-  # IMPORTANT: SQLite + SMB/NFS = Database locked errors!
-  # For network storage (SMB, NFS), use PostgreSQL or MySQL.
-  backend: "sqlite"
-  connection: "file:gohoarder.db?cache=shared&mode=rwc"  # Legacy, not used with GORM
+  backend: "sqlite"  # sqlite, postgresql, file
+  connection: "file:gohoarder.db?cache=shared&mode=rwc"
 
-  # SQLite configuration (for local storage only)
-  # Use with local storage classes (local-path, hostPath, or RWX like longhorn)
-  # DO NOT use with SMB/NFS network storage!
   sqlite:
     path: "gohoarder.db"
-    wal_mode: true  # Set to false for network filesystems if you must use SQLite
+    wal_mode: true
 
-  # PostgreSQL configuration (recommended for production)
-  # Works with any storage including SMB/NFS
-  # Supports multiple replicas and high availability
   postgresql:
     host: "localhost"
     port: 5432
     database: "gohoarder"
     user: "gohoarder"
     password: ""
-    ssl_mode: "disable"  # disable, require, verify-ca, verify-full
-
-  # MySQL/MariaDB configuration (alternative to PostgreSQL)
-  # Works with any storage including SMB/NFS
-  mysql:
-    host: "localhost"
-    port: 3306
-    database: "gohoarder"
-    user: "gohoarder"
-    password: ""
-    charset: "utf8mb4"
-    parse_time: true
-
-  # GORM connection pool settings (applies to all database backends)
-  max_open_conns: 25      # Maximum number of open connections to the database
-  max_idle_conns: 5       # Maximum number of idle connections in the pool
-  conn_max_lifetime: 3600 # Maximum lifetime of a connection in seconds (1 hour)
-  log_level: "warn"       # GORM log level: silent, error, warn, info
+    ssl_mode: "disable"
 
 cache:
   default_ttl: "168h"  # 7 days

deployments/kubernetes/deployment-all-in-one.yaml

@@ -1,6 +1,5 @@
 # GoHoarder - Kubernetes Deployment (All-in-One)
 # This manifest deploys all GoHoarder services under a single ingress
-# The frontend includes integrated nginx reverse proxy to the backend
 #
 # Usage:
 # kubectl create namespace gohoarder
@@ -223,13 +222,6 @@ spec:
           value: "1.0.0"
         - name: APP_NAME
           value: GoHoarder
-        # Backend proxy configuration (frontend includes nginx reverse proxy)
-        - name: BACKEND_HOST
-          value: gohoarder-server
-        - name: BACKEND_PORT
-          value: "8080"
-        - name: SERVER_NAME
-          value: hoarder.i.raczylo.com
         livenessProbe:
           httpGet:
             path: /
@@ -333,6 +325,88 @@ spec:
         configMap:
           name: gohoarder-config
 
+---
+# Deployment - Gateway (Nginx Reverse Proxy)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gohoarder-gateway
+  namespace: gohoarder
+  labels:
+    app.kubernetes.io/name: gohoarder
+    app.kubernetes.io/component: gateway
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gohoarder
+      app.kubernetes.io/component: gateway
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gohoarder
+        app.kubernetes.io/component: gateway
+    spec:
+      containers:
+      - name: gateway
+        image: ghcr.io/lukaszraczylo/gohoarder-gateway:latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        env:
+        - name: BACKEND_HOST
+          value: gohoarder-server
+        - name: BACKEND_PORT
+          value: "8080"
+        - name: FRONTEND_HOST
+          value: gohoarder-frontend
+        - name: FRONTEND_PORT
+          value: "80"
+        - name: SERVER_NAME
+          value: hoarder.i.raczylo.com
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 5
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 256Mi
+
+---
+# Service - Gateway
+apiVersion: v1
+kind: Service
+metadata:
+  name: gohoarder-gateway
+  namespace: gohoarder
+  labels:
+    app.kubernetes.io/name: gohoarder
+    app.kubernetes.io/component: gateway
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: gohoarder
+    app.kubernetes.io/component: gateway
+
 ---
 # Ingress - Expose via domain
 apiVersion: networking.k8s.io/v1
@@ -362,7 +436,7 @@ spec:
         pathType: Prefix
         backend:
           service:
-            name: gohoarder-frontend
+            name: gohoarder-gateway
             port:
               number: 80
   # Uncomment for HTTPS/TLS
@@ -403,20 +477,20 @@ spec:
         averageUtilization: 80
 
 ---
-# HorizontalPodAutoscaler - Frontend
+# HorizontalPodAutoscaler - Gateway
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
-  name: gohoarder-frontend
+  name: gohoarder-gateway
   namespace: gohoarder
   labels:
     app.kubernetes.io/name: gohoarder
-    app.kubernetes.io/component: frontend
+    app.kubernetes.io/component: gateway
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: gohoarder-frontend
+    name: gohoarder-gateway
   minReplicas: 2
   maxReplicas: 10
   metrics:

docker-compose.example.yaml

@@ -2,7 +2,7 @@ version: '3.8'
 
 # GoHoarder - Unified Deployment Example
 # This docker-compose file demonstrates deploying all GoHoarder services
-# The frontend includes integrated reverse proxy to the backend
+# under a single domain using the gateway reverse proxy
 
 services:
   # Backend - Main application server
@@ -39,7 +39,7 @@ services:
       retries: 3
       start_period: 5s
 
-  # Frontend - Web dashboard with integrated reverse proxy
+  # Frontend - Web dashboard
   gohoarder-frontend:
     image: ghcr.io/lukaszraczylo/gohoarder-frontend:latest
     container_name: gohoarder-frontend
@@ -49,19 +49,8 @@ services:
       - API_BASE_URL=/api
       - APP_VERSION=1.0.0
       - APP_NAME=GoHoarder
-      # Backend proxy configuration (frontend includes nginx reverse proxy)
-      - BACKEND_HOST=gohoarder-server
-      - BACKEND_PORT=8080
-      - SERVER_NAME=hoarder.i.raczylo.com
-    ports:
-      # Map to host port 80 (HTTP)
-      - "80:80"
-      # Map to host port 443 (HTTPS) - uncomment if using SSL
-      # - "443:443"
     networks:
       - gohoarder-internal
-    depends_on:
-      - gohoarder-server
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/"]
       interval: 30s
@@ -93,6 +82,41 @@ services:
     # profiles:
     #   - scanner
 
+  # Gateway - Nginx reverse proxy
+  gohoarder-gateway:
+    image: ghcr.io/lukaszraczylo/gohoarder-gateway:latest
+    container_name: gohoarder-gateway
+    restart: unless-stopped
+    environment:
+      # Backend service connection
+      - BACKEND_HOST=gohoarder-server
+      - BACKEND_PORT=8080
+      # Frontend service connection
+      - FRONTEND_HOST=gohoarder-frontend
+      - FRONTEND_PORT=80
+      # Server configuration
+      - SERVER_NAME=hoarder.i.raczylo.com
+    ports:
+      # Map to host port 80 (HTTP)
+      - "80:80"
+      # Map to host port 443 (HTTPS) - uncomment if using SSL
+      # - "443:443"
+    networks:
+      - gohoarder-internal
+    depends_on:
+      - gohoarder-server
+      - gohoarder-frontend
+    # Uncomment if using custom SSL certificates
+    # volumes:
+    #   - ./ssl/cert.pem:/etc/nginx/ssl/cert.pem:ro
+    #   - ./ssl/key.pem:/etc/nginx/ssl/key.pem:ro
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 5s
+
 networks:
   gohoarder-internal:
     driver: bridge
@@ -120,7 +144,7 @@ volumes:
 # - Metrics: http://localhost/metrics
 #
 # For production:
-# - Enable HTTPS in the frontend container (add SSL certificates to nginx)
+# - Enable HTTPS in the gateway container
 # - Set up proper SSL certificates
 # - Configure firewall rules
 # - Set appropriate resource limits

frontend/gohoarder.pid

@@ -0,0 +1 @@
+12921

frontend/src/components/Dashboard.spec.ts

@@ -47,11 +47,9 @@ describe('Dashboard.vue', () => {
       registry: '',
       total_packages: 2,
       total_size: 3072,
-      max_cache_size: 10737418240,
       total_downloads: 30,
       scanned_packages: 2,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -69,11 +67,9 @@ describe('Dashboard.vue', () => {
       registry: '',
       total_packages: 100,
       total_size: 0,
-      max_cache_size: 10737418240,
       total_downloads: 0,
       scanned_packages: 0,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -89,11 +85,9 @@ describe('Dashboard.vue', () => {
       registry: '',
       total_packages: 0,
       total_size: 0,
-      max_cache_size: 10737418240,
       total_downloads: 500,
       scanned_packages: 0,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -109,11 +103,9 @@ describe('Dashboard.vue', () => {
       registry: '',
       total_packages: 0,
       total_size: 1048576, // 1 MB
-      max_cache_size: 10737418240,
       total_downloads: 0,
       scanned_packages: 0,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 

frontend/src/components/PackageList.vue

@@ -128,7 +128,6 @@
                         :counts="version.vulnerabilities.counts"
                         :total="version.vulnerabilities.total"
                         :scannedAt="version.vulnerabilities.scannedAt"
-                        :isBlocked="version.vulnerabilities.isBlocked"
                         @click="showVulnerabilityDetails(group.registry, group.name, version.version)"
                       />
                     </div>

frontend/src/components/Stats.spec.ts

@@ -43,11 +43,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 100,
       total_size: 1073741824, // 1 GB
-      max_cache_size: 10737418240,
       total_downloads: 500,
       scanned_packages: 90,
       vulnerable_packages: 5,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -65,11 +63,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 100,
       total_size: 1073741824,
-      max_cache_size: 10737418240,
       total_downloads: 500,
       scanned_packages: 90,
       vulnerable_packages: 5,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -87,11 +83,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 100,
       total_size: 1073741824,
-      max_cache_size: 10737418240,
       total_downloads: 500,
       scanned_packages: 90,
       vulnerable_packages: 5,
-      blocked_packages: 0,
     }
     store.registries = {
       npm: {
@@ -130,11 +124,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 100,
       total_size: 1073741824, // 1 GB
-      max_cache_size: 10737418240,
       total_downloads: 500,
       scanned_packages: 90,
       vulnerable_packages: 5,
-      blocked_packages: 0,
     }
     await wrapper.vm.$nextTick()
 
@@ -159,11 +151,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 3,
       total_size: 0,
-      max_cache_size: 10737418240,
       total_downloads: 0,
       scanned_packages: 0,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     store.registries = {
       npm: { count: 1, size: 0, downloads: 0 },
@@ -187,11 +177,9 @@ describe('Stats.vue', () => {
       registry: '',
       total_packages: 0,
       total_size: 0,
-      max_cache_size: 10737418240,
       total_downloads: 0,
       scanned_packages: 0,
       vulnerable_packages: 0,
-      blocked_packages: 0,
     }
     store.registries = {}
     await wrapper.vm.$nextTick()

frontend/src/components/Stats.vue

@@ -29,26 +29,11 @@
               </p>
               <p class="text-sm text-gray-600">Total Packages</p>
             </div>
-            <div class="p-6 bg-gray-50 rounded-lg">
-              <div class="text-center mb-3">
-                <p class="text-2xl font-bold text-blue-600">
-                  {{ formatBytes(stats?.total_size || 0) }} / {{ formatBytes(stats?.max_cache_size || 0) }}
-                </p>
-                <p class="text-sm text-gray-600 mt-1">Storage Used</p>
-              </div>
-              <div class="w-full bg-gray-200 rounded-full h-3 overflow-hidden">
-                <div
-                  class="h-full bg-blue-600 rounded-full transition-all duration-300"
-                  :style="{ width: storagePercentage + '%' }"
-                  :class="{
-                    'bg-green-600': storagePercentage < 50,
-                    'bg-yellow-600': storagePercentage >= 50 && storagePercentage < 80,
-                    'bg-orange-600': storagePercentage >= 80 && storagePercentage < 90,
-                    'bg-red-600': storagePercentage >= 90
-                  }"
-                ></div>
-              </div>
-              <p class="text-xs text-gray-500 text-center mt-1">{{ storagePercentage.toFixed(1) }}% used</p>
+            <div class="text-center p-6 bg-gray-50 rounded-lg">
+              <p class="text-4xl font-bold text-blue-600 mb-2">
+                {{ formatBytes(stats?.total_size || 0) }}
+              </p>
+              <p class="text-sm text-gray-600">Total Storage Used</p>
             </div>
             <div class="text-center p-6 bg-gray-50 rounded-lg">
               <p class="text-4xl font-bold text-green-600 mb-2">
@@ -66,7 +51,7 @@
           <h3 class="text-xl font-semibold text-gray-900 mb-6">
             <i class="fas fa-shield-alt mr-2"></i>Security Scanning
           </h3>
-          <div class="grid grid-cols-1 md:grid-cols-3 gap-6">
+          <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
             <div class="flex items-center justify-between p-6 bg-green-50 rounded-lg border border-green-200">
               <div>
                 <p class="text-3xl font-bold text-green-600">
@@ -78,11 +63,11 @@
             </div>
             <div
               @click="showVulnerablePackages"
-              class="flex items-center justify-between p-6 bg-orange-50 rounded-lg border border-orange-200 cursor-pointer hover:bg-orange-100 transition-colors"
+              class="flex items-center justify-between p-6 bg-red-50 rounded-lg border border-red-200 cursor-pointer hover:bg-red-100 transition-colors"
               :class="{ 'opacity-50': (stats?.vulnerable_packages || 0) === 0 }"
             >
               <div>
-                <p class="text-3xl font-bold text-orange-600">
+                <p class="text-3xl font-bold text-red-600">
                   {{ formatNumber(stats?.vulnerable_packages || 0) }}
                 </p>
                 <p class="text-sm text-gray-600 mt-1">
@@ -90,23 +75,7 @@
                   <span v-if="(stats?.vulnerable_packages || 0) > 0" class="text-xs ml-1">(click to view)</span>
                 </p>
               </div>
-              <i class="fas fa-exclamation-triangle text-5xl text-orange-400"></i>
-            </div>
-            <div
-              @click="showBlockedPackages"
-              class="flex items-center justify-between p-6 bg-red-50 rounded-lg border border-red-200 cursor-pointer hover:bg-red-100 transition-colors"
-              :class="{ 'opacity-50': (stats?.blocked_packages || 0) === 0 }"
-            >
-              <div>
-                <p class="text-3xl font-bold text-red-600">
-                  {{ formatNumber(stats?.blocked_packages || 0) }}
-                </p>
-                <p class="text-sm text-gray-600 mt-1">
-                  Blocked Packages
-                  <span v-if="(stats?.blocked_packages || 0) > 0" class="text-xs ml-1">(click to view)</span>
-                </p>
-              </div>
-              <i class="fas fa-hand text-5xl text-red-400"></i>
+              <i class="fas fa-exclamation-triangle text-5xl text-red-400"></i>
             </div>
           </div>
         </CardContent>
@@ -172,14 +141,6 @@ function showVulnerablePackages() {
   router.push('/vulnerable-packages')
 }
 
-function showBlockedPackages() {
-  if ((stats.value?.blocked_packages || 0) === 0) {
-    return
-  }
-
-  router.push('/blocked-packages')
-}
-
 // Registry configuration for icons and colors
 const registryConfig: Record<string, {label: string, icon: string, color: string}> = {
   npm: {
@@ -219,12 +180,6 @@ const registries = computed(() => {
   })
 })
 
-const storagePercentage = computed(() => {
-  const totalSize = stats.value?.total_size || 0
-  const maxSize = stats.value?.max_cache_size || 1
-  return (totalSize / maxSize) * 100
-})
-
 function formatNumber(num: number): string {
   return new Intl.NumberFormat().format(num)
 }

frontend/src/components/VulnerabilityBadge.vue

@@ -1,15 +1,5 @@
 <template>
   <div class="flex items-center gap-2">
-    <!-- Blocked Icon (if package exceeds thresholds) -->
-    <span
-      v-if="isBlocked"
-      class="inline-flex items-center px-2.5 py-1 rounded-md text-xs font-medium bg-red-600 text-white border border-red-700"
-      title="Download blocked - exceeds vulnerability thresholds"
-    >
-      <i class="fas fa-hand mr-1"></i>
-      BLOCKED
-    </span>
-
     <!-- Critical Vulnerabilities -->
     <button
       v-if="counts.critical > 0"
@@ -99,14 +89,12 @@ interface Props {
   counts?: VulnerabilityCounts
   total?: number
   scannedAt?: string // ISO 8601 timestamp
-  isBlocked?: boolean // Whether download is blocked due to vulnerabilities
 }
 
 const props = withDefaults(defineProps<Props>(), {
   scanned: false,
   status: 'not_scanned',
   total: 0,
-  isBlocked: false,
 })
 
 const emit = defineEmits<{

frontend/src/components/VulnerablePackages.vue

@@ -7,16 +7,11 @@
         Back to Stats
       </Button>
       <div class="flex items-center gap-3">
-        <i :class="showOnlyBlocked ? 'fas fa-hand' : 'fas fa-exclamation-triangle'" class="text-3xl text-red-600"></i>
+        <i class="fas fa-exclamation-triangle text-3xl text-red-600"></i>
         <div>
-          <h1 class="text-3xl font-bold text-gray-900">
-            {{ showOnlyBlocked ? 'Blocked Packages' : 'Vulnerable Packages' }}
-          </h1>
+          <h1 class="text-3xl font-bold text-gray-900">Vulnerable Packages</h1>
           <p class="text-gray-600 mt-1">
-            {{ showOnlyBlocked
-              ? 'Packages blocked from download due to exceeding vulnerability thresholds'
-              : 'Packages with known security vulnerabilities, sorted by risk'
-            }}
+            Packages with known security vulnerabilities, sorted by risk
           </p>
         </div>
       </div>
@@ -137,7 +132,6 @@
                             :counts="version.vulnerabilities.counts"
                             :total="version.vulnerabilities.total"
                             :scannedAt="version.vulnerabilities.scannedAt"
-                            :isBlocked="version.vulnerabilities.isBlocked"
                             @click.stop="navigateToPackage(version)"
                           />
                         </div>
@@ -159,7 +153,7 @@
 
 <script setup lang="ts">
 import { computed, onMounted, ref } from 'vue'
-import { useRouter, useRoute } from 'vue-router'
+import { useRouter } from 'vue-router'
 import { usePackageStore, type Package } from '../stores/packages'
 import { Alert, AlertDescription } from '@/components/ui/alert'
 import { Card, CardContent } from '@/components/ui/card'
@@ -176,15 +170,11 @@ import { getRegistryBadgeClass } from '@/composables/useBadgeStyles'
 
 const store = usePackageStore()
 const router = useRouter()
-const route = useRoute()
 
 const loading = ref(false)
 const error = ref<string | null>(null)
 const vulnerablePackages = ref<Package[]>([])
 
-// Check if we should filter to show only blocked packages
-const showOnlyBlocked = computed(() => route.path === '/blocked-packages')
-
 onMounted(async () => {
   await fetchVulnerablePackages()
 })
@@ -195,13 +185,9 @@ async function fetchVulnerablePackages() {
 
   try {
     await store.fetchPackages()
-    vulnerablePackages.value = store.packages.filter(pkg => {
-      const isVulnerable = pkg.vulnerabilities?.status === 'vulnerable'
-      if (showOnlyBlocked.value) {
-        return isVulnerable && pkg.vulnerabilities?.isBlocked === true
-      }
-      return isVulnerable
-    })
+    vulnerablePackages.value = store.packages.filter(
+      pkg => pkg.vulnerabilities?.status === 'vulnerable'
+    )
   } catch (err: any) {
     console.error('Failed to load vulnerable packages:', err)
     error.value = err.message || 'Failed to load vulnerable packages'

frontend/src/router/index.ts

@@ -37,11 +37,6 @@ const router = createRouter({
       name: 'vulnerable-packages',
       component: VulnerablePackages,
     },
-    {
-      path: '/blocked-packages',
-      name: 'blocked-packages',
-      component: VulnerablePackages,
-    },
     {
       path: '/admin/bypasses',
       name: 'bypasses',

frontend/src/stores/packages.ts

@@ -15,7 +15,6 @@ export interface VulnerabilityInfo {
   counts?: VulnerabilityCounts
   total?: number
   scannedAt?: string // ISO 8601 timestamp
-  isBlocked?: boolean // Whether download is blocked due to vulnerability thresholds
 }
 
 export interface Package {
@@ -34,11 +33,9 @@ export interface Stats {
   registry: string
   total_packages: number
   total_size: number
-  max_cache_size: number
   total_downloads: number
   scanned_packages: number
   vulnerable_packages: number
-  blocked_packages: number
 }
 
 export const usePackageStore = defineStore('packages', () => {

frontend/tsconfig.json

@@ -1,25 +1,31 @@
 {
-    "compilerOptions": {
-        "target": "ES2020",
-        "useDefineForClassFields": true,
-        "module": "ESNext",
-        "lib": ["ES2020", "DOM", "DOM.Iterable"],
-        "skipLibCheck": true,
-        "moduleResolution": "bundler",
-        "allowImportingTsExtensions": true,
-        "resolveJsonModule": true,
-        "isolatedModules": true,
-        "noEmit": true,
-        "jsx": "preserve",
-        "strict": true,
-        "noUnusedLocals": true,
-        "noUnusedParameters": true,
-        "noFallthroughCasesInSwitch": true,
-        "baseUrl": ".",
-        "paths": {
-            "@/*": ["./src/*"],
-        },
-    },
-    "include": ["src/**/*.ts", "src/**/*.d.ts", "src/**/*.tsx", "src/**/*.vue"],
-    "references": [{ "path": "./tsconfig.node.json" }],
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "module": "ESNext",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "preserve",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+
+    /* Path mapping */
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src/**/*.ts", "src/**/*.d.ts", "src/**/*.tsx", "src/**/*.vue"],
+  "references": [{ "path": "./tsconfig.node.json" }]
 }

go.mod

@@ -7,35 +7,23 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.32.6
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.6
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
-	github.com/go-gormigrate/gormigrate/v2 v2.1.5
-	github.com/go-sql-driver/mysql v1.9.3
 	github.com/goccy/go-json v0.10.5
 	github.com/gofiber/fiber/v2 v2.52.10
 	github.com/gorilla/websocket v1.5.3
 	github.com/hirochachacha/go-smb2 v1.1.0
-	github.com/lib/pq v1.10.9
 	github.com/prometheus/client_golang v1.23.2
+	github.com/redis/go-redis/v9 v9.17.2
 	github.com/rs/zerolog v1.34.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
-	github.com/testcontainers/testcontainers-go v0.40.0
-	github.com/testcontainers/testcontainers-go/modules/mysql v0.40.0
-	github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0
 	golang.org/x/crypto v0.46.0
 	golang.org/x/sync v0.19.0
 	golang.org/x/time v0.14.0
-	gorm.io/driver/mysql v1.6.0
-	gorm.io/driver/postgres v1.6.0
-	gorm.io/driver/sqlite v1.6.0
-	gorm.io/gorm v1.31.1
+	modernc.org/sqlite v1.42.2
 )
 
 require (
-	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
@@ -53,85 +41,45 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
 	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/stringish v0.1.1 // indirect
 	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker v28.5.2+incompatible // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.9.1 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.8.0 // indirect
-	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
-	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
-	github.com/mattn/go-sqlite3 v1.14.33 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
-	github.com/moby/patternmatcher v0.6.0 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/moby/term v0.5.2 // indirect
-	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.4 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.12 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.68.0 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
 	golang.org/x/sys v0.39.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
-	google.golang.org/grpc v1.78.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.67.4 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )

go.sum

@@ -1,13 +1,3 @@
-dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
-dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
-github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
@@ -50,43 +40,24 @@ github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
 github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
-github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
 github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
 github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
 github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
-github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
-github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
-github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
-github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
-github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
-github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
-github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
-github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
-github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
-github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
-github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
@@ -94,18 +65,6 @@ github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8
 github.com/geoffgarside/ber v1.1.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
 github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm64=
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
-github.com/go-gormigrate/gormigrate/v2 v2.1.5 h1:1OyorA5LtdQw12cyJDEHuTrEV3GiXiIhS4/QTTa/SM8=
-github.com/go-gormigrate/gormigrate/v2 v2.1.5/go.mod h1:mj9ekk/7CPF3VjopaFvWKN2v7fN3D9d3eEOAXRhi/+M=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
-github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
@@ -115,28 +74,18 @@ github.com/gofiber/fiber/v2 v2.52.10 h1:jRHROi2BuNti6NYXmZ6gbNSfT3zj/8c0xy94GOU5
 github.com/gofiber/fiber/v2 v2.52.10/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 h1:kEISI/Gx67NzH3nJxAmY/dGac80kKZgZt134u7Y/k1s=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4/go.mod h1:6Nz966r3vQYCqIzWsuEl9d7cf7mRhtDmm++sOxlnfxI=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hirochachacha/go-smb2 v1.1.0 h1:b6hs9qKIql9eVXAiN0M2wSFY5xnhbHAQoCwRKbaRTZI=
 github.com/hirochachacha/go-smb2 v1.1.0/go.mod h1:8F1A4d5EZzrGu5R7PU163UcMRDJQl4FtcxjBfsY8TZE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
-github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
-github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
-github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
-github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
-github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
 github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -145,12 +94,6 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
-github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
-github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -160,42 +103,15 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
 github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
-github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
-github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
-github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
-github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
-github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
-github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
-github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
-github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
-github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
-github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
-github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
-github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
-github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
-github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
-github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
@@ -204,18 +120,18 @@ github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+L
 github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/redis/go-redis/v9 v9.17.2 h1:P2EGsA4qVIM3Pp+aPocCJ7DguDHhqrXNhVcEp4ViluI=
+github.com/redis/go-redis/v9 v9.17.2/go.mod h1:u410H11HMLoB+TP67dz8rL9s6QW2j76l0//kSOd3370=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
-github.com/shirou/gopsutil/v4 v4.25.12 h1:e7PvW/0RmJ8p8vPGJH4jvNkOyLmbkXgXW4m6ZPic6CY=
-github.com/shirou/gopsutil/v4 v4.25.12/go.mod h1:EivAfP5x2EhLp2ovdpKSozecVXn1TmuG7SMzs/Wh4PU=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
@@ -227,53 +143,18 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/testcontainers/testcontainers-go v0.40.0 h1:pSdJYLOVgLE8YdUY2FHQ1Fxu+aMnb6JfVz1mxk7OeMU=
-github.com/testcontainers/testcontainers-go v0.40.0/go.mod h1:FSXV5KQtX2HAMlm7U3APNyLkkap35zNLxukw9oBi/MY=
-github.com/testcontainers/testcontainers-go/modules/mysql v0.40.0 h1:P9Txfy5Jothx2wFdcus0QoSmX/PKSIXZxrTbZPVJswA=
-github.com/testcontainers/testcontainers-go/modules/mysql v0.40.0/go.mod h1:oZPHHqJqXG7FD8OB/yWH7gLnDvZUlFHAVJNrGftL+eg=
-github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0 h1:s2bIayFXlbDFexo96y+htn7FzuhpXLYJNnIuglNKqOk=
-github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0/go.mod h1:h+u/2KoREGTnTl9UwrQ/g+XhasAT8E6dClclAADeXoQ=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
 github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
@@ -284,51 +165,59 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
 golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
 golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
 golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b h1:uA40e2M6fYRBf0+8uN5mLlqUtV192iiksiICIBkYJ1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:Xa7le7qx2vmqB/SzWUBa7KdMjpdpAHlh5QCSnjessQk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
-google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/mysql v1.6.0 h1:eNbLmNTpPpTOVZi8MMxCi2aaIm0ZpInbORNXDwyLGvg=
-gorm.io/driver/mysql v1.6.0/go.mod h1:D/oCC2GWK3M/dqoLxnOlaNKmXz8WNTfcS9y5ovaSqKo=
-gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
-gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
-gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
-gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
-gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
-gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
-gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
-gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
+modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
+modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.67.4 h1:zZGmCMUVPORtKv95c2ReQN5VDjvkoRm9GWPTEPuvlWg=
+modernc.org/libc v1.67.4/go.mod h1:QvvnnJ5P7aitu0ReNpVIEyesuhmDLQ8kaEoyMjIFZJA=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.42.2 h1:7hkZUNJvJFN2PgfUdjni9Kbvd4ef4mNLOu0B9FGxM74=
+modernc.org/sqlite v1.42.2/go.mod h1:+VkC6v3pLOAE0A0uVucQEcbVW0I5nHCeDaBf+DpsQT8=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

gohoarder.pid

@@ -0,0 +1 @@
+b540e2e

helm/gohoarder/README.md

@@ -69,119 +69,7 @@ helm install gohoarder gohoarder/gohoarder \
   --set storage.s3.secretAccessKey=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
 ```
 
-### With Private Container Registry
-
-If using images from a private registry, create an image pull secret and reference it:
-
-```bash
-# Create a Docker registry secret
-kubectl create secret docker-registry ghcr-secret \
-  --docker-server=ghcr.io \
-  --docker-username=<your-username> \
-  --docker-password=<your-token> \
-  --docker-email=<your-email> \
-  -n gohoarder
-
-# Install with the secret
-helm install gohoarder gohoarder/gohoarder \
-  --set global.imagePullSecrets[0].name=ghcr-secret \
-  -n gohoarder
-```
-
-Or using a values file to reference existing secrets:
-
-```yaml
-global:
-  imagePullSecrets:
-    - name: ghcr-secret
-    - name: dockerhub-secret  # Multiple secrets supported
-```
-
-**Auto-create secrets** (chart will create them for you):
-
-```yaml
-imageCredentials:
-  ghcr-secret:
-    registry: ghcr.io
-    username: myusername
-    password: mytoken
-    email: [email protected]
-
-global:
-  imagePullSecrets:
-    - name: ghcr-secret
-```
-
-> **Note**: Storing credentials in values files is less secure than creating secrets manually. Consider using external secret management solutions like Sealed Secrets or External Secrets Operator for production.
-
-## Configuration Methods
-
-GoHoarder supports two configuration methods that can be used together:
-
-### 1. ConfigMap (Default)
-
-The chart automatically generates a `config.yaml` from Helm values and mounts it as a ConfigMap. This is the default approach and works out of the box.
-
-### 2. Environment Variables
-
-You can override any configuration using environment variables with the format `GOHOARDER_<CONFIG_KEY>` where dots are replaced with underscores.
-
-**Example using values file:**
-
-```yaml
-server:
-  env:
-    - name: GOHOARDER_STORAGE_BACKEND
-      value: "s3"
-    - name: GOHOARDER_STORAGE_S3_BUCKET
-      value: "my-bucket"
-    # Reference secrets for sensitive data
-    - name: GOHOARDER_STORAGE_S3_SECRET_ACCESS_KEY
-      valueFrom:
-        secretKeyRef:
-          name: aws-credentials
-          key: secret-access-key
-    - name: GOHOARDER_METADATA_POSTGRESQL_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: postgres-secret
-          key: password
-```
-
-**Example using command line:**
-
-```bash
-helm install gohoarder gohoarder/gohoarder \
-  --set server.env[0].name=GOHOARDER_STORAGE_BACKEND \
-  --set server.env[0].value=s3 \
-  --set server.env[1].name=GOHOARDER_LOGGING_LEVEL \
-  --set server.env[1].value=debug
-```
-
-**Benefits of environment variables:**
-- Better integration with Kubernetes secrets
-- Override specific values without modifying ConfigMap
-- Support for secret references (no plain-text passwords)
-- Compatible with external secret management (External Secrets Operator, Sealed Secrets)
-
-**Common environment variable mappings:**
-
-| Config Path | Environment Variable |
-|-------------|---------------------|
-| `storage.backend` | `GOHOARDER_STORAGE_BACKEND` |
-| `storage.s3.bucket` | `GOHOARDER_STORAGE_S3_BUCKET` |
-| `storage.s3.region` | `GOHOARDER_STORAGE_S3_REGION` |
-| `storage.s3.access_key_id` | `GOHOARDER_STORAGE_S3_ACCESS_KEY_ID` |
-| `storage.s3.secret_access_key` | `GOHOARDER_STORAGE_S3_SECRET_ACCESS_KEY` |
-| `metadata.backend` | `GOHOARDER_METADATA_BACKEND` |
-| `metadata.postgresql.host` | `GOHOARDER_METADATA_POSTGRESQL_HOST` |
-| `metadata.postgresql.password` | `GOHOARDER_METADATA_POSTGRESQL_PASSWORD` |
-| `security.enabled` | `GOHOARDER_SECURITY_ENABLED` |
-| `security.scanners.trivy.enabled` | `GOHOARDER_SECURITY_SCANNERS_TRIVY_ENABLED` |
-| `logging.level` | `GOHOARDER_LOGGING_LEVEL` |
-| `logging.format` | `GOHOARDER_LOGGING_FORMAT` |
-
-## Configuration Reference
+## Configuration
 
 The following table lists the configurable parameters and their default values.
 
@@ -189,11 +77,8 @@ The following table lists the configurable parameters and their default values.
 
 | Parameter | Description | Default |
 |-----------|-------------|---------|
-| `nameOverride` | Override the name of the chart | `""` |
-| `fullnameOverride` | Override the full name of the chart | `""` |
 | `global.domain` | Base domain for the deployment | `gohoarder.local` |
-| `global.imagePullSecrets` | Image pull secrets (reference existing) | `[]` |
-| `imageCredentials` | Auto-create image pull secrets from credentials | `{}` |
+| `global.imagePullSecrets` | Image pull secrets | `[]` |
 
 ### Replica Count
 
@@ -209,21 +94,10 @@ The following table lists the configurable parameters and their default values.
 |-----------|-------------|---------|
 | `image.server.repository` | Server image repository | `ghcr.io/lukaszraczylo/gohoarder-server` |
 | `image.server.tag` | Server image tag | `latest` |
-| `image.server.pullPolicy` | Server image pull policy | `IfNotPresent` |
 | `image.frontend.repository` | Frontend image repository | `ghcr.io/lukaszraczylo/gohoarder-frontend` |
 | `image.frontend.tag` | Frontend image tag | `latest` |
-| `image.frontend.pullPolicy` | Frontend image pull policy | `IfNotPresent` |
 | `image.scanner.repository` | Scanner image repository | `ghcr.io/lukaszraczylo/gohoarder-scanner` |
 | `image.scanner.tag` | Scanner image tag | `latest` |
-| `image.scanner.pullPolicy` | Scanner image pull policy | `IfNotPresent` |
-
-### Environment Variables
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `server.env` | Additional environment variables for server | `[]` |
-| `frontend.env` | Additional environment variables for frontend | `[]` |
-| `scanner.env` | Additional environment variables for scanner | `[]` |
 
 ### Storage Configuration
 
@@ -276,165 +150,6 @@ The following table lists the configurable parameters and their default values.
 | `ingress.frontend.host` | Frontend hostname | `gohoarder.local` |
 | `ingress.frontend.tls.enabled` | Enable TLS for frontend | `false` |
 
-## High Availability & Scaling
-
-### Running Multiple Server Replicas
-
-GoHoarder can run with multiple server replicas for high availability and load distribution, but the configuration must be set correctly to avoid data inconsistency.
-
-#### ✅ Compatible Configurations (Safe for Multiple Replicas)
-
-**Storage:**
-- ✅ **S3** - Fully compatible, recommended for production HA setups
-- ✅ **SMB** - Compatible, shared network storage
-- ✅ **Filesystem with RWX** - Compatible when using ReadWriteMany storage classes
-  - ✅ Examples: Longhorn RWX, NFS, CephFS, GlusterFS, Azure Files
-  - ✅ Uses atomic rename operations for safe concurrent writes
-  - ✅ Packages are static/immutable - perfect for shared storage
-  - ❌ Not compatible with local storage or ReadWriteOnce (RWO) PVCs
-
-**Metadata:**
-- ✅ **PostgreSQL** - Fully compatible, handles concurrent writes, recommended for HA
-- ⚠️ **SQLite** - Limited compatibility:
-  - Uses WAL mode which supports concurrent reads
-  - Multiple writers can cause lock contention
-  - Works but may have performance issues under high concurrency
-  - Only if using shared storage (NFS, etc.)
-
-#### 📋 Recommended HA Configurations
-
-**Option 1: Cloud Storage (S3)**
-
-Best for cloud deployments, object storage:
-
-```yaml
-replicaCount:
-  server: 3
-
-storage:
-  backend: s3
-  s3:
-    endpoint: s3.amazonaws.com
-    region: us-east-1
-    bucket: gohoarder-cache
-
-metadata:
-  backend: postgresql
-  postgresql:
-    host: postgres.database.svc.cluster.local
-    database: gohoarder
-
-podDisruptionBudget:
-  enabled: true
-  minAvailable: 1
-```
-
-**Option 2: Shared Filesystem (Longhorn/NFS)**
-
-Best for on-premises or self-hosted Kubernetes:
-
-```yaml
-replicaCount:
-  server: 3
-
-storage:
-  backend: filesystem
-  filesystem:
-    # Use RWX storage class (Longhorn, NFS, CephFS, etc.)
-    storageClass: "longhorn"  # or "nfs-client", "cephfs", etc.
-    size: "500Gi"
-    accessMode: "ReadWriteMany"  # RWX - Critical for multiple replicas!
-
-metadata:
-  backend: postgresql  # Or SQLite with RWX storage
-  postgresql:
-    host: postgres.database.svc.cluster.local
-    database: gohoarder
-
-podDisruptionBudget:
-  enabled: true
-  minAvailable: 1
-```
-
-**Why Filesystem with RWX Works:**
-- Packages are immutable once cached (static files)
-- Filesystem backend uses atomic `rename()` operations
-- Race condition safe: If two replicas cache same package, one wins
-- Performance: Local filesystem often faster than object storage for reads
-
-#### ⚠️ What Won't Work with Multiple Replicas
-
-**Filesystem storage with local volumes:**
-```yaml
-# ❌ DON'T DO THIS with multiple replicas
-storage:
-  backend: filesystem
-  filesystem:
-    useHostPath: true  # Each replica gets different storage
-```
-
-**SQLite with local storage:**
-```yaml
-# ⚠️ AVOID with multiple replicas
-metadata:
-  backend: sqlite
-  sqlite:
-    persistence:
-      enabled: true  # Each replica gets its own database
-```
-
-#### 🔄 How It Works
-
-**Request Deduplication:**
-- Single replica: Uses `singleflight` to prevent duplicate upstream fetches
-- Multiple replicas: Each replica may fetch the same package independently
-- **Mitigation**: Package metadata in shared database prevents duplicate downloads once one replica completes
-
-**Cache Consistency:**
-- Storage backend (S3/SMB) ensures all replicas see the same cached packages
-- Metadata database ensures consistent package information across replicas
-- First replica to cache a package wins, others will use the cached version
-
-**Session Affinity:**
-- Not required - GoHoarder is stateless
-- Load balancer can distribute requests randomly
-
-**Scanner Replicas:**
-- Scanner can run as a single replica or multiple
-- If multiple scanners enabled, they share work through the metadata database
-- Package scans are deduplicated via database state
-
-#### 🔬 Technical Details: Concurrent Write Safety
-
-**Filesystem Backend with RWX Storage:**
-
-The filesystem storage backend uses a **temp-file + atomic rename** pattern:
-
-```go
-1. Write package to: /cache/npm/package@1.0.0.tmp
-2. Calculate checksums (MD5, SHA256)
-3. Atomic rename: .tmp → /cache/npm/package@1.0.0
-```
-
-**Why this is safe for concurrent writes:**
-- `os.Rename()` is atomic on POSIX filesystems
-- If two replicas cache the same package simultaneously:
-  - Both write to separate `.tmp` files
-  - Both attempt atomic rename
-  - One succeeds, one gets "file exists" error
-  - Result: Same file content, no corruption
-
-**Package immutability:**
-- Packages are versioned and immutable (npm/pypi/go semantics)
-- Same package@version always has identical content
-- Concurrent writes produce identical results
-- No risk of partial/corrupted files
-
-**Quota tracking:**
-- Per-process mutex (minor inaccuracy across replicas)
-- Conservative: May undercount slightly
-- Not critical for operation
-
 ## Uninstallation
 
 ```bash

helm/gohoarder/templates/_helpers.tpl

@@ -172,17 +172,3 @@ Trivy cache volume configuration
   emptyDir: {}
 {{- end }}
 {{- end }}
-
-{{/*
-Validate SQLite configuration - SQLite cannot be used with SMB/NFS network storage
-*/}}
-{{- define "gohoarder.validateSQLiteConfig" -}}
-{{- if eq .Values.metadata.backend "sqlite" }}
-  {{- if .Values.metadata.sqlite.persistence.enabled }}
-    {{- $storageClass := .Values.metadata.sqlite.persistence.storageClass | default .Values.storage.storageClass }}
-    {{- if or (contains "smb" ($storageClass | lower)) (contains "cifs" ($storageClass | lower)) (contains "nfs" ($storageClass | lower)) }}
-      {{- fail "\n\n❌ ERROR: SQLite cannot be used with SMB/CIFS/NFS network storage!\n\nSQLite requires POSIX file locking which is not reliably supported over network filesystems.\nThis will cause 'database is locked' errors and data corruption.\n\nPlease choose ONE of the following solutions:\n\n1. Use PostgreSQL for network storage (RECOMMENDED for production):\n   metadata:\n     backend: postgresql\n     postgresql:\n       host: your-postgres-host\n       ...\n\n2. Use MySQL/MariaDB for network storage (alternative to PostgreSQL):\n   metadata:\n     backend: mysql\n     mysql:\n       host: your-mysql-host\n       ...\n\n3. Use local storage for SQLite (OK for development):\n   metadata:\n     sqlite:\n       persistence:\n         enabled: true\n         storageClass: local-path  # or another local storage class\n\n4. Disable persistence (data will be lost on pod restart):\n   metadata:\n     sqlite:\n       persistence:\n         enabled: false\n\nFor more information, see: https://www.sqlite.org/lockingv3.html\n" }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- end }}

helm/gohoarder/templates/configmap.yaml

@@ -93,30 +93,24 @@ data:
         low: {{ .Values.security.blockThresholds.low }}
       scanners:
         trivy:
-          # Disabled in server config (no trivy binary), enabled via env var in scanner pod
-          enabled: false
+          enabled: {{ .Values.security.scanners.trivy.enabled }}
           timeout: {{ .Values.security.scanners.trivy.timeout | quote }}
           cache_db: {{ .Values.security.scanners.trivy.cacheDb | quote }}
         osv:
-          # API-based scanner - works in both server and scanner pods
           enabled: {{ .Values.security.scanners.osv.enabled }}
           api_url: {{ .Values.security.scanners.osv.apiUrl | quote }}
           timeout: {{ .Values.security.scanners.osv.timeout | quote }}
         grype:
-          # Disabled in server config (no grype binary), enabled via env var in scanner pod
-          enabled: false
+          enabled: {{ .Values.security.scanners.grype.enabled }}
           timeout: {{ .Values.security.scanners.grype.timeout | quote }}
         govulncheck:
-          # Disabled in server config (no go/govulncheck binary), enabled via env var in scanner pod
-          enabled: false
+          enabled: {{ .Values.security.scanners.govulncheck.enabled }}
           timeout: {{ .Values.security.scanners.govulncheck.timeout | quote }}
         npm_audit:
-          # Disabled in server config (no npm binary), enabled via env var in scanner pod
-          enabled: false
+          enabled: {{ .Values.security.scanners.npmAudit.enabled }}
           timeout: {{ .Values.security.scanners.npmAudit.timeout | quote }}
         pip_audit:
-          # Disabled in server config (no pip binary), enabled via env var in scanner pod
-          enabled: false
+          enabled: {{ .Values.security.scanners.pipAudit.enabled }}
           timeout: {{ .Values.security.scanners.pipAudit.timeout | quote }}
         ghsa:
           enabled: {{ .Values.security.scanners.ghsa.enabled }}

helm/gohoarder/templates/deployment-frontend.yaml

@@ -26,62 +26,22 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "gohoarder.serviceAccountName" . }}
       securityContext:
-        fsGroup: 101
-        runAsNonRoot: true
-        runAsUser: 101
-      initContainers:
-      - name: copy-static-files
-        image: "{{ .Values.image.frontend.repository }}:{{ .Values.image.frontend.tag | default .Chart.AppVersion }}"
-        command: ['sh', '-c']
-        args:
-        - |
-          # Copy built frontend files to writable volume
-          cp -rp /usr/share/nginx/html/* /html/
-          # Copy nginx config to writable volume
-          cp -rp /etc/nginx/conf.d/* /conf/
-        volumeMounts:
-        - name: nginx-html
-          mountPath: /html
-        - name: nginx-conf
-          mountPath: /conf
-        securityContext:
-          runAsUser: 101
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
       - name: frontend
         securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: false
-          runAsUser: 101
+          {{- toYaml .Values.securityContext | nindent 12 }}
         image: "{{ .Values.image.frontend.repository }}:{{ .Values.image.frontend.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.image.frontend.pullPolicy }}
         ports:
         - name: http
-          containerPort: 80
+          containerPort: {{ .Values.frontend.port }}
           protocol: TCP
         env:
-        - name: API_BASE_URL
-          value: {{ .Values.frontend.backendUrl | default "/api" | quote }}
-        - name: APP_VERSION
-          value: {{ .Chart.AppVersion | quote }}
-        - name: APP_NAME
-          value: "GoHoarder"
-        # Backend proxy configuration (frontend now includes reverse proxy)
-        - name: BACKEND_HOST
-          value: {{ include "gohoarder.fullname" . }}-server
-        - name: BACKEND_PORT
-          value: {{ .Values.server.service.port | quote }}
-        - name: SERVER_NAME
-          value: {{ .Values.frontend.serverName | default "_" | quote }}
-        {{- with .Values.frontend.env }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
+        - name: VITE_BACKEND_URL
+          value: "http://{{ include "gohoarder.fullname" . }}-server:{{ .Values.server.service.port }}"
+        - name: VITE_PORT
+          value: "{{ .Values.frontend.port }}"
         livenessProbe:
           {{- toYaml .Values.frontend.livenessProbe | nindent 12 }}
         readinessProbe:
@@ -91,25 +51,9 @@ spec:
         volumeMounts:
         - name: tmp
           mountPath: /tmp
-        - name: nginx-cache
-          mountPath: /var/cache/nginx
-        - name: nginx-run
-          mountPath: /var/run
-        - name: nginx-html
-          mountPath: /usr/share/nginx/html
-        - name: nginx-conf
-          mountPath: /etc/nginx/conf.d
       volumes:
       - name: tmp
         emptyDir: {}
-      - name: nginx-cache
-        emptyDir: {}
-      - name: nginx-run
-        emptyDir: {}
-      - name: nginx-html
-        emptyDir: {}
-      - name: nginx-conf
-        emptyDir: {}
       {{- with .Values.frontend.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

helm/gohoarder/templates/deployment-scanner.yaml

@@ -1,5 +1,4 @@
 {{- if .Values.security.enabled }}
-{{- include "gohoarder.validateSQLiteConfig" . }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -29,77 +28,27 @@ spec:
       serviceAccountName: {{ include "gohoarder.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if .Values.migration.enabled }}
       initContainers:
-      # Wait for database to be ready
-      - name: wait-for-db
-        image: busybox:1.36
-        command:
-        - sh
-        - -c
-        - |
-          echo "Waiting for database..."
-          {{- if eq .Values.metadata.backend "postgresql" }}
-          until nc -z {{ .Values.metadata.postgresql.host }} {{ .Values.metadata.postgresql.port }}; do
-            echo "  PostgreSQL not ready, retrying in 2s..."
-            sleep 2
-          done
-          echo "✓ PostgreSQL is ready"
-          {{- else if eq .Values.metadata.backend "mysql" }}
-          until nc -z {{ .Values.metadata.mysql.host }} {{ .Values.metadata.mysql.port }}; do
-            echo "  MySQL not ready, retrying in 2s..."
-            sleep 2
-          done
-          echo "✓ MySQL is ready"
-          {{- else }}
-          echo "✓ SQLite (no wait needed)"
-          {{- end }}
-        securityContext:
-          allowPrivilegeEscalation: false
-          runAsNonRoot: true
-          runAsUser: 1000
-        resources:
-          limits:
-            cpu: 100m
-            memory: 64Mi
-          requests:
-            cpu: 10m
-            memory: 32Mi
-      # Run database migrations
-      - name: migrate
-        image: "{{ .Values.migration.image.repository }}:{{ .Values.migration.image.tag | default .Chart.AppVersion }}"
-        imagePullPolicy: {{ .Values.migration.image.pullPolicy }}
-        env:
-        - name: DB_DRIVER
-          value: {{ .Values.metadata.backend | quote }}
-        {{- if eq .Values.metadata.backend "postgresql" }}
-        - name: DATABASE_URL
-          value: "postgresql://{{ .Values.metadata.postgresql.username }}:{{ .Values.metadata.postgresql.password }}@{{ .Values.metadata.postgresql.host }}:{{ .Values.metadata.postgresql.port }}/{{ .Values.metadata.postgresql.database }}?sslmode={{ .Values.metadata.postgresql.sslMode }}"
-        {{- else if eq .Values.metadata.backend "mysql" }}
-        - name: DATABASE_URL
-          value: "{{ .Values.metadata.mysql.username }}:{{ .Values.metadata.mysql.password }}@tcp({{ .Values.metadata.mysql.host }}:{{ .Values.metadata.mysql.port }})/{{ .Values.metadata.mysql.database }}?charset={{ .Values.metadata.mysql.charset }}&parseTime={{ .Values.metadata.mysql.parseTime }}"
-        {{- else }}
-        - name: DATABASE_URL
-          value: "/var/lib/gohoarder/metadata/gohoarder.db"
-        {{- end }}
+      - name: init-permissions
+        image: busybox:latest
+        command: ['sh', '-c']
         args:
-        - --driver=$(DB_DRIVER)
-        - --dsn=$(DATABASE_URL)
-        - --action=migrate
-        - --log-level={{ .Values.migration.logLevel | default "info" }}
-        - --timeout={{ .Values.migration.timeout | default "5m" }}
-        securityContext:
-          allowPrivilegeEscalation: false
-          runAsNonRoot: true
-          runAsUser: 1000
-        resources:
-          {{- toYaml .Values.migration.resources | nindent 10 }}
-        {{- if eq .Values.metadata.backend "sqlite" }}
+        - |
+          mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
+          {{- if .Values.security.scanners.trivy.enabled }}
+          mkdir -p {{ .Values.security.scanners.trivy.cacheDb }}
+          chown -R 1000:1000 {{ .Values.security.scanners.trivy.cacheDb }}
+          {{- end }}
+          chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
+          chmod 750 /var/cache/gohoarder /var/lib/gohoarder
         volumeMounts:
-        - name: metadata
-          mountPath: /var/lib/gohoarder/metadata
-        {{- end }}
-      {{- end }}
+        {{- include "gohoarder.storageVolume" . | nindent 8 }}
+        {{- include "gohoarder.metadataVolume" . | nindent 8 }}
+        {{- include "gohoarder.trivyCacheVolume" . | nindent 8 }}
+        - name: tmp
+          mountPath: /tmp/gohoarder
+        securityContext:
+          runAsUser: 0
       containers:
       - name: scanner
         securityContext:
@@ -109,63 +58,6 @@ spec:
         env:
         - name: CONFIG_FILE
           value: /etc/gohoarder/config.yaml
-        # Enable tool-based scanners only in scanner pod (server doesn't have the tools)
-        - name: GOHOARDER_SECURITY_SCANNERS_TRIVY_ENABLED
-          value: "{{ .Values.security.scanners.trivy.enabled }}"
-        - name: GOHOARDER_SECURITY_SCANNERS_GRYPE_ENABLED
-          value: "{{ .Values.security.scanners.grype.enabled }}"
-        - name: GOHOARDER_SECURITY_SCANNERS_GOVULNCHECK_ENABLED
-          value: "{{ .Values.security.scanners.govulncheck.enabled }}"
-        - name: GOHOARDER_SECURITY_SCANNERS_NPM_AUDIT_ENABLED
-          value: "{{ .Values.security.scanners.npmAudit.enabled }}"
-        - name: GOHOARDER_SECURITY_SCANNERS_PIP_AUDIT_ENABLED
-          value: "{{ .Values.security.scanners.pipAudit.enabled }}"
-        {{- if and (eq .Values.metadata.backend "postgresql") .Values.metadata.postgresql.existingSecret }}
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.postgresql.existingSecret }}
-              key: username
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.postgresql.existingSecret }}
-              key: password
-        {{- else if and (eq .Values.metadata.backend "postgresql") .Values.metadata.postgresql.username }}
-        - name: POSTGRES_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-postgresql
-              key: username
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-postgresql
-              key: password
-        {{- end }}
-        {{- if and (or (eq .Values.metadata.backend "mysql") (eq .Values.metadata.backend "mariadb")) .Values.metadata.mysql.existingSecret }}
-        - name: MYSQL_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.mysql.existingSecret }}
-              key: username
-        - name: MYSQL_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.mysql.existingSecret }}
-              key: password
-        {{- else if and (or (eq .Values.metadata.backend "mysql") (eq .Values.metadata.backend "mariadb")) .Values.metadata.mysql.username }}
-        - name: MYSQL_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-mysql
-              key: username
-        - name: MYSQL_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-mysql
-              key: password
-        {{- end }}
         {{- if and .Values.security.scanners.ghsa.enabled .Values.security.scanners.ghsa.existingSecret }}
         - name: GHSA_TOKEN
           valueFrom:
@@ -179,9 +71,6 @@ spec:
               name: {{ include "gohoarder.fullname" . }}-ghsa
               key: token
         {{- end }}
-        {{- with .Values.scanner.env }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
         resources:
           {{- toYaml .Values.scanner.resources | nindent 12 }}
         volumeMounts:

helm/gohoarder/templates/deployment-server.yaml

@@ -1,4 +1,3 @@
-{{- include "gohoarder.validateSQLiteConfig" . }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -30,77 +29,22 @@ spec:
       serviceAccountName: {{ include "gohoarder.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if .Values.migration.enabled }}
       initContainers:
-      # Wait for database to be ready
-      - name: wait-for-db
-        image: busybox:1.36
-        command:
-        - sh
-        - -c
-        - |
-          echo "Waiting for database..."
-          {{- if eq .Values.metadata.backend "postgresql" }}
-          until nc -z {{ .Values.metadata.postgresql.host }} {{ .Values.metadata.postgresql.port }}; do
-            echo "  PostgreSQL not ready, retrying in 2s..."
-            sleep 2
-          done
-          echo "✓ PostgreSQL is ready"
-          {{- else if eq .Values.metadata.backend "mysql" }}
-          until nc -z {{ .Values.metadata.mysql.host }} {{ .Values.metadata.mysql.port }}; do
-            echo "  MySQL not ready, retrying in 2s..."
-            sleep 2
-          done
-          echo "✓ MySQL is ready"
-          {{- else }}
-          echo "✓ SQLite (no wait needed)"
-          {{- end }}
-        securityContext:
-          allowPrivilegeEscalation: false
-          runAsNonRoot: true
-          runAsUser: 1000
-        resources:
-          limits:
-            cpu: 100m
-            memory: 64Mi
-          requests:
-            cpu: 10m
-            memory: 32Mi
-      # Run database migrations
-      - name: migrate
-        image: "{{ .Values.migration.image.repository }}:{{ .Values.migration.image.tag | default .Chart.AppVersion }}"
-        imagePullPolicy: {{ .Values.migration.image.pullPolicy }}
-        env:
-        - name: DB_DRIVER
-          value: {{ .Values.metadata.backend | quote }}
-        {{- if eq .Values.metadata.backend "postgresql" }}
-        - name: DATABASE_URL
-          value: "postgresql://{{ .Values.metadata.postgresql.username }}:{{ .Values.metadata.postgresql.password }}@{{ .Values.metadata.postgresql.host }}:{{ .Values.metadata.postgresql.port }}/{{ .Values.metadata.postgresql.database }}?sslmode={{ .Values.metadata.postgresql.sslMode }}"
-        {{- else if eq .Values.metadata.backend "mysql" }}
-        - name: DATABASE_URL
-          value: "{{ .Values.metadata.mysql.username }}:{{ .Values.metadata.mysql.password }}@tcp({{ .Values.metadata.mysql.host }}:{{ .Values.metadata.mysql.port }})/{{ .Values.metadata.mysql.database }}?charset={{ .Values.metadata.mysql.charset }}&parseTime={{ .Values.metadata.mysql.parseTime }}"
-        {{- else }}
-        - name: DATABASE_URL
-          value: "/var/lib/gohoarder/metadata/gohoarder.db"
-        {{- end }}
+      - name: init-permissions
+        image: busybox:latest
+        command: ['sh', '-c']
         args:
-        - --driver=$(DB_DRIVER)
-        - --dsn=$(DATABASE_URL)
-        - --action=migrate
-        - --log-level={{ .Values.migration.logLevel | default "info" }}
-        - --timeout={{ .Values.migration.timeout | default "5m" }}
-        securityContext:
-          allowPrivilegeEscalation: false
-          runAsNonRoot: true
-          runAsUser: 1000
-        resources:
-          {{- toYaml .Values.migration.resources | nindent 10 }}
-        {{- if eq .Values.metadata.backend "sqlite" }}
+        - |
+          mkdir -p /var/cache/gohoarder /var/lib/gohoarder/metadata /tmp/gohoarder
+          chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
+          chmod 750 /var/cache/gohoarder /var/lib/gohoarder
         volumeMounts:
-        - name: metadata
-          mountPath: /var/lib/gohoarder/metadata
-        {{- end }}
-      {{- end }}
+        {{- include "gohoarder.storageVolume" . | nindent 8 }}
+        {{- include "gohoarder.metadataVolume" . | nindent 8 }}
+        - name: tmp
+          mountPath: /tmp/gohoarder
+        securityContext:
+          runAsUser: 0
       containers:
       - name: server
         securityContext:
@@ -196,29 +140,6 @@ spec:
               name: {{ include "gohoarder.fullname" . }}-postgresql
               key: password
         {{- end }}
-        {{- if and (or (eq .Values.metadata.backend "mysql") (eq .Values.metadata.backend "mariadb")) .Values.metadata.mysql.existingSecret }}
-        - name: MYSQL_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.mysql.existingSecret }}
-              key: username
-        - name: MYSQL_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ .Values.metadata.mysql.existingSecret }}
-              key: password
-        {{- else if and (or (eq .Values.metadata.backend "mysql") (eq .Values.metadata.backend "mariadb")) .Values.metadata.mysql.username }}
-        - name: MYSQL_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-mysql
-              key: username
-        - name: MYSQL_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "gohoarder.fullname" . }}-mysql
-              key: password
-        {{- end }}
         {{- if and .Values.security.scanners.ghsa.enabled .Values.security.scanners.ghsa.existingSecret }}
         - name: GHSA_TOKEN
           valueFrom:
@@ -232,9 +153,6 @@ spec:
               name: {{ include "gohoarder.fullname" . }}-ghsa
               key: token
         {{- end }}
-        {{- with .Values.server.env }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
         livenessProbe:
           {{- toYaml .Values.server.livenessProbe | nindent 12 }}
         readinessProbe:

helm/gohoarder/templates/imagepullsecret.yaml

@@ -1,14 +0,0 @@
-{{- if .Values.imageCredentials }}
-{{- range $name, $config := .Values.imageCredentials }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $name }}
-  labels:
-    {{- include "gohoarder.labels" $ | nindent 4 }}
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: {{ printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"%s\",\"auth\":\"%s\"}}}" $config.registry $config.username $config.password $config.email (printf "%s:%s" $config.username $config.password | b64enc) | b64enc }}
-{{- end }}
-{{- end }}

helm/gohoarder/templates/ingress.yaml

@@ -1,10 +1,11 @@
 {{- if .Values.ingress.enabled -}}
+{{- if .Values.ingress.frontend.enabled -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "gohoarder.fullname" . }}
+  name: {{ include "gohoarder.fullname" . }}-frontend
   labels:
-    {{- include "gohoarder.labels" . | nindent 4 }}
+    {{- include "gohoarder.frontend.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -13,17 +14,30 @@ spec:
   {{- if .Values.ingress.className }}
   ingressClassName: {{ .Values.ingress.className }}
   {{- end }}
-  {{- if .Values.ingress.tls.enabled }}
+  {{- if .Values.ingress.frontend.tls.enabled }}
   tls:
     - hosts:
-        - {{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
-      secretName: {{ .Values.ingress.tls.secretName }}
+        - {{ .Values.ingress.frontend.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
+      secretName: {{ .Values.ingress.frontend.tls.secretName }}
   {{- end }}
   rules:
-    - host: {{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
+    - host: {{ .Values.ingress.frontend.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
       http:
         paths:
-          # Route all traffic to frontend (which now includes reverse proxy to backend)
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "gohoarder.fullname" . }}-server
+                port:
+                  number: {{ .Values.server.service.port }}
+          - path: /ws
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "gohoarder.fullname" . }}-server
+                port:
+                  number: {{ .Values.server.service.port }}
           - path: /
             pathType: Prefix
             backend:
@@ -32,3 +46,38 @@ spec:
                 port:
                   number: {{ .Values.frontend.service.port }}
 {{- end }}
+---
+{{- if .Values.ingress.api.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "gohoarder.fullname" . }}-api
+  labels:
+    {{- include "gohoarder.server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.api.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.api.host | default (printf "api.%s.%s" "gohoarder" .Values.global.domain) | quote }}
+      secretName: {{ .Values.ingress.api.tls.secretName }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.api.host | default (printf "api.%s.%s" "gohoarder" .Values.global.domain) | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "gohoarder.fullname" . }}-server
+                port:
+                  number: {{ .Values.server.service.port }}
+{{- end }}
+{{- end }}

helm/gohoarder/templates/secret.yaml

@@ -53,19 +53,6 @@ data:
   password: {{ .Values.metadata.postgresql.password | b64enc | quote }}
 {{- end }}
 ---
-{{- if and (or (eq .Values.metadata.backend "mysql") (eq .Values.metadata.backend "mariadb")) (not .Values.metadata.mysql.existingSecret) .Values.metadata.mysql.username }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "gohoarder.fullname" . }}-mysql
-  labels:
-    {{- include "gohoarder.labels" . | nindent 4 }}
-type: Opaque
-data:
-  username: {{ .Values.metadata.mysql.username | b64enc | quote }}
-  password: {{ .Values.metadata.mysql.password | b64enc | quote }}
-{{- end }}
----
 {{- if and .Values.security.scanners.ghsa.enabled (not .Values.security.scanners.ghsa.existingSecret) .Values.security.scanners.ghsa.token }}
 apiVersion: v1
 kind: Secret

helm/gohoarder/values.yaml

@@ -2,45 +2,14 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-# Override the name of the chart
-nameOverride: ""
-# Override the full name of the chart
-fullnameOverride: ""
-
 # Global configuration
 global:
   # Base domain for the deployment
   domain: "gohoarder.local"
-
-  # Image pull secrets for private registries
-  # Reference existing secrets by name:
-  # imagePullSecrets:
-  #   - name: ghcr-secret
-  #   - name: dockerhub-secret
+  # Image pull secrets
   imagePullSecrets: []
 
-# Auto-create image pull secrets from credentials (optional)
-# If you want the chart to create the secrets for you, use this instead:
-# imageCredentials:
-#   ghcr-secret:
-#     registry: ghcr.io
-#     username: myusername
-#     password: mytoken
-#     email: [email protected]
-#   dockerhub-secret:
-#     registry: https://index.docker.io/v1/
-#     username: myusername
-#     password: mytoken
-#     email: [email protected]
-# Then reference them in global.imagePullSecrets:
-#   - name: ghcr-secret
-imageCredentials: {}
-
 # Deployment replicas
-# NOTE: When running multiple server replicas (>1):
-#   - Use S3 or SMB for storage.backend (not filesystem with local storage)
-#   - Use PostgreSQL for metadata.backend (SQLite has limited concurrency)
-#   - See "High Availability & Scaling" section in README
 replicaCount:
   server: 1
   frontend: 1
@@ -94,24 +63,6 @@ server:
   writeTimeout: "5m"
   idleTimeout: "2m"
 
-  # Additional environment variables for server container
-  # Use this to override config via environment variables
-  # Format: GOHOARDER_<CONFIG_KEY> (dots replaced with underscores)
-  # Examples:
-  #   GOHOARDER_STORAGE_BACKEND: s3
-  #   GOHOARDER_METADATA_BACKEND: postgresql
-  # env:
-  #   - name: GOHOARDER_STORAGE_BACKEND
-  #     value: "s3"
-  #   - name: GOHOARDER_STORAGE_S3_BUCKET
-  #     value: "my-bucket"
-  #   - name: GOHOARDER_METADATA_POSTGRESQL_PASSWORD
-  #     valueFrom:
-  #       secretKeyRef:
-  #         name: postgres-secret
-  #         key: password
-  env: []
-
   # Service configuration
   service:
     type: ClusterIP
@@ -158,20 +109,13 @@ server:
 
 # Frontend configuration
 frontend:
-  # Backend URL for API calls
-  backendUrl: ""  # Auto-configured if empty
-
-  # Additional environment variables for frontend container
-  # env:
-  #   - name: API_BASE_URL
-  #     value: "https://api.example.com"
-  env: []
+  port: 3000
 
   # Service configuration
   service:
     type: ClusterIP
     port: 80
-    targetPort: 80
+    targetPort: 3000
     annotations: {}
 
   # Resource limits
@@ -204,12 +148,6 @@ frontend:
 
 # Scanner configuration
 scanner:
-  # Additional environment variables for scanner container
-  # env:
-  #   - name: GOHOARDER_SECURITY_SCANNERS_TRIVY_ENABLED
-  #     value: "true"
-  env: []
-
   # Resource limits
   resources:
     limits:
@@ -226,24 +164,17 @@ scanner:
 # Storage configuration
 storage:
   # Storage backend: filesystem, s3, smb
-  # For multiple server replicas:
-  #   - S3 or SMB (recommended)
-  #   - Filesystem with ReadWriteMany (RWX) storage class (Longhorn, NFS, CephFS)
-  #   - NOT filesystem with ReadWriteOnce (RWO) or local storage
   backend: "filesystem"
 
   # Filesystem storage
   filesystem:
     # Storage class for PVC
-    # For multiple replicas: use RWX-capable storage class (longhorn, nfs-client, cephfs, etc.)
     storageClass: ""
     # Storage size
     size: "100Gi"
-    # Access mode:
-    #   ReadWriteOnce (RWO) - Single replica only
-    #   ReadWriteMany (RWX) - Multiple replicas (requires RWX storage class)
+    # Access mode
     accessMode: "ReadWriteOnce"
-    # Use hostPath instead of PVC (for single-node testing only)
+    # Use hostPath instead of PVC (for single-node testing)
     useHostPath: false
     hostPath: "/var/lib/gohoarder"
     # Existing PVC name (if you want to use existing PVC)
@@ -272,48 +203,21 @@ storage:
 
 # Metadata storage configuration
 metadata:
-  # Backend: sqlite, postgresql, mysql
-  #
-  # IMPORTANT: SQLite CANNOT be used with SMB/CIFS/NFS network storage!
-  # SQLite requires POSIX file locking which causes "database is locked" errors on network filesystems.
-  #
-  # Choose your configuration:
-  # 1. SQLite with local storage (development/single-node only)
-  #    - Set backend: sqlite
-  #    - Set sqlite.persistence.storageClass to a LOCAL storage class (e.g., "local-path")
-  #    - OR set sqlite.persistence.enabled: false to use emptyDir (data lost on pod restart)
-  #
-  # 2. PostgreSQL with any storage (RECOMMENDED for production)
-  #    - Set backend: postgresql
-  #    - Configure postgresql settings below
-  #    - Works with any storage including SMB/NFS
-  #    - Supports multiple replicas and high availability
-  #
-  # 3. MySQL/MariaDB with any storage (alternative to PostgreSQL)
-  #    - Set backend: mysql
-  #    - Configure mysql settings below
-  #    - Works with any storage including SMB/NFS
-  #
+  # Backend: sqlite, postgresql
   backend: "sqlite"
 
   # SQLite configuration
-  # WARNING: Do NOT use SMB/CIFS/NFS storage classes with SQLite!
   sqlite:
     # Use PVC for SQLite database
-    # IMPORTANT: storageClass must be LOCAL storage, NOT network storage (smb/nfs)
     persistence:
-      enabled: false  # Changed to false by default - use emptyDir unless you have local storage
-      storageClass: ""  # Must be local-path or similar LOCAL storage class if enabled
+      enabled: true
+      storageClass: ""
       size: "10Gi"
       accessMode: "ReadWriteOnce"
       existingClaim: ""
-    # WAL mode provides better concurrency but doesn't work on network filesystems (SMB, NFS)
-    # Set to false when using network storage for the metadata volume
-    walMode: false
+    walMode: true
 
   # PostgreSQL configuration
-  # Works with any storage including SMB/NFS
-  # Recommended for production deployments
   postgresql:
     # Use bundled PostgreSQL (sets up postgresql subchart)
     enabled: false
@@ -322,57 +226,10 @@ metadata:
     database: "gohoarder"
     username: "gohoarder"
     password: ""
-    sslMode: "disable"  # disable, require, verify-ca, verify-full
+    sslMode: "disable"
     # Use existing secret for PostgreSQL credentials
     existingSecret: ""
 
-  # MySQL/MariaDB configuration
-  # Works with any storage including SMB/NFS
-  # Alternative to PostgreSQL for production deployments
-  mysql:
-    host: "localhost"
-    port: 3306
-    database: "gohoarder"
-    username: "gohoarder"
-    password: ""
-    charset: "utf8mb4"
-    parseTime: true
-    # Use existing secret for MySQL credentials
-    existingSecret: ""
-
-  # GORM connection pool settings (applies to all database backends)
-  # These settings control database connection pooling and performance
-  maxOpenConns: 25      # Maximum number of open connections to the database
-  maxIdleConns: 5       # Maximum number of idle connections in the pool
-  connMaxLifetime: 3600 # Maximum lifetime of a connection in seconds (1 hour)
-  logLevel: "warn"      # GORM log level: silent, error, warn, info
-
-# Database migration configuration
-migration:
-  # Enable automatic database migrations via init containers
-  # When enabled, each pod will run migrations before starting the main container
-  # Gormigrate handles concurrency automatically - safe for multiple pods
-  enabled: true
-
-  # Migration image configuration
-  image:
-    repository: ghcr.io/lukaszraczylo/gohoarder-migrate
-    pullPolicy: IfNotPresent
-    tag: "latest"  # Should match the application version
-
-  # Migration settings
-  logLevel: "info"    # debug, info, warn, error
-  timeout: "5m"       # Maximum time for migrations to complete
-
-  # Resource limits for migration init container
-  resources:
-    limits:
-      cpu: 500m
-      memory: 256Mi
-    requests:
-      cpu: 100m
-      memory: 128Mi
-
 # Cache configuration
 cache:
   defaultTTL: "168h"  # 7 days
@@ -507,12 +364,21 @@ ingress:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
 
-  # Single ingress routes all traffic to frontend
-  # Frontend now includes reverse proxy to backend (merged gateway functionality)
-  host: "gohoarder.local"
-  tls:
+  # Ingress for frontend
+  frontend:
+    enabled: true
+    host: "gohoarder.local"
+    tls:
+      enabled: false
+      secretName: "gohoarder-frontend-tls"
+
+  # Ingress for API (if you want separate ingress)
+  api:
     enabled: false
-    secretName: "gohoarder-tls"
+    host: "api.gohoarder.local"
+    tls:
+      enabled: false
+      secretName: "gohoarder-api-tls"
 
 # Autoscaling configuration
 autoscaling:

migrations/001_create_schema_v2_mysql.sql

@@ -1,367 +0,0 @@
--- GoHoarder Database Schema V2 - MySQL/MariaDB
--- Optimized for multi-user production deployments
--- Created: 2026-01-03
--- Requires: MySQL 8.0+ or MariaDB 10.5+
-
--- Set charset and collation
-SET NAMES utf8mb4;
-SET CHARACTER SET utf8mb4;
-
--- ============================================================================
--- TABLE: registries
--- Purpose: Normalized registry data (eliminates repeated strings)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS registries (
-    id              INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    name            VARCHAR(50) UNIQUE NOT NULL,
-    display_name    VARCHAR(100) NOT NULL,
-    upstream_url    VARCHAR(512) NOT NULL,
-    enabled         BOOLEAN NOT NULL DEFAULT TRUE,
-    scan_by_default BOOLEAN NOT NULL DEFAULT TRUE,
-    created_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at      TIMESTAMP NULL,
-
-    INDEX idx_registry_name (name),
-    INDEX idx_registry_enabled (enabled, deleted_at)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: packages
--- Purpose: Core package metadata with denormalized counts for performance
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS packages (
-    id                  BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    registry_id         INT UNSIGNED NOT NULL,
-    name                VARCHAR(255) NOT NULL,
-    version             VARCHAR(100) NOT NULL,
-
-    -- Storage information
-    storage_key         VARCHAR(512) UNIQUE NOT NULL,
-    size                BIGINT NOT NULL,
-    checksum_md5        CHAR(32),
-    checksum_sha256     CHAR(64),
-    upstream_url        VARCHAR(1024),
-
-    -- Cache management
-    cached_at           TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    last_accessed       TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    expires_at          TIMESTAMP NULL,
-    access_count        BIGINT NOT NULL DEFAULT 0,
-
-    -- Security (denormalized for performance)
-    security_scanned    BOOLEAN NOT NULL DEFAULT FALSE,
-    last_scanned_at     TIMESTAMP NULL,
-    vulnerability_count INT NOT NULL DEFAULT 0,
-    highest_severity    VARCHAR(20),
-
-    -- Authentication
-    requires_auth       BOOLEAN NOT NULL DEFAULT FALSE,
-    auth_provider       VARCHAR(50),
-
-    -- Audit trail
-    created_at          TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at          TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at          TIMESTAMP NULL,
-
-    FOREIGN KEY (registry_id) REFERENCES registries(id) ON DELETE RESTRICT ON UPDATE CASCADE,
-
-    UNIQUE INDEX idx_package_registry_name_version (registry_id, name, version, deleted_at),
-    INDEX idx_package_storage_key (storage_key),
-    INDEX idx_package_name (name(50)),
-    INDEX idx_package_last_accessed (last_accessed DESC),
-    INDEX idx_package_expires_at (expires_at),
-    INDEX idx_package_access_count (access_count DESC),
-    INDEX idx_package_size (size DESC),
-    INDEX idx_package_vuln_count (vulnerability_count),
-    INDEX idx_package_severity (highest_severity),
-    INDEX idx_package_security_scanned (security_scanned, deleted_at)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: package_metadata
--- Purpose: Structured metadata (1:1 with packages)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS package_metadata (
-    package_id  BIGINT UNSIGNED PRIMARY KEY,
-    author      VARCHAR(255),
-    license     VARCHAR(100),
-    homepage    VARCHAR(512),
-    repository  VARCHAR(512),
-    description TEXT,
-    keywords    JSON,       -- JSON array for MySQL 8.0+
-    raw_metadata JSON,      -- Full metadata as JSON
-    created_at  TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at  TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at  TIMESTAMP NULL,
-
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE CASCADE ON UPDATE CASCADE,
-
-    INDEX idx_metadata_author (author(100)),
-    INDEX idx_metadata_license (license)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: vulnerabilities
--- Purpose: Normalized vulnerability data (each CVE stored once)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS vulnerabilities (
-    id            BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    cve_id        VARCHAR(50) UNIQUE NOT NULL,
-    title         VARCHAR(512) NOT NULL,
-    description   TEXT,
-    severity      VARCHAR(20) NOT NULL,
-    cvss          FLOAT,
-    published_at  TIMESTAMP NOT NULL,
-    fixed_version VARCHAR(100),
-    references    JSON,
-    created_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at    TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at    TIMESTAMP NULL,
-
-    UNIQUE INDEX idx_vuln_cve_id (cve_id),
-    INDEX idx_vuln_severity (severity),
-    INDEX idx_vuln_cvss (cvss DESC),
-    INDEX idx_vuln_published (published_at DESC)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: package_vulnerabilities
--- Purpose: Many-to-many relationship between packages and vulnerabilities
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS package_vulnerabilities (
-    id                BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    package_id        BIGINT UNSIGNED NOT NULL,
-    vulnerability_id  BIGINT UNSIGNED NOT NULL,
-    scanner           VARCHAR(50) NOT NULL,
-    detected_at       TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    bypassed          BOOLEAN NOT NULL DEFAULT FALSE,
-    bypass_id         BIGINT UNSIGNED,
-    created_at        TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at        TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at        TIMESTAMP NULL,
-
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE CASCADE ON UPDATE CASCADE,
-    FOREIGN KEY (vulnerability_id) REFERENCES vulnerabilities(id) ON DELETE CASCADE ON UPDATE CASCADE,
-
-    INDEX idx_pkg_vuln_package (package_id, deleted_at),
-    INDEX idx_pkg_vuln_vuln (vulnerability_id, deleted_at),
-    INDEX idx_pkg_vuln_composite (package_id, vulnerability_id, deleted_at),
-    INDEX idx_pkg_vuln_scanner (scanner),
-    INDEX idx_pkg_vuln_bypassed (bypassed)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: scan_results
--- Purpose: Security scan results with severity breakdown
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS scan_results (
-    id             BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    package_id     BIGINT UNSIGNED NOT NULL,
-    scanner        VARCHAR(50) NOT NULL,
-    scanned_at     TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    status         VARCHAR(20) NOT NULL,
-    vuln_count     INT NOT NULL DEFAULT 0,
-    critical_count INT NOT NULL DEFAULT 0,
-    high_count     INT NOT NULL DEFAULT 0,
-    medium_count   INT NOT NULL DEFAULT 0,
-    low_count      INT NOT NULL DEFAULT 0,
-    scan_duration  INT NOT NULL DEFAULT 0,
-    details        JSON,
-    created_at     TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at     TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at     TIMESTAMP NULL,
-
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE CASCADE ON UPDATE CASCADE,
-
-    INDEX idx_scan_package_scanner (package_id, scanner, deleted_at),
-    INDEX idx_scan_scanned_at (scanned_at DESC),
-    INDEX idx_scan_status (status),
-    INDEX idx_scan_vuln_count (vuln_count)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: cve_bypasses
--- Purpose: CVE bypass rules with usage tracking
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS cve_bypasses (
-    id               BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    type             VARCHAR(20) NOT NULL,
-    target           VARCHAR(512) NOT NULL,
-    reason           TEXT NOT NULL,
-    created_by       VARCHAR(255) NOT NULL,
-    expires_at       TIMESTAMP NOT NULL,
-    notify_on_expiry BOOLEAN NOT NULL DEFAULT FALSE,
-    active           BOOLEAN NOT NULL DEFAULT TRUE,
-    usage_count      BIGINT NOT NULL DEFAULT 0,
-    last_used_at     TIMESTAMP NULL,
-    registry_id      INT UNSIGNED,
-    package_id       BIGINT UNSIGNED,
-    created_at       TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at       TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    deleted_at       TIMESTAMP NULL,
-
-    FOREIGN KEY (registry_id) REFERENCES registries(id) ON DELETE SET NULL ON UPDATE CASCADE,
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE SET NULL ON UPDATE CASCADE,
-
-    INDEX idx_bypass_type (type),
-    INDEX idx_bypass_target (target(100)),
-    INDEX idx_bypass_active (active, deleted_at),
-    INDEX idx_bypass_expires_at (expires_at, active),
-    INDEX idx_bypass_created_by (created_by(100))
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: download_events
--- Purpose: High-volume time-series data
--- Note: MySQL doesn't support native partitioning as elegantly as PostgreSQL
--- Consider manual partitioning or TimescaleDB if needed
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_events (
-    id            BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    package_id    BIGINT UNSIGNED NOT NULL,
-    registry_id   INT UNSIGNED NOT NULL,
-    downloaded_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    user_agent    VARCHAR(512),
-    ip_address    VARCHAR(45),
-    authenticated BOOLEAN NOT NULL DEFAULT FALSE,
-    username      VARCHAR(255),
-
-    INDEX idx_download_events_package (package_id, downloaded_at),
-    INDEX idx_download_events_registry (registry_id),
-    INDEX idx_download_events_time (downloaded_at)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: download_stats_hourly
--- Purpose: Pre-aggregated hourly statistics
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_stats_hourly (
-    id              BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    registry_id     INT UNSIGNED NOT NULL,
-    package_id      BIGINT UNSIGNED,
-    time_bucket     TIMESTAMP NOT NULL,
-    download_count  BIGINT NOT NULL DEFAULT 0,
-    unique_ips      BIGINT NOT NULL DEFAULT 0,
-    auth_downloads  BIGINT NOT NULL DEFAULT 0,
-    created_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-
-    FOREIGN KEY (registry_id) REFERENCES registries(id) ON DELETE CASCADE ON UPDATE CASCADE,
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE CASCADE ON UPDATE CASCADE,
-
-    UNIQUE INDEX idx_stats_hourly_composite (registry_id, IFNULL(package_id, 0), time_bucket),
-    INDEX idx_stats_hourly_time (time_bucket DESC)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: download_stats_daily
--- Purpose: Pre-aggregated daily statistics
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_stats_daily (
-    id              BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    registry_id     INT UNSIGNED NOT NULL,
-    package_id      BIGINT UNSIGNED,
-    time_bucket     TIMESTAMP NOT NULL,
-    download_count  BIGINT NOT NULL DEFAULT 0,
-    unique_ips      BIGINT NOT NULL DEFAULT 0,
-    auth_downloads  BIGINT NOT NULL DEFAULT 0,
-    top_user_agents JSON,
-    created_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at      TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-
-    FOREIGN KEY (registry_id) REFERENCES registries(id) ON DELETE CASCADE ON UPDATE CASCADE,
-    FOREIGN KEY (package_id) REFERENCES packages(id) ON DELETE CASCADE ON UPDATE CASCADE,
-
-    UNIQUE INDEX idx_stats_daily_composite (registry_id, IFNULL(package_id, 0), time_bucket),
-    INDEX idx_stats_daily_time (time_bucket DESC)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- TABLE: audit_log
--- Purpose: Audit trail for compliance
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS audit_log (
-    id          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
-    entity_type VARCHAR(50) NOT NULL,
-    entity_id   BIGINT NOT NULL,
-    action      VARCHAR(20) NOT NULL,
-    username    VARCHAR(255) NOT NULL,
-    timestamp   TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    changes     JSON,
-    ip_address  VARCHAR(45),
-    user_agent  VARCHAR(512),
-
-    INDEX idx_audit_log_entity (entity_type, entity_id),
-    INDEX idx_audit_log_username (username(100)),
-    INDEX idx_audit_log_timestamp (timestamp DESC)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- ============================================================================
--- SEED DATA: Default registries
--- ============================================================================
-
-INSERT INTO registries (name, display_name, upstream_url, enabled, scan_by_default) VALUES
-    ('npm', 'NPM Registry', 'https://registry.npmjs.org', TRUE, TRUE),
-    ('pypi', 'PyPI', 'https://pypi.org', TRUE, TRUE),
-    ('go', 'Go Modules', 'https://proxy.golang.org', TRUE, TRUE)
-ON DUPLICATE KEY UPDATE
-    display_name = VALUES(display_name),
-    upstream_url = VALUES(upstream_url);
-
--- ============================================================================
--- VIEWS: Convenience views for common queries
--- ============================================================================
-
-CREATE OR REPLACE VIEW v_vulnerable_packages AS
-SELECT
-    r.name AS registry,
-    p.name,
-    p.version,
-    p.vulnerability_count,
-    p.highest_severity,
-    p.last_scanned_at
-FROM packages p
-JOIN registries r ON p.registry_id = r.id
-WHERE p.vulnerability_count > 0 AND p.deleted_at IS NULL
-ORDER BY
-    CASE p.highest_severity
-        WHEN 'critical' THEN 1
-        WHEN 'high' THEN 2
-        WHEN 'medium' THEN 3
-        WHEN 'low' THEN 4
-        ELSE 5
-    END,
-    p.vulnerability_count DESC;
-
--- ============================================================================
--- PERFORMANCE TUNING RECOMMENDATIONS
--- ============================================================================
-
--- Set InnoDB buffer pool size to 50-70% of RAM
--- SET GLOBAL innodb_buffer_pool_size = 4294967296; -- 4GB
-
--- Enable query cache (MySQL 5.7 and earlier)
--- SET GLOBAL query_cache_type = 1;
--- SET GLOBAL query_cache_size = 67108864; -- 64MB
-
--- Optimize for SSD
--- SET GLOBAL innodb_flush_log_at_trx_commit = 2;
--- SET GLOBAL innodb_io_capacity = 2000;
-
--- ============================================================================
--- COMPLETE
--- ============================================================================
-
-SELECT 'Schema V2 created successfully for MySQL/MariaDB!' AS status;

migrations/001_create_schema_v2_postgres.sql

@@ -1,470 +0,0 @@
--- GoHoarder Database Schema V2 - PostgreSQL
--- Optimized for multi-user production deployments
--- Created: 2026-01-03
-
--- Enable required extensions
-CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
-
--- ============================================================================
--- TABLE: registries
--- Purpose: Normalized registry data (eliminates repeated strings)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS registries (
-    id              SERIAL PRIMARY KEY,
-    name            VARCHAR(50) UNIQUE NOT NULL,
-    display_name    VARCHAR(100) NOT NULL,
-    upstream_url    VARCHAR(512) NOT NULL,
-    enabled         BOOLEAN NOT NULL DEFAULT TRUE,
-    scan_by_default BOOLEAN NOT NULL DEFAULT TRUE,
-    created_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at      TIMESTAMP
-);
-
-CREATE INDEX idx_registry_name ON registries(name) WHERE deleted_at IS NULL;
-CREATE INDEX idx_registry_enabled ON registries(enabled) WHERE enabled = TRUE AND deleted_at IS NULL;
-
-COMMENT ON TABLE registries IS 'Normalized registry data (npm, pypi, go)';
-COMMENT ON COLUMN registries.name IS 'Short name: npm, pypi, go';
-COMMENT ON COLUMN registries.display_name IS 'Human-readable name: NPM Registry, PyPI';
-
--- ============================================================================
--- TABLE: packages
--- Purpose: Core package metadata with denormalized counts for performance
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS packages (
-    id                  BIGSERIAL PRIMARY KEY,
-    registry_id         INTEGER NOT NULL REFERENCES registries(id) ON DELETE RESTRICT,
-    name                VARCHAR(255) NOT NULL,
-    version             VARCHAR(100) NOT NULL,
-
-    -- Storage information
-    storage_key         VARCHAR(512) UNIQUE NOT NULL,
-    size                BIGINT NOT NULL,
-    checksum_md5        VARCHAR(32),
-    checksum_sha256     VARCHAR(64),
-    upstream_url        VARCHAR(1024),
-
-    -- Cache management
-    cached_at           TIMESTAMP NOT NULL DEFAULT NOW(),
-    last_accessed       TIMESTAMP NOT NULL DEFAULT NOW(),
-    expires_at          TIMESTAMP,
-    access_count        BIGINT NOT NULL DEFAULT 0,
-
-    -- Security (denormalized for performance)
-    security_scanned    BOOLEAN NOT NULL DEFAULT FALSE,
-    last_scanned_at     TIMESTAMP,
-    vulnerability_count INTEGER NOT NULL DEFAULT 0,
-    highest_severity    VARCHAR(20), -- critical, high, medium, low, none
-
-    -- Authentication
-    requires_auth       BOOLEAN NOT NULL DEFAULT FALSE,
-    auth_provider       VARCHAR(50),
-
-    -- Audit trail
-    created_at          TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at          TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at          TIMESTAMP
-);
-
--- Composite indexes for common queries
-CREATE UNIQUE INDEX idx_package_registry_name_version
-    ON packages(registry_id, name, version) WHERE deleted_at IS NULL;
-
-CREATE INDEX idx_package_storage_key ON packages(storage_key);
-CREATE INDEX idx_package_name ON packages(name text_pattern_ops) WHERE deleted_at IS NULL;
-CREATE INDEX idx_package_last_accessed ON packages(last_accessed DESC) WHERE deleted_at IS NULL;
-CREATE INDEX idx_package_expires_at ON packages(expires_at) WHERE expires_at IS NOT NULL AND deleted_at IS NULL;
-CREATE INDEX idx_package_access_count ON packages(access_count DESC) WHERE deleted_at IS NULL;
-CREATE INDEX idx_package_size ON packages(size DESC);
-
--- Partial indexes for security queries
-CREATE INDEX idx_package_vuln_count ON packages(vulnerability_count) WHERE vulnerability_count > 0 AND deleted_at IS NULL;
-CREATE INDEX idx_package_severity ON packages(highest_severity) WHERE highest_severity IN ('critical', 'high') AND deleted_at IS NULL;
-CREATE INDEX idx_package_security_scanned ON packages(security_scanned) WHERE deleted_at IS NULL;
-
-COMMENT ON TABLE packages IS 'Core package metadata (optimized V2 schema)';
-COMMENT ON COLUMN packages.access_count IS 'Total downloads (denormalized from stats)';
-COMMENT ON COLUMN packages.vulnerability_count IS 'Number of vulnerabilities (denormalized)';
-
--- ============================================================================
--- TABLE: package_metadata
--- Purpose: Structured metadata (1:1 with packages, reduces main table size)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS package_metadata (
-    package_id  BIGINT PRIMARY KEY REFERENCES packages(id) ON DELETE CASCADE,
-    author      VARCHAR(255),
-    license     VARCHAR(100),
-    homepage    VARCHAR(512),
-    repository  VARCHAR(512),
-    description TEXT,
-    keywords    JSONB,      -- Array of keywords
-    raw_metadata JSONB,     -- Full metadata
-    created_at  TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at  TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at  TIMESTAMP
-);
-
-CREATE INDEX idx_metadata_author ON package_metadata(author);
-CREATE INDEX idx_metadata_license ON package_metadata(license);
-CREATE INDEX idx_metadata_keywords ON package_metadata USING GIN(keywords);
-CREATE INDEX idx_metadata_raw ON package_metadata USING GIN(raw_metadata);
-
-COMMENT ON TABLE package_metadata IS 'Structured package metadata (separated for performance)';
-
--- ============================================================================
--- TABLE: vulnerabilities
--- Purpose: Normalized vulnerability data (each CVE stored once)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS vulnerabilities (
-    id           BIGSERIAL PRIMARY KEY,
-    cve_id       VARCHAR(50) UNIQUE NOT NULL,
-    title        VARCHAR(512) NOT NULL,
-    description  TEXT,
-    severity     VARCHAR(20) NOT NULL, -- critical, high, medium, low
-    cvss         REAL,
-    published_at TIMESTAMP NOT NULL,
-    fixed_version VARCHAR(100),
-    references   JSONB, -- Array of URLs
-    created_at   TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at   TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at   TIMESTAMP
-);
-
-CREATE UNIQUE INDEX idx_vuln_cve_id ON vulnerabilities(cve_id);
-CREATE INDEX idx_vuln_severity ON vulnerabilities(severity);
-CREATE INDEX idx_vuln_cvss ON vulnerabilities(cvss DESC NULLS LAST);
-CREATE INDEX idx_vuln_published ON vulnerabilities(published_at DESC);
-
-COMMENT ON TABLE vulnerabilities IS 'Normalized vulnerability data (99% storage reduction)';
-
--- ============================================================================
--- TABLE: package_vulnerabilities
--- Purpose: Many-to-many relationship between packages and vulnerabilities
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS package_vulnerabilities (
-    id              BIGSERIAL PRIMARY KEY,
-    package_id      BIGINT NOT NULL REFERENCES packages(id) ON DELETE CASCADE,
-    vulnerability_id BIGINT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
-    scanner         VARCHAR(50) NOT NULL,
-    detected_at     TIMESTAMP NOT NULL DEFAULT NOW(),
-    bypassed        BOOLEAN NOT NULL DEFAULT FALSE,
-    bypass_id       BIGINT, -- References cve_bypasses.id (soft reference)
-    created_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at      TIMESTAMP
-);
-
-CREATE INDEX idx_pkg_vuln_package ON package_vulnerabilities(package_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_pkg_vuln_vuln ON package_vulnerabilities(vulnerability_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_pkg_vuln_composite ON package_vulnerabilities(package_id, vulnerability_id) WHERE deleted_at IS NULL;
-CREATE INDEX idx_pkg_vuln_scanner ON package_vulnerabilities(scanner);
-CREATE INDEX idx_pkg_vuln_bypassed ON package_vulnerabilities(bypassed) WHERE bypassed = FALSE;
-
--- ============================================================================
--- TABLE: scan_results
--- Purpose: Security scan results with severity breakdown
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS scan_results (
-    id             BIGSERIAL PRIMARY KEY,
-    package_id     BIGINT NOT NULL REFERENCES packages(id) ON DELETE CASCADE,
-    scanner        VARCHAR(50) NOT NULL,
-    scanned_at     TIMESTAMP NOT NULL DEFAULT NOW(),
-    status         VARCHAR(20) NOT NULL, -- success, failed, pending
-    vuln_count     INTEGER NOT NULL DEFAULT 0,
-    critical_count INTEGER NOT NULL DEFAULT 0,
-    high_count     INTEGER NOT NULL DEFAULT 0,
-    medium_count   INTEGER NOT NULL DEFAULT 0,
-    low_count      INTEGER NOT NULL DEFAULT 0,
-    scan_duration  INTEGER NOT NULL DEFAULT 0, -- milliseconds
-    details        JSONB,
-    created_at     TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at     TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at     TIMESTAMP
-);
-
-CREATE INDEX idx_scan_package_scanner ON scan_results(package_id, scanner) WHERE deleted_at IS NULL;
-CREATE INDEX idx_scan_scanned_at ON scan_results(scanned_at DESC);
-CREATE INDEX idx_scan_status ON scan_results(status);
-CREATE INDEX idx_scan_vuln_count ON scan_results(vuln_count) WHERE vuln_count > 0;
-
-COMMENT ON TABLE scan_results IS 'Security scan results (optimized V2)';
-
--- ============================================================================
--- TABLE: cve_bypasses
--- Purpose: CVE bypass rules with usage tracking
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS cve_bypasses (
-    id               BIGSERIAL PRIMARY KEY,
-    type             VARCHAR(20) NOT NULL, -- cve, package, registry
-    target           VARCHAR(512) NOT NULL,
-    reason           TEXT NOT NULL,
-    created_by       VARCHAR(255) NOT NULL,
-    expires_at       TIMESTAMP NOT NULL,
-    notify_on_expiry BOOLEAN NOT NULL DEFAULT FALSE,
-    active           BOOLEAN NOT NULL DEFAULT TRUE,
-    usage_count      BIGINT NOT NULL DEFAULT 0,
-    last_used_at     TIMESTAMP,
-    registry_id      INTEGER REFERENCES registries(id),
-    package_id       BIGINT REFERENCES packages(id),
-    created_at       TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at       TIMESTAMP NOT NULL DEFAULT NOW(),
-    deleted_at       TIMESTAMP
-);
-
-CREATE INDEX idx_bypass_type ON cve_bypasses(type);
-CREATE INDEX idx_bypass_target ON cve_bypasses(target);
-CREATE INDEX idx_bypass_active ON cve_bypasses(active) WHERE active = TRUE AND deleted_at IS NULL;
-CREATE INDEX idx_bypass_expires_at ON cve_bypasses(expires_at) WHERE active = TRUE;
-CREATE INDEX idx_bypass_created_by ON cve_bypasses(created_by);
-
-COMMENT ON TABLE cve_bypasses IS 'CVE bypass rules with scope limiting';
-
--- ============================================================================
--- PARTITIONED TABLE: download_events
--- Purpose: High-volume time-series data (partitioned by month)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_events (
-    id            BIGSERIAL,
-    package_id    BIGINT NOT NULL,
-    registry_id   INTEGER NOT NULL,
-    downloaded_at TIMESTAMP NOT NULL,
-    user_agent    VARCHAR(512),
-    ip_address    VARCHAR(45),
-    authenticated BOOLEAN NOT NULL DEFAULT FALSE,
-    username      VARCHAR(255)
-) PARTITION BY RANGE (downloaded_at);
-
-CREATE INDEX idx_download_events_package ON download_events(package_id, downloaded_at);
-CREATE INDEX idx_download_events_registry ON download_events(registry_id);
-CREATE INDEX idx_download_events_time ON download_events(downloaded_at);
-
-COMMENT ON TABLE download_events IS 'Download events (partitioned by month for performance)';
-
--- Create partitions for current month ± 2 months
-DO $$
-DECLARE
-    start_date DATE;
-    end_date DATE;
-    partition_name TEXT;
-    i INTEGER;
-BEGIN
-    FOR i IN -2..2 LOOP
-        start_date := date_trunc('month', NOW() + (i || ' months')::INTERVAL)::DATE;
-        end_date := (start_date + INTERVAL '1 month')::DATE;
-        partition_name := 'download_events_' || to_char(start_date, 'YYYY_MM');
-
-        EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF download_events FOR VALUES FROM (%L) TO (%L)',
-            partition_name, start_date, end_date);
-
-        EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(package_id, downloaded_at)',
-            partition_name || '_package_idx', partition_name);
-        EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(registry_id)',
-            partition_name || '_registry_idx', partition_name);
-    END LOOP;
-END $$;
-
--- ============================================================================
--- TABLE: download_stats_hourly
--- Purpose: Pre-aggregated hourly statistics (1000x faster queries)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_stats_hourly (
-    id              BIGSERIAL PRIMARY KEY,
-    registry_id     INTEGER NOT NULL REFERENCES registries(id),
-    package_id      BIGINT REFERENCES packages(id), -- NULL = all packages in registry
-    time_bucket     TIMESTAMP NOT NULL,
-    download_count  BIGINT NOT NULL DEFAULT 0,
-    unique_ips      BIGINT NOT NULL DEFAULT 0,
-    auth_downloads  BIGINT NOT NULL DEFAULT 0,
-    created_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at      TIMESTAMP NOT NULL DEFAULT NOW()
-);
-
-CREATE UNIQUE INDEX idx_stats_hourly_composite
-    ON download_stats_hourly(registry_id, COALESCE(package_id, 0), time_bucket);
-CREATE INDEX idx_stats_hourly_time ON download_stats_hourly(time_bucket DESC);
-
-COMMENT ON TABLE download_stats_hourly IS 'Hourly aggregated stats (pre-computed)';
-
--- ============================================================================
--- TABLE: download_stats_daily
--- Purpose: Pre-aggregated daily statistics with analytics
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS download_stats_daily (
-    id              BIGSERIAL PRIMARY KEY,
-    registry_id     INTEGER NOT NULL REFERENCES registries(id),
-    package_id      BIGINT REFERENCES packages(id),
-    time_bucket     TIMESTAMP NOT NULL,
-    download_count  BIGINT NOT NULL DEFAULT 0,
-    unique_ips      BIGINT NOT NULL DEFAULT 0,
-    auth_downloads  BIGINT NOT NULL DEFAULT 0,
-    top_user_agents JSONB,
-    created_at      TIMESTAMP NOT NULL DEFAULT NOW(),
-    updated_at      TIMESTAMP NOT NULL DEFAULT NOW()
-);
-
-CREATE UNIQUE INDEX idx_stats_daily_composite
-    ON download_stats_daily(registry_id, COALESCE(package_id, 0), time_bucket);
-CREATE INDEX idx_stats_daily_time ON download_stats_daily(time_bucket DESC);
-
-COMMENT ON TABLE download_stats_daily IS 'Daily aggregated stats with analytics';
-
--- ============================================================================
--- PARTITIONED TABLE: audit_log
--- Purpose: Audit trail for compliance (partitioned by month)
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS audit_log (
-    id          BIGSERIAL,
-    entity_type VARCHAR(50) NOT NULL,
-    entity_id   BIGINT NOT NULL,
-    action      VARCHAR(20) NOT NULL, -- create, update, delete
-    username    VARCHAR(255) NOT NULL,
-    timestamp   TIMESTAMP NOT NULL DEFAULT NOW(),
-    changes     JSONB,
-    ip_address  VARCHAR(45),
-    user_agent  VARCHAR(512)
-) PARTITION BY RANGE (timestamp);
-
-CREATE INDEX idx_audit_log_entity ON audit_log(entity_type, entity_id);
-CREATE INDEX idx_audit_log_username ON audit_log(username);
-CREATE INDEX idx_audit_log_timestamp ON audit_log(timestamp DESC);
-
-COMMENT ON TABLE audit_log IS 'Audit trail for compliance and debugging';
-
--- Create audit_log partitions
-DO $$
-DECLARE
-    start_date DATE;
-    end_date DATE;
-    partition_name TEXT;
-    i INTEGER;
-BEGIN
-    FOR i IN -1..2 LOOP
-        start_date := date_trunc('month', NOW() + (i || ' months')::INTERVAL)::DATE;
-        end_date := (start_date + INTERVAL '1 month')::DATE;
-        partition_name := 'audit_log_' || to_char(start_date, 'YYYY_MM');
-
-        EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF audit_log FOR VALUES FROM (%L) TO (%L)',
-            partition_name, start_date, end_date);
-
-        EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(entity_type, entity_id)',
-            partition_name || '_entity_idx', partition_name);
-        EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(username)',
-            partition_name || '_user_idx', partition_name);
-    END LOOP;
-END $$;
-
--- ============================================================================
--- FUNCTIONS: Automatic partition creation
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION create_next_month_partitions()
-RETURNS void AS $$
-DECLARE
-    next_month DATE := date_trunc('month', NOW() + INTERVAL '2 months');
-    partition_name TEXT;
-    start_date TEXT;
-    end_date TEXT;
-BEGIN
-    -- Download events partition
-    partition_name := 'download_events_' || to_char(next_month, 'YYYY_MM');
-    start_date := to_char(next_month, 'YYYY-MM-DD');
-    end_date := to_char(next_month + INTERVAL '1 month', 'YYYY-MM-DD');
-
-    EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF download_events FOR VALUES FROM (%L) TO (%L)',
-        partition_name, start_date, end_date);
-
-    EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(package_id, downloaded_at)',
-        partition_name || '_package_idx', partition_name);
-    EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(registry_id)',
-        partition_name || '_registry_idx', partition_name);
-
-    -- Audit log partition
-    partition_name := 'audit_log_' || to_char(next_month, 'YYYY_MM');
-
-    EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF audit_log FOR VALUES FROM (%L) TO (%L)',
-        partition_name, start_date, end_date);
-
-    EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(entity_type, entity_id)',
-        partition_name || '_entity_idx', partition_name);
-
-    RAISE NOTICE 'Created partitions for %', to_char(next_month, 'YYYY-MM');
-END;
-$$ LANGUAGE plpgsql;
-
-COMMENT ON FUNCTION create_next_month_partitions() IS 'Auto-create partitions for next month';
-
--- ============================================================================
--- TRIGGERS: Updated_at timestamp
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION update_updated_at_column()
-RETURNS TRIGGER AS $$
-BEGIN
-    NEW.updated_at = NOW();
-    RETURN NEW;
-END;
-$$ LANGUAGE plpgsql;
-
-CREATE TRIGGER update_registries_updated_at BEFORE UPDATE ON registries
-    FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
-CREATE TRIGGER update_packages_updated_at BEFORE UPDATE ON packages
-    FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
-CREATE TRIGGER update_package_metadata_updated_at BEFORE UPDATE ON package_metadata
-    FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
--- ============================================================================
--- SEED DATA: Default registries
--- ============================================================================
-
-INSERT INTO registries (name, display_name, upstream_url, enabled, scan_by_default) VALUES
-    ('npm', 'NPM Registry', 'https://registry.npmjs.org', TRUE, TRUE),
-    ('pypi', 'PyPI', 'https://pypi.org', TRUE, TRUE),
-    ('go', 'Go Modules', 'https://proxy.golang.org', TRUE, TRUE)
-ON CONFLICT (name) DO NOTHING;
-
--- ============================================================================
--- VIEWS: Convenience views for common queries
--- ============================================================================
-
-CREATE OR REPLACE VIEW v_vulnerable_packages AS
-SELECT
-    r.name AS registry,
-    p.name,
-    p.version,
-    p.vulnerability_count,
-    p.highest_severity,
-    p.last_scanned_at
-FROM packages p
-JOIN registries r ON p.registry_id = r.id
-WHERE p.vulnerability_count > 0 AND p.deleted_at IS NULL
-ORDER BY
-    CASE p.highest_severity
-        WHEN 'critical' THEN 1
-        WHEN 'high' THEN 2
-        WHEN 'medium' THEN 3
-        WHEN 'low' THEN 4
-        ELSE 5
-    END,
-    p.vulnerability_count DESC;
-
-COMMENT ON VIEW v_vulnerable_packages IS 'All packages with vulnerabilities (sorted by severity)';
-
--- ============================================================================
--- COMPLETE
--- ============================================================================
-
-SELECT 'Schema V2 created successfully!' AS status;

pkg/analytics/analytics.go

@@ -10,23 +10,23 @@ import (
 
 // PackageDownload represents a package download event
 type PackageDownload struct {
-	Timestamp time.Time
 	Registry  string
 	Name      string
 	Version   string
+	Timestamp time.Time
+	BytesSize int64
 	ClientIP  string
 	UserAgent string
-	BytesSize int64
 }
 
 // PackageStats holds statistics for a package
 type PackageStats struct {
-	LastDownload   time.Time
-	FirstSeen      time.Time
 	Registry       string
 	Name           string
 	TotalDownloads int64
 	UniqueVersions int
+	LastDownload   time.Time
+	FirstSeen      time.Time
 	BytesServed    int64
 }
 
@@ -48,13 +48,13 @@ type PopularPackage struct {
 
 // Engine tracks and analyzes package downloads
 type Engine struct {
-	stats       map[string]*PackageStats
+	downloads   []PackageDownload
+	downloadsMu sync.RWMutex
+	stats       map[string]*PackageStats // key: registry:name
+	statsMu     sync.RWMutex
+	maxEvents   int
 	flushTicker *time.Ticker
 	stopChan    chan struct{}
-	downloads   []PackageDownload
-	maxEvents   int
-	downloadsMu sync.RWMutex
-	statsMu     sync.RWMutex
 }
 
 // Config holds analytics engine configuration

pkg/app/app.go

@@ -17,9 +17,10 @@ import (
 	"github.com/lukaszraczylo/gohoarder/pkg/cdn"
 	"github.com/lukaszraczylo/gohoarder/pkg/config"
 	"github.com/lukaszraczylo/gohoarder/pkg/health"
+	"github.com/lukaszraczylo/gohoarder/pkg/lock"
 	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
 	metafile "github.com/lukaszraczylo/gohoarder/pkg/metadata/file"
-	metagorm "github.com/lukaszraczylo/gohoarder/pkg/metadata/gormstore"
+	metasqlite "github.com/lukaszraczylo/gohoarder/pkg/metadata/sqlite"
 	"github.com/lukaszraczylo/gohoarder/pkg/metrics"
 	"github.com/lukaszraczylo/gohoarder/pkg/network"
 	"github.com/lukaszraczylo/gohoarder/pkg/prewarming"
@@ -29,8 +30,6 @@ import (
 	"github.com/lukaszraczylo/gohoarder/pkg/scanner"
 	"github.com/lukaszraczylo/gohoarder/pkg/storage"
 	"github.com/lukaszraczylo/gohoarder/pkg/storage/filesystem"
-	"github.com/lukaszraczylo/gohoarder/pkg/storage/s3"
-	"github.com/lukaszraczylo/gohoarder/pkg/storage/smb"
 	"github.com/lukaszraczylo/gohoarder/pkg/vcs"
 	"github.com/lukaszraczylo/gohoarder/pkg/websocket"
 	"github.com/rs/zerolog/log"
@@ -51,6 +50,7 @@ type App struct {
 	analyticsEngine *analytics.Engine
 	wsServer        *websocket.Server
 	prewarmWorker   *prewarming.Worker
+	lockManager     *lock.Manager
 	cdnMiddleware   *cdn.Middleware
 }
 
@@ -82,33 +82,7 @@ func (a *App) initializeComponents() error {
 	switch a.config.Storage.Backend {
 	case "filesystem":
 		a.storage, err = filesystem.New(a.config.Storage.Path, a.config.Cache.MaxSizeBytes)
-	case "s3":
-		a.storage, err = s3.New(s3.Config{
-			Region:          a.config.Storage.S3.Region,
-			Bucket:          a.config.Storage.S3.Bucket,
-			Prefix:          a.config.Storage.S3.Prefix,
-			AccessKeyID:     a.config.Storage.S3.AccessKeyID,
-			SecretAccessKey: a.config.Storage.S3.SecretAccessKey,
-			Endpoint:        a.config.Storage.S3.Endpoint,
-			ForcePathStyle:  a.config.Storage.S3.ForcePathStyle,
-			MaxSizeBytes:    a.config.Cache.MaxSizeBytes,
-		})
-	case "smb":
-		a.storage, err = smb.New(smb.Config{
-			Host:         a.config.Storage.SMB.Host,
-			Port:         445, // Default SMB port
-			Share:        a.config.Storage.SMB.Share,
-			Path:         a.config.Storage.Path,
-			Username:     a.config.Storage.SMB.Username,
-			Password:     a.config.Storage.SMB.Password,
-			Domain:       a.config.Storage.SMB.Domain,
-			MaxSizeBytes: a.config.Cache.MaxSizeBytes,
-			PoolSize:     5, // Default connection pool size
-		})
 	default:
-		log.Warn().
-			Str("backend", a.config.Storage.Backend).
-			Msg("Unknown storage backend, defaulting to filesystem")
 		a.storage, err = filesystem.New(a.config.Storage.Path, a.config.Cache.MaxSizeBytes)
 	}
 	if err != nil {
@@ -119,67 +93,16 @@ func (a *App) initializeComponents() error {
 	log.Info().Str("backend", a.config.Metadata.Backend).Msg("Initializing metadata store")
 	switch a.config.Metadata.Backend {
 	case "sqlite":
-		// Use GORM for SQLite
-		a.metadata, err = metagorm.NewV2(metagorm.Config{
-			Driver:          "sqlite",
-			DSN:             metagorm.BuildSQLiteDSN(a.config.Metadata.SQLite.Path, a.config.Metadata.SQLite.WALMode),
-			MaxOpenConns:    getOrDefault(a.config.Metadata.MaxOpenConns, 25),
-			MaxIdleConns:    getOrDefault(a.config.Metadata.MaxIdleConns, 5),
-			ConnMaxLifetime: time.Duration(getOrDefault(a.config.Metadata.ConnMaxLifetime, 3600)) * time.Second,
-			LogLevel:        getOrDefaultStr(a.config.Metadata.LogLevel, "warn"),
+		a.metadata, err = metasqlite.New(metasqlite.Config{
+			Path: a.config.Metadata.Connection,
 		})
-
-	case "postgresql", "postgres":
-		// Use GORM for PostgreSQL
-		dsn := metagorm.BuildPostgresDSN(
-			a.config.Metadata.PostgreSQL.Host,
-			a.config.Metadata.PostgreSQL.Port,
-			a.config.Metadata.PostgreSQL.User,
-			a.config.Metadata.PostgreSQL.Password,
-			a.config.Metadata.PostgreSQL.Database,
-			getOrDefaultStr(a.config.Metadata.PostgreSQL.SSLMode, "disable"),
-		)
-		a.metadata, err = metagorm.NewV2(metagorm.Config{
-			Driver:          "postgres",
-			DSN:             dsn,
-			MaxOpenConns:    getOrDefault(a.config.Metadata.MaxOpenConns, 25),
-			MaxIdleConns:    getOrDefault(a.config.Metadata.MaxIdleConns, 5),
-			ConnMaxLifetime: time.Duration(getOrDefault(a.config.Metadata.ConnMaxLifetime, 3600)) * time.Second,
-			LogLevel:        getOrDefaultStr(a.config.Metadata.LogLevel, "warn"),
-		})
-
-	case "mysql", "mariadb":
-		// Use GORM for MySQL/MariaDB
-		dsn := metagorm.BuildMySQLDSN(
-			a.config.Metadata.MySQL.Host,
-			a.config.Metadata.MySQL.Port,
-			a.config.Metadata.MySQL.User,
-			a.config.Metadata.MySQL.Password,
-			a.config.Metadata.MySQL.Database,
-			getOrDefaultStr(a.config.Metadata.MySQL.Charset, "utf8mb4"),
-		)
-		a.metadata, err = metagorm.NewV2(metagorm.Config{
-			Driver:          "mysql",
-			DSN:             dsn,
-			MaxOpenConns:    getOrDefault(a.config.Metadata.MaxOpenConns, 25),
-			MaxIdleConns:    getOrDefault(a.config.Metadata.MaxIdleConns, 5),
-			ConnMaxLifetime: time.Duration(getOrDefault(a.config.Metadata.ConnMaxLifetime, 3600)) * time.Second,
-			LogLevel:        getOrDefaultStr(a.config.Metadata.LogLevel, "warn"),
-		})
-
 	case "file":
-		// Keep file backend as-is for file-based metadata
 		a.metadata, err = metafile.New(metafile.Config{
 			Path: a.config.Metadata.Connection,
 		})
-
 	default:
-		// Default to SQLite with GORM
-		log.Warn().Str("backend", a.config.Metadata.Backend).Msg("Unknown metadata backend, defaulting to SQLite with GORM")
-		a.metadata, err = metagorm.NewV2(metagorm.Config{
-			Driver:   "sqlite",
-			DSN:      metagorm.BuildSQLiteDSN("gohoarder.db", false),
-			LogLevel: "warn",
+		a.metadata, err = metasqlite.New(metasqlite.Config{
+			Path: "gohoarder.db",
 		})
 	}
 	if err != nil {
@@ -193,16 +116,9 @@ func (a *App) initializeComponents() error {
 		return fmt.Errorf("failed to initialize scanner: %w", err)
 	}
 
-	// Initialize analytics engine first (needed by cache)
-	log.Info().Msg("Initializing analytics engine")
-	a.analyticsEngine = analytics.NewEngine(analytics.Config{
-		MaxEvents:     10000,
-		FlushInterval: 5 * time.Minute,
-	})
-
-	// Initialize cache manager with scanner and analytics
+	// Initialize cache manager with scanner
 	log.Info().Msg("Initializing cache manager")
-	a.cache, err = cache.New(a.storage, a.metadata, a.scanManager, a.analyticsEngine, cache.Config{
+	a.cache, err = cache.New(a.storage, a.metadata, a.scanManager, cache.Config{
 		DefaultTTL:      a.config.Cache.DefaultTTL,
 		CleanupInterval: 5 * time.Minute,
 	})
@@ -237,6 +153,13 @@ func (a *App) initializeComponents() error {
 		a.rescanWorker = scanner.NewRescanWorker(a.scanManager, a.metadata, a.storage, a.config.Security.RescanInterval)
 	}
 
+	// Initialize analytics engine
+	log.Info().Msg("Initializing analytics engine")
+	a.analyticsEngine = analytics.NewEngine(analytics.Config{
+		MaxEvents:     10000,
+		FlushInterval: 5 * time.Minute,
+	})
+
 	// Initialize WebSocket server
 	log.Info().Msg("Initializing WebSocket server")
 	a.wsServer = websocket.NewServer(websocket.Config{
@@ -290,9 +213,7 @@ func (a *App) initializeComponents() error {
 	a.healthChecker.AddCheck("scanner", func(ctx context.Context) (health.Status, string) {
 		if a.config.Security.Enabled {
 			if err := a.scanManager.Health(ctx); err != nil {
-				// Scanner failures (e.g., API rate limits) shouldn't mark server as unhealthy
-				// Server can still serve cached packages, just can't scan new ones
-				return health.StatusDegraded, err.Error()
+				return health.StatusUnhealthy, err.Error()
 			}
 		}
 		return health.StatusHealthy, ""
@@ -327,28 +248,9 @@ func (a *App) setupServer() error {
 	a.app.Get("/api/stats/timeseries", a.handleTimeSeriesStats)
 	a.app.Get("/api/info", a.handleInfo)
 
-	// Analytics endpoints
-	a.app.Get("/api/analytics/top", a.handleAnalyticsTopPackages)
-	a.app.Get("/api/analytics/trending", a.handleAnalyticsTrendingPackages)
-	a.app.Get("/api/analytics/trends", a.handleAnalyticsTrends)
-	a.app.Get("/api/analytics/total", a.handleAnalyticsTotalStats)
-	a.app.Get("/api/analytics/registry/:registry", a.handleAnalyticsRegistryStats)
-	a.app.Get("/api/analytics/package/:registry/:name", a.handleAnalyticsPackageStats)
-	a.app.Get("/api/analytics/search", a.handleAnalyticsSearch)
-
 	// Admin endpoints (bypass management)
 	a.app.All("/api/admin/bypasses/:id?", a.requireAdmin, a.handleAdminBypasses)
 
-	// Admin endpoints (pre-warming)
-	a.app.Get("/api/admin/prewarming/status", a.requireAdmin, a.handlePrewarmingStatus)
-	a.app.Post("/api/admin/prewarming/trigger", a.requireAdmin, a.handlePrewarmingTrigger)
-	a.app.Post("/api/admin/prewarming/package", a.requireAdmin, a.handlePrewarmingPackage)
-
-	// Admin endpoints (API key management)
-	a.app.Post("/api/admin/keys", a.requireAdmin, a.handleGenerateAPIKey)
-	a.app.Get("/api/admin/keys", a.requireAdmin, a.handleListAPIKeys)
-	a.app.Delete("/api/admin/keys/:key_id", a.requireAdmin, a.handleRevokeAPIKey)
-
 	// Proxy handlers (adapted from net/http)
 	// Load git credentials if configured
 	var credStore *vcs.CredentialStore
@@ -368,28 +270,22 @@ func (a *App) setupServer() error {
 		}
 	}
 
-	// Go proxy with CDN caching
 	goProxyHandler := goproxy.New(a.cache, a.networkClient, goproxy.Config{
 		Upstream:  "https://proxy.golang.org",
 		SumDBURL:  "https://sum.golang.org",
 		CredStore: credStore,
 	})
-	goProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/go", goProxyHandler))
-	a.app.All("/go/*", adaptor.HTTPHandler(goProxyWithCDN))
+	a.app.All("/go/*", adaptor.HTTPHandler(http.StripPrefix("/go", goProxyHandler)))
 
-	// NPM proxy with CDN caching
 	npmProxyHandler := npm.New(a.cache, a.networkClient, npm.Config{
 		Upstream: "https://registry.npmjs.org",
 	})
-	npmProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/npm", npmProxyHandler))
-	a.app.All("/npm/*", adaptor.HTTPHandler(npmProxyWithCDN))
+	a.app.All("/npm/*", adaptor.HTTPHandler(http.StripPrefix("/npm", npmProxyHandler)))
 
-	// PyPI proxy with CDN caching
 	pypiProxyHandler := pypi.New(a.cache, a.networkClient, pypi.Config{
 		Upstream: "https://pypi.org/simple",
 	})
-	pypiProxyWithCDN := a.cdnMiddleware.Handler(http.StripPrefix("/pypi", pypiProxyHandler))
-	a.app.All("/pypi/*", adaptor.HTTPHandler(pypiProxyWithCDN))
+	a.app.All("/pypi/*", adaptor.HTTPHandler(http.StripPrefix("/pypi", pypiProxyHandler)))
 
 	// Serve frontend static files
 	frontendDir := "frontend/dist"
@@ -501,6 +397,13 @@ func (a *App) Shutdown() error {
 		log.Error().Err(err).Msg("Error closing metadata store")
 	}
 
+	// Close lock manager if initialized
+	if a.lockManager != nil {
+		if err := a.lockManager.Close(); err != nil {
+			log.Error().Err(err).Msg("Error closing lock manager")
+		}
+	}
+
 	log.Info().Msg("Shutdown complete")
 	return nil
 }
@@ -530,19 +433,3 @@ func (a *App) startAggregationWorker(ctx context.Context) {
 		}
 	}
 }
-
-// getOrDefault returns the value if it's non-zero, otherwise returns the default
-func getOrDefault(value, defaultValue int) int {
-	if value == 0 {
-		return defaultValue
-	}
-	return value
-}
-
-// getOrDefaultStr returns the value if it's non-empty, otherwise returns the default
-func getOrDefaultStr(value, defaultValue string) string {
-	if value == "" {
-		return defaultValue
-	}
-	return value
-}

pkg/app/handlers.go

@@ -142,13 +142,6 @@ func (a *App) handleListPackages(c *fiber.Ctx) error {
 						severityCounts[strings.ToUpper(vuln.Severity)]++
 					}
 
-					// Check if package should be blocked based on thresholds
-					isBlocked := false
-					if a.scanManager != nil {
-						blocked, _, _ := a.scanManager.CheckVulnerabilities(ctx, pkg.Registry, entry.originalName, pkg.Version)
-						isBlocked = blocked
-					}
-
 					pkgMap["vulnerabilities"] = map[string]interface{}{
 						"scanned":   true,
 						"status":    scanResult.Status,
@@ -159,21 +152,18 @@ func (a *App) handleListPackages(c *fiber.Ctx) error {
 							"moderate": severityCounts["MODERATE"],
 							"low":      severityCounts["LOW"],
 						},
-						"total":     scanResult.VulnerabilityCount,
-						"isBlocked": isBlocked,
+						"total": scanResult.VulnerabilityCount,
 					}
 				} else {
 					pkgMap["vulnerabilities"] = map[string]interface{}{
-						"scanned":   false,
-						"status":    "pending",
-						"isBlocked": false,
+						"scanned": false,
+						"status":  "pending",
 					}
 				}
 			} else {
 				pkgMap["vulnerabilities"] = map[string]interface{}{
-					"scanned":   false,
-					"status":    "not_scanned",
-					"isBlocked": false,
+					"scanned": false,
+					"status":  "not_scanned",
 				}
 			}
 
@@ -361,9 +351,8 @@ func (a *App) handleStats(c *fiber.Ctx) error {
 		packages = []*metadata.Package{}
 	}
 
-	// Calculate per-registry breakdown and blocked packages count
+	// Calculate per-registry breakdown (exclude metadata entries like "list", "latest")
 	registryStats := make(map[string]map[string]interface{})
-	blockedCount := int64(0)
 
 	for _, pkg := range packages {
 		// Skip metadata entries (npm metadata pages, pypi pages, etc.)
@@ -382,14 +371,6 @@ func (a *App) handleStats(c *fiber.Ctx) error {
 		registryStats[pkg.Registry]["count"] = registryStats[pkg.Registry]["count"].(int) + 1
 		registryStats[pkg.Registry]["size"] = registryStats[pkg.Registry]["size"].(int64) + pkg.Size
 		registryStats[pkg.Registry]["downloads"] = registryStats[pkg.Registry]["downloads"].(int64) + int64(pkg.DownloadCount)
-
-		// Check if package is blocked (only if security scanning is enabled and package is scanned)
-		if a.config.Security.Enabled && a.scanManager != nil && pkg.SecurityScanned {
-			blocked, _, _ := a.scanManager.CheckVulnerabilities(ctx, pkg.Registry, pkg.Name, pkg.Version)
-			if blocked {
-				blockedCount++
-			}
-		}
 	}
 
 	// Combine statistics using database stats for accuracy
@@ -397,14 +378,12 @@ func (a *App) handleStats(c *fiber.Ctx) error {
 		"total_packages":      cacheStats.TotalPackages,
 		"total_downloads":     cacheStats.TotalDownloads,
 		"total_size":          cacheStats.TotalSize,
-		"max_cache_size":      a.config.Cache.MaxSizeBytes,
 		"cache_hits":          cacheStats.TotalDownloads,
 		"cache_misses":        0, // TODO: Track cache misses
 		"cache_evictions":     0, // TODO: Track evictions
 		"cache_size":          cacheStats.TotalSize,
 		"scanned_packages":    cacheStats.ScannedPackages,
 		"vulnerable_packages": cacheStats.VulnerablePackages,
-		"blocked_packages":    blockedCount,
 	}
 
 	// Convert registry stats to interface map
@@ -521,10 +500,11 @@ func (a *App) handleInfo(c *fiber.Ctx) error {
 			"max_cache_size":   a.config.Cache.MaxSizeBytes,
 		},
 		"features": map[string]bool{
-			"security_scanning": a.config.Security.Enabled,
-			"pre_warming":       a.prewarmWorker != nil,
-			"websockets":        true,
-			"analytics":         true,
+			"distributed_locking": a.lockManager != nil,
+			"security_scanning":   a.config.Security.Enabled,
+			"pre_warming":         a.prewarmWorker != nil,
+			"websockets":          true,
+			"analytics":           true,
 		},
 	}
 

pkg/app/handlers_admin.go

@@ -110,13 +110,13 @@ func (a *App) handleListBypasses(c *fiber.Ctx) error {
 
 // CreateBypassRequest represents the request body for creating a bypass
 type CreateBypassRequest struct {
-	Type           metadata.BypassType `json:"type"`
-	Target         string              `json:"target"`
-	Reason         string              `json:"reason"`
-	CreatedBy      string              `json:"created_by"`
-	AppliesTo      string              `json:"applies_to,omitempty"`
-	ExpiresInHours int                 `json:"expires_in_hours"`
-	NotifyOnExpiry bool                `json:"notify_on_expiry"`
+	Type           metadata.BypassType `json:"type"`                 // "cve" or "package"
+	Target         string              `json:"target"`               // CVE ID or package name
+	Reason         string              `json:"reason"`               // Why this bypass is needed
+	CreatedBy      string              `json:"created_by"`           // Admin username
+	ExpiresInHours int                 `json:"expires_in_hours"`     // How many hours until expiration
+	AppliesTo      string              `json:"applies_to,omitempty"` // Optional: limit CVE bypass to specific package
+	NotifyOnExpiry bool                `json:"notify_on_expiry"`     // Send notification when expired
 }
 
 // handleCreateBypass creates a new CVE bypass

pkg/app/handlers_analytics.go

@@ -1,149 +0,0 @@
-package app
-
-import (
-	"strconv"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/rs/zerolog/log"
-)
-
-// handleAnalyticsTopPackages returns the most downloaded packages
-func (a *App) handleAnalyticsTopPackages(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	// Get limit from query params (default: 10)
-	limit := 10
-	if limitStr := c.Query("limit"); limitStr != "" {
-		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
-			limit = parsedLimit
-		}
-	}
-
-	packages := a.analyticsEngine.GetTopPackages(limit)
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"packages": packages,
-		"total":    len(packages),
-	})
-}
-
-// handleAnalyticsTrendingPackages returns trending packages
-func (a *App) handleAnalyticsTrendingPackages(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	// Get limit from query params (default: 10)
-	limit := 10
-	if limitStr := c.Query("limit"); limitStr != "" {
-		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
-			limit = parsedLimit
-		}
-	}
-
-	packages := a.analyticsEngine.GetTrendingPackages(limit)
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"packages": packages,
-		"total":    len(packages),
-	})
-}
-
-// handleAnalyticsTrends returns download trends over time
-func (a *App) handleAnalyticsTrends(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	trends := a.analyticsEngine.GetTrends()
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"trends": trends,
-	})
-}
-
-// handleAnalyticsTotalStats returns overall statistics
-func (a *App) handleAnalyticsTotalStats(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	stats := a.analyticsEngine.GetTotalStats()
-
-	return c.Status(fiber.StatusOK).JSON(stats)
-}
-
-// handleAnalyticsRegistryStats returns per-registry statistics
-func (a *App) handleAnalyticsRegistryStats(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	registry := c.Params("registry")
-	if registry == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "registry parameter is required",
-		})
-	}
-
-	stats := a.analyticsEngine.GetRegistryStats(registry)
-
-	return c.Status(fiber.StatusOK).JSON(stats)
-}
-
-// handleAnalyticsPackageStats returns statistics for a specific package
-func (a *App) handleAnalyticsPackageStats(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	registry := c.Params("registry")
-	name := c.Params("name")
-
-	if registry == "" || name == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "registry and name parameters are required",
-		})
-	}
-
-	stats, exists := a.analyticsEngine.GetPackageStats(registry, name)
-	if !exists {
-		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
-			"error": "package not found in analytics",
-		})
-	}
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"package": stats,
-	})
-}
-
-// handleAnalyticsSearch searches for packages matching a query
-func (a *App) handleAnalyticsSearch(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-	c.Set("Access-Control-Allow-Origin", "*")
-
-	query := c.Query("q")
-	if query == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "query parameter 'q' is required",
-		})
-	}
-
-	// Get limit from query params (default: 20)
-	limit := 20
-	if limitStr := c.Query("limit"); limitStr != "" {
-		if parsedLimit, err := strconv.Atoi(limitStr); err == nil && parsedLimit > 0 {
-			limit = parsedLimit
-		}
-	}
-
-	results := a.analyticsEngine.SearchPackages(query, limit)
-
-	log.Debug().
-		Str("query", query).
-		Int("results", len(results)).
-		Msg("Analytics search completed")
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"results": results,
-		"total":   len(results),
-		"query":   query,
-	})
-}

pkg/app/handlers_analytics_test.go

@@ -1,298 +0,0 @@
-package app
-
-import (
-	"encoding/json"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/lukaszraczylo/gohoarder/pkg/analytics"
-	"github.com/stretchr/testify/suite"
-)
-
-type AnalyticsHandlersTestSuite struct {
-	suite.Suite
-	app     *fiber.App
-	appInst *App
-	engine  *analytics.Engine
-}
-
-func (s *AnalyticsHandlersTestSuite) SetupTest() {
-	// Create analytics engine
-	s.engine = analytics.NewEngine(analytics.Config{
-		MaxEvents:     10000,
-		FlushInterval: 5 * time.Minute,
-	})
-
-	// Seed some test data
-	s.engine.TrackDownload(analytics.PackageDownload{
-		Registry:  "npm",
-		Name:      "lodash",
-		Version:   "4.17.21",
-		Timestamp: time.Now(),
-		BytesSize: 1024,
-	})
-	s.engine.TrackDownload(analytics.PackageDownload{
-		Registry:  "npm",
-		Name:      "react",
-		Version:   "18.0.0",
-		Timestamp: time.Now(),
-		BytesSize: 2048,
-	})
-	s.engine.TrackDownload(analytics.PackageDownload{
-		Registry:  "pypi",
-		Name:      "requests",
-		Version:   "2.28.0",
-		Timestamp: time.Now(),
-		BytesSize: 512,
-	})
-
-	// Create app instance
-	s.appInst = &App{
-		analyticsEngine: s.engine,
-	}
-
-	// Create Fiber app
-	s.app = fiber.New()
-
-	// Register routes
-	s.app.Get("/api/analytics/top", s.appInst.handleAnalyticsTopPackages)
-	s.app.Get("/api/analytics/trending", s.appInst.handleAnalyticsTrendingPackages)
-	s.app.Get("/api/analytics/trends", s.appInst.handleAnalyticsTrends)
-	s.app.Get("/api/analytics/total", s.appInst.handleAnalyticsTotalStats)
-	s.app.Get("/api/analytics/registry/:registry", s.appInst.handleAnalyticsRegistryStats)
-	s.app.Get("/api/analytics/package/:registry/:name", s.appInst.handleAnalyticsPackageStats)
-	s.app.Get("/api/analytics/search", s.appInst.handleAnalyticsSearch)
-}
-
-func (s *AnalyticsHandlersTestSuite) TearDownTest() {
-	if s.engine != nil {
-		s.engine.Close()
-	}
-}
-
-func TestAnalyticsHandlersTestSuite(t *testing.T) {
-	suite.Run(t, new(AnalyticsHandlersTestSuite))
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTopPackages() {
-	tests := []struct {
-		name           string
-		queryParams    string
-		expectedStatus int
-		expectError    bool
-	}{
-		{
-			name:           "get top packages default",
-			queryParams:    "",
-			expectedStatus: 200,
-			expectError:    false,
-		},
-		{
-			name:           "get top packages with limit",
-			queryParams:    "?limit=5",
-			expectedStatus: 200,
-			expectError:    false,
-		},
-		{
-			name:           "get top packages with registry filter",
-			queryParams:    "?registry=npm",
-			expectedStatus: 200,
-			expectError:    false,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("GET", "/api/analytics/top"+tt.queryParams, nil)
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-
-			if !tt.expectError {
-				var result struct {
-					Packages []analytics.PackageStats `json:"packages"`
-					Total    int                      `json:"total"`
-				}
-				err = json.NewDecoder(resp.Body).Decode(&result)
-				s.NoError(err)
-			}
-		})
-	}
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTrendingPackages() {
-	req := httptest.NewRequest("GET", "/api/analytics/trending", nil)
-	resp, err := s.app.Test(req)
-	s.Require().NoError(err)
-	s.Equal(200, resp.StatusCode)
-
-	var result struct {
-		Packages []analytics.PackageStats `json:"packages"`
-		Total    int                      `json:"total"`
-	}
-	err = json.NewDecoder(resp.Body).Decode(&result)
-	s.NoError(err)
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTrends() {
-	tests := []struct {
-		name           string
-		queryParams    string
-		expectedStatus int
-	}{
-		{
-			name:           "get trends default timeframe",
-			queryParams:    "",
-			expectedStatus: 200,
-		},
-		{
-			name:           "get trends with registry filter",
-			queryParams:    "?registry=npm",
-			expectedStatus: 200,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("GET", "/api/analytics/trends"+tt.queryParams, nil)
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-		})
-	}
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsTotalStats() {
-	req := httptest.NewRequest("GET", "/api/analytics/total", nil)
-	resp, err := s.app.Test(req)
-	s.Require().NoError(err)
-	s.Equal(200, resp.StatusCode)
-
-	var result struct {
-		TotalDownloads int64 `json:"total_downloads"`
-		TotalBytes     int64 `json:"total_bytes"`
-		UniquePackages int   `json:"unique_packages"`
-	}
-	err = json.NewDecoder(resp.Body).Decode(&result)
-	s.NoError(err)
-	s.Greater(result.TotalDownloads, int64(0))
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsRegistryStats() {
-	tests := []struct {
-		name           string
-		registry       string
-		expectedStatus int
-	}{
-		{
-			name:           "npm registry stats",
-			registry:       "npm",
-			expectedStatus: 200,
-		},
-		{
-			name:           "pypi registry stats",
-			registry:       "pypi",
-			expectedStatus: 200,
-		},
-		{
-			name:           "go registry stats",
-			registry:       "go",
-			expectedStatus: 200,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("GET", "/api/analytics/registry/"+tt.registry, nil)
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-		})
-	}
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsPackageStats() {
-	tests := []struct {
-		name           string
-		registry       string
-		packageName    string
-		expectedStatus int
-	}{
-		{
-			name:           "lodash package stats",
-			registry:       "npm",
-			packageName:    "lodash",
-			expectedStatus: 200,
-		},
-		{
-			name:           "react package stats",
-			registry:       "npm",
-			packageName:    "react",
-			expectedStatus: 200,
-		},
-		{
-			name:           "requests package stats",
-			registry:       "pypi",
-			packageName:    "requests",
-			expectedStatus: 200,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("GET", "/api/analytics/package/"+tt.registry+"/"+tt.packageName, nil)
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-		})
-	}
-}
-
-func (s *AnalyticsHandlersTestSuite) TestHandleAnalyticsSearch() {
-	tests := []struct {
-		name           string
-		queryParams    string
-		expectedStatus int
-		expectError    bool
-	}{
-		{
-			name:           "search for lodash",
-			queryParams:    "?q=lodash",
-			expectedStatus: 200,
-			expectError:    false,
-		},
-		{
-			name:           "search for react",
-			queryParams:    "?q=react",
-			expectedStatus: 200,
-			expectError:    false,
-		},
-		{
-			name:           "search with no query",
-			queryParams:    "",
-			expectedStatus: 400, // Query parameter is required
-			expectError:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("GET", "/api/analytics/search"+tt.queryParams, nil)
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-
-			if !tt.expectError {
-				var result struct {
-					Results []analytics.PackageStats `json:"results"`
-					Total   int                      `json:"total"`
-					Query   string                   `json:"query"`
-				}
-				err = json.NewDecoder(resp.Body).Decode(&result)
-				s.NoError(err)
-			}
-		})
-	}
-}

pkg/app/handlers_auth.go

@@ -1,135 +0,0 @@
-package app
-
-import (
-	"time"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/lukaszraczylo/gohoarder/pkg/auth"
-	"github.com/rs/zerolog/log"
-)
-
-// GenerateAPIKeyRequest represents a request to generate a new API key
-type GenerateAPIKeyRequest struct {
-	ExpiresInMin *int   `json:"expires_in_min"`
-	Name         string `json:"name"`
-	Role         string `json:"role"`
-}
-
-// handleGenerateAPIKey generates a new API key
-func (a *App) handleGenerateAPIKey(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	var req GenerateAPIKeyRequest
-	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "invalid JSON in request body",
-		})
-	}
-
-	// Validate request
-	if req.Name == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "name is required",
-		})
-	}
-
-	// Parse role (default to readonly if not specified)
-	var role auth.Role
-	switch req.Role {
-	case "admin":
-		role = auth.RoleAdmin
-	case "readwrite":
-		role = auth.RoleReadWrite
-	case "readonly", "":
-		role = auth.RoleReadOnly
-	default:
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "invalid role, must be 'admin', 'readwrite', or 'readonly'",
-		})
-	}
-
-	// Calculate expiration
-	var expiresIn *time.Duration
-	if req.ExpiresInMin != nil {
-		duration := time.Duration(*req.ExpiresInMin) * time.Minute
-		expiresIn = &duration
-	}
-
-	// Generate key
-	apiKey, rawKey, err := a.authManager.GenerateAPIKey(req.Name, role, expiresIn)
-	if err != nil {
-		log.Error().Err(err).Str("name", req.Name).Msg("Failed to generate API key")
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
-			"error": "failed to generate API key",
-		})
-	}
-
-	log.Info().
-		Str("key_id", apiKey.ID).
-		Str("name", apiKey.Name).
-		Str("role", string(apiKey.Role)).
-		Msg("API key generated")
-
-	// Return the key info and raw key (only time it's shown!)
-	return c.Status(fiber.StatusCreated).JSON(fiber.Map{
-		"key":     rawKey, // IMPORTANT: This is the only time the raw key is shown
-		"key_id":  apiKey.ID,
-		"name":    apiKey.Name,
-		"role":    apiKey.Role,
-		"expires": apiKey.ExpiresAt,
-		"message": "Save this key now! It will not be shown again.",
-	})
-}
-
-// handleListAPIKeys lists all API keys
-func (a *App) handleListAPIKeys(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	keys := a.authManager.ListAPIKeys()
-
-	// Convert to response format (excluding hashed keys)
-	response := make([]fiber.Map, len(keys))
-	for i, key := range keys {
-		response[i] = fiber.Map{
-			"id":           key.ID,
-			"name":         key.Name,
-			"role":         key.Role,
-			"created_at":   key.CreatedAt,
-			"expires_at":   key.ExpiresAt,
-			"last_used_at": key.LastUsedAt,
-			"permissions":  key.Permissions,
-		}
-	}
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"keys":  response,
-		"total": len(response),
-	})
-}
-
-// handleRevokeAPIKey revokes an API key
-func (a *App) handleRevokeAPIKey(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	keyID := c.Params("key_id")
-	if keyID == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "key_id parameter is required",
-		})
-	}
-
-	err := a.authManager.RevokeAPIKey(keyID)
-	if err != nil {
-		log.Warn().Err(err).Str("key_id", keyID).Msg("Failed to revoke API key")
-		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
-			"error": "API key not found",
-		})
-	}
-
-	log.Info().Str("key_id", keyID).Msg("API key revoked")
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"message": "API key revoked successfully",
-		"key_id":  keyID,
-	})
-}

pkg/app/handlers_auth_test.go

@@ -1,285 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/lukaszraczylo/gohoarder/pkg/auth"
-	"github.com/stretchr/testify/suite"
-)
-
-type AuthHandlersTestSuite struct {
-	suite.Suite
-	app         *fiber.App
-	appInst     *App
-	authManager *auth.Manager
-}
-
-func (s *AuthHandlersTestSuite) SetupTest() {
-	// Create auth manager
-	s.authManager = auth.New()
-
-	// Create app instance
-	s.appInst = &App{
-		authManager: s.authManager,
-	}
-
-	// Create Fiber app
-	s.app = fiber.New()
-
-	// Register routes
-	s.app.Post("/api/admin/keys", s.appInst.handleGenerateAPIKey)
-	s.app.Get("/api/admin/keys", s.appInst.handleListAPIKeys)
-	s.app.Delete("/api/admin/keys/:key_id", s.appInst.handleRevokeAPIKey)
-}
-
-func TestAuthHandlersTestSuite(t *testing.T) {
-	suite.Run(t, new(AuthHandlersTestSuite))
-}
-
-func (s *AuthHandlersTestSuite) TestHandleGenerateAPIKey() {
-	tests := []struct {
-		requestBody    map[string]string
-		name           string
-		expectedStatus int
-		expectedRole   string
-		expectKey      bool
-	}{
-		{
-			name: "generate read-only key",
-			requestBody: map[string]string{
-				"role": "readonly",
-				"name": "test-readonly-key",
-			},
-			expectedStatus: 201,
-			expectedRole:   "readonly",
-			expectKey:      true,
-		},
-		{
-			name: "generate read-write key",
-			requestBody: map[string]string{
-				"role": "readwrite",
-				"name": "test-readwrite-key",
-			},
-			expectedStatus: 201,
-			expectedRole:   "readwrite",
-			expectKey:      true,
-		},
-		{
-			name: "generate admin key",
-			requestBody: map[string]string{
-				"role": "admin",
-				"name": "test-admin-key",
-			},
-			expectedStatus: 201,
-			expectedRole:   "admin",
-			expectKey:      true,
-		},
-		{
-			name: "invalid role",
-			requestBody: map[string]string{
-				"role": "invalid-role",
-				"name": "test-key",
-			},
-			expectedStatus: 400,
-			expectKey:      false,
-		},
-		{
-			name: "missing role defaults to readonly",
-			requestBody: map[string]string{
-				"name": "test-key-default-role",
-			},
-			expectedStatus: 201,
-			expectedRole:   "readonly", // Role defaults to readonly when not specified
-			expectKey:      true,
-		},
-		{
-			name: "missing name",
-			requestBody: map[string]string{
-				"role": "read-only",
-			},
-			expectedStatus: 400,
-			expectKey:      false,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			bodyBytes, err := json.Marshal(tt.requestBody)
-			s.Require().NoError(err)
-
-			req := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader(bodyBytes))
-			req.Header.Set("Content-Type", "application/json")
-
-			resp, err := s.app.Test(req, 5000) // 5 second timeout for CI environments
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-
-			if tt.expectKey {
-				var result struct {
-					Key     string `json:"key"`
-					KeyID   string `json:"key_id"`
-					Role    string `json:"role"`
-					Name    string `json:"name"`
-					Message string `json:"message"`
-				}
-				err = json.NewDecoder(resp.Body).Decode(&result)
-				s.NoError(err)
-				s.NotEmpty(result.Key)
-				s.NotEmpty(result.KeyID)
-				s.Equal(tt.expectedRole, result.Role)
-				s.Equal(tt.requestBody["name"], result.Name)
-			}
-		})
-	}
-}
-
-func (s *AuthHandlersTestSuite) TestHandleListAPIKeys() {
-	// Generate some test keys first
-	s.authManager.GenerateAPIKey("test-key-1", auth.RoleReadOnly, nil)
-	s.authManager.GenerateAPIKey("test-key-2", auth.RoleReadWrite, nil)
-	s.authManager.GenerateAPIKey("test-key-3", auth.RoleAdmin, nil)
-
-	req := httptest.NewRequest("GET", "/api/admin/keys", nil)
-	resp, err := s.app.Test(req, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(200, resp.StatusCode)
-
-	var result struct {
-		Keys  []map[string]interface{} `json:"keys"`
-		Total int                      `json:"total"`
-	}
-	err = json.NewDecoder(resp.Body).Decode(&result)
-	s.NoError(err)
-	s.GreaterOrEqual(result.Total, 3)
-
-	// Verify keys don't include the actual key value
-	for _, key := range result.Keys {
-		s.NotEmpty(key["id"])
-		s.NotEmpty(key["role"])
-		s.NotEmpty(key["name"])
-		s.NotEmpty(key["created_at"])
-	}
-}
-
-func (s *AuthHandlersTestSuite) TestHandleRevokeAPIKey() {
-	// Generate a test key
-	keyInfo, _, _ := s.authManager.GenerateAPIKey("test-revoke-key", auth.RoleReadOnly, nil)
-
-	tests := []struct {
-		name           string
-		keyID          string
-		expectedStatus int
-	}{
-		{
-			name:           "revoke existing key",
-			keyID:          keyInfo.ID,
-			expectedStatus: 200,
-		},
-		{
-			name:           "revoke non-existent key",
-			keyID:          "non-existent-key-id",
-			expectedStatus: 404,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			req := httptest.NewRequest("DELETE", "/api/admin/keys/"+tt.keyID, nil)
-			resp, err := s.app.Test(req, 5000) // 5 second timeout for CI environments
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-
-			if tt.expectedStatus == 200 {
-				var result map[string]string
-				err = json.NewDecoder(resp.Body).Decode(&result)
-				s.NoError(err)
-				s.Contains(result, "message")
-			}
-		})
-	}
-}
-
-func (s *AuthHandlersTestSuite) TestHandleGenerateAPIKeyInvalidJSON() {
-	req := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader([]byte("invalid json")))
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := s.app.Test(req, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(400, resp.StatusCode)
-}
-
-func (s *AuthHandlersTestSuite) TestGenerateAndRevokeKeyFlow() {
-	// Generate a key
-	bodyBytes, _ := json.Marshal(map[string]string{
-		"role": "readonly",
-		"name": "integration-test-key",
-	})
-
-	req1 := httptest.NewRequest("POST", "/api/admin/keys", bytes.NewReader(bodyBytes))
-	req1.Header.Set("Content-Type", "application/json")
-	resp1, err := s.app.Test(req1, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(201, resp1.StatusCode)
-
-	var createResult struct {
-		Key   string `json:"key"`
-		KeyID string `json:"key_id"`
-	}
-	err = json.NewDecoder(resp1.Body).Decode(&createResult)
-	s.Require().NoError(err)
-	keyID := createResult.KeyID
-
-	// List keys - should include our new key
-	req2 := httptest.NewRequest("GET", "/api/admin/keys", nil)
-	resp2, err := s.app.Test(req2, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(200, resp2.StatusCode)
-
-	var listResult struct {
-		Keys  []map[string]interface{} `json:"keys"`
-		Total int                      `json:"total"`
-	}
-	err = json.NewDecoder(resp2.Body).Decode(&listResult)
-	s.Require().NoError(err)
-
-	found := false
-	for _, key := range listResult.Keys {
-		if key["id"].(string) == keyID {
-			found = true
-			break
-		}
-	}
-	s.True(found, "newly created key should be in the list")
-
-	// Revoke the key
-	req3 := httptest.NewRequest("DELETE", "/api/admin/keys/"+keyID, nil)
-	resp3, err := s.app.Test(req3, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(200, resp3.StatusCode)
-
-	// List keys again - should not include the revoked key
-	req4 := httptest.NewRequest("GET", "/api/admin/keys", nil)
-	resp4, err := s.app.Test(req4, 5000) // 5 second timeout for CI environments
-	s.Require().NoError(err)
-	s.Equal(200, resp4.StatusCode)
-
-	var listResult2 struct {
-		Keys  []map[string]interface{} `json:"keys"`
-		Total int                      `json:"total"`
-	}
-	err = json.NewDecoder(resp4.Body).Decode(&listResult2)
-	s.Require().NoError(err)
-
-	found = false
-	for _, key := range listResult2.Keys {
-		if key["id"].(string) == keyID {
-			found = true
-			break
-		}
-	}
-	s.False(found, "revoked key should not be in the list")
-}

pkg/app/handlers_prewarming.go

@@ -1,94 +0,0 @@
-package app
-
-import (
-	"github.com/gofiber/fiber/v2"
-	"github.com/rs/zerolog/log"
-)
-
-// handlePrewarmingStatus returns the status of the pre-warming worker
-func (a *App) handlePrewarmingStatus(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	status := a.prewarmWorker.GetStatus()
-
-	return c.Status(fiber.StatusOK).JSON(status)
-}
-
-// handlePrewarmingTrigger manually triggers a pre-warming cycle
-func (a *App) handlePrewarmingTrigger(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	ctx := c.Context()
-	a.prewarmWorker.TriggerPrewarm(ctx)
-
-	log.Info().Msg("Pre-warming manually triggered via API")
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"message": "Pre-warming cycle triggered successfully",
-	})
-}
-
-// PrewarmPackageRequest represents a request to pre-warm a specific package
-type PrewarmPackageRequest struct {
-	Registry string `json:"registry"`
-	Name     string `json:"name"`
-	Version  string `json:"version"`
-}
-
-// handlePrewarmingPackage pre-warms a specific package
-func (a *App) handlePrewarmingPackage(c *fiber.Ctx) error {
-	c.Set("Content-Type", "application/json")
-
-	var req PrewarmPackageRequest
-	if err := c.BodyParser(&req); err != nil {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "invalid JSON in request body",
-		})
-	}
-
-	// Validate request
-	if req.Registry == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "registry is required",
-		})
-	}
-	if req.Name == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "name is required",
-		})
-	}
-	if req.Version == "" {
-		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
-			"error": "version is required",
-		})
-	}
-
-	ctx := c.Context()
-	err := a.prewarmWorker.PrewarmPackage(ctx, req.Registry, req.Name, req.Version)
-	if err != nil {
-		log.Error().
-			Err(err).
-			Str("registry", req.Registry).
-			Str("name", req.Name).
-			Str("version", req.Version).
-			Msg("Failed to pre-warm package")
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
-			"error": "failed to pre-warm package",
-		})
-	}
-
-	log.Info().
-		Str("registry", req.Registry).
-		Str("name", req.Name).
-		Str("version", req.Version).
-		Msg("Package pre-warmed via API")
-
-	return c.Status(fiber.StatusOK).JSON(fiber.Map{
-		"message": "Package pre-warmed successfully",
-		"package": fiber.Map{
-			"registry": req.Registry,
-			"name":     req.Name,
-			"version":  req.Version,
-		},
-	})
-}

pkg/app/handlers_prewarming_test.go

@@ -1,162 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/lukaszraczylo/gohoarder/pkg/prewarming"
-	"github.com/stretchr/testify/suite"
-)
-
-type PrewarmingHandlersTestSuite struct {
-	suite.Suite
-	app           *fiber.App
-	appInst       *App
-	prewarmWorker *prewarming.Worker
-}
-
-func (s *PrewarmingHandlersTestSuite) SetupTest() {
-	// Create pre-warming worker (disabled by default)
-	s.prewarmWorker = prewarming.NewWorker(prewarming.Config{
-		Enabled:       false,
-		MaxConcurrent: 5,
-	})
-
-	// Create app instance
-	s.appInst = &App{
-		prewarmWorker: s.prewarmWorker,
-	}
-
-	// Create Fiber app
-	s.app = fiber.New()
-
-	// Register routes
-	s.app.Get("/api/admin/prewarming/status", s.appInst.handlePrewarmingStatus)
-	s.app.Post("/api/admin/prewarming/trigger", s.appInst.handlePrewarmingTrigger)
-	s.app.Post("/api/admin/prewarming/package", s.appInst.handlePrewarmingPackage)
-}
-
-func (s *PrewarmingHandlersTestSuite) TearDownTest() {
-	if s.prewarmWorker != nil {
-		s.prewarmWorker.Stop()
-	}
-}
-
-func TestPrewarmingHandlersTestSuite(t *testing.T) {
-	suite.Run(t, new(PrewarmingHandlersTestSuite))
-}
-
-func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingStatus() {
-	req := httptest.NewRequest("GET", "/api/admin/prewarming/status", nil)
-	resp, err := s.app.Test(req)
-	s.Require().NoError(err)
-	s.Equal(200, resp.StatusCode)
-
-	var result struct {
-		Enabled       bool `json:"enabled"`
-		Running       bool `json:"running"`
-		QueueSize     int  `json:"queue_size"`
-		ActiveWorkers int  `json:"active_workers"`
-	}
-	err = json.NewDecoder(resp.Body).Decode(&result)
-	s.NoError(err)
-	s.False(result.Enabled) // Disabled in test setup
-}
-
-func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingTrigger() {
-	req := httptest.NewRequest("POST", "/api/admin/prewarming/trigger", nil)
-	resp, err := s.app.Test(req)
-	s.Require().NoError(err)
-	s.Equal(200, resp.StatusCode)
-
-	var result map[string]interface{}
-	err = json.NewDecoder(resp.Body).Decode(&result)
-	s.NoError(err)
-	s.Contains(result, "message")
-}
-
-func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingPackage() {
-	tests := []struct {
-		requestBody    map[string]string
-		name           string
-		expectedStatus int
-	}{
-		{
-			name: "prewarm npm package",
-			requestBody: map[string]string{
-				"registry": "npm",
-				"name":     "lodash",
-				"version":  "4.17.21",
-			},
-			expectedStatus: 200,
-		},
-		{
-			name: "prewarm pypi package",
-			requestBody: map[string]string{
-				"registry": "pypi",
-				"name":     "requests",
-				"version":  "2.28.0",
-			},
-			expectedStatus: 200,
-		},
-		{
-			name: "prewarm go package",
-			requestBody: map[string]string{
-				"registry": "go",
-				"name":     "github.com/stretchr/testify",
-				"version":  "v1.8.0",
-			},
-			expectedStatus: 200,
-		},
-		{
-			name: "missing registry",
-			requestBody: map[string]string{
-				"name":    "lodash",
-				"version": "4.17.21",
-			},
-			expectedStatus: 400,
-		},
-		{
-			name: "missing name",
-			requestBody: map[string]string{
-				"registry": "npm",
-				"version":  "4.17.21",
-			},
-			expectedStatus: 400,
-		},
-		{
-			name: "missing version",
-			requestBody: map[string]string{
-				"registry": "npm",
-				"name":     "lodash",
-			},
-			expectedStatus: 400,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			bodyBytes, err := json.Marshal(tt.requestBody)
-			s.Require().NoError(err)
-
-			req := httptest.NewRequest("POST", "/api/admin/prewarming/package", bytes.NewReader(bodyBytes))
-			req.Header.Set("Content-Type", "application/json")
-
-			resp, err := s.app.Test(req)
-			s.Require().NoError(err)
-			s.Equal(tt.expectedStatus, resp.StatusCode)
-		})
-	}
-}
-
-func (s *PrewarmingHandlersTestSuite) TestHandlePrewarmingPackageInvalidJSON() {
-	req := httptest.NewRequest("POST", "/api/admin/prewarming/package", bytes.NewReader([]byte("invalid json")))
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := s.app.Test(req)
-	s.Require().NoError(err)
-	s.Equal(400, resp.StatusCode)
-}

pkg/auth/validation_cache.go

@@ -7,9 +7,9 @@ import (
 
 // ValidationResult represents a cached credential validation result
 type ValidationResult struct {
+	Allowed   bool
 	ExpiresAt time.Time
 	Reason    string
-	Allowed   bool
 }
 
 // ValidationCache caches credential validation results to reduce upstream checks

pkg/cache/cache.go

@@ -11,7 +11,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/lukaszraczylo/gohoarder/pkg/analytics"
 	"github.com/lukaszraczylo/gohoarder/pkg/errors"
 	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
 	"github.com/lukaszraczylo/gohoarder/pkg/metrics"
@@ -28,21 +27,15 @@ type ScannerInterface interface {
 	CheckVulnerabilities(ctx context.Context, registry, packageName, version string) (blocked bool, reason string, err error)
 }
 
-// AnalyticsInterface defines the interface for analytics tracking
-type AnalyticsInterface interface {
-	TrackDownload(download analytics.PackageDownload)
-}
-
 // Manager coordinates caching operations between storage and metadata
 type Manager struct {
-	storage   storage.StorageBackend
-	metadata  metadata.MetadataStore
-	scanner   ScannerInterface
-	analytics AnalyticsInterface
-	sf        singleflight.Group
-	config    Config
-	mu        sync.RWMutex
-	evicting  bool
+	storage  storage.StorageBackend
+	metadata metadata.MetadataStore
+	scanner  ScannerInterface
+	config   Config
+	sf       singleflight.Group
+	mu       sync.RWMutex
+	evicting bool
 }
 
 // Config holds cache manager configuration
@@ -55,15 +48,15 @@ type Config struct {
 
 // CacheEntry represents a cached package
 type CacheEntry struct {
-	Data         io.ReadCloser
 	Package      *metadata.Package
+	Data         io.ReadCloser
+	FromCache    bool
 	UpstreamURL  string
 	CacheControl string
-	FromCache    bool
 }
 
 // New creates a new cache manager
-func New(storage storage.StorageBackend, metadata metadata.MetadataStore, scanner ScannerInterface, analytics AnalyticsInterface, config Config) (*Manager, error) {
+func New(storage storage.StorageBackend, metadata metadata.MetadataStore, scanner ScannerInterface, config Config) (*Manager, error) {
 	if storage == nil {
 		return nil, errors.New(errors.ErrCodeInvalidConfig, "storage backend is required")
 	}
@@ -77,11 +70,6 @@ func New(storage storage.StorageBackend, metadata metadata.MetadataStore, scanne
 		log.Info().Msg("Cache manager initialized with security scanning enabled")
 	}
 
-	// Analytics is optional - can be nil if analytics tracking is disabled
-	if analytics != nil {
-		log.Info().Msg("Cache manager initialized with analytics tracking enabled")
-	}
-
 	if config.DefaultTTL == 0 {
 		config.DefaultTTL = 7 * 24 * time.Hour // 7 days default
 	}
@@ -99,11 +87,10 @@ func New(storage storage.StorageBackend, metadata metadata.MetadataStore, scanne
 	}
 
 	manager := &Manager{
-		storage:   storage,
-		metadata:  metadata,
-		scanner:   scanner,
-		analytics: analytics,
-		config:    config,
+		storage:  storage,
+		metadata: metadata,
+		scanner:  scanner,
+		config:   config,
 	}
 
 	// Start background cleanup worker
@@ -147,11 +134,6 @@ func (m *Manager) getOrFetch(ctx context.Context, registry, name, version string
 				metrics.RecordCacheHit(registry)
 				_ = m.metadata.UpdateDownloadCount(ctx, registry, name, version) // #nosec G104 -- Async update, error logged
 
-				// Track download in analytics if enabled
-				if m.analytics != nil {
-					m.trackDownload(registry, name, version, pkg.Size)
-				}
-
 				// Check for vulnerabilities if scanner is enabled
 				if m.scanner != nil {
 					blocked, reason, err := m.scanner.CheckVulnerabilities(ctx, registry, name, version)
@@ -203,12 +185,9 @@ func (m *Manager) getOrFetch(ctx context.Context, registry, name, version string
 		return nil, err
 	}
 
-	// Skip security scan wait for metadata entries (index pages, lists, etc.)
-	isMetadataEntry := version == "list" || version == "page" || version == "latest" || version == "metadata"
-
 	// Wait briefly for initial scan to complete if scanner is enabled
 	// This prevents serving vulnerable packages on first request
-	if m.scanner != nil && !isMetadataEntry {
+	if m.scanner != nil {
 		// Wait up to 30 seconds for scan to complete
 		scanCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
 		defer cancel()
@@ -363,19 +342,15 @@ func (m *Manager) store(ctx context.Context, registry, name, version string, dat
 		Metadata:       make(map[string]string),
 	}
 
-	// Save metadata (skip metadata entries like index pages, lists, etc.)
-	isMetadataEntry := version == "list" || version == "page" || version == "latest" || version == "metadata"
-	if !isMetadataEntry {
-		if err := m.metadata.SavePackage(ctx, pkg); err != nil {
-			// Clean up storage if metadata save fails
-			_ = m.storage.Delete(ctx, storageKey) // #nosec G104 -- Cleanup, error logged
-			return nil, err
-		}
+	// Save metadata
+	if err := m.metadata.SavePackage(ctx, pkg); err != nil {
+		// Clean up storage if metadata save fails
+		_ = m.storage.Delete(ctx, storageKey) // #nosec G104 -- Cleanup, error logged
+		return nil, err
 	}
 
 	// Scan package if scanner is enabled (run in background to not block cache operations)
-	// Skip scanning metadata entries (index pages, lists, etc.)
-	if m.scanner != nil && !isMetadataEntry {
+	if m.scanner != nil {
 		go func() {
 			scanCtx := context.Background()
 			var filePath string
@@ -577,21 +552,6 @@ func (m *Manager) Health(ctx context.Context) error {
 	return nil
 }
 
-// trackDownload tracks a package download event in analytics
-func (m *Manager) trackDownload(registry, name, version string, size int64) {
-	download := analytics.PackageDownload{
-		Registry:  registry,
-		Name:      name,
-		Version:   version,
-		Timestamp: time.Now(),
-		BytesSize: size,
-		ClientIP:  "", // TODO: Extract from context if available
-		UserAgent: "", // TODO: Extract from context if available
-	}
-
-	m.analytics.TrackDownload(download)
-}
-
 // Close closes the cache manager
 func (m *Manager) Close() error {
 	var err error

pkg/cache/cache_test.go

@@ -197,12 +197,12 @@ func (m *MockMetadataStore) AggregateDownloadData(ctx context.Context) error {
 // TestNew tests cache manager creation
 func TestNew(t *testing.T) {
 	tests := []struct {
+		name        string
 		storage     storage.StorageBackend
 		metadata    metadata.MetadataStore
-		name        string
-		errContains string
 		config      Config
 		wantErr     bool
+		errContains string
 	}{
 		// GOOD: Valid configuration
 		{
@@ -262,7 +262,7 @@ func TestNew(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			manager, err := New(tt.storage, tt.metadata, nil, nil, tt.config)
+			manager, err := New(tt.storage, tt.metadata, nil, tt.config)
 
 			if tt.wantErr {
 				require.Error(t, err)
@@ -295,15 +295,15 @@ func TestNew(t *testing.T) {
 // TestGet tests cache retrieval with various scenarios
 func TestGet(t *testing.T) {
 	tests := []struct {
-		setupMock     func(*MockStorageBackend, *MockMetadataStore)
-		fetchFunc     func(context.Context) (io.ReadCloser, string, error)
 		name          string
 		registry      string
 		packageName   string
 		version       string
-		errContains   string
+		setupMock     func(*MockStorageBackend, *MockMetadataStore)
+		fetchFunc     func(context.Context) (io.ReadCloser, string, error)
 		wantFromCache bool
 		wantErr       bool
+		errContains   string
 	}{
 		// GOOD: Cache hit
 		{
@@ -489,7 +489,7 @@ func TestGet(t *testing.T) {
 				tt.setupMock(mockStorage, mockMetadata)
 			}
 
-			manager, err := New(mockStorage, mockMetadata, nil, nil, Config{
+			manager, err := New(mockStorage, mockMetadata, nil, Config{
 				DefaultTTL:      24 * time.Hour,
 				CleanupInterval: 1 * time.Hour,
 			})
@@ -523,13 +523,13 @@ func TestGet(t *testing.T) {
 // TestDelete tests package deletion
 func TestDelete(t *testing.T) {
 	tests := []struct {
-		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		name        string
 		registry    string
 		packageName string
 		version     string
-		errContains string
+		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		wantErr     bool
+		errContains string
 	}{
 		// GOOD: Successful deletion
 		{
@@ -615,7 +615,7 @@ func TestDelete(t *testing.T) {
 				tt.setupMock(mockStorage, mockMetadata)
 			}
 
-			manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+			manager, err := New(mockStorage, mockMetadata, nil, Config{})
 			require.NoError(t, err)
 
 			ctx := context.Background()
@@ -639,10 +639,10 @@ func TestDelete(t *testing.T) {
 // TestHealth tests health check functionality
 func TestHealth(t *testing.T) {
 	tests := []struct {
-		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		name        string
-		errContains string
+		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		wantErr     bool
+		errContains string
 	}{
 		// GOOD: Both healthy
 		{
@@ -692,7 +692,7 @@ func TestHealth(t *testing.T) {
 				tt.setupMock(mockStorage, mockMetadata)
 			}
 
-			manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+			manager, err := New(mockStorage, mockMetadata, nil, Config{})
 			require.NoError(t, err)
 
 			ctx := context.Background()
@@ -727,7 +727,7 @@ func TestGetStats(t *testing.T) {
 
 	mockMetadata.On("GetStats", mock.Anything, "npm").Return(expectedStats, nil)
 
-	manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+	manager, err := New(mockStorage, mockMetadata, nil, Config{})
 	require.NoError(t, err)
 
 	ctx := context.Background()
@@ -741,8 +741,8 @@ func TestGetStats(t *testing.T) {
 // TestClose tests manager cleanup
 func TestClose(t *testing.T) {
 	tests := []struct {
-		setupMock func(*MockStorageBackend, *MockMetadataStore)
 		name      string
+		setupMock func(*MockStorageBackend, *MockMetadataStore)
 		wantErr   bool
 	}{
 		// GOOD: Clean close
@@ -792,7 +792,7 @@ func TestClose(t *testing.T) {
 				tt.setupMock(mockStorage, mockMetadata)
 			}
 
-			manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+			manager, err := New(mockStorage, mockMetadata, nil, Config{})
 			require.NoError(t, err)
 
 			err = manager.Close() // #nosec G104 -- Cleanup, error not critical
@@ -812,11 +812,11 @@ func TestClose(t *testing.T) {
 // TestEvict tests LRU eviction
 func TestEvict(t *testing.T) {
 	tests := []struct {
-		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		name        string
-		errContains string
 		needed      int64
+		setupMock   func(*MockStorageBackend, *MockMetadataStore)
 		wantErr     bool
+		errContains string
 	}{
 		// GOOD: Successful eviction
 		{
@@ -881,7 +881,7 @@ func TestEvict(t *testing.T) {
 				tt.setupMock(mockStorage, mockMetadata)
 			}
 
-			manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+			manager, err := New(mockStorage, mockMetadata, nil, Config{})
 			require.NoError(t, err)
 
 			ctx := context.Background()
@@ -907,7 +907,7 @@ func TestGenerateStorageKey(t *testing.T) {
 	mockStorage := &MockStorageBackend{}
 	mockMetadata := &MockMetadataStore{}
 
-	manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+	manager, err := New(mockStorage, mockMetadata, nil, Config{})
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -954,7 +954,7 @@ func TestConcurrentGet(t *testing.T) {
 		io.NopCloser(bytes.NewReader([]byte("test data"))), nil).Maybe()
 	mockMetadata.On("UpdateDownloadCount", mock.Anything, "npm", "concurrent", "1.0.0").Return(nil).Maybe()
 
-	manager, err := New(mockStorage, mockMetadata, nil, nil, Config{})
+	manager, err := New(mockStorage, mockMetadata, nil, Config{})
 	require.NoError(t, err)
 
 	ctx := context.Background()

pkg/cdn/cdn.go

@@ -4,7 +4,10 @@ import (
 	"crypto/md5" // #nosec G501 -- MD5 used for ETag generation, not cryptographic security
 	"encoding/hex"
 	"fmt"
+	"io"
 	"net/http"
+	"strconv"
+	"time"
 
 	"github.com/rs/zerolog/log"
 )
@@ -211,11 +214,38 @@ func (m *Middleware) generateETag(body []byte) string {
 	return `"` + hex.EncodeToString(hash[:]) + `"`
 }
 
+// SetLastModified sets the Last-Modified header
+func SetLastModified(w http.ResponseWriter, t time.Time) {
+	w.Header().Set("Last-Modified", t.UTC().Format(http.TimeFormat))
+}
+
+// SetCacheControl sets a custom Cache-Control header
+func SetCacheControl(w http.ResponseWriter, cc CacheControl) {
+	w.Header().Set("Cache-Control", cc.String())
+}
+
+// SetNoCache sets headers to prevent caching
+func SetNoCache(w http.ResponseWriter) {
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+}
+
+// SetImmutable sets headers for immutable content (content-addressed files)
+func SetImmutable(w http.ResponseWriter, maxAge int) {
+	cc := CacheControl{
+		Public:    true,
+		MaxAge:    maxAge,
+		Immutable: true,
+	}
+	w.Header().Set("Cache-Control", cc.String())
+}
+
 // responseWriter wraps http.ResponseWriter to capture response
 type responseWriter struct {
 	http.ResponseWriter
-	body       []byte
 	statusCode int
+	body       []byte
 }
 
 func (rw *responseWriter) WriteHeader(statusCode int) {
@@ -231,3 +261,100 @@ func (rw *responseWriter) Write(b []byte) (int, error) {
 	rw.body = append(rw.body, b...)
 	return rw.ResponseWriter.Write(b)
 }
+
+// HandleRange handles HTTP Range requests for partial content
+func HandleRange(w http.ResponseWriter, r *http.Request, content io.ReadSeeker, size int64, modTime time.Time) error {
+	// Set Last-Modified header
+	SetLastModified(w, modTime)
+
+	// Check for Range header
+	rangeHeader := r.Header.Get("Range")
+	if rangeHeader == "" {
+		// No range request - serve full content
+		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+		w.Header().Set("Accept-Ranges", "bytes")
+		w.WriteHeader(http.StatusOK)
+		_, err := io.Copy(w, content)
+		return err
+	}
+
+	// Parse range header (simplified - only handles single range)
+	// Format: bytes=start-end
+	var start, end int64
+	n, err := fmt.Sscanf(rangeHeader, "bytes=%d-%d", &start, &end)
+	if err != nil || n != 2 {
+		// Invalid range - serve full content
+		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+		w.Header().Set("Accept-Ranges", "bytes")
+		w.WriteHeader(http.StatusOK)
+		_, err := io.Copy(w, content)
+		return err
+	}
+
+	// Validate range
+	if start < 0 || start >= size || end < start || end >= size {
+		w.Header().Set("Content-Range", fmt.Sprintf("bytes */%d", size))
+		w.WriteHeader(http.StatusRequestedRangeNotSatisfiable)
+		return nil
+	}
+
+	// Seek to start position
+	if _, err := content.Seek(start, io.SeekStart); err != nil {
+		return err
+	}
+
+	// Calculate content length
+	contentLength := end - start + 1
+
+	// Set headers for partial content
+	w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", start, end, size))
+	w.Header().Set("Content-Length", strconv.FormatInt(contentLength, 10))
+	w.Header().Set("Accept-Ranges", "bytes")
+	w.WriteHeader(http.StatusPartialContent)
+
+	// Copy range to response
+	_, err = io.CopyN(w, content, contentLength)
+	return err
+}
+
+// DefaultCacheControl returns sensible defaults for different content types
+func DefaultCacheControl(contentType string, versioned bool) CacheControl {
+	if versioned {
+		// Content-addressed or versioned resources can be cached forever
+		return CacheControl{
+			Public:    true,
+			MaxAge:    31536000, // 1 year
+			Immutable: true,
+		}
+	}
+
+	// Default caching based on content type
+	switch contentType {
+	case "application/json":
+		return CacheControl{
+			Public:  true,
+			MaxAge:  3600, // 1 hour
+			SMaxAge: 7200, // 2 hours for shared caches
+		}
+	case "application/octet-stream", "application/x-gzip", "application/zip":
+		// Binary packages
+		return CacheControl{
+			Public:  true,
+			MaxAge:  86400,  // 1 day
+			SMaxAge: 604800, // 1 week for shared caches
+		}
+	case "text/html":
+		// HTML should revalidate
+		return CacheControl{
+			Public:         true,
+			MaxAge:         0,
+			MustRevalidate: true,
+		}
+	default:
+		return CacheControl{
+			Public:  true,
+			MaxAge:  3600, // 1 hour default
+			SMaxAge: 7200,
+		}
+	}
+}

pkg/cdn/cdn_test.go

@@ -1,299 +0,0 @@
-package cdn
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/suite"
-)
-
-type CDNMiddlewareTestSuite struct {
-	suite.Suite
-	middleware *Middleware
-}
-
-func (s *CDNMiddlewareTestSuite) SetupTest() {
-	s.middleware = NewMiddleware(Config{
-		DefaultCacheControl: CacheControl{
-			Public:  true,
-			MaxAge:  3600,
-			SMaxAge: 7200,
-		},
-		EnableETag: true,
-		EnableVary: true,
-	})
-}
-
-func TestCDNMiddlewareTestSuite(t *testing.T) {
-	suite.Run(t, new(CDNMiddlewareTestSuite))
-}
-
-func (s *CDNMiddlewareTestSuite) TestCacheControlHeader() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("test response"))
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	req := httptest.NewRequest("GET", "/test", nil)
-	w := httptest.NewRecorder()
-
-	wrappedHandler.ServeHTTP(w, req)
-
-	s.Equal(http.StatusOK, w.Code)
-	s.Contains(w.Header().Get("Cache-Control"), "public")
-	s.Contains(w.Header().Get("Cache-Control"), "max-age=3600")
-	s.Contains(w.Header().Get("Cache-Control"), "s-maxage=7200")
-}
-
-func (s *CDNMiddlewareTestSuite) TestETagGeneration() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("test response content"))
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	req := httptest.NewRequest("GET", "/test", nil)
-	w := httptest.NewRecorder()
-
-	wrappedHandler.ServeHTTP(w, req)
-
-	s.Equal(http.StatusOK, w.Code)
-	etag := w.Header().Get("ETag")
-	s.NotEmpty(etag)
-	s.True(len(etag) > 0)
-}
-
-func (s *CDNMiddlewareTestSuite) TestETagConsistencyAcrossRequests() {
-	responseBody := []byte("test response content")
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write(responseBody)
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	// First request to get ETag
-	req1 := httptest.NewRequest("GET", "/test", nil)
-	w1 := httptest.NewRecorder()
-	wrappedHandler.ServeHTTP(w1, req1)
-	etag := w1.Header().Get("ETag")
-	s.NotEmpty(etag)
-	s.Equal(http.StatusOK, w1.Code)
-
-	// Verify ETag is consistent for same content
-	req2 := httptest.NewRequest("GET", "/test", nil)
-	w2 := httptest.NewRecorder()
-	wrappedHandler.ServeHTTP(w2, req2)
-	etag2 := w2.Header().Get("ETag")
-	s.Equal(etag, etag2, "ETag should be consistent for same content")
-}
-
-func (s *CDNMiddlewareTestSuite) TestVaryHeader() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("test"))
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	req := httptest.NewRequest("GET", "/test", nil)
-	req.Header.Set("Accept-Encoding", "gzip")
-	req.Header.Set("Accept", "application/json")
-	req.Header.Set("Authorization", "Bearer token")
-
-	w := httptest.NewRecorder()
-	wrappedHandler.ServeHTTP(w, req)
-
-	vary := w.Header().Get("Vary")
-	s.NotEmpty(vary)
-	s.Contains(vary, "Accept-Encoding")
-	s.Contains(vary, "Authorization")
-	s.Contains(vary, "Accept")
-}
-
-func (s *CDNMiddlewareTestSuite) TestCacheControlString() {
-	tests := []struct {
-		name     string
-		expected string
-		cc       CacheControl
-	}{
-		{
-			name: "public with max-age",
-			cc: CacheControl{
-				Public: true,
-				MaxAge: 3600,
-			},
-			expected: "public, max-age=3600",
-		},
-		{
-			name: "private with no-cache",
-			cc: CacheControl{
-				Private: true,
-				NoCache: true,
-			},
-			expected: "private, no-cache",
-		},
-		{
-			name: "immutable",
-			cc: CacheControl{
-				Public:    true,
-				MaxAge:    31536000,
-				Immutable: true,
-			},
-			expected: "public, immutable, max-age=31536000",
-		},
-		{
-			name: "no-store",
-			cc: CacheControl{
-				NoStore: true,
-			},
-			expected: "no-store",
-		},
-		{
-			name: "must-revalidate",
-			cc: CacheControl{
-				Public:         true,
-				MustRevalidate: true,
-			},
-			expected: "public, must-revalidate",
-		},
-		{
-			name: "s-maxage",
-			cc: CacheControl{
-				Public:  true,
-				MaxAge:  3600,
-				SMaxAge: 7200,
-			},
-			expected: "public, max-age=3600, s-maxage=7200",
-		},
-		{
-			name: "stale-while-revalidate",
-			cc: CacheControl{
-				Public:               true,
-				MaxAge:               3600,
-				StaleWhileRevalidate: 86400,
-			},
-			expected: "public, max-age=3600, stale-while-revalidate=86400",
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			result := tt.cc.String()
-			// Check that all expected parts are in the result
-			for _, part := range splitCacheControl(tt.expected) {
-				s.Contains(result, part)
-			}
-		})
-	}
-}
-
-func (s *CDNMiddlewareTestSuite) TestGenerateETag() {
-	tests := []struct {
-		name     string
-		body     []byte
-		expected bool // true if ETag should be generated
-	}{
-		{
-			name:     "non-empty body",
-			body:     []byte("test content"),
-			expected: true,
-		},
-		{
-			name:     "empty body",
-			body:     []byte{},
-			expected: true, // Empty body still generates ETag (MD5 of empty string)
-		},
-		{
-			name:     "nil body",
-			body:     nil,
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		s.Run(tt.name, func() {
-			etag := s.middleware.generateETag(tt.body)
-			if tt.expected {
-				s.NotEmpty(etag)
-				s.True(len(etag) > 2) // Should be quoted
-			} else {
-				s.Empty(etag)
-			}
-		})
-	}
-}
-
-func (s *CDNMiddlewareTestSuite) TestETagConsistency() {
-	// Same content should produce same ETag
-	body := []byte("consistent content")
-	etag1 := s.middleware.generateETag(body)
-	etag2 := s.middleware.generateETag(body)
-
-	s.Equal(etag1, etag2)
-
-	// Different content should produce different ETag
-	body2 := []byte("different content")
-	etag3 := s.middleware.generateETag(body2)
-
-	s.NotEqual(etag1, etag3)
-}
-
-func (s *CDNMiddlewareTestSuite) TestNoCacheFor4xxErrors() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusNotFound)
-		w.Write([]byte("not found"))
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	req := httptest.NewRequest("GET", "/test", nil)
-	w := httptest.NewRecorder()
-
-	wrappedHandler.ServeHTTP(w, req)
-
-	s.Equal(http.StatusNotFound, w.Code)
-	// 4xx errors should not have cache headers applied
-	// (based on the middleware only applying headers for 2xx status codes)
-}
-
-func (s *CDNMiddlewareTestSuite) TestNoCacheFor5xxErrors() {
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte("error"))
-	})
-
-	wrappedHandler := s.middleware.Handler(handler)
-
-	req := httptest.NewRequest("GET", "/test", nil)
-	w := httptest.NewRecorder()
-
-	wrappedHandler.ServeHTTP(w, req)
-
-	s.Equal(http.StatusInternalServerError, w.Code)
-	// 5xx errors should not have cache headers applied
-}
-
-// Helper function to split cache-control string
-func splitCacheControl(s string) []string {
-	var parts []string
-	current := ""
-	for _, char := range s {
-		if char == ',' {
-			if current != "" {
-				parts = append(parts, current)
-				current = ""
-			}
-		} else if char != ' ' {
-			current += string(char)
-		}
-	}
-	if current != "" {
-		parts = append(parts, current)
-	}
-	return parts
-}

pkg/config/config.go

@@ -7,42 +7,42 @@ import (
 
 // Config is the main configuration struct
 type Config struct {
+	Server   ServerConfig   `mapstructure:"server" json:"server"`
 	Storage  StorageConfig  `mapstructure:"storage" json:"storage"`
+	Metadata MetadataConfig `mapstructure:"metadata" json:"metadata"`
 	Cache    CacheConfig    `mapstructure:"cache" json:"cache"`
 	Security SecurityConfig `mapstructure:"security" json:"security"`
-	Metadata MetadataConfig `mapstructure:"metadata" json:"metadata"`
-	Handlers HandlersConfig `mapstructure:"handlers" json:"handlers"`
-	Server   ServerConfig   `mapstructure:"server" json:"server"`
-	Logging  LoggingConfig  `mapstructure:"logging" json:"logging"`
-	Network  NetworkConfig  `mapstructure:"network" json:"network"`
 	Auth     AuthConfig     `mapstructure:"auth" json:"auth"`
+	Network  NetworkConfig  `mapstructure:"network" json:"network"`
+	Logging  LoggingConfig  `mapstructure:"logging" json:"logging"`
+	Handlers HandlersConfig `mapstructure:"handlers" json:"handlers"`
 }
 
 // ServerConfig contains HTTP server configuration
 type ServerConfig struct {
-	TLS          TLSConfig     `mapstructure:"tls" json:"tls"`
 	Host         string        `mapstructure:"host" json:"host"`
 	Port         int           `mapstructure:"port" json:"port"`
 	ReadTimeout  time.Duration `mapstructure:"read_timeout" json:"read_timeout"`
 	WriteTimeout time.Duration `mapstructure:"write_timeout" json:"write_timeout"`
 	IdleTimeout  time.Duration `mapstructure:"idle_timeout" json:"idle_timeout"`
+	TLS          TLSConfig     `mapstructure:"tls" json:"tls"`
 }
 
 // TLSConfig contains TLS/HTTPS configuration
 type TLSConfig struct {
+	Enabled  bool   `mapstructure:"enabled" json:"enabled"`
 	CertFile string `mapstructure:"cert_file" json:"cert_file"`
 	KeyFile  string `mapstructure:"key_file" json:"key_file"`
-	Enabled  bool   `mapstructure:"enabled" json:"enabled"`
 }
 
 // StorageConfig contains storage backend configuration
 type StorageConfig struct {
-	Options    map[string]interface{} `mapstructure:"options" json:"options"`
-	SMB        SMBConfig              `mapstructure:"smb" json:"smb"`
-	Backend    string                 `mapstructure:"backend" json:"backend"`
+	Backend    string                 `mapstructure:"backend" json:"backend"` // filesystem, s3, smb, nfs
 	Path       string                 `mapstructure:"path" json:"path"`
 	Filesystem FilesystemConfig       `mapstructure:"filesystem" json:"filesystem"`
 	S3         S3Config               `mapstructure:"s3" json:"s3"`
+	SMB        SMBConfig              `mapstructure:"smb" json:"smb"`
+	Options    map[string]interface{} `mapstructure:"options" json:"options"`
 }
 
 // FilesystemConfig contains local filesystem storage configuration
@@ -52,14 +52,12 @@ type FilesystemConfig struct {
 
 // S3Config contains S3-compatible storage configuration
 type S3Config struct {
-	Endpoint        string `mapstructure:"endpoint" json:"endpoint"`                 // Optional: for MinIO, etc.
-	Region          string `mapstructure:"region" json:"region"`                     // AWS region (e.g., us-east-1)
-	Bucket          string `mapstructure:"bucket" json:"bucket"`                     // S3 bucket name
-	Prefix          string `mapstructure:"prefix" json:"prefix"`                     // Optional: key prefix
-	AccessKeyID     string `mapstructure:"access_key_id" json:"access_key_id"`       // AWS access key
-	SecretAccessKey string `mapstructure:"secret_access_key" json:"-"`               // AWS secret key (not serialized)
-	ForcePathStyle  bool   `mapstructure:"force_path_style" json:"force_path_style"` // For MinIO compatibility
-	UseSSL          bool   `mapstructure:"use_ssl" json:"use_ssl"`                   // Deprecated: use endpoint with https://
+	Endpoint        string `mapstructure:"endpoint" json:"endpoint"`
+	Region          string `mapstructure:"region" json:"region"`
+	Bucket          string `mapstructure:"bucket" json:"bucket"`
+	AccessKeyID     string `mapstructure:"access_key_id" json:"access_key_id"`
+	SecretAccessKey string `mapstructure:"secret_access_key" json:"-"` // Don't serialize secrets
+	UseSSL          bool   `mapstructure:"use_ssl" json:"use_ssl"`
 }
 
 // SMBConfig contains SMB/CIFS storage configuration
@@ -73,17 +71,10 @@ type SMBConfig struct {
 
 // MetadataConfig contains metadata store configuration
 type MetadataConfig struct {
-	Backend    string           `mapstructure:"backend" json:"backend"`
+	Backend    string           `mapstructure:"backend" json:"backend"` // sqlite, postgresql, file
 	Connection string           `mapstructure:"connection" json:"connection"`
 	SQLite     SQLiteConfig     `mapstructure:"sqlite" json:"sqlite"`
 	PostgreSQL PostgreSQLConfig `mapstructure:"postgresql" json:"postgresql"`
-	MySQL      MySQLConfig      `mapstructure:"mysql" json:"mysql"`
-
-	// GORM-specific settings
-	MaxOpenConns    int    `mapstructure:"max_open_conns" json:"max_open_conns"`
-	MaxIdleConns    int    `mapstructure:"max_idle_conns" json:"max_idle_conns"`
-	ConnMaxLifetime int    `mapstructure:"conn_max_lifetime" json:"conn_max_lifetime"` // seconds
-	LogLevel        string `mapstructure:"log_level" json:"log_level"`                 // "silent", "error", "warn", "info"
 }
 
 // SQLiteConfig contains SQLite-specific configuration
@@ -98,41 +89,30 @@ type PostgreSQLConfig struct {
 	Port     int    `mapstructure:"port" json:"port"`
 	Database string `mapstructure:"database" json:"database"`
 	User     string `mapstructure:"user" json:"user"`
-	Password string `mapstructure:"password" json:"-"`
+	Password string `mapstructure:"password" json:"-"` // Don't serialize secrets
 	SSLMode  string `mapstructure:"ssl_mode" json:"ssl_mode"`
 }
 
-// MySQLConfig contains MySQL/MariaDB-specific configuration
-type MySQLConfig struct {
-	Host      string `mapstructure:"host" json:"host"`
-	Port      int    `mapstructure:"port" json:"port"`
-	Database  string `mapstructure:"database" json:"database"`
-	User      string `mapstructure:"user" json:"user"`
-	Password  string `mapstructure:"password" json:"-"` // Don't serialize
-	Charset   string `mapstructure:"charset" json:"charset"`
-	ParseTime bool   `mapstructure:"parse_time" json:"parse_time"`
-}
-
 // CacheConfig contains cache management configuration
 type CacheConfig struct {
-	TTLOverrides    map[string]time.Duration `mapstructure:"ttl_overrides" json:"ttl_overrides"`
 	DefaultTTL      time.Duration            `mapstructure:"default_ttl" json:"default_ttl"`
 	CleanupInterval time.Duration            `mapstructure:"cleanup_interval" json:"cleanup_interval"`
 	MaxSizeBytes    int64                    `mapstructure:"max_size_bytes" json:"max_size_bytes"`
 	PerProjectQuota int64                    `mapstructure:"per_project_quota" json:"per_project_quota"`
+	TTLOverrides    map[string]time.Duration `mapstructure:"ttl_overrides" json:"ttl_overrides"` // Per ecosystem
 }
 
 // SecurityConfig contains security scanning configuration
 type SecurityConfig struct {
-	Scanners          ScannersConfig          `mapstructure:"scanners" json:"scanners"`
-	BlockOnSeverity   string                  `mapstructure:"block_on_severity" json:"block_on_severity"`
-	AllowedPackages   []string                `mapstructure:"allowed_packages" json:"allowed_packages"`
-	IgnoredCVEs       []string                `mapstructure:"ignored_cves" json:"ignored_cves"`
-	BlockThresholds   VulnerabilityThresholds `mapstructure:"block_thresholds" json:"block_thresholds"`
-	RescanInterval    time.Duration           `mapstructure:"rescan_interval" json:"rescan_interval"`
 	Enabled           bool                    `mapstructure:"enabled" json:"enabled"`
-	ScanOnDownload    bool                    `mapstructure:"scan_on_download" json:"scan_on_download"`
-	UpdateDBOnStartup bool                    `mapstructure:"update_db_on_startup" json:"update_db_on_startup"`
+	ScanOnDownload    bool                    `mapstructure:"scan_on_download" json:"scan_on_download"`         // Scan packages on first download
+	RescanInterval    time.Duration           `mapstructure:"rescan_interval" json:"rescan_interval"`           // How often to re-scan (e.g., 24h, 168h for weekly)
+	BlockOnSeverity   string                  `mapstructure:"block_on_severity" json:"block_on_severity"`       // none, low, medium, high, critical
+	BlockThresholds   VulnerabilityThresholds `mapstructure:"block_thresholds" json:"block_thresholds"`         // Max vulns per severity before blocking
+	UpdateDBOnStartup bool                    `mapstructure:"update_db_on_startup" json:"update_db_on_startup"` // Update vulnerability databases on startup
+	AllowedPackages   []string                `mapstructure:"allowed_packages" json:"allowed_packages"`         // Packages that bypass security checks (format: "registry/name@version" or "registry/name")
+	IgnoredCVEs       []string                `mapstructure:"ignored_cves" json:"ignored_cves"`                 // CVE IDs to ignore globally (e.g., "CVE-2021-23337")
+	Scanners          ScannersConfig          `mapstructure:"scanners" json:"scanners"`
 }
 
 // VulnerabilityThresholds defines max allowed vulnerabilities per severity
@@ -146,36 +126,36 @@ type VulnerabilityThresholds struct {
 // ScannersConfig contains individual scanner configurations
 type ScannersConfig struct {
 	Trivy       TrivyConfig       `mapstructure:"trivy" json:"trivy"`
-	GHSA        GHSAConfig        `mapstructure:"ghsa" json:"ghsa"`
-	Static      StaticConfig      `mapstructure:"static" json:"static"`
 	OSV         OSVConfig         `mapstructure:"osv" json:"osv"`
+	Static      StaticConfig      `mapstructure:"static" json:"static"`
 	Grype       GrypeConfig       `mapstructure:"grype" json:"grype"`
 	Govulncheck GovulncheckConfig `mapstructure:"govulncheck" json:"govulncheck"`
 	NpmAudit    NpmAuditConfig    `mapstructure:"npm_audit" json:"npm_audit"`
 	PipAudit    PipAuditConfig    `mapstructure:"pip_audit" json:"pip_audit"`
+	GHSA        GHSAConfig        `mapstructure:"ghsa" json:"ghsa"`
 }
 
 // TrivyConfig contains Trivy scanner configuration
 type TrivyConfig struct {
-	CacheDB string        `mapstructure:"cache_db" json:"cache_db"`
-	Timeout time.Duration `mapstructure:"timeout" json:"timeout"`
 	Enabled bool          `mapstructure:"enabled" json:"enabled"`
+	Timeout time.Duration `mapstructure:"timeout" json:"timeout"`
+	CacheDB string        `mapstructure:"cache_db" json:"cache_db"`
 }
 
 // OSVConfig contains OSV scanner configuration
 type OSVConfig struct {
+	Enabled bool          `mapstructure:"enabled" json:"enabled"`
 	APIURL  string        `mapstructure:"api_url" json:"api_url"`
 	Timeout time.Duration `mapstructure:"timeout" json:"timeout"`
-	Enabled bool          `mapstructure:"enabled" json:"enabled"`
 }
 
 // StaticConfig contains static analysis configuration
 type StaticConfig struct {
-	AllowedLicenses []string `mapstructure:"allowed_licenses" json:"allowed_licenses"`
-	MaxPackageSize  int64    `mapstructure:"max_package_size" json:"max_package_size"`
 	Enabled         bool     `mapstructure:"enabled" json:"enabled"`
+	MaxPackageSize  int64    `mapstructure:"max_package_size" json:"max_package_size"`
 	CheckChecksums  bool     `mapstructure:"check_checksums" json:"check_checksums"`
 	BlockSuspicious bool     `mapstructure:"block_suspicious" json:"block_suspicious"`
+	AllowedLicenses []string `mapstructure:"allowed_licenses" json:"allowed_licenses"`
 }
 
 // GrypeConfig contains Grype scanner configuration
@@ -204,16 +184,16 @@ type PipAuditConfig struct {
 
 // GHSAConfig contains GitHub Advisory Database scanner configuration
 type GHSAConfig struct {
-	Token   string        `mapstructure:"token" json:"-"`
-	Timeout time.Duration `mapstructure:"timeout" json:"timeout"`
 	Enabled bool          `mapstructure:"enabled" json:"enabled"`
+	Timeout time.Duration `mapstructure:"timeout" json:"timeout"`
+	Token   string        `mapstructure:"token" json:"-"` // GitHub token for higher rate limits (don't serialize)
 }
 
 // AuthConfig contains authentication configuration
 type AuthConfig struct {
+	Enabled       bool          `mapstructure:"enabled" json:"enabled"`
 	KeyExpiration time.Duration `mapstructure:"key_expiration" json:"key_expiration"`
 	BcryptCost    int           `mapstructure:"bcrypt_cost" json:"bcrypt_cost"`
-	Enabled       bool          `mapstructure:"enabled" json:"enabled"`
 	AuditLog      bool          `mapstructure:"audit_log" json:"audit_log"`
 }
 
@@ -265,24 +245,24 @@ type HandlersConfig struct {
 
 // GoHandlerConfig contains Go proxy configuration
 type GoHandlerConfig struct {
+	Enabled            bool   `mapstructure:"enabled" json:"enabled"`
 	UpstreamProxy      string `mapstructure:"upstream_proxy" json:"upstream_proxy"`
 	ChecksumDB         string `mapstructure:"checksum_db" json:"checksum_db"`
-	GitCredentialsFile string `mapstructure:"git_credentials_file" json:"git_credentials_file"`
-	Enabled            bool   `mapstructure:"enabled" json:"enabled"`
 	VerifyChecksums    bool   `mapstructure:"verify_checksums" json:"verify_checksums"`
+	GitCredentialsFile string `mapstructure:"git_credentials_file" json:"git_credentials_file"` // Path to git credentials JSON file
 }
 
 // NPMHandlerConfig contains NPM registry configuration
 type NPMHandlerConfig struct {
-	UpstreamRegistry string `mapstructure:"upstream_registry" json:"upstream_registry"`
 	Enabled          bool   `mapstructure:"enabled" json:"enabled"`
+	UpstreamRegistry string `mapstructure:"upstream_registry" json:"upstream_registry"`
 }
 
 // PyPIHandlerConfig contains PyPI configuration
 type PyPIHandlerConfig struct {
+	Enabled      bool   `mapstructure:"enabled" json:"enabled"`
 	UpstreamURL  string `mapstructure:"upstream_url" json:"upstream_url"`
 	SimpleAPIURL string `mapstructure:"simple_api_url" json:"simple_api_url"`
-	Enabled      bool   `mapstructure:"enabled" json:"enabled"`
 }
 
 // Default returns a configuration with sensible defaults
@@ -433,16 +413,9 @@ func (c *Config) Validate() error {
 	}
 
 	// Validate metadata backend
-	validMetadataBackends := map[string]bool{
-		"sqlite":     true,
-		"postgresql": true,
-		"postgres":   true,
-		"mysql":      true,
-		"mariadb":    true,
-		"file":       true,
-	}
+	validMetadataBackends := map[string]bool{"sqlite": true, "postgresql": true, "file": true}
 	if !validMetadataBackends[c.Metadata.Backend] {
-		return fmt.Errorf("metadata.backend must be one of: sqlite, postgresql, mysql, file; got %s", c.Metadata.Backend)
+		return fmt.Errorf("metadata.backend must be one of: sqlite, postgresql, file; got %s", c.Metadata.Backend)
 	}
 
 	// Validate cache

pkg/config/config_test.go

@@ -41,10 +41,10 @@ func (s *ConfigTestSuite) TestDefault() {
 
 func (s *ConfigTestSuite) TestValidate() {
 	tests := []struct {
-		modify      func(*Config)
 		name        string
-		errorSubstr string
+		modify      func(*Config)
 		expectError bool
+		errorSubstr string
 	}{
 		{
 			name:        "valid_config",
@@ -175,11 +175,11 @@ func (s *ConfigTestSuite) TestValidate() {
 
 func (s *ConfigTestSuite) TestLoad() {
 	tests := []struct {
-		envVars     map[string]string
-		validate    func(*Config)
 		name        string
 		configYAML  string
+		envVars     map[string]string
 		expectError bool
+		validate    func(*Config)
 	}{
 		{
 			name: "valid_yaml_config",
@@ -319,6 +319,13 @@ func (s *ConfigTestSuite) TestLoadMissingFile() {
 	s.Nil(cfg)
 }
 
+func (s *ConfigTestSuite) TestLoadWithDefaults() {
+	// Invalid config path should return defaults
+	cfg := LoadWithDefaults("/invalid/path/config.yaml")
+	s.NotNil(cfg)
+	s.Equal(8080, cfg.Server.Port)
+}
+
 // Benchmark tests
 func BenchmarkDefault(b *testing.B) {
 	for i := 0; i < b.N; i++ {
@@ -337,8 +344,8 @@ func BenchmarkValidate(b *testing.B) {
 // Table-driven edge cases
 func TestConfigEdgeCases(t *testing.T) {
 	tests := []struct {
-		config *Config
 		name   string
+		config *Config
 		valid  bool
 	}{
 		{

pkg/config/loader.go

@@ -51,3 +51,12 @@ func Load(configPath string) (*Config, error) {
 
 	return cfg, nil
 }
+
+// LoadWithDefaults loads configuration or returns defaults on error
+func LoadWithDefaults(configPath string) *Config {
+	cfg, err := Load(configPath)
+	if err != nil {
+		return Default()
+	}
+	return cfg
+}

pkg/errors/codes.go

@@ -58,3 +58,11 @@ var HTTPStatusCode = map[string]int{
 	ErrCodeServiceUnavailable: 503,
 	ErrCodeCircuitOpen:        503,
 }
+
+// GetHTTPStatus returns the HTTP status code for an error code
+func GetHTTPStatus(code string) int {
+	if status, ok := HTTPStatusCode[code]; ok {
+		return status
+	}
+	return 500 // Default to internal server error
+}

pkg/errors/errors.go

@@ -6,11 +6,11 @@ import (
 
 // Error represents a structured error with code and details
 type Error struct {
-	Details interface{} `json:"details,omitempty"`
-	Cause   error       `json:"-"`
 	Code    string      `json:"code"`
 	Message string      `json:"message"`
+	Details interface{} `json:"details,omitempty"`
 	Trace   []string    `json:"trace,omitempty"`
+	Cause   error       `json:"-"` // Internal cause, not serialized
 }
 
 // Error implements the error interface
@@ -34,12 +34,26 @@ func New(code, message string) *Error {
 	}
 }
 
+// Newf creates a new error with formatted message
+func Newf(code, format string, args ...interface{}) *Error {
+	return &Error{
+		Code:    code,
+		Message: fmt.Sprintf(format, args...),
+	}
+}
+
 // WithDetails adds details to the error
 func (e *Error) WithDetails(details interface{}) *Error {
 	e.Details = details
 	return e
 }
 
+// WithTrace adds stack trace to the error
+func (e *Error) WithTrace(trace []string) *Error {
+	e.Trace = trace
+	return e
+}
+
 // WithCause adds an underlying cause to the error
 func (e *Error) WithCause(cause error) *Error {
 	e.Cause = cause
@@ -55,12 +69,44 @@ func Wrap(err error, code, message string) *Error {
 	}
 }
 
-// NotFound creates a not found error
+// Wrapf wraps an existing error with formatted message
+func Wrapf(err error, code, format string, args ...interface{}) *Error {
+	return &Error{
+		Code:    code,
+		Message: fmt.Sprintf(format, args...),
+		Cause:   err,
+	}
+}
+
+// Common error constructors
+func BadRequest(message string) *Error {
+	return New(ErrCodeBadRequest, message)
+}
+
+func Unauthorized(message string) *Error {
+	return New(ErrCodeUnauthorized, message)
+}
+
+func Forbidden(message string) *Error {
+	return New(ErrCodeForbidden, message)
+}
+
 func NotFound(message string) *Error {
 	return New(ErrCodeNotFound, message)
 }
 
-// QuotaExceeded creates a quota exceeded error
+func InternalServer(message string) *Error {
+	return New(ErrCodeInternalServer, message)
+}
+
+func PackageNotFound(name, version string) *Error {
+	return New(ErrCodePackageNotFound, fmt.Sprintf("Package %s@%s not found", name, version)).
+		WithDetails(map[string]string{
+			"package": name,
+			"version": version,
+		})
+}
+
 func QuotaExceeded(limit int64) *Error {
 	return New(ErrCodeQuotaExceeded, "Storage quota exceeded").
 		WithDetails(map[string]interface{}{

pkg/errors/errors_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -45,10 +46,43 @@ func (s *ErrorsTestSuite) TestNew() {
 	}
 }
 
+func (s *ErrorsTestSuite) TestNewf() {
+	tests := []struct {
+		name     string
+		code     string
+		format   string
+		args     []interface{}
+		expected string
+	}{
+		{
+			name:     "formatted_message",
+			code:     ErrCodePackageNotFound,
+			format:   "Package %s@%s not found",
+			args:     []interface{}{"react", "18.2.0"},
+			expected: "Package [email protected] not found",
+		},
+		{
+			name:     "no_args",
+			code:     ErrCodeInternalServer,
+			format:   "Internal error",
+			args:     []interface{}{},
+			expected: "Internal error",
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			err := Newf(tt.code, tt.format, tt.args...)
+			s.Equal(tt.code, err.Code)
+			s.Equal(tt.expected, err.Message)
+		})
+	}
+}
+
 func (s *ErrorsTestSuite) TestWithDetails() {
 	tests := []struct {
-		details interface{}
 		name    string
+		details interface{}
 	}{
 		{
 			name:    "map_details",
@@ -72,6 +106,12 @@ func (s *ErrorsTestSuite) TestWithDetails() {
 	}
 }
 
+func (s *ErrorsTestSuite) TestWithTrace() {
+	trace := []string{"file1.go:10", "file2.go:20"}
+	err := New(ErrCodeInternalServer, "test").WithTrace(trace)
+	s.Equal(trace, err.Trace)
+}
+
 func (s *ErrorsTestSuite) TestWithCause() {
 	cause := errors.New("underlying error")
 	err := New(ErrCodeStorageFailure, "test").WithCause(cause)
@@ -89,6 +129,15 @@ func (s *ErrorsTestSuite) TestWrap() {
 	s.True(errors.Is(wrapped, cause))
 }
 
+func (s *ErrorsTestSuite) TestWrapf() {
+	cause := errors.New("connection refused")
+	wrapped := Wrapf(cause, ErrCodeUpstreamFailure, "failed to connect to %s", "registry.npmjs.org")
+
+	s.Equal(ErrCodeUpstreamFailure, wrapped.Code)
+	s.Equal("failed to connect to registry.npmjs.org", wrapped.Message)
+	s.Equal(cause, wrapped.Cause)
+}
+
 func (s *ErrorsTestSuite) TestErrorString() {
 	tests := []struct {
 		name     string
@@ -114,6 +163,59 @@ func (s *ErrorsTestSuite) TestErrorString() {
 	}
 }
 
+func (s *ErrorsTestSuite) TestCommonConstructors() {
+	tests := []struct {
+		name     string
+		fn       func() *Error
+		wantCode string
+	}{
+		{
+			name:     "bad_request",
+			fn:       func() *Error { return BadRequest("invalid input") },
+			wantCode: ErrCodeBadRequest,
+		},
+		{
+			name:     "unauthorized",
+			fn:       func() *Error { return Unauthorized("invalid token") },
+			wantCode: ErrCodeUnauthorized,
+		},
+		{
+			name:     "forbidden",
+			fn:       func() *Error { return Forbidden("access denied") },
+			wantCode: ErrCodeForbidden,
+		},
+		{
+			name:     "not_found",
+			fn:       func() *Error { return NotFound("resource missing") },
+			wantCode: ErrCodeNotFound,
+		},
+		{
+			name:     "internal_server",
+			fn:       func() *Error { return InternalServer("server error") },
+			wantCode: ErrCodeInternalServer,
+		},
+	}
+
+	for _, tt := range tests {
+		s.Run(tt.name, func() {
+			err := tt.fn()
+			s.Equal(tt.wantCode, err.Code)
+		})
+	}
+}
+
+func (s *ErrorsTestSuite) TestPackageNotFound() {
+	err := PackageNotFound("lodash", "4.17.21")
+	s.Equal(ErrCodePackageNotFound, err.Code)
+	s.Equal("Package [email protected] not found", err.Message)
+	s.NotNil(err.Details)
+
+	details, ok := err.Details.(map[string]string)
+	s.True(ok)
+	s.Equal("lodash", details["package"])
+	s.Equal("4.17.21", details["version"])
+}
+
 func (s *ErrorsTestSuite) TestQuotaExceeded() {
 	limit := int64(1000000)
 	err := QuotaExceeded(limit)
@@ -173,3 +275,31 @@ func (s *ErrorsTestSuite) TestEdgeCases() {
 		s.Equal(largeDetails, err.Details)
 	})
 }
+
+// Table-driven test for error codes
+func TestGetHTTPStatus(t *testing.T) {
+	tests := []struct {
+		code           string
+		expectedStatus int
+	}{
+		{ErrCodeBadRequest, 400},
+		{ErrCodeUnauthorized, 401},
+		{ErrCodeForbidden, 403},
+		{ErrCodeNotFound, 404},
+		{ErrCodeConflict, 409},
+		{ErrCodePayloadTooLarge, 413},
+		{ErrCodeChecksumMismatch, 422},
+		{ErrCodeRateLimited, 429},
+		{ErrCodeInternalServer, 500},
+		{ErrCodeDatabaseFailure, 500},
+		{ErrCodeUpstreamFailure, 502},
+		{ErrCodeServiceUnavailable, 503},
+		{"UNKNOWN_CODE", 500}, // Default
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.code, func(t *testing.T) {
+			assert.Equal(t, tt.expectedStatus, GetHTTPStatus(tt.code))
+		})
+	}
+}

pkg/errors/response.go

@@ -0,0 +1,90 @@
+package errors
+
+import (
+	"net/http"
+	"time"
+
+	json "github.com/goccy/go-json"
+)
+
+// Response is the standard API response envelope
+type Response struct {
+	Success  bool           `json:"success"`
+	Data     interface{}    `json:"data,omitempty"`
+	Error    *ErrorResponse `json:"error,omitempty"`
+	Metadata *ResponseMeta  `json:"metadata,omitempty"`
+}
+
+// ErrorResponse contains error details
+type ErrorResponse struct {
+	Code    string      `json:"code"`
+	Message string      `json:"message"`
+	Details interface{} `json:"details,omitempty"`
+	Trace   []string    `json:"trace,omitempty"`
+}
+
+// ResponseMeta contains request metadata
+type ResponseMeta struct {
+	RequestID string `json:"request_id"`
+	Timestamp string `json:"timestamp"`
+	Duration  string `json:"duration,omitempty"`
+	Version   string `json:"version"`
+}
+
+// WriteJSON writes a success response as JSON
+func WriteJSON(w http.ResponseWriter, statusCode int, data interface{}, meta *ResponseMeta) {
+	response := Response{
+		Success:  statusCode < 400,
+		Data:     data,
+		Metadata: meta,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		// Fallback to simple error response
+		http.Error(w, `{"success":false,"error":{"code":"ENCODING_ERROR","message":"Failed to encode response"}}`, http.StatusInternalServerError)
+	}
+}
+
+// WriteError writes an error response as JSON
+func WriteError(w http.ResponseWriter, statusCode int, err *Error, meta *ResponseMeta) {
+	errResp := &ErrorResponse{
+		Code:    err.Code,
+		Message: err.Message,
+		Details: err.Details,
+		Trace:   err.Trace,
+	}
+
+	response := Response{
+		Success:  false,
+		Error:    errResp,
+		Metadata: meta,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+
+	if encErr := json.NewEncoder(w).Encode(response); encErr != nil {
+		// Fallback to simple error response
+		http.Error(w, `{"success":false,"error":{"code":"ENCODING_ERROR","message":"Failed to encode error response"}}`, http.StatusInternalServerError)
+	}
+}
+
+// WriteErrorSimple writes an error without metadata
+func WriteErrorSimple(w http.ResponseWriter, err *Error) {
+	statusCode := GetHTTPStatus(err.Code)
+	meta := &ResponseMeta{
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+	}
+	WriteError(w, statusCode, err, meta)
+}
+
+// WriteJSONSimple writes a success response without metadata
+func WriteJSONSimple(w http.ResponseWriter, statusCode int, data interface{}) {
+	meta := &ResponseMeta{
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+	}
+	WriteJSON(w, statusCode, data, meta)
+}

pkg/health/health.go

@@ -21,25 +21,25 @@ const (
 
 // Check represents a single health check
 type Check struct {
-	Fn     func(context.Context) (Status, string) `json:"-"`
 	Name   string                                 `json:"name"`
 	Status Status                                 `json:"status"`
 	Error  string                                 `json:"error,omitempty"`
+	Fn     func(context.Context) (Status, string) `json:"-"`
 }
 
 // Response is the health check response
 type Response struct {
+	Success  bool        `json:"success"`
 	Data     *HealthData `json:"data,omitempty"`
 	Metadata *Metadata   `json:"metadata,omitempty"`
-	Success  bool        `json:"success"`
 }
 
 // HealthData contains health check data
 type HealthData struct {
-	Components map[string]*Component `json:"components"`
 	Status     Status                `json:"status"`
 	Version    string                `json:"version"`
 	Uptime     string                `json:"uptime"`
+	Components map[string]*Component `json:"components"`
 }
 
 // Component represents a system component
@@ -57,8 +57,8 @@ type Metadata struct {
 
 // Checker manages health checks
 type Checker struct {
-	startTime time.Time
 	checks    []*Check
+	startTime time.Time
 	mu        sync.RWMutex
 }
 

pkg/lock/redis.go

@@ -0,0 +1,275 @@
+package lock
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+	"github.com/rs/zerolog/log"
+)
+
+var (
+	ErrLockNotAcquired = errors.New("lock not acquired")
+	ErrLockNotHeld     = errors.New("lock not held by this instance")
+	ErrInvalidTTL      = errors.New("invalid TTL: must be positive")
+)
+
+// Lock represents a distributed lock
+type Lock struct {
+	client *redis.Client
+	key    string
+	value  string
+	ttl    time.Duration
+}
+
+// Manager manages distributed locks using Redis
+type Manager struct {
+	client *redis.Client
+}
+
+// Config holds Redis connection configuration
+type Config struct {
+	Addr     string
+	Password string
+	DB       int
+}
+
+// NewManager creates a new lock manager
+func NewManager(cfg Config) (*Manager, error) {
+	client := redis.NewClient(&redis.Options{
+		Addr:     cfg.Addr,
+		Password: cfg.Password,
+		DB:       cfg.DB,
+	})
+
+	// Test connection
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if err := client.Ping(ctx).Err(); err != nil {
+		return nil, err
+	}
+
+	log.Info().
+		Str("addr", cfg.Addr).
+		Int("db", cfg.DB).
+		Msg("Connected to Redis for distributed locking")
+
+	return &Manager{
+		client: client,
+	}, nil
+}
+
+// Acquire attempts to acquire a lock with the given key and TTL
+// Returns a Lock instance if successful, or an error if the lock is already held
+func (m *Manager) Acquire(ctx context.Context, key string, ttl time.Duration) (*Lock, error) {
+	if ttl <= 0 {
+		return nil, ErrInvalidTTL
+	}
+
+	// Generate unique value for this lock instance
+	value, err := generateLockValue()
+	if err != nil {
+		return nil, err
+	}
+
+	// Try to acquire lock using SET NX (set if not exists)
+	success, err := m.client.SetNX(ctx, key, value, ttl).Result()
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("key", key).
+			Msg("Failed to acquire lock")
+		return nil, err
+	}
+
+	if !success {
+		log.Debug().
+			Str("key", key).
+			Msg("Lock already held by another instance")
+		return nil, ErrLockNotAcquired
+	}
+
+	log.Debug().
+		Str("key", key).
+		Dur("ttl", ttl).
+		Msg("Lock acquired successfully")
+
+	return &Lock{
+		client: m.client,
+		key:    key,
+		value:  value,
+		ttl:    ttl,
+	}, nil
+}
+
+// TryAcquire attempts to acquire a lock, retrying for the specified duration
+// Returns a Lock instance if successful within the timeout, or an error
+func (m *Manager) TryAcquire(ctx context.Context, key string, ttl, timeout time.Duration) (*Lock, error) {
+	if ttl <= 0 {
+		return nil, ErrInvalidTTL
+	}
+
+	deadline := time.Now().Add(timeout)
+	ticker := time.NewTicker(50 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		lock, err := m.Acquire(ctx, key, ttl)
+		if err == nil {
+			return lock, nil
+		}
+
+		if err != ErrLockNotAcquired {
+			return nil, err
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-ticker.C:
+			if time.Now().After(deadline) {
+				return nil, ErrLockNotAcquired
+			}
+		}
+	}
+}
+
+// Release releases the lock
+// Returns an error if the lock is not held by this instance
+func (l *Lock) Release(ctx context.Context) error {
+	// Use Lua script to ensure atomic check-and-delete
+	// Only delete if the value matches (ensures we own the lock)
+	script := redis.NewScript(`
+		if redis.call("get", KEYS[1]) == ARGV[1] then
+			return redis.call("del", KEYS[1])
+		else
+			return 0
+		end
+	`)
+
+	result, err := script.Run(ctx, l.client, []string{l.key}, l.value).Result()
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("key", l.key).
+			Msg("Failed to release lock")
+		return err
+	}
+
+	// Result of 0 means the lock was not deleted (not owned by us)
+	if result.(int64) == 0 {
+		log.Warn().
+			Str("key", l.key).
+			Msg("Attempted to release lock not held by this instance")
+		return ErrLockNotHeld
+	}
+
+	log.Debug().
+		Str("key", l.key).
+		Msg("Lock released successfully")
+
+	return nil
+}
+
+// Extend extends the lock TTL
+// Returns an error if the lock is not held by this instance
+func (l *Lock) Extend(ctx context.Context, additionalTTL time.Duration) error {
+	// Use Lua script to ensure atomic check-and-extend
+	script := redis.NewScript(`
+		if redis.call("get", KEYS[1]) == ARGV[1] then
+			return redis.call("expire", KEYS[1], ARGV[2])
+		else
+			return 0
+		end
+	`)
+
+	newTTL := l.ttl + additionalTTL
+	result, err := script.Run(ctx, l.client, []string{l.key}, l.value, int(newTTL.Seconds())).Result()
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("key", l.key).
+			Msg("Failed to extend lock")
+		return err
+	}
+
+	if result.(int64) == 0 {
+		log.Warn().
+			Str("key", l.key).
+			Msg("Attempted to extend lock not held by this instance")
+		return ErrLockNotHeld
+	}
+
+	l.ttl = newTTL
+	log.Debug().
+		Str("key", l.key).
+		Dur("new_ttl", newTTL).
+		Msg("Lock TTL extended")
+
+	return nil
+}
+
+// IsHeld checks if the lock is still held by this instance
+func (l *Lock) IsHeld(ctx context.Context) bool {
+	value, err := l.client.Get(ctx, l.key).Result()
+	if err != nil {
+		return false
+	}
+	return value == l.value
+}
+
+// Close closes the lock manager and its Redis connection
+func (m *Manager) Close() error {
+	return m.client.Close() // #nosec G104 -- Cleanup, error not critical
+}
+
+// generateLockValue generates a cryptographically random lock value
+func generateLockValue() (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(bytes), nil
+}
+
+// WithLock executes a function while holding a distributed lock
+// The lock is automatically released when the function returns
+func (m *Manager) WithLock(ctx context.Context, key string, ttl time.Duration, fn func(context.Context) error) error {
+	lock, err := m.Acquire(ctx, key, ttl)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := lock.Release(context.Background()); err != nil {
+			log.Error().
+				Err(err).
+				Str("key", key).
+				Msg("Failed to release lock in defer")
+		}
+	}()
+
+	return fn(ctx)
+}
+
+// WithRetryLock executes a function while holding a distributed lock
+// It retries acquisition for the specified timeout duration
+func (m *Manager) WithRetryLock(ctx context.Context, key string, ttl, timeout time.Duration, fn func(context.Context) error) error {
+	lock, err := m.TryAcquire(ctx, key, ttl, timeout)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := lock.Release(context.Background()); err != nil {
+			log.Error().
+				Err(err).
+				Str("key", key).
+				Msg("Failed to release lock in defer")
+		}
+	}()
+
+	return fn(ctx)
+}

pkg/logger/logger.go

@@ -35,3 +35,23 @@ func Init(cfg Config) error {
 
 	return nil
 }
+
+// Get returns the global logger
+func Get() *zerolog.Logger {
+	return &log.Logger
+}
+
+// WithFields returns a logger with additional fields
+func WithFields(fields map[string]interface{}) *zerolog.Logger {
+	logger := log.Logger
+	for k, v := range fields {
+		logger = logger.With().Interface(k, v).Logger()
+	}
+	return &logger
+}
+
+// WithRequestID returns a logger with request ID
+func WithRequestID(requestID string) *zerolog.Logger {
+	logger := log.With().Str("request_id", requestID).Logger()
+	return &logger
+}

pkg/logger/middleware.go

@@ -0,0 +1,65 @@
+package logger
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/lukaszraczylo/gohoarder/pkg/uuid"
+	"github.com/rs/zerolog/log"
+)
+
+// responseWriter wraps http.ResponseWriter to capture status code
+type responseWriter struct {
+	http.ResponseWriter
+	statusCode int
+	written    int64
+}
+
+func (rw *responseWriter) WriteHeader(code int) {
+	rw.statusCode = code
+	rw.ResponseWriter.WriteHeader(code)
+}
+
+func (rw *responseWriter) Write(b []byte) (int, error) {
+	n, err := rw.ResponseWriter.Write(b)
+	rw.written += int64(n)
+	return n, err
+}
+
+// Middleware is HTTP middleware for request logging
+func Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+
+		// Generate request ID
+		requestID := r.Header.Get("X-Request-ID")
+		if requestID == "" {
+			requestID = "req_" + uuid.New().String()[:8]
+		}
+
+		// Wrap response writer
+		rw := &responseWriter{
+			ResponseWriter: w,
+			statusCode:     http.StatusOK,
+		}
+
+		// Set request ID in response header
+		rw.Header().Set("X-Request-ID", requestID)
+
+		// Call next handler
+		next.ServeHTTP(rw, r)
+
+		// Log request
+		duration := time.Since(start)
+		log.Info().
+			Str("request_id", requestID).
+			Str("method", r.Method).
+			Str("path", r.URL.Path).
+			Str("remote_addr", r.RemoteAddr).
+			Str("user_agent", r.UserAgent()).
+			Int("status", rw.statusCode).
+			Int64("bytes", rw.written).
+			Dur("duration_ms", duration).
+			Msg("HTTP request")
+	})
+}

pkg/metadata/gormstore/aggregation_worker.go

@@ -1,357 +0,0 @@
-package gormstore
-
-import (
-	"time"
-
-	"github.com/rs/zerolog/log"
-	"gorm.io/gorm"
-)
-
-// AggregationWorker handles background aggregation of download statistics
-type AggregationWorker struct {
-	db       *gorm.DB
-	stopChan chan struct{}
-	ticker   *time.Ticker
-}
-
-// NewAggregationWorker creates a new aggregation worker
-func NewAggregationWorker(db *gorm.DB) *AggregationWorker {
-	return &AggregationWorker{
-		db:       db,
-		stopChan: make(chan struct{}),
-		ticker:   time.NewTicker(1 * time.Hour), // Run every hour
-	}
-}
-
-// Start begins the aggregation worker
-func (w *AggregationWorker) Start() {
-	log.Info().Msg("Starting aggregation worker")
-
-	// Run immediately on start
-	if err := w.AggregateHourly(); err != nil {
-		log.Error().Err(err).Msg("Failed to run initial hourly aggregation")
-	}
-
-	for {
-		select {
-		case <-w.ticker.C:
-			if err := w.AggregateHourly(); err != nil {
-				log.Error().Err(err).Msg("Failed to aggregate hourly stats")
-			}
-
-			// Check if it's time for daily aggregation (run at midnight)
-			now := time.Now()
-			if now.Hour() == 0 {
-				if err := w.AggregateDaily(); err != nil {
-					log.Error().Err(err).Msg("Failed to aggregate daily stats")
-				}
-			}
-
-		case <-w.stopChan:
-			log.Info().Msg("Stopping aggregation worker")
-			w.ticker.Stop()
-			return
-		}
-	}
-}
-
-// Stop stops the aggregation worker
-func (w *AggregationWorker) Stop() {
-	close(w.stopChan)
-}
-
-// AggregateHourly aggregates download events into hourly stats
-func (w *AggregationWorker) AggregateHourly() error {
-	startTime := time.Now()
-	log.Debug().Msg("Starting hourly aggregation")
-
-	// Get dialect name
-	dialectName := w.db.Dialector.Name()
-
-	// Calculate cutoff time (aggregate events older than 5 minutes to avoid partial data)
-	cutoff := time.Now().Add(-5 * time.Minute).Truncate(time.Hour)
-
-	return w.db.Transaction(func(tx *gorm.DB) error {
-		var aggregateSQL string
-
-		switch dialectName {
-		case "postgres":
-			// PostgreSQL: Use date_trunc for time bucketing
-			aggregateSQL = `
-				INSERT INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					de.registry_id,
-					de.package_id,
-					date_trunc('hour', de.downloaded_at) AS time_bucket,
-					COUNT(*) AS download_count,
-					COUNT(DISTINCT de.ip_address) AS unique_ips,
-					COUNT(*) FILTER (WHERE de.authenticated = true) AS auth_downloads,
-					NOW() AS created_at,
-					NOW() AS updated_at
-				FROM download_events de
-				WHERE de.downloaded_at < ?
-				GROUP BY de.registry_id, de.package_id, time_bucket
-				ON CONFLICT (registry_id, COALESCE(package_id, 0), time_bucket)
-				DO UPDATE SET
-					download_count = download_stats_hourly.download_count + EXCLUDED.download_count,
-					unique_ips = GREATEST(download_stats_hourly.unique_ips, EXCLUDED.unique_ips),
-					auth_downloads = download_stats_hourly.auth_downloads + EXCLUDED.auth_downloads,
-					updated_at = NOW()
-			`
-
-		case "mysql":
-			// MySQL: Use DATE_FORMAT for time bucketing
-			aggregateSQL = `
-				INSERT INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					de.registry_id,
-					de.package_id,
-					DATE_FORMAT(de.downloaded_at, '%Y-%m-%d %H:00:00') AS time_bucket,
-					COUNT(*) AS download_count,
-					COUNT(DISTINCT de.ip_address) AS unique_ips,
-					SUM(CASE WHEN de.authenticated = true THEN 1 ELSE 0 END) AS auth_downloads,
-					NOW() AS created_at,
-					NOW() AS updated_at
-				FROM download_events de
-				WHERE de.downloaded_at < ?
-				GROUP BY de.registry_id, de.package_id, time_bucket
-				ON DUPLICATE KEY UPDATE
-					download_count = download_stats_hourly.download_count + VALUES(download_count),
-					unique_ips = GREATEST(download_stats_hourly.unique_ips, VALUES(unique_ips)),
-					auth_downloads = download_stats_hourly.auth_downloads + VALUES(auth_downloads),
-					updated_at = NOW()
-			`
-
-		default: // SQLite
-			// SQLite: Use strftime for time bucketing
-			// Note: SQLite doesn't support UPSERT as elegantly, need to handle separately
-			aggregateSQL = `
-				INSERT OR REPLACE INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					de.registry_id,
-					de.package_id,
-					strftime('%Y-%m-%d %H:00:00', de.downloaded_at) AS time_bucket,
-					COUNT(*) AS download_count,
-					COUNT(DISTINCT de.ip_address) AS unique_ips,
-					SUM(CASE WHEN de.authenticated = 1 THEN 1 ELSE 0 END) AS auth_downloads,
-					datetime('now') AS created_at,
-					datetime('now') AS updated_at
-				FROM download_events de
-				WHERE de.downloaded_at < ?
-				GROUP BY de.registry_id, de.package_id, time_bucket
-			`
-		}
-
-		// Execute aggregation
-		if err := tx.Exec(aggregateSQL, cutoff).Error; err != nil {
-			return err
-		}
-
-		// Delete aggregated events (older than 24 hours to keep recent data for debugging)
-		deleteOlder := time.Now().Add(-24 * time.Hour)
-		deleteResult := tx.Exec("DELETE FROM download_events WHERE downloaded_at < ?", deleteOlder)
-		if deleteResult.Error != nil {
-			return deleteResult.Error
-		}
-
-		// Also update package-level stats (NULL package_id = registry totals)
-		var registryAggSQL string
-		if dialectName == "postgres" {
-			registryAggSQL = `
-				INSERT INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					registry_id,
-					NULL as package_id,
-					time_bucket,
-					SUM(download_count) as download_count,
-					SUM(unique_ips) as unique_ips,
-					SUM(auth_downloads) as auth_downloads,
-					NOW() as created_at,
-					NOW() as updated_at
-				FROM download_stats_hourly
-				WHERE package_id IS NOT NULL
-				GROUP BY registry_id, time_bucket
-				ON CONFLICT (registry_id, COALESCE(package_id, 0), time_bucket)
-				DO UPDATE SET
-					download_count = EXCLUDED.download_count,
-					unique_ips = EXCLUDED.unique_ips,
-					auth_downloads = EXCLUDED.auth_downloads,
-					updated_at = NOW()
-			`
-		} else if dialectName == "mysql" {
-			registryAggSQL = `
-				INSERT INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					registry_id,
-					NULL as package_id,
-					time_bucket,
-					SUM(download_count) as download_count,
-					SUM(unique_ips) as unique_ips,
-					SUM(auth_downloads) as auth_downloads,
-					NOW() as created_at,
-					NOW() as updated_at
-				FROM download_stats_hourly
-				WHERE package_id IS NOT NULL
-				GROUP BY registry_id, time_bucket
-				ON DUPLICATE KEY UPDATE
-					download_count = VALUES(download_count),
-					unique_ips = VALUES(unique_ips),
-					auth_downloads = VALUES(auth_downloads),
-					updated_at = NOW()
-			`
-		} else {
-			// SQLite
-			registryAggSQL = `
-				INSERT OR REPLACE INTO download_stats_hourly (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, created_at, updated_at)
-				SELECT
-					registry_id,
-					NULL as package_id,
-					time_bucket,
-					SUM(download_count) as download_count,
-					SUM(unique_ips) as unique_ips,
-					SUM(auth_downloads) as auth_downloads,
-					datetime('now') as created_at,
-					datetime('now') as updated_at
-				FROM download_stats_hourly
-				WHERE package_id IS NOT NULL
-				GROUP BY registry_id, time_bucket
-			`
-		}
-
-		if err := tx.Exec(registryAggSQL).Error; err != nil {
-			log.Warn().Err(err).Msg("Failed to aggregate registry totals (continuing anyway)")
-		}
-
-		elapsed := time.Since(startTime)
-		log.Info().
-			Int64("deleted_events", deleteResult.RowsAffected).
-			Dur("duration", elapsed).
-			Msg("Completed hourly aggregation")
-
-		return nil
-	})
-}
-
-// AggregateDaily aggregates hourly stats into daily stats
-func (w *AggregationWorker) AggregateDaily() error {
-	startTime := time.Now()
-	log.Debug().Msg("Starting daily aggregation")
-
-	dialectName := w.db.Dialector.Name()
-
-	// Aggregate yesterday's data
-	yesterday := time.Now().AddDate(0, 0, -1).Truncate(24 * time.Hour)
-	dayEnd := yesterday.Add(24 * time.Hour)
-
-	return w.db.Transaction(func(tx *gorm.DB) error {
-		var aggregateSQL string
-
-		switch dialectName {
-		case "postgres":
-			aggregateSQL = `
-				INSERT INTO download_stats_daily (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, top_user_agents, created_at, updated_at)
-				SELECT
-					registry_id,
-					package_id,
-					date_trunc('day', time_bucket) AS time_bucket,
-					SUM(download_count) AS download_count,
-					MAX(unique_ips) AS unique_ips,
-					SUM(auth_downloads) AS auth_downloads,
-					'{}' AS top_user_agents,
-					NOW() AS created_at,
-					NOW() AS updated_at
-				FROM download_stats_hourly
-				WHERE time_bucket >= ? AND time_bucket < ?
-				GROUP BY registry_id, package_id, date_trunc('day', time_bucket)
-				ON CONFLICT (registry_id, COALESCE(package_id, 0), time_bucket)
-				DO UPDATE SET
-					download_count = EXCLUDED.download_count,
-					unique_ips = EXCLUDED.unique_ips,
-					auth_downloads = EXCLUDED.auth_downloads,
-					updated_at = NOW()
-			`
-
-		case "mysql":
-			aggregateSQL = `
-				INSERT INTO download_stats_daily (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, top_user_agents, created_at, updated_at)
-				SELECT
-					registry_id,
-					package_id,
-					DATE_FORMAT(time_bucket, '%Y-%m-%d 00:00:00') AS time_bucket,
-					SUM(download_count) AS download_count,
-					MAX(unique_ips) AS unique_ips,
-					SUM(auth_downloads) AS auth_downloads,
-					'{}' AS top_user_agents,
-					NOW() AS created_at,
-					NOW() AS updated_at
-				FROM download_stats_hourly
-				WHERE time_bucket >= ? AND time_bucket < ?
-				GROUP BY registry_id, package_id, DATE_FORMAT(time_bucket, '%Y-%m-%d 00:00:00')
-				ON DUPLICATE KEY UPDATE
-					download_count = VALUES(download_count),
-					unique_ips = VALUES(unique_ips),
-					auth_downloads = VALUES(auth_downloads),
-					updated_at = NOW()
-			`
-
-		default: // SQLite
-			aggregateSQL = `
-				INSERT OR REPLACE INTO download_stats_daily (registry_id, package_id, time_bucket, download_count, unique_ips, auth_downloads, top_user_agents, created_at, updated_at)
-				SELECT
-					registry_id,
-					package_id,
-					date(time_bucket) AS time_bucket,
-					SUM(download_count) AS download_count,
-					MAX(unique_ips) AS unique_ips,
-					SUM(auth_downloads) AS auth_downloads,
-					'{}' AS top_user_agents,
-					datetime('now') AS created_at,
-					datetime('now') AS updated_at
-				FROM download_stats_hourly
-				WHERE time_bucket >= ? AND time_bucket < ?
-				GROUP BY registry_id, package_id, date(time_bucket)
-			`
-		}
-
-		if err := tx.Exec(aggregateSQL, yesterday, dayEnd).Error; err != nil {
-			return err
-		}
-
-		// Delete old hourly stats (keep last 7 days)
-		deleteOlder := time.Now().AddDate(0, 0, -7)
-		deleteResult := tx.Exec("DELETE FROM download_stats_hourly WHERE time_bucket < ?", deleteOlder)
-		if deleteResult.Error != nil {
-			return deleteResult.Error
-		}
-
-		elapsed := time.Since(startTime)
-		log.Info().
-			Int64("deleted_hourly_stats", deleteResult.RowsAffected).
-			Dur("duration", elapsed).
-			Msg("Completed daily aggregation")
-
-		return nil
-	})
-}
-
-// UpdatePackageAccessCounts synchronizes package access_count from download stats
-func (w *AggregationWorker) UpdatePackageAccessCounts() error {
-	log.Debug().Msg("Updating package access counts")
-
-	// Update from download_stats_hourly (sum all-time downloads per package)
-	updateSQL := `
-		UPDATE packages p
-		SET access_count = COALESCE((
-			SELECT SUM(download_count)
-			FROM download_stats_hourly dsh
-			WHERE dsh.package_id = p.id
-		), 0)
-	`
-
-	if err := w.db.Exec(updateSQL).Error; err != nil {
-		return err
-	}
-
-	log.Info().Msg("Updated package access counts")
-	return nil
-}

pkg/metadata/gormstore/config.go

@@ -1,78 +0,0 @@
-package gormstore
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/lukaszraczylo/gohoarder/pkg/errors"
-)
-
-// Config holds GORM store configuration
-type Config struct {
-	// Database connection
-	Driver string // "sqlite", "postgres", "mysql"
-	DSN    string // Data Source Name
-
-	// Connection pool
-	MaxOpenConns    int
-	MaxIdleConns    int
-	ConnMaxLifetime time.Duration
-
-	// GORM settings
-	LogLevel string // "silent", "error", "warn", "info"
-}
-
-// Validate validates the configuration
-func (c *Config) Validate() error {
-	if c.Driver == "" {
-		return errors.New(errors.ErrCodeInvalidConfig, "driver is required")
-	}
-	if c.DSN == "" {
-		return errors.New(errors.ErrCodeInvalidConfig, "DSN is required")
-	}
-
-	// Set defaults
-	if c.MaxOpenConns == 0 {
-		c.MaxOpenConns = 25
-	}
-	if c.MaxIdleConns == 0 {
-		c.MaxIdleConns = 5
-	}
-	if c.ConnMaxLifetime == 0 {
-		c.ConnMaxLifetime = time.Hour
-	}
-	if c.LogLevel == "" {
-		c.LogLevel = "warn"
-	}
-
-	return nil
-}
-
-// BuildPostgresDSN builds PostgreSQL DSN from structured config
-func BuildPostgresDSN(host string, port int, user, password, database, sslmode string) string {
-	if sslmode == "" {
-		sslmode = "disable"
-	}
-	return fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=%s",
-		host, port, user, password, database, sslmode)
-}
-
-// BuildMySQLDSN builds MySQL/MariaDB DSN from structured config
-func BuildMySQLDSN(host string, port int, user, password, database, charset string) string {
-	if charset == "" {
-		charset = "utf8mb4"
-	}
-	return fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=%s&parseTime=True&loc=Local",
-		user, password, host, port, database, charset)
-}
-
-// BuildSQLiteDSN builds SQLite DSN with pragmas
-func BuildSQLiteDSN(path string, walMode bool) string {
-	if path == "" {
-		path = "gohoarder.db"
-	}
-	if walMode {
-		return fmt.Sprintf("%s?_journal_mode=WAL&_busy_timeout=5000&_synchronous=NORMAL&_cache_size=2000", path)
-	}
-	return fmt.Sprintf("%s?_journal_mode=DELETE&_busy_timeout=5000&_synchronous=NORMAL", path)
-}

pkg/metadata/gormstore/gormstore_v2_mysql_test.go

@@ -1,279 +0,0 @@
-//go:build integration
-// +build integration
-
-package gormstore
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
-	"github.com/stretchr/testify/suite"
-	"github.com/testcontainers/testcontainers-go"
-	"github.com/testcontainers/testcontainers-go/modules/mysql"
-	"github.com/testcontainers/testcontainers-go/wait"
-)
-
-// MySQLV2IntegrationTestSuite embeds the V2 test suite with MySQL container
-type MySQLV2IntegrationTestSuite struct {
-	GORMStoreV2TestSuite
-	container *mysql.MySQLContainer
-}
-
-// SetupSuite runs once before all tests
-func (s *MySQLV2IntegrationTestSuite) SetupSuite() {
-	ctx := context.Background()
-
-	// Start MySQL container
-	container, err := mysql.RunContainer(ctx,
-		testcontainers.WithImage("mysql:8.0"),
-		mysql.WithDatabase("testdb"),
-		mysql.WithUsername("testuser"),
-		mysql.WithPassword("testpass"),
-		testcontainers.WithWaitStrategy(
-			wait.ForLog("port: 3306  MySQL Community Server").
-				WithOccurrence(1).
-				WithStartupTimeout(60*time.Second),
-		),
-	)
-	s.Require().NoError(err)
-	s.container = container
-}
-
-// TearDownSuite runs once after all tests
-func (s *MySQLV2IntegrationTestSuite) TearDownSuite() {
-	if s.container != nil {
-		ctx := context.Background()
-		err := s.container.Terminate(ctx)
-		s.NoError(err)
-	}
-}
-
-// SetupTest runs before each test
-func (s *MySQLV2IntegrationTestSuite) SetupTest() {
-	s.ctx = context.Background()
-
-	// Get connection string from container
-	connStr, err := s.container.ConnectionString(s.ctx)
-	s.Require().NoError(err)
-
-	// Create GORM store with MySQL
-	cfg := Config{
-		Driver:          "mysql",
-		DSN:             connStr,
-		MaxOpenConns:    10,
-		MaxIdleConns:    5,
-		ConnMaxLifetime: 3600 * time.Second,
-		LogLevel:        "silent",
-	}
-
-	s.store, err = NewV2(cfg)
-	s.Require().NoError(err)
-	s.Require().NotNil(s.store)
-}
-
-// TearDownTest runs after each test
-func (s *MySQLV2IntegrationTestSuite) TearDownTest() {
-	if s.store != nil {
-		// Clean up all tables for next test
-		tables := []string{
-			"download_events",
-			"download_stats_hourly",
-			"download_stats_daily",
-			"audit_log",
-			"cve_bypasses",
-			"scan_results",
-			"package_vulnerabilities",
-			"vulnerabilities",
-			"package_metadata",
-			"packages",
-			"registries",
-		}
-
-		for _, table := range tables {
-			s.store.db.Exec("TRUNCATE TABLE " + table)
-		}
-
-		// Re-seed default registries after truncate
-		defaultRegistries := []RegistryModel{
-			{Name: "npm", DisplayName: "NPM Registry", UpstreamURL: "https://registry.npmjs.org", Enabled: true, ScanByDefault: true},
-			{Name: "pypi", DisplayName: "PyPI", UpstreamURL: "https://pypi.org", Enabled: true, ScanByDefault: true},
-			{Name: "go", DisplayName: "Go Modules", UpstreamURL: "https://proxy.golang.org", Enabled: true, ScanByDefault: true},
-		}
-		for _, reg := range defaultRegistries {
-			s.store.db.Create(&reg)
-		}
-
-		// Rebuild registry cache
-		s.store.rebuildRegistryCache()
-
-		s.store.Close()
-	}
-}
-
-// TestMySQLV2IntegrationTestSuite runs the integration test suite with MySQL
-func TestMySQLV2IntegrationTestSuite(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration tests in short mode")
-	}
-
-	suite.Run(t, new(MySQLV2IntegrationTestSuite))
-}
-
-// Test_MySQLV2_SpecificFeatures tests MySQL-specific features
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_SpecificFeatures() {
-	// Test that we're actually using MySQL
-	var version string
-	err := s.store.db.Raw("SELECT VERSION()").Scan(&version).Error
-	s.NoError(err)
-	s.Contains(version, "MySQL")
-}
-
-// Test_MySQLV2_NoPartitioning tests that partition manager is nil for MySQL
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_NoPartitioning() {
-	// MySQL doesn't use our partition manager (uses native partitioning differently)
-	s.Nil(s.store.partitionManager)
-}
-
-// Test_MySQLV2_HighConcurrency tests MySQL's concurrent write support
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_HighConcurrency() {
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "concurrent-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/concurrent-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// MySQL can handle concurrent writes (with InnoDB row-level locking)
-	concurrency := 15
-	done := make(chan bool, concurrency)
-
-	for i := 0; i < concurrency; i++ {
-		go func() {
-			err := s.store.UpdateDownloadCount(s.ctx, "npm", "concurrent-test", "1.0.0")
-			s.NoError(err)
-			done <- true
-		}()
-	}
-
-	// Wait for all goroutines
-	for i := 0; i < concurrency; i++ {
-		<-done
-	}
-
-	// Verify all updates succeeded
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "concurrent-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(concurrency), retrieved.DownloadCount)
-}
-
-// Test_MySQLV2_JSON tests MySQL JSON functionality
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_JSON() {
-	metadata := map[string]interface{}{
-		"author":      "Test Author",
-		"license":     "MIT",
-		"description": "Test package",
-		"keywords":    []interface{}{"test", "mysql", "json"},
-	}
-
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "json-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/json-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-		Metadata:     metadata,
-	}
-
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Retrieve and verify JSON data
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "json-test", "1.0.0")
-	s.NoError(err)
-	s.NotNil(retrieved.Metadata)
-	s.Equal("MIT", retrieved.Metadata["license"])
-	s.Equal("Test Author", retrieved.Metadata["author"])
-}
-
-// Test_MySQLV2_TransactionRollback tests MySQL transaction rollback
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_TransactionRollback() {
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "tx-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/tx-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Try to update with invalid data that should trigger rollback
-	err = s.store.db.Transaction(func(tx *gorm.DB) error {
-		// First update succeeds
-		result := tx.Model(&PackageModel{}).
-			Where("registry_id = ? AND name = ? AND version = ?",
-				s.store.registryCache["npm"], "tx-test", "1.0.0").
-			Update("access_count", gorm.Expr("access_count + ?", 1))
-		if result.Error != nil {
-			return result.Error
-		}
-
-		// Second operation fails (invalid foreign key)
-		invalidModel := &PackageModel{
-			RegistryID:   9999, // Non-existent registry
-			Name:         "invalid",
-			Version:      "1.0.0",
-			StorageKey:   "invalid",
-			Size:         100,
-			CachedAt:     time.Now(),
-			LastAccessed: time.Now(),
-		}
-		return tx.Create(invalidModel).Error
-	})
-
-	// Transaction should fail
-	s.Error(err)
-
-	// Verify first update was rolled back
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "tx-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(0), retrieved.DownloadCount) // Should still be 0, not 1
-}
-
-// Test_MySQLV2_CharacterSet tests MySQL UTF-8 support
-func (s *MySQLV2IntegrationTestSuite) Test_MySQLV2_CharacterSet() {
-	// Test package with Unicode characters
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "unicode-test-世界-🚀",
-		Version:      "1.0.0",
-		StorageKey:   "npm/unicode-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-		Metadata: map[string]interface{}{
-			"description": "Test with emoji 🎉 and Chinese 中文",
-		},
-	}
-
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Retrieve and verify Unicode data preserved
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "unicode-test-世界-🚀", "1.0.0")
-	s.NoError(err)
-	s.Equal("unicode-test-世界-🚀", retrieved.Name)
-	s.Contains(retrieved.Metadata["description"], "🎉")
-	s.Contains(retrieved.Metadata["description"], "中文")
-}

pkg/metadata/gormstore/gormstore_v2_postgres_test.go

@@ -1,202 +0,0 @@
-//go:build integration
-// +build integration
-
-package gormstore
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
-	"github.com/stretchr/testify/suite"
-	"github.com/testcontainers/testcontainers-go"
-	"github.com/testcontainers/testcontainers-go/modules/postgres"
-	"github.com/testcontainers/testcontainers-go/wait"
-)
-
-// PostgresV2IntegrationTestSuite embeds the V2 test suite with PostgreSQL container
-type PostgresV2IntegrationTestSuite struct {
-	GORMStoreV2TestSuite
-	container *postgres.PostgresContainer
-}
-
-// SetupSuite runs once before all tests
-func (s *PostgresV2IntegrationTestSuite) SetupSuite() {
-	ctx := context.Background()
-
-	// Start PostgreSQL container
-	container, err := postgres.RunContainer(ctx,
-		testcontainers.WithImage("postgres:16-alpine"),
-		postgres.WithDatabase("testdb"),
-		postgres.WithUsername("testuser"),
-		postgres.WithPassword("testpass"),
-		testcontainers.WithWaitStrategy(
-			wait.ForLog("database system is ready to accept connections").
-				WithOccurrence(2).
-				WithStartupTimeout(60*time.Second),
-		),
-	)
-	s.Require().NoError(err)
-	s.container = container
-}
-
-// TearDownSuite runs once after all tests
-func (s *PostgresV2IntegrationTestSuite) TearDownSuite() {
-	if s.container != nil {
-		ctx := context.Background()
-		err := s.container.Terminate(ctx)
-		s.NoError(err)
-	}
-}
-
-// SetupTest runs before each test
-func (s *PostgresV2IntegrationTestSuite) SetupTest() {
-	s.ctx = context.Background()
-
-	// Get connection string from container
-	connStr, err := s.container.ConnectionString(s.ctx)
-	s.Require().NoError(err)
-
-	// Create GORM store with PostgreSQL
-	cfg := Config{
-		Driver:          "postgres",
-		DSN:             connStr + "sslmode=disable",
-		MaxOpenConns:    10,
-		MaxIdleConns:    5,
-		ConnMaxLifetime: 3600 * time.Second,
-		LogLevel:        "silent",
-	}
-
-	s.store, err = NewV2(cfg)
-	s.Require().NoError(err)
-	s.Require().NotNil(s.store)
-}
-
-// TearDownTest runs after each test
-func (s *PostgresV2IntegrationTestSuite) TearDownTest() {
-	if s.store != nil {
-		// Clean up all tables for next test
-		tables := []string{
-			"download_events",
-			"download_stats_hourly",
-			"download_stats_daily",
-			"audit_log",
-			"cve_bypasses",
-			"scan_results",
-			"package_vulnerabilities",
-			"vulnerabilities",
-			"package_metadata",
-			"packages",
-		}
-
-		for _, table := range tables {
-			s.store.db.Exec("TRUNCATE TABLE " + table + " CASCADE")
-		}
-
-		s.store.Close()
-	}
-}
-
-// TestPostgresV2IntegrationTestSuite runs the integration test suite with PostgreSQL
-func TestPostgresV2IntegrationTestSuite(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping integration tests in short mode")
-	}
-
-	suite.Run(t, new(PostgresV2IntegrationTestSuite))
-}
-
-// Test_PostgresV2_SpecificFeatures tests PostgreSQL-specific features
-func (s *PostgresV2IntegrationTestSuite) Test_PostgresV2_SpecificFeatures() {
-	// Test that we're actually using PostgreSQL
-	var version string
-	err := s.store.db.Raw("SELECT version()").Scan(&version).Error
-	s.NoError(err)
-	s.Contains(version, "PostgreSQL")
-}
-
-// Test_PostgresV2_Partitioning tests partition manager
-func (s *PostgresV2IntegrationTestSuite) Test_PostgresV2_Partitioning() {
-	s.NotNil(s.store.partitionManager)
-
-	// Get partition info
-	info, err := s.store.partitionManager.GetPartitionInfo()
-	s.NoError(err)
-	s.NotNil(info)
-
-	// Should have created partitions
-	downloadPartitions := info["download_events_partitions"].(int64)
-	s.Greater(downloadPartitions, int64(0))
-
-	auditPartitions := info["audit_log_partitions"].(int64)
-	s.Greater(auditPartitions, int64(0))
-}
-
-// Test_PostgresV2_HighConcurrency tests PostgreSQL's excellent concurrent write support
-func (s *PostgresV2IntegrationTestSuite) Test_PostgresV2_HighConcurrency() {
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "concurrent-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/concurrent-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// PostgreSQL can handle many concurrent writes
-	concurrency := 20
-	done := make(chan bool, concurrency)
-
-	for i := 0; i < concurrency; i++ {
-		go func() {
-			err := s.store.UpdateDownloadCount(s.ctx, "npm", "concurrent-test", "1.0.0")
-			s.NoError(err)
-			done <- true
-		}()
-	}
-
-	// Wait for all goroutines
-	for i := 0; i < concurrency; i++ {
-		<-done
-	}
-
-	// Verify all updates succeeded
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "concurrent-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(concurrency), retrieved.DownloadCount)
-}
-
-// Test_PostgresV2_JSONB tests PostgreSQL JSONB functionality
-func (s *PostgresV2IntegrationTestSuite) Test_PostgresV2_JSONB() {
-	metadata := map[string]interface{}{
-		"author":      "Test Author",
-		"license":     "MIT",
-		"description": "Test package",
-		"keywords":    []interface{}{"test", "postgres", "jsonb"},
-	}
-
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "jsonb-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/jsonb-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-		Metadata:     metadata,
-	}
-
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Retrieve and verify JSONB data
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "jsonb-test", "1.0.0")
-	s.NoError(err)
-	s.NotNil(retrieved.Metadata)
-	s.Equal("MIT", retrieved.Metadata["license"])
-	s.Equal("Test Author", retrieved.Metadata["author"])
-}

pkg/metadata/gormstore/gormstore_v2_test.go

@@ -1,871 +0,0 @@
-package gormstore
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/lukaszraczylo/gohoarder/pkg/metadata"
-	"github.com/stretchr/testify/suite"
-	"gorm.io/driver/sqlite"
-	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
-)
-
-// GORMStoreV2TestSuite is the test suite for V2 GORM implementation
-type GORMStoreV2TestSuite struct {
-	suite.Suite
-	db    *gorm.DB
-	store *GORMStoreV2
-	ctx   context.Context
-}
-
-// SetupSuite runs once before all tests
-func (s *GORMStoreV2TestSuite) SetupSuite() {
-	// Use in-memory SQLite for fast tests
-	db, err := gorm.Open(sqlite.Open("file::memory:?cache=shared"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	s.Require().NoError(err)
-	s.db = db
-}
-
-// SetupTest runs before each test
-func (s *GORMStoreV2TestSuite) SetupTest() {
-	s.ctx = context.Background()
-
-	// Create fresh store with V2 schema
-	cfg := Config{
-		Driver:          "sqlite",
-		DSN:             "file::memory:?cache=shared",
-		MaxOpenConns:    10,
-		MaxIdleConns:    5,
-		ConnMaxLifetime: 3600 * time.Second,
-		LogLevel:        "silent",
-	}
-
-	store, err := NewV2(cfg)
-	s.Require().NoError(err)
-	s.Require().NotNil(store)
-
-	s.store = store
-}
-
-// TearDownTest runs after each test
-func (s *GORMStoreV2TestSuite) TearDownTest() {
-	if s.store != nil {
-		// Clean up all tables for next test
-		tables := []string{
-			"audit_log",
-			"download_stats_daily",
-			"download_stats_hourly",
-			"download_events",
-			"cve_bypasses",
-			"scan_results",
-			"package_vulnerabilities",
-			"vulnerabilities",
-			"package_metadata",
-			"packages",
-		}
-
-		for _, table := range tables {
-			s.store.db.Exec(fmt.Sprintf("DELETE FROM %s", table))
-		}
-
-		s.store.Close()
-	}
-}
-
-// TestGORMStoreV2TestSuite runs the test suite
-func TestGORMStoreV2TestSuite(t *testing.T) {
-	suite.Run(t, new(GORMStoreV2TestSuite))
-}
-
-// Test_V2_SavePackage_Success tests saving a package
-func (s *GORMStoreV2TestSuite) Test_V2_SavePackage_Success() {
-	pkg := &metadata.Package{
-		Registry:       "npm",
-		Name:           "test-package",
-		Version:        "1.0.0",
-		StorageKey:     "npm/test-package/1.0.0.tgz",
-		Size:           12345,
-		ChecksumMD5:    "abc123",
-		ChecksumSHA256: "def456",
-		UpstreamURL:    "https://registry.npmjs.org/test-package",
-		CachedAt:       time.Now(),
-		LastAccessed:   time.Now(),
-	}
-
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Verify package was saved
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "test-package", "1.0.0")
-	s.NoError(err)
-	s.NotNil(retrieved)
-	s.Equal("npm", retrieved.Registry)
-	s.Equal("test-package", retrieved.Name)
-	s.Equal("1.0.0", retrieved.Version)
-	s.Equal(int64(12345), retrieved.Size)
-}
-
-// Test_V2_SavePackage_WithMetadata tests saving package with metadata
-func (s *GORMStoreV2TestSuite) Test_V2_SavePackage_WithMetadata() {
-	metadataMap := map[string]string{
-		"author":      "Test Author",
-		"license":     "MIT",
-		"homepage":    "https://example.com",
-		"description": "Test package description",
-	}
-
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "meta-package",
-		Version:      "2.0.0",
-		StorageKey:   "npm/meta-package/2.0.0.tgz",
-		Size:         5000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-		Metadata:     metadataMap,
-	}
-
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Verify metadata was saved in separate table
-	var pkgMetadata PackageMetadataModel
-	err = s.store.db.Where("package_id = (SELECT id FROM packages WHERE name = ?)", "meta-package").
-		First(&pkgMetadata).Error
-	s.NoError(err)
-	s.Equal("Test Author", pkgMetadata.Author)
-	s.Equal("MIT", pkgMetadata.License)
-	s.Equal("https://example.com", pkgMetadata.Homepage)
-}
-
-// Test_V2_SavePackage_Upsert tests update on conflict
-func (s *GORMStoreV2TestSuite) Test_V2_SavePackage_Upsert() {
-	// Save initial package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "upsert-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/upsert-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Update same package
-	pkg.Size = 2000
-	pkg.ChecksumMD5 = "updated"
-	err = s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Verify updated
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "upsert-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(2000), retrieved.Size)
-	s.Equal("updated", retrieved.ChecksumMD5)
-}
-
-// Test_V2_GetPackage_NotFound tests getting non-existent package
-func (s *GORMStoreV2TestSuite) Test_V2_GetPackage_NotFound() {
-	_, err := s.store.GetPackage(s.ctx, "npm", "nonexistent", "1.0.0")
-	s.Error(err)
-	s.Contains(err.Error(), "not found")
-}
-
-// Test_V2_DeletePackage_Success tests soft delete
-func (s *GORMStoreV2TestSuite) Test_V2_DeletePackage_Success() {
-	// Save package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "delete-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/delete-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Delete package (soft delete)
-	err = s.store.DeletePackage(s.ctx, "npm", "delete-test", "1.0.0")
-	s.NoError(err)
-
-	// Verify deleted (should not be found)
-	_, err = s.store.GetPackage(s.ctx, "npm", "delete-test", "1.0.0")
-	s.Error(err)
-
-	// Verify soft delete (deleted_at set)
-	var count int64
-	s.store.db.Unscoped().Model(&PackageModel{}).
-		Where("name = ?", "delete-test").
-		Count(&count)
-	s.Equal(int64(1), count) // Still in DB, just soft deleted
-}
-
-// Test_V2_ListPackages_All tests listing all packages
-func (s *GORMStoreV2TestSuite) Test_V2_ListPackages_All() {
-	// Create multiple packages
-	for i := 0; i < 5; i++ {
-		pkg := &metadata.Package{
-			Registry:     "npm",
-			Name:         fmt.Sprintf("package-%d", i),
-			Version:      "1.0.0",
-			StorageKey:   fmt.Sprintf("npm/package-%d/1.0.0.tgz", i),
-			Size:         int64(i * 1000),
-			CachedAt:     time.Now(),
-			LastAccessed: time.Now(),
-		}
-		err := s.store.SavePackage(s.ctx, pkg)
-		s.NoError(err)
-	}
-
-	// List all packages
-	packages, err := s.store.ListPackages(s.ctx, &metadata.ListOptions{})
-	s.NoError(err)
-	s.Len(packages, 5)
-}
-
-// Test_V2_ListPackages_FilterByRegistry tests filtering by registry
-func (s *GORMStoreV2TestSuite) Test_V2_ListPackages_FilterByRegistry() {
-	// Create packages in different registries
-	registries := []string{"npm", "pypi", "go"}
-	for _, reg := range registries {
-		pkg := &metadata.Package{
-			Registry:     reg,
-			Name:         "test-package",
-			Version:      "1.0.0",
-			StorageKey:   fmt.Sprintf("%s/test-package/1.0.0", reg),
-			Size:         1000,
-			CachedAt:     time.Now(),
-			LastAccessed: time.Now(),
-		}
-		err := s.store.SavePackage(s.ctx, pkg)
-		s.NoError(err)
-	}
-
-	// Filter by npm registry
-	packages, err := s.store.ListPackages(s.ctx, &metadata.ListOptions{
-		Registry: "npm",
-	})
-	s.NoError(err)
-	s.Len(packages, 1)
-	s.Equal("npm", packages[0].Registry)
-}
-
-// Test_V2_ListPackages_Pagination tests pagination
-func (s *GORMStoreV2TestSuite) Test_V2_ListPackages_Pagination() {
-	// Create 10 packages
-	for i := 0; i < 10; i++ {
-		pkg := &metadata.Package{
-			Registry:     "npm",
-			Name:         fmt.Sprintf("package-%d", i),
-			Version:      "1.0.0",
-			StorageKey:   fmt.Sprintf("npm/package-%d/1.0.0.tgz", i),
-			Size:         int64(i * 1000),
-			CachedAt:     time.Now(),
-			LastAccessed: time.Now(),
-		}
-		err := s.store.SavePackage(s.ctx, pkg)
-		s.NoError(err)
-	}
-
-	// Get first page (5 items)
-	page1, err := s.store.ListPackages(s.ctx, &metadata.ListOptions{
-		Limit:  5,
-		Offset: 0,
-	})
-	s.NoError(err)
-	s.Len(page1, 5)
-
-	// Get second page (5 items)
-	page2, err := s.store.ListPackages(s.ctx, &metadata.ListOptions{
-		Limit:  5,
-		Offset: 5,
-	})
-	s.NoError(err)
-	s.Len(page2, 5)
-
-	// Verify different packages
-	s.NotEqual(page1[0].Name, page2[0].Name)
-}
-
-// Test_V2_UpdateDownloadCount_Success tests incrementing download count
-func (s *GORMStoreV2TestSuite) Test_V2_UpdateDownloadCount_Success() {
-	// Create package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "download-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/download-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Update download count
-	err = s.store.UpdateDownloadCount(s.ctx, "npm", "download-test", "1.0.0")
-	s.NoError(err)
-
-	// Verify count incremented
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "download-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(1), retrieved.DownloadCount)
-
-	// Update again
-	err = s.store.UpdateDownloadCount(s.ctx, "npm", "download-test", "1.0.0")
-	s.NoError(err)
-
-	retrieved, err = s.store.GetPackage(s.ctx, "npm", "download-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(2), retrieved.DownloadCount)
-
-	// Verify download event was recorded
-	var eventCount int64
-	s.store.db.Model(&DownloadEventModel{}).Count(&eventCount)
-	s.Equal(int64(2), eventCount)
-}
-
-// Test_V2_Count tests counting packages
-func (s *GORMStoreV2TestSuite) Test_V2_Count() {
-	// Initially zero
-	count, err := s.store.Count(s.ctx)
-	s.NoError(err)
-	s.Equal(0, count)
-
-	// Create 3 packages
-	for i := 0; i < 3; i++ {
-		pkg := &metadata.Package{
-			Registry:     "npm",
-			Name:         fmt.Sprintf("count-test-%d", i),
-			Version:      "1.0.0",
-			StorageKey:   fmt.Sprintf("npm/count-test-%d/1.0.0.tgz", i),
-			Size:         1000,
-			CachedAt:     time.Now(),
-			LastAccessed: time.Now(),
-		}
-		err := s.store.SavePackage(s.ctx, pkg)
-		s.NoError(err)
-	}
-
-	count, err = s.store.Count(s.ctx)
-	s.NoError(err)
-	s.Equal(3, count)
-}
-
-// Test_V2_GetStats tests aggregated statistics
-func (s *GORMStoreV2TestSuite) Test_V2_GetStats() {
-	// Create packages in different registries
-	packages := []*metadata.Package{
-		{Registry: "npm", Name: "pkg1", Version: "1.0.0", StorageKey: "npm/pkg1/1.0.0.tgz", Size: 1000, CachedAt: time.Now(), LastAccessed: time.Now()},
-		{Registry: "npm", Name: "pkg2", Version: "1.0.0", StorageKey: "npm/pkg2/1.0.0.tgz", Size: 2000, CachedAt: time.Now(), LastAccessed: time.Now()},
-		{Registry: "pypi", Name: "pkg3", Version: "1.0.0", StorageKey: "pypi/pkg3/1.0.0.tar.gz", Size: 3000, CachedAt: time.Now(), LastAccessed: time.Now()},
-	}
-
-	for _, pkg := range packages {
-		err := s.store.SavePackage(s.ctx, pkg)
-		s.NoError(err)
-	}
-
-	// Update download counts
-	s.store.UpdateDownloadCount(s.ctx, "npm", "pkg1", "1.0.0")
-	s.store.UpdateDownloadCount(s.ctx, "npm", "pkg1", "1.0.0")
-	s.store.UpdateDownloadCount(s.ctx, "npm", "pkg2", "1.0.0")
-
-	// Get stats for all registries
-	statsAll, err := s.store.GetStats(s.ctx, "")
-	s.NoError(err)
-	s.Equal(int64(3), statsAll.TotalPackages)
-	s.Equal(int64(6000), statsAll.TotalSize)
-	s.Equal(int64(3), statsAll.TotalDownloads)
-
-	// Get stats for npm registry
-	statsNpm, err := s.store.GetStats(s.ctx, "npm")
-	s.NoError(err)
-	s.Equal("npm", statsNpm.Registry)
-	s.Equal(int64(2), statsNpm.TotalPackages)
-	s.Equal(int64(3000), statsNpm.TotalSize)
-	s.Equal(int64(3), statsNpm.TotalDownloads)
-
-	// Get stats for pypi registry
-	statsPypi, err := s.store.GetStats(s.ctx, "pypi")
-	s.NoError(err)
-	s.Equal("pypi", statsPypi.Registry)
-	s.Equal(int64(1), statsPypi.TotalPackages)
-	s.Equal(int64(3000), statsPypi.TotalSize)
-}
-
-// Test_V2_Health tests database health check
-func (s *GORMStoreV2TestSuite) Test_V2_Health() {
-	err := s.store.Health(s.ctx)
-	s.NoError(err)
-}
-
-// Test_V2_RegistryCache tests registry caching
-func (s *GORMStoreV2TestSuite) Test_V2_RegistryCache() {
-	// Default registries should be cached
-	s.Contains(s.store.registryCache, "npm")
-	s.Contains(s.store.registryCache, "pypi")
-	s.Contains(s.store.registryCache, "go")
-
-	// Get registry ID from cache
-	npmID, err := s.store.getRegistryID("npm")
-	s.NoError(err)
-	s.Greater(npmID, int32(0))
-
-	// Second call should use cache (no DB query)
-	npmID2, err := s.store.getRegistryID("npm")
-	s.NoError(err)
-	s.Equal(npmID, npmID2)
-
-	// Non-existent registry
-	_, err = s.store.getRegistryID("nonexistent")
-	s.Error(err)
-	s.Contains(err.Error(), "not found")
-}
-
-// Test_V2_SoftDelete tests soft delete behavior
-func (s *GORMStoreV2TestSuite) Test_V2_SoftDelete() {
-	// Create package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "soft-delete",
-		Version:      "1.0.0",
-		StorageKey:   "npm/soft-delete/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Delete
-	err = s.store.DeletePackage(s.ctx, "npm", "soft-delete", "1.0.0")
-	s.NoError(err)
-
-	// Count should not include deleted
-	count, err := s.store.Count(s.ctx)
-	s.NoError(err)
-	s.Equal(0, count)
-
-	// But record still exists with deleted_at set
-	var pkgModel PackageModel
-	err = s.store.db.Unscoped().Where("name = ?", "soft-delete").First(&pkgModel).Error
-	s.NoError(err)
-	s.NotNil(pkgModel.DeletedAt)
-}
-
-// Test_V2_AggregationWorker tests that aggregation worker is initialized
-func (s *GORMStoreV2TestSuite) Test_V2_AggregationWorker() {
-	s.NotNil(s.store.aggregationWorker)
-}
-
-// Test_V2_ConcurrentUpdates tests concurrent download count updates
-func (s *GORMStoreV2TestSuite) Test_V2_ConcurrentUpdates() {
-	// Create package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "concurrent-test",
-		Version:      "1.0.0",
-		StorageKey:   "npm/concurrent-test/1.0.0.tgz",
-		Size:         1000,
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// SQLite: Sequential updates only (write lock prevents concurrent writes)
-	updateCount := 5
-	for i := 0; i < updateCount; i++ {
-		err := s.store.UpdateDownloadCount(s.ctx, "npm", "concurrent-test", "1.0.0")
-		s.NoError(err)
-	}
-
-	// Verify all updates succeeded
-	retrieved, err := s.store.GetPackage(s.ctx, "npm", "concurrent-test", "1.0.0")
-	s.NoError(err)
-	s.Equal(int64(updateCount), retrieved.DownloadCount)
-}
-
-// Test_V2_SaveScanResult tests saving a scan result
-func (s *GORMStoreV2TestSuite) Test_V2_SaveScanResult() {
-	// Create a package first
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "test-package",
-		Version:      "1.0.0",
-		StorageKey:   "/cache/npm/test-package-1.0.0.tgz",
-		Size:         1024,
-		UpstreamURL:  "https://registry.npmjs.org/test-package",
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Create and save a scan result
-	scanResult := &metadata.ScanResult{
-		Registry:       "npm",
-		PackageName:    "test-package",
-		PackageVersion: "1.0.0",
-		Scanner:        "trivy",
-		Status:         metadata.ScanStatusVulnerable,
-		ScannedAt:      time.Now(),
-		Vulnerabilities: []metadata.Vulnerability{
-			{
-				ID:          "CVE-2024-0001",
-				Severity:    "HIGH",
-				Title:       "Test vulnerability",
-				Description: "Test description",
-				References:  []string{"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0001"},
-			},
-			{
-				ID:          "CVE-2024-0002",
-				Severity:    "CRITICAL",
-				Title:       "Critical vulnerability",
-				Description: "Critical test description",
-				References:  []string{"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0002"},
-			},
-		},
-		VulnerabilityCount: 2,
-		Details: map[string]interface{}{
-			"scan_duration":   42,
-			"scanner_version": "1.0.0",
-		},
-	}
-
-	err = s.store.SaveScanResult(s.ctx, scanResult)
-	s.NoError(err)
-
-	// Verify the scan result was saved and package was updated
-	retrievedPkg, err := s.store.GetPackage(s.ctx, "npm", "test-package", "1.0.0")
-	s.NoError(err)
-	s.True(retrievedPkg.SecurityScanned)
-}
-
-// Test_V2_GetScanResult tests retrieving a scan result
-func (s *GORMStoreV2TestSuite) Test_V2_GetScanResult() {
-	// Create a package
-	pkg := &metadata.Package{
-		Registry:     "npm",
-		Name:         "scan-test",
-		Version:      "2.0.0",
-		StorageKey:   "/cache/npm/scan-test-2.0.0.tgz",
-		Size:         2048,
-		UpstreamURL:  "https://registry.npmjs.org/scan-test",
-		CachedAt:     time.Now(),
-		LastAccessed: time.Now(),
-	}
-	err := s.store.SavePackage(s.ctx, pkg)
-	s.NoError(err)
-
-	// Save a scan result with vulnerabilities
-	scanResult := &metadata.ScanResult{
-		Registry:       "npm",
-		PackageName:    "scan-test",
-		PackageVersion: "2.0.0",
-		Scanner:        "grype",
-		Status:         metadata.ScanStatusVulnerable,
-		ScannedAt:      time.Now(),
-		Vulnerabilities: []metadata.Vulnerability{
-			{
-				ID:          "CVE-2024-1234",
-				Severity:    "HIGH",
-				Title:       "Test High Severity",
-				Description: "High severity test",
-				References:  []string{"https://example.com/cve-2024-1234"},
-				FixedIn:     "2.1.0",
-			},
-			{
-				ID:          "CVE-2024-5678",
-				Severity:    "MODERATE",
-				Title:       "Test Moderate Severity",
-				Description: "Moderate severity test",
-				References:  []string{"https://example.com/cve-2024-5678"},
-			},
-		},
-		VulnerabilityCount: 2,
-	}
-	err = s.store.SaveScanResult(s.ctx, scanResult)
-	s.NoError(err)
-
-	// Retrieve the scan result
-	retrieved, err := s.store.GetScanResult(s.ctx, "npm", "scan-test", "2.0.0")
-	s.NoError(err)
-	s.NotNil(retrieved)
-	s.Equal("grype", retrieved.Scanner)
-	s.Equal(metadata.ScanStatusVulnerable, retrieved.Status)
-	s.Equal(2, retrieved.VulnerabilityCount)
-	s.Len(retrieved.Vulnerabilities, 2)
-
-	// Verify vulnerability details are retrieved correctly
-	s.Equal("CVE-2024-1234", retrieved.Vulnerabilities[0].ID)
-	s.Equal("HIGH", retrieved.Vulnerabilities[0].Severity)
-	s.Equal("Test High Severity", retrieved.Vulnerabilities[0].Title)
-	s.Equal("2.1.0", retrieved.Vulnerabilities[0].FixedIn)
-	s.Len(retrieved.Vulnerabilities[0].References, 1)
-}
-
-// Test_V2_GetScanResult_NotFound tests retrieving a non-existent scan result
-func (s *GORMStoreV2TestSuite) Test_V2_GetScanResult_NotFound() {
-	_, err := s.store.GetScanResult(s.ctx, "npm", "nonexistent", "1.0.0")
-	s.Error(err)
-}
-
-// Test_V2_SaveCVEBypass tests saving a CVE bypass
-func (s *GORMStoreV2TestSuite) Test_V2_SaveCVEBypass() {
-	bypass := &metadata.CVEBypass{
-		Type:           metadata.BypassTypeCVE,
-		Target:         "CVE-2024-0001",
-		Reason:         "False positive - not applicable to our use case",
-		CreatedBy:      "[email protected]",
-		ExpiresAt:      time.Now().Add(30 * 24 * time.Hour), // 30 days
-		NotifyOnExpiry: true,
-		Active:         true,
-	}
-
-	err := s.store.SaveCVEBypass(s.ctx, bypass)
-	s.NoError(err)
-	s.NotEmpty(bypass.ID)
-	s.NotZero(bypass.CreatedAt)
-}
-
-// Test_V2_SaveCVEBypass_Update tests updating an existing CVE bypass
-func (s *GORMStoreV2TestSuite) Test_V2_SaveCVEBypass_Update() {
-	// Create initial bypass
-	bypass := &metadata.CVEBypass{
-		Type:           metadata.BypassTypeCVE,
-		Target:         "CVE-2024-0002",
-		Reason:         "Initial reason",
-		CreatedBy:      "[email protected]",
-		ExpiresAt:      time.Now().Add(30 * 24 * time.Hour),
-		NotifyOnExpiry: false,
-		Active:         true,
-	}
-	err := s.store.SaveCVEBypass(s.ctx, bypass)
-	s.NoError(err)
-	s.NotEmpty(bypass.ID)
-
-	// Update the bypass
-	bypass.Reason = "Updated reason"
-	bypass.NotifyOnExpiry = true
-	err = s.store.SaveCVEBypass(s.ctx, bypass)
-	s.NoError(err)
-}
-
-// Test_V2_GetActiveCVEBypasses tests retrieving active CVE bypasses
-func (s *GORMStoreV2TestSuite) Test_V2_GetActiveCVEBypasses() {
-	// Create active bypass with unique target
-	uniqueTarget := fmt.Sprintf("CVE-2024-TEST-%d", time.Now().UnixNano())
-	activeBypass := &metadata.CVEBypass{
-		Type:      metadata.BypassTypeCVE,
-		Target:    uniqueTarget,
-		Reason:    "Active bypass",
-		CreatedBy: "[email protected]",
-		ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
-		Active:    true,
-	}
-	err := s.store.SaveCVEBypass(s.ctx, activeBypass)
-	s.NoError(err)
-
-	// Create expired bypass
-	expiredBypass := &metadata.CVEBypass{
-		Type:      metadata.BypassTypeCVE,
-		Target:    "CVE-2024-0004",
-		Reason:    "Expired bypass",
-		CreatedBy: "[email protected]",
-		ExpiresAt: time.Now().Add(-24 * time.Hour), // Expired yesterday
-		Active:    true,
-	}
-	err = s.store.SaveCVEBypass(s.ctx, expiredBypass)
-	s.NoError(err)
-
-	// Create inactive bypass
-	inactiveBypass := &metadata.CVEBypass{
-		Type:      metadata.BypassTypeCVE,
-		Target:    "CVE-2024-0005",
-		Reason:    "Inactive bypass",
-		CreatedBy: "[email protected]",
-		ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
-		Active:    false,
-	}
-	err = s.store.SaveCVEBypass(s.ctx, inactiveBypass)
-	s.NoError(err)
-
-	// Retrieve active bypasses
-	bypasses, err := s.store.GetActiveCVEBypasses(s.ctx)
-	s.NoError(err)
-
-	// Should contain our active bypass, but may contain others from parallel tests
-	found := false
-	for _, b := range bypasses {
-		if b.Target == uniqueTarget {
-			found = true
-			break
-		}
-		// All bypasses should be active and non-expired
-		s.True(b.Active)
-		s.True(b.ExpiresAt.After(time.Now()))
-	}
-	s.True(found, "Should find our unique active bypass")
-}
-
-// Test_V2_ListCVEBypasses tests listing CVE bypasses with filters
-func (s *GORMStoreV2TestSuite) Test_V2_ListCVEBypasses() {
-	// Create multiple bypasses with unique targets
-	nano := time.Now().UnixNano()
-	bypasses := []*metadata.CVEBypass{
-		{
-			Type:      metadata.BypassTypeCVE,
-			Target:    fmt.Sprintf("CVE-2024-LIST-%d-1", nano),
-			Reason:    "Test 1",
-			CreatedBy: "[email protected]",
-			ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
-			Active:    true,
-		},
-		{
-			Type:      metadata.BypassTypePackage,
-			Target:    fmt.Sprintf("npm/vulnerable-package@%d", nano),
-			Reason:    "Test 2",
-			CreatedBy: "[email protected]",
-			ExpiresAt: time.Now().Add(15 * 24 * time.Hour),
-			Active:    true,
-		},
-		{
-			Type:      metadata.BypassTypeCVE,
-			Target:    fmt.Sprintf("CVE-2024-LIST-%d-2", nano),
-			Reason:    "Test 3",
-			CreatedBy: "[email protected]",
-			ExpiresAt: time.Now().Add(-1 * time.Hour), // Expired
-			Active:    true,
-		},
-	}
-
-	for _, b := range bypasses {
-		err := s.store.SaveCVEBypass(s.ctx, b)
-		s.NoError(err)
-	}
-
-	// List only CVE type
-	opts := &metadata.BypassListOptions{
-		Type: metadata.BypassTypeCVE,
-	}
-	cveOnly, err := s.store.ListCVEBypasses(s.ctx, opts)
-	s.NoError(err)
-	for _, b := range cveOnly {
-		s.Equal(metadata.BypassTypeCVE, b.Type)
-	}
-
-	// List only non-expired
-	opts = &metadata.BypassListOptions{
-		IncludeExpired: false,
-	}
-	nonExpired, err := s.store.ListCVEBypasses(s.ctx, opts)
-	s.NoError(err)
-	for _, b := range nonExpired {
-		s.True(b.ExpiresAt.After(time.Now()))
-	}
-
-	// Test pagination
-	opts = &metadata.BypassListOptions{
-		Limit:  1,
-		Offset: 0,
-	}
-	page1, err := s.store.ListCVEBypasses(s.ctx, opts)
-	s.NoError(err)
-	s.LessOrEqual(len(page1), 1) // Should be at most 1
-}
-
-// Test_V2_DeleteCVEBypass tests deleting a CVE bypass
-func (s *GORMStoreV2TestSuite) Test_V2_DeleteCVEBypass() {
-	// Create a bypass
-	bypass := &metadata.CVEBypass{
-		Type:      metadata.BypassTypeCVE,
-		Target:    "CVE-2024-0008",
-		Reason:    "To be deleted",
-		CreatedBy: "[email protected]",
-		ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
-		Active:    true,
-	}
-	err := s.store.SaveCVEBypass(s.ctx, bypass)
-	s.NoError(err)
-	s.NotEmpty(bypass.ID)
-
-	// Delete the bypass
-	err = s.store.DeleteCVEBypass(s.ctx, bypass.ID)
-	s.NoError(err)
-
-	// Verify it's no longer in active bypasses
-	active, err := s.store.GetActiveCVEBypasses(s.ctx)
-	s.NoError(err)
-	for _, b := range active {
-		s.NotEqual(bypass.ID, b.ID)
-	}
-}
-
-// Test_V2_DeleteCVEBypass_NotFound tests deleting a non-existent bypass
-func (s *GORMStoreV2TestSuite) Test_V2_DeleteCVEBypass_NotFound() {
-	err := s.store.DeleteCVEBypass(s.ctx, "99999999")
-	s.Error(err)
-}
-
-// Test_V2_DeleteCVEBypass_InvalidID tests deleting with invalid ID
-func (s *GORMStoreV2TestSuite) Test_V2_DeleteCVEBypass_InvalidID() {
-	err := s.store.DeleteCVEBypass(s.ctx, "invalid-id")
-	s.Error(err)
-}
-
-// Test_V2_CleanupExpiredBypasses tests cleaning up expired bypasses
-func (s *GORMStoreV2TestSuite) Test_V2_CleanupExpiredBypasses() {
-	// Create expired bypasses
-	for i := 0; i < 3; i++ {
-		bypass := &metadata.CVEBypass{
-			Type:      metadata.BypassTypeCVE,
-			Target:    fmt.Sprintf("CVE-2024-00%d", 10+i),
-			Reason:    "Expired bypass",
-			CreatedBy: "[email protected]",
-			ExpiresAt: time.Now().Add(-24 * time.Hour), // Expired
-			Active:    true,
-		}
-		err := s.store.SaveCVEBypass(s.ctx, bypass)
-		s.NoError(err)
-	}
-
-	// Create active bypass (should not be deleted)
-	activeBypass := &metadata.CVEBypass{
-		Type:      metadata.BypassTypeCVE,
-		Target:    "CVE-2024-0999",
-		Reason:    "Active bypass",
-		CreatedBy: "[email protected]",
-		ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
-		Active:    true,
-	}
-	err := s.store.SaveCVEBypass(s.ctx, activeBypass)
-	s.NoError(err)
-
-	// Cleanup expired bypasses
-	count, err := s.store.CleanupExpiredBypasses(s.ctx)
-	s.NoError(err)
-	s.GreaterOrEqual(count, 3) // At least the 3 we just created
-
-	// Verify active bypass is still there
-	active, err := s.store.GetActiveCVEBypasses(s.ctx)
-	s.NoError(err)
-	found := false
-	for _, b := range active {
-		if b.Target == "CVE-2024-0999" {
-			found = true
-			break
-		}
-	}
-	s.True(found, "Active bypass should still exist")
-}

pkg/metadata/gormstore/migrations.go

@@ -1,228 +0,0 @@
-package gormstore
-
-import (
-	"github.com/go-gormigrate/gormigrate/v2"
-	"gorm.io/gorm"
-)
-
-// GetMigrations returns all database migrations for gormigrate
-func GetMigrations() []*gormigrate.Migration {
-	return []*gormigrate.Migration{
-		{
-			ID: "202601030001",
-			Migrate: func(tx *gorm.DB) error {
-				// Migration: Create V2 schema
-				return migrateToV2(tx)
-			},
-			Rollback: func(tx *gorm.DB) error {
-				// Rollback: Drop V2 schema (careful!)
-				return rollbackFromV2(tx)
-			},
-		},
-		// Future migrations go here
-		// {
-		//     ID: "202601040001",
-		//     Migrate: func(tx *gorm.DB) error {
-		//         // Add new column, index, etc.
-		//         return tx.Exec("ALTER TABLE packages ADD COLUMN new_field VARCHAR(255)").Error
-		//     },
-		//     Rollback: func(tx *gorm.DB) error {
-		//         return tx.Exec("ALTER TABLE packages DROP COLUMN new_field").Error
-		//     },
-		// },
-	}
-}
-
-// migrateToV2 creates the complete V2 schema
-func migrateToV2(tx *gorm.DB) error {
-	// Get dialect name for database-specific features
-	dialectName := tx.Dialector.Name()
-
-	// Step 1: Create all tables using GORM AutoMigrate
-	// This handles cross-database compatibility automatically
-	if err := tx.AutoMigrate(GetAllModels()...); err != nil {
-		return err
-	}
-
-	// Step 2: Seed default registries
-	registries := []RegistryModel{
-		{Name: "npm", DisplayName: "NPM Registry", UpstreamURL: "https://registry.npmjs.org", Enabled: true, ScanByDefault: true},
-		{Name: "pypi", DisplayName: "PyPI", UpstreamURL: "https://pypi.org", Enabled: true, ScanByDefault: true},
-		{Name: "go", DisplayName: "Go Modules", UpstreamURL: "https://proxy.golang.org", Enabled: true, ScanByDefault: true},
-	}
-
-	for _, reg := range registries {
-		// Upsert: create if not exists
-		if err := tx.Where("name = ?", reg.Name).FirstOrCreate(&reg).Error; err != nil {
-			return err
-		}
-	}
-
-	// Step 3: Create database-specific optimizations
-	if dialectName == "postgres" {
-		if err := createPostgreSQLOptimizations(tx); err != nil {
-			return err
-		}
-	} else if dialectName == "mysql" {
-		if err := createMySQLOptimizations(tx); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// createPostgreSQLOptimizations adds PostgreSQL-specific features
-func createPostgreSQLOptimizations(tx *gorm.DB) error {
-	optimizations := []string{
-		// Create GIN indexes for JSONB columns
-		`CREATE INDEX IF NOT EXISTS idx_package_metadata_keywords_gin
-		 ON package_metadata USING GIN(keywords)`,
-
-		`CREATE INDEX IF NOT EXISTS idx_package_metadata_raw_gin
-		 ON package_metadata USING GIN(raw_metadata)`,
-
-		`CREATE INDEX IF NOT EXISTS idx_vulnerabilities_references_gin
-		 ON vulnerabilities USING GIN(references)`,
-
-		// Create partial indexes (only non-deleted records)
-		`CREATE INDEX IF NOT EXISTS idx_packages_active
-		 ON packages(registry_id, name, version) WHERE deleted_at IS NULL`,
-
-		`CREATE INDEX IF NOT EXISTS idx_packages_vulnerable
-		 ON packages(vulnerability_count, highest_severity)
-		 WHERE vulnerability_count > 0 AND deleted_at IS NULL`,
-
-		// Create view for vulnerable packages
-		`CREATE OR REPLACE VIEW v_vulnerable_packages AS
-		 SELECT
-		   r.name AS registry,
-		   p.name,
-		   p.version,
-		   p.vulnerability_count,
-		   p.highest_severity,
-		   p.last_scanned_at
-		 FROM packages p
-		 JOIN registries r ON p.registry_id = r.id
-		 WHERE p.vulnerability_count > 0 AND p.deleted_at IS NULL
-		 ORDER BY
-		   CASE p.highest_severity
-		     WHEN 'critical' THEN 1
-		     WHEN 'high' THEN 2
-		     WHEN 'medium' THEN 3
-		     WHEN 'low' THEN 4
-		     ELSE 5
-		   END,
-		   p.vulnerability_count DESC`,
-
-		// Create function for automatic partition creation
-		`CREATE OR REPLACE FUNCTION create_next_month_partitions()
-		 RETURNS void AS $$
-		 DECLARE
-		   next_month DATE := date_trunc('month', NOW() + INTERVAL '2 months');
-		   partition_name TEXT;
-		   start_date TEXT;
-		   end_date TEXT;
-		 BEGIN
-		   -- Download events partition
-		   partition_name := 'download_events_' || to_char(next_month, 'YYYY_MM');
-		   start_date := to_char(next_month, 'YYYY-MM-DD');
-		   end_date := to_char(next_month + INTERVAL '1 month', 'YYYY-MM-DD');
-
-		   EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF download_events FOR VALUES FROM (%L) TO (%L)',
-		     partition_name, start_date, end_date);
-
-		   -- Audit log partition
-		   partition_name := 'audit_log_' || to_char(next_month, 'YYYY_MM');
-		   EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF audit_log FOR VALUES FROM (%L) TO (%L)',
-		     partition_name, start_date, end_date);
-
-		   RAISE NOTICE 'Created partitions for %', to_char(next_month, 'YYYY-MM');
-		 END;
-		 $$ LANGUAGE plpgsql`,
-	}
-
-	for _, sql := range optimizations {
-		if err := tx.Exec(sql).Error; err != nil {
-			// Log warning but don't fail migration
-			// Some optimizations might already exist
-			continue
-		}
-	}
-
-	return nil
-}
-
-// createMySQLOptimizations adds MySQL-specific features
-func createMySQLOptimizations(tx *gorm.DB) error {
-	optimizations := []string{
-		// Create view for vulnerable packages
-		`CREATE OR REPLACE VIEW v_vulnerable_packages AS
-		 SELECT
-		   r.name AS registry,
-		   p.name,
-		   p.version,
-		   p.vulnerability_count,
-		   p.highest_severity,
-		   p.last_scanned_at
-		 FROM packages p
-		 JOIN registries r ON p.registry_id = r.id
-		 WHERE p.vulnerability_count > 0 AND p.deleted_at IS NULL
-		 ORDER BY
-		   CASE p.highest_severity
-		     WHEN 'critical' THEN 1
-		     WHEN 'high' THEN 2
-		     WHEN 'medium' THEN 3
-		     WHEN 'low' THEN 4
-		     ELSE 5
-		   END,
-		   p.vulnerability_count DESC`,
-	}
-
-	for _, sql := range optimizations {
-		if err := tx.Exec(sql).Error; err != nil {
-			continue
-		}
-	}
-
-	return nil
-}
-
-// rollbackFromV2 drops all V2 tables (USE WITH CAUTION!)
-func rollbackFromV2(tx *gorm.DB) error {
-	// Drop in reverse order to respect foreign keys
-	tables := []string{
-		"audit_log",
-		"download_stats_daily",
-		"download_stats_hourly",
-		"download_events",
-		"cve_bypasses",
-		"scan_results",
-		"package_vulnerabilities",
-		"vulnerabilities",
-		"package_metadata",
-		"packages",
-		"registries",
-	}
-
-	// Drop PostgreSQL-specific objects
-	if tx.Dialector.Name() == "postgres" {
-		tx.Exec("DROP VIEW IF EXISTS v_vulnerable_packages")
-		tx.Exec("DROP FUNCTION IF EXISTS create_next_month_partitions()")
-	}
-
-	// Drop MySQL-specific objects
-	if tx.Dialector.Name() == "mysql" {
-		tx.Exec("DROP VIEW IF EXISTS v_vulnerable_packages")
-	}
-
-	// Drop all tables
-	for _, table := range tables {
-		if err := tx.Migrator().DropTable(table); err != nil {
-			// Continue even if table doesn't exist
-			continue
-		}
-	}
-
-	return nil
-}

pkg/metadata/gormstore/models_v2.go

@@ -1,328 +0,0 @@
-package gormstore
-
-import (
-	"database/sql/driver"
-	"encoding/json"
-	"time"
-
-	"gorm.io/gorm"
-)
-
-// BaseModel provides common fields for all models with audit trail
-type BaseModel struct {
-	CreatedAt time.Time      `gorm:"not null"`
-	UpdatedAt time.Time      `gorm:"not null"`
-	DeletedAt gorm.DeletedAt `gorm:"index"` // Soft delete support (auto-generated index name per table)
-}
-
-// RegistryModel represents package registries (normalized)
-// This eliminates repetition of "npm", "pypi", "go" across millions of rows
-type RegistryModel struct {
-	ID            int32  `gorm:"primaryKey;autoIncrement"`
-	Name          string `gorm:"uniqueIndex:idx_registry_name;not null;size:50"` // npm, pypi, go
-	DisplayName   string `gorm:"not null;size:100"`                              // NPM Registry, PyPI, Go Modules
-	UpstreamURL   string `gorm:"not null;size:512"`                              // https://registry.npmjs.org
-	Enabled       bool   `gorm:"not null;default:true;index:idx_registry_enabled"`
-	ScanByDefault bool   `gorm:"not null;default:true"`
-	BaseModel
-}
-
-func (RegistryModel) TableName() string {
-	return "registries"
-}
-
-// PackageModel represents the core package data (optimized)
-type PackageModel struct {
-	ID         int64  `gorm:"primaryKey;autoIncrement"`
-	RegistryID int32  `gorm:"not null;index:idx_package_registry_name_version,priority:1"` // Foreign key to registries
-	Name       string `gorm:"not null;size:255;index:idx_package_name;index:idx_package_registry_name_version,priority:2"`
-	Version    string `gorm:"not null;size:100;index:idx_package_registry_name_version,priority:3"`
-
-	// Storage information
-	StorageKey     string `gorm:"not null;uniqueIndex:idx_package_storage_key;size:512"`
-	Size           int64  `gorm:"not null;index:idx_package_size"` // For storage quota queries
-	ChecksumMD5    string `gorm:"size:32;index:idx_package_md5"`
-	ChecksumSHA256 string `gorm:"size:64;index:idx_package_sha256"`
-	UpstreamURL    string `gorm:"size:1024"`
-
-	// Cache management
-	CachedAt     time.Time  `gorm:"not null;index:idx_package_cached_at"`
-	LastAccessed time.Time  `gorm:"not null;index:idx_package_last_accessed"`          // For LRU eviction
-	ExpiresAt    *time.Time `gorm:"index:idx_package_expires_at"`                      // For cache invalidation
-	AccessCount  int64      `gorm:"not null;default:0;index:idx_package_access_count"` // Total access count (denormalized for performance)
-
-	// Security
-	SecurityScanned    bool       `gorm:"not null;default:false;index:idx_package_security_scanned"`
-	LastScannedAt      *time.Time `gorm:"index:idx_package_last_scanned"`
-	VulnerabilityCount int        `gorm:"not null;default:0;index:idx_package_vuln_count"` // Denormalized for fast filtering
-	HighestSeverity    string     `gorm:"size:20;index:idx_package_severity"`              // critical, high, medium, low, none
-	CriticalCount      int        `gorm:"not null;default:0"`                              // Count of critical vulnerabilities
-	HighCount          int        `gorm:"not null;default:0"`                              // Count of high vulnerabilities
-	ModerateCount      int        `gorm:"not null;default:0"`                              // Count of moderate vulnerabilities
-	LowCount           int        `gorm:"not null;default:0"`                              // Count of low vulnerabilities
-
-	// Authentication
-	RequiresAuth bool   `gorm:"not null;default:false;index:idx_package_requires_auth"`
-	AuthProvider string `gorm:"size:50;index:idx_package_auth_provider"` // github, gitlab, custom
-
-	BaseModel
-
-	// Relationships
-	Registry        RegistryModel               `gorm:"foreignKey:RegistryID;constraint:OnUpdate:CASCADE,OnDelete:RESTRICT"`
-	Metadata        *PackageMetadataModel       `gorm:"foreignKey:PackageID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-	ScanResults     []ScanResultModel           `gorm:"foreignKey:PackageID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-	Vulnerabilities []PackageVulnerabilityModel `gorm:"foreignKey:PackageID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-}
-
-func (PackageModel) TableName() string {
-	return "packages"
-}
-
-// BeforeCreate hook to set access count
-func (p *PackageModel) BeforeCreate(tx *gorm.DB) error {
-	if p.AccessCount == 0 {
-		p.AccessCount = 0
-	}
-	return nil
-}
-
-// PackageMetadataModel stores structured package metadata (1:1 with packages)
-// Separated from main table to reduce row size and improve query performance
-type PackageMetadataModel struct {
-	PackageID   int64         `gorm:"primaryKey;not null"` // 1:1 relationship
-	Author      string        `gorm:"size:255;index:idx_metadata_author"`
-	License     string        `gorm:"size:100;index:idx_metadata_license"`
-	Homepage    string        `gorm:"size:512"`
-	Repository  string        `gorm:"size:512"`
-	Description string        `gorm:"type:text"`
-	Keywords    PostgresArray `gorm:"type:text"`  // JSONB array for PostgreSQL, JSON for MySQL/SQLite
-	RawMetadata JSONBField    `gorm:"type:jsonb"` // Full metadata as JSONB (PostgreSQL) or JSON
-	BaseModel
-}
-
-func (PackageMetadataModel) TableName() string {
-	return "package_metadata"
-}
-
-// ScanResultModel represents security scan results (optimized)
-type ScanResultModel struct {
-	ID            int64      `gorm:"primaryKey;autoIncrement"`
-	PackageID     int64      `gorm:"not null;index:idx_scan_package_scanner,priority:1"` // Foreign key
-	Scanner       string     `gorm:"not null;size:50;index:idx_scan_scanner;index:idx_scan_package_scanner,priority:2"`
-	ScannedAt     time.Time  `gorm:"not null;index:idx_scan_scanned_at"`
-	Status        string     `gorm:"not null;size:20;index:idx_scan_status"` // success, failed, pending
-	VulnCount     int        `gorm:"not null;default:0;index:idx_scan_vuln_count"`
-	CriticalCount int        `gorm:"not null;default:0"`
-	HighCount     int        `gorm:"not null;default:0"`
-	MediumCount   int        `gorm:"not null;default:0"`
-	LowCount      int        `gorm:"not null;default:0"`
-	ScanDuration  int        `gorm:"not null;default:0"` // milliseconds
-	Details       JSONBField `gorm:"type:jsonb"`         // Scanner-specific details
-	BaseModel
-
-	Package PackageModel `gorm:"foreignKey:PackageID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-}
-
-func (ScanResultModel) TableName() string {
-	return "scan_results"
-}
-
-// VulnerabilityModel represents unique vulnerabilities (normalized)
-type VulnerabilityModel struct {
-	ID           int64         `gorm:"primaryKey;autoIncrement"`
-	CVEID        string        `gorm:"uniqueIndex:idx_vuln_cve_id;not null;size:50"` // CVE-2021-12345
-	Title        string        `gorm:"not null;size:512"`
-	Description  string        `gorm:"type:text"`
-	Severity     string        `gorm:"not null;size:20;index:idx_vuln_severity"` // critical, high, medium, low
-	CVSS         float32       `gorm:"index:idx_vuln_cvss"`                      // CVSS score for sorting
-	PublishedAt  time.Time     `gorm:"not null;index:idx_vuln_published"`
-	FixedVersion string        `gorm:"size:100"`  // First version where it's fixed
-	References   PostgresArray `gorm:"type:text"` // URLs to advisories
-	BaseModel
-}
-
-func (VulnerabilityModel) TableName() string {
-	return "vulnerabilities"
-}
-
-// PackageVulnerabilityModel is a many-to-many relationship between packages and vulnerabilities
-type PackageVulnerabilityModel struct {
-	ID              int64     `gorm:"primaryKey;autoIncrement"`
-	PackageID       int64     `gorm:"not null;index:idx_pkg_vuln_package,priority:1;index:idx_pkg_vuln_composite,priority:1"`
-	VulnerabilityID int64     `gorm:"not null;index:idx_pkg_vuln_vuln,priority:1;index:idx_pkg_vuln_composite,priority:2"`
-	Scanner         string    `gorm:"not null;size:50;index:idx_pkg_vuln_scanner"`
-	DetectedAt      time.Time `gorm:"not null;index:idx_pkg_vuln_detected"`
-	Bypassed        bool      `gorm:"not null;default:false;index:idx_pkg_vuln_bypassed"`
-	BypassID        *int64    `gorm:"index:idx_pkg_vuln_bypass_id"` // Reference to bypass if applicable
-	BaseModel
-
-	Package       PackageModel       `gorm:"foreignKey:PackageID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-	Vulnerability VulnerabilityModel `gorm:"foreignKey:VulnerabilityID;constraint:OnUpdate:CASCADE,OnDelete:CASCADE"`
-}
-
-func (PackageVulnerabilityModel) TableName() string {
-	return "package_vulnerabilities"
-}
-
-// CVEBypassModel represents CVE bypass rules (improved)
-type CVEBypassModel struct {
-	ID             int64      `gorm:"primaryKey;autoIncrement"`
-	Type           string     `gorm:"not null;size:20;index:idx_bypass_type"`    // cve, package, registry
-	Target         string     `gorm:"not null;size:512;index:idx_bypass_target"` // CVE-ID, package name, etc.
-	Reason         string     `gorm:"not null;type:text"`
-	CreatedBy      string     `gorm:"not null;size:255;index:idx_bypass_created_by"`
-	ExpiresAt      time.Time  `gorm:"not null;index:idx_bypass_expires_at"`
-	NotifyOnExpiry bool       `gorm:"not null;default:false"`
-	Active         bool       `gorm:"not null;default:true;index:idx_bypass_active"`
-	UsageCount     int64      `gorm:"not null;default:0"` // How many times this bypass has been used
-	LastUsedAt     *time.Time `gorm:"index:idx_bypass_last_used"`
-
-	// Scope limiting (optional)
-	RegistryID *int32 `gorm:"index:idx_bypass_registry"` // NULL = all registries
-	PackageID  *int64 `gorm:"index:idx_bypass_package"`  // NULL = all packages
-
-	BaseModel
-}
-
-func (CVEBypassModel) TableName() string {
-	return "cve_bypasses"
-}
-
-// DownloadEventModel represents raw download events (partitioned by month)
-// This table should use PostgreSQL partitioning or time-series DB features
-type DownloadEventModel struct {
-	ID            int64     `gorm:"primaryKey;autoIncrement"`
-	PackageID     int64     `gorm:"not null;index:idx_download_package,priority:1"`
-	RegistryID    int32     `gorm:"not null;index:idx_download_registry"`
-	DownloadedAt  time.Time `gorm:"not null;index:idx_download_time;index:idx_download_package,priority:2"` // Partition key
-	UserAgent     string    `gorm:"size:512"`                                                               // For analytics
-	IPAddress     string    `gorm:"size:45;index:idx_download_ip"`                                          // IPv6 support
-	Authenticated bool      `gorm:"not null;default:false"`
-	Username      string    `gorm:"size:255;index:idx_download_user"`
-
-	// No BaseModel - this is append-only, no updates/deletes on individual rows
-	// Partitioned tables handle cleanup via DROP PARTITION
-}
-
-func (DownloadEventModel) TableName() string {
-	return "download_events"
-}
-
-// DownloadStatsHourlyModel represents pre-aggregated hourly statistics (partitioned)
-type DownloadStatsHourlyModel struct {
-	ID            int64     `gorm:"primaryKey;autoIncrement"`
-	RegistryID    int32     `gorm:"not null;index:idx_stats_hourly_composite,priority:1"`
-	PackageID     *int64    `gorm:"index:idx_stats_hourly_package"`                       // NULL = all packages in registry
-	TimeBucket    time.Time `gorm:"not null;index:idx_stats_hourly_composite,priority:2"` // Truncated to hour
-	DownloadCount int64     `gorm:"not null;default:0"`
-	UniqueIPs     int64     `gorm:"not null;default:0"` // Unique downloaders
-	AuthDownloads int64     `gorm:"not null;default:0"` // Authenticated downloads
-
-	BaseModel
-}
-
-func (DownloadStatsHourlyModel) TableName() string {
-	return "download_stats_hourly"
-}
-
-// DownloadStatsDailyModel represents pre-aggregated daily statistics
-type DownloadStatsDailyModel struct {
-	ID            int64      `gorm:"primaryKey;autoIncrement"`
-	RegistryID    int32      `gorm:"not null;index:idx_stats_daily_composite,priority:1"`
-	PackageID     *int64     `gorm:"index:idx_stats_daily_package"`                       // NULL = all packages in registry
-	TimeBucket    time.Time  `gorm:"not null;index:idx_stats_daily_composite,priority:2"` // Truncated to day
-	DownloadCount int64      `gorm:"not null;default:0"`
-	UniqueIPs     int64      `gorm:"not null;default:0"`
-	AuthDownloads int64      `gorm:"not null;default:0"`
-	TopUserAgents JSONBField `gorm:"type:jsonb"` // Top 10 user agents
-
-	BaseModel
-}
-
-func (DownloadStatsDailyModel) TableName() string {
-	return "download_stats_daily"
-}
-
-// AuditLogModel tracks all important changes (optional, for compliance)
-type AuditLogModel struct {
-	ID         int64      `gorm:"primaryKey;autoIncrement"`
-	EntityType string     `gorm:"not null;size:50;index:idx_audit_entity_type"` // package, bypass, registry
-	EntityID   int64      `gorm:"not null;index:idx_audit_entity_id"`
-	Action     string     `gorm:"not null;size:20;index:idx_audit_action"` // create, update, delete
-	Username   string     `gorm:"not null;size:255;index:idx_audit_username"`
-	Timestamp  time.Time  `gorm:"not null;index:idx_audit_timestamp"`
-	Changes    JSONBField `gorm:"type:jsonb"` // Before/after values
-	IPAddress  string     `gorm:"size:45"`
-	UserAgent  string     `gorm:"size:512"`
-
-	// No BaseModel - append-only audit log
-}
-
-func (AuditLogModel) TableName() string {
-	return "audit_log"
-}
-
-// JSONBField is a custom type for JSONB (PostgreSQL) / JSON (MySQL/SQLite)
-type JSONBField map[string]interface{}
-
-func (j JSONBField) Value() (driver.Value, error) {
-	if j == nil {
-		return nil, nil
-	}
-	return json.Marshal(j)
-}
-
-func (j *JSONBField) Scan(value interface{}) error {
-	if value == nil {
-		*j = nil
-		return nil
-	}
-
-	bytes, ok := value.([]byte)
-	if !ok {
-		return nil
-	}
-
-	return json.Unmarshal(bytes, j)
-}
-
-// PostgresArray is a custom type for PostgreSQL arrays stored as JSON
-type PostgresArray []string
-
-func (a PostgresArray) Value() (driver.Value, error) {
-	if a == nil {
-		return nil, nil
-	}
-	return json.Marshal(a)
-}
-
-func (a *PostgresArray) Scan(value interface{}) error {
-	if value == nil {
-		*a = nil
-		return nil
-	}
-
-	bytes, ok := value.([]byte)
-	if !ok {
-		return nil
-	}
-
-	return json.Unmarshal(bytes, a)
-}
-
-// GetAllModels returns all models for GORM auto-migration
-func GetAllModels() []interface{} {
-	return []interface{}{
-		&RegistryModel{},
-		&PackageModel{},
-		&PackageMetadataModel{},
-		&ScanResultModel{},
-		&VulnerabilityModel{},
-		&PackageVulnerabilityModel{},
-		&CVEBypassModel{},
-		&DownloadEventModel{},
-		&DownloadStatsHourlyModel{},
-		&DownloadStatsDailyModel{},
-		&AuditLogModel{},
-	}
-}

pkg/metadata/gormstore/partition_manager.go

@@ -1,380 +0,0 @@
-package gormstore
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/rs/zerolog/log"
-	"gorm.io/gorm"
-)
-
-// PartitionManager handles automatic partition creation and cleanup for PostgreSQL
-type PartitionManager struct {
-	db *gorm.DB
-}
-
-// NewPartitionManager creates a new partition manager
-func NewPartitionManager(db *gorm.DB) *PartitionManager {
-	return &PartitionManager{db: db}
-}
-
-// EnsurePartitions ensures required partitions exist for current and future months
-func (pm *PartitionManager) EnsurePartitions() error {
-	// Check if we're using PostgreSQL
-	if pm.db.Dialector.Name() != "postgres" {
-		log.Debug().Msg("Partitioning only supported on PostgreSQL, skipping")
-		return nil
-	}
-
-	log.Info().Msg("Ensuring partitions exist")
-
-	// Create partitions for download_events
-	if err := pm.ensureDownloadEventPartitions(); err != nil {
-		return err
-	}
-
-	// Create partitions for audit_log
-	if err := pm.ensureAuditLogPartitions(); err != nil {
-		return err
-	}
-
-	// Set up automatic partition creation
-	if err := pm.createPartitionFunction(); err != nil {
-		log.Warn().Err(err).Msg("Failed to create partition function (may already exist)")
-	}
-
-	return nil
-}
-
-// ensureDownloadEventPartitions creates download_events partitions
-func (pm *PartitionManager) ensureDownloadEventPartitions() error {
-	// Check if table is already partitioned
-	var isPartitioned bool
-	err := pm.db.Raw(`
-		SELECT EXISTS (
-			SELECT 1 FROM pg_partitioned_table
-			WHERE partrelid = 'download_events'::regclass
-		)
-	`).Scan(&isPartitioned).Error
-
-	if err != nil {
-		return err
-	}
-
-	if !isPartitioned {
-		log.Info().Msg("Converting download_events to partitioned table")
-
-		// Rename existing table
-		if err := pm.db.Exec("ALTER TABLE IF EXISTS download_events RENAME TO download_events_old").Error; err != nil {
-			log.Warn().Err(err).Msg("Could not rename old table (may not exist)")
-		}
-
-		// Create partitioned table
-		createTableSQL := `
-			CREATE TABLE IF NOT EXISTS download_events (
-				id             BIGSERIAL,
-				package_id     BIGINT NOT NULL,
-				registry_id    INTEGER NOT NULL,
-				downloaded_at  TIMESTAMP NOT NULL,
-				user_agent     VARCHAR(512),
-				ip_address     VARCHAR(45),
-				authenticated  BOOLEAN NOT NULL DEFAULT FALSE,
-				username       VARCHAR(255)
-			) PARTITION BY RANGE (downloaded_at)
-		`
-
-		if err := pm.db.Exec(createTableSQL).Error; err != nil {
-			return fmt.Errorf("failed to create partitioned table: %w", err)
-		}
-
-		log.Info().Msg("Created partitioned download_events table")
-	}
-
-	// Create partitions for past 3 months, current month, and next 3 months
-	now := time.Now()
-	for i := -3; i <= 3; i++ {
-		month := now.AddDate(0, i, 0)
-		if err := pm.createDownloadEventPartition(month); err != nil {
-			log.Error().Err(err).Time("month", month).Msg("Failed to create partition")
-		}
-	}
-
-	return nil
-}
-
-// createDownloadEventPartition creates a partition for a specific month
-func (pm *PartitionManager) createDownloadEventPartition(month time.Time) error {
-	// Truncate to start of month
-	startOfMonth := time.Date(month.Year(), month.Month(), 1, 0, 0, 0, 0, time.UTC)
-	endOfMonth := startOfMonth.AddDate(0, 1, 0)
-
-	partitionName := fmt.Sprintf("download_events_%d_%02d", month.Year(), month.Month())
-
-	// Check if partition already exists
-	var exists bool
-	err := pm.db.Raw("SELECT EXISTS (SELECT 1 FROM pg_tables WHERE tablename = ?)", partitionName).Scan(&exists).Error
-	if err != nil {
-		return err
-	}
-
-	if exists {
-		log.Debug().Str("partition", partitionName).Msg("Partition already exists")
-		return nil
-	}
-
-	// Create partition
-	createPartitionSQL := fmt.Sprintf(`
-		CREATE TABLE %s PARTITION OF download_events
-		FOR VALUES FROM ('%s') TO ('%s')
-	`, partitionName, startOfMonth.Format("2006-01-02"), endOfMonth.Format("2006-01-02"))
-
-	if err := pm.db.Exec(createPartitionSQL).Error; err != nil {
-		return fmt.Errorf("failed to create partition %s: %w", partitionName, err)
-	}
-
-	// Create indexes on partition
-	indexSQL := []string{
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_package_idx ON %s(package_id, downloaded_at)", partitionName, partitionName),
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_registry_idx ON %s(registry_id)", partitionName, partitionName),
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_time_idx ON %s(downloaded_at)", partitionName, partitionName),
-	}
-
-	for _, sql := range indexSQL {
-		if err := pm.db.Exec(sql).Error; err != nil {
-			log.Warn().Err(err).Str("sql", sql).Msg("Failed to create index")
-		}
-	}
-
-	log.Info().Str("partition", partitionName).Msg("Created partition")
-	return nil
-}
-
-// ensureAuditLogPartitions creates audit_log partitions
-func (pm *PartitionManager) ensureAuditLogPartitions() error {
-	// Check if table exists
-	var exists bool
-	err := pm.db.Raw("SELECT EXISTS (SELECT 1 FROM pg_tables WHERE tablename = 'audit_log')").Scan(&exists).Error
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		// Create partitioned table
-		createTableSQL := `
-			CREATE TABLE IF NOT EXISTS audit_log (
-				id          BIGSERIAL,
-				entity_type VARCHAR(50) NOT NULL,
-				entity_id   BIGINT NOT NULL,
-				action      VARCHAR(20) NOT NULL,
-				username    VARCHAR(255) NOT NULL,
-				timestamp   TIMESTAMP NOT NULL,
-				changes     JSONB,
-				ip_address  VARCHAR(45),
-				user_agent  VARCHAR(512)
-			) PARTITION BY RANGE (timestamp)
-		`
-
-		if err := pm.db.Exec(createTableSQL).Error; err != nil {
-			return fmt.Errorf("failed to create audit_log table: %w", err)
-		}
-
-		log.Info().Msg("Created partitioned audit_log table")
-	}
-
-	// Create partitions for past month, current month, and next 2 months
-	now := time.Now()
-	for i := -1; i <= 2; i++ {
-		month := now.AddDate(0, i, 0)
-		if err := pm.createAuditLogPartition(month); err != nil {
-			log.Error().Err(err).Time("month", month).Msg("Failed to create audit partition")
-		}
-	}
-
-	return nil
-}
-
-// createAuditLogPartition creates a partition for a specific month
-func (pm *PartitionManager) createAuditLogPartition(month time.Time) error {
-	startOfMonth := time.Date(month.Year(), month.Month(), 1, 0, 0, 0, 0, time.UTC)
-	endOfMonth := startOfMonth.AddDate(0, 1, 0)
-
-	partitionName := fmt.Sprintf("audit_log_%d_%02d", month.Year(), month.Month())
-
-	// Check if partition already exists
-	var exists bool
-	err := pm.db.Raw("SELECT EXISTS (SELECT 1 FROM pg_tables WHERE tablename = ?)", partitionName).Scan(&exists).Error
-	if err != nil {
-		return err
-	}
-
-	if exists {
-		return nil
-	}
-
-	// Create partition
-	createPartitionSQL := fmt.Sprintf(`
-		CREATE TABLE %s PARTITION OF audit_log
-		FOR VALUES FROM ('%s') TO ('%s')
-	`, partitionName, startOfMonth.Format("2006-01-02"), endOfMonth.Format("2006-01-02"))
-
-	if err := pm.db.Exec(createPartitionSQL).Error; err != nil {
-		return fmt.Errorf("failed to create partition %s: %w", partitionName, err)
-	}
-
-	// Create indexes
-	indexSQL := []string{
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_entity_idx ON %s(entity_type, entity_id)", partitionName, partitionName),
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_user_idx ON %s(username)", partitionName, partitionName),
-		fmt.Sprintf("CREATE INDEX IF NOT EXISTS %s_time_idx ON %s(timestamp)", partitionName, partitionName),
-	}
-
-	for _, sql := range indexSQL {
-		if err := pm.db.Exec(sql).Error; err != nil {
-			log.Warn().Err(err).Msg("Failed to create audit index")
-		}
-	}
-
-	log.Info().Str("partition", partitionName).Msg("Created audit partition")
-	return nil
-}
-
-// createPartitionFunction creates a PostgreSQL function for automatic partition creation
-func (pm *PartitionManager) createPartitionFunction() error {
-	functionSQL := `
-		CREATE OR REPLACE FUNCTION create_next_month_partitions()
-		RETURNS void AS $$
-		DECLARE
-			next_month DATE := date_trunc('month', NOW() + INTERVAL '2 months');
-			partition_name TEXT;
-			start_date TEXT;
-			end_date TEXT;
-		BEGIN
-			-- Create download_events partition
-			partition_name := 'download_events_' || to_char(next_month, 'YYYY_MM');
-			start_date := to_char(next_month, 'YYYY-MM-DD');
-			end_date := to_char(next_month + INTERVAL '1 month', 'YYYY-MM-DD');
-
-			EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF download_events FOR VALUES FROM (%L) TO (%L)',
-				partition_name, start_date, end_date);
-
-			EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(package_id, downloaded_at)',
-				partition_name || '_package_idx', partition_name);
-			EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(registry_id)',
-				partition_name || '_registry_idx', partition_name);
-
-			-- Create audit_log partition
-			partition_name := 'audit_log_' || to_char(next_month, 'YYYY_MM');
-
-			EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF audit_log FOR VALUES FROM (%L) TO (%L)',
-				partition_name, start_date, end_date);
-
-			EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %I(entity_type, entity_id)',
-				partition_name || '_entity_idx', partition_name);
-
-			RAISE NOTICE 'Created partitions for %', to_char(next_month, 'YYYY-MM');
-		END;
-		$$ LANGUAGE plpgsql;
-	`
-
-	if err := pm.db.Exec(functionSQL).Error; err != nil {
-		return err
-	}
-
-	log.Info().Msg("Created partition management function")
-	return nil
-}
-
-// CleanupOldPartitions drops partitions older than the retention period
-func (pm *PartitionManager) CleanupOldPartitions(retentionMonths int) error {
-	if pm.db.Dialector.Name() != "postgres" {
-		return nil
-	}
-
-	cutoffDate := time.Now().AddDate(0, -retentionMonths, 0)
-	cutoffPartition := fmt.Sprintf("%d_%02d", cutoffDate.Year(), cutoffDate.Month())
-
-	log.Info().
-		Str("cutoff", cutoffPartition).
-		Int("retention_months", retentionMonths).
-		Msg("Cleaning up old partitions")
-
-	// Find and drop old download_events partitions
-	var downloadPartitions []string
-	err := pm.db.Raw(`
-		SELECT tablename FROM pg_tables
-		WHERE tablename LIKE 'download_events_%'
-		AND tablename < 'download_events_' || ?
-	`, cutoffPartition).Scan(&downloadPartitions).Error
-
-	if err != nil {
-		return err
-	}
-
-	for _, partition := range downloadPartitions {
-		log.Info().Str("partition", partition).Msg("Dropping old partition")
-		if err := pm.db.Exec(fmt.Sprintf("DROP TABLE IF EXISTS %s", partition)).Error; err != nil {
-			log.Error().Err(err).Str("partition", partition).Msg("Failed to drop partition")
-		}
-	}
-
-	// Find and drop old audit_log partitions
-	var auditPartitions []string
-	err = pm.db.Raw(`
-		SELECT tablename FROM pg_tables
-		WHERE tablename LIKE 'audit_log_%'
-		AND tablename < 'audit_log_' || ?
-	`, cutoffPartition).Scan(&auditPartitions).Error
-
-	if err != nil {
-		return err
-	}
-
-	for _, partition := range auditPartitions {
-		log.Info().Str("partition", partition).Msg("Dropping old audit partition")
-		if err := pm.db.Exec(fmt.Sprintf("DROP TABLE IF EXISTS %s", partition)).Error; err != nil {
-			log.Error().Err(err).Str("partition", partition).Msg("Failed to drop audit partition")
-		}
-	}
-
-	return nil
-}
-
-// GetPartitionInfo returns information about current partitions
-func (pm *PartitionManager) GetPartitionInfo() (map[string]interface{}, error) {
-	if pm.db.Dialector.Name() != "postgres" {
-		return map[string]interface{}{"status": "not_applicable"}, nil
-	}
-
-	info := make(map[string]interface{})
-
-	// Count download_events partitions
-	var downloadCount int64
-	pm.db.Raw("SELECT COUNT(*) FROM pg_tables WHERE tablename LIKE 'download_events_%'").Scan(&downloadCount)
-	info["download_events_partitions"] = downloadCount
-
-	// Count audit_log partitions
-	var auditCount int64
-	pm.db.Raw("SELECT COUNT(*) FROM pg_tables WHERE tablename LIKE 'audit_log_%'").Scan(&auditCount)
-	info["audit_log_partitions"] = auditCount
-
-	// Get partition sizes
-	type PartitionSize struct {
-		TableName string
-		SizeMB    float64
-	}
-
-	var partitionSizes []PartitionSize
-	pm.db.Raw(`
-		SELECT
-			tablename AS table_name,
-			pg_total_relation_size(tablename::regclass) / 1024.0 / 1024.0 AS size_mb
-		FROM pg_tables
-		WHERE tablename LIKE 'download_events_%' OR tablename LIKE 'audit_log_%'
-		ORDER BY size_mb DESC
-		LIMIT 10
-	`).Scan(&partitionSizes)
-
-	info["largest_partitions"] = partitionSizes
-
-	return info, nil
-}

pkg/metadata/interface.go

@@ -68,37 +68,37 @@ type MetadataStore interface {
 
 // Package represents package metadata
 type Package struct {
-	CachedAt        time.Time         `json:"cached_at"`
-	LastAccessed    time.Time         `json:"last_accessed"`
-	Metadata        map[string]string `json:"metadata"`
-	ExpiresAt       *time.Time        `json:"expires_at"`
-	UpstreamURL     string            `json:"upstream_url"`
-	ChecksumMD5     string            `json:"checksum_md5"`
-	ChecksumSHA256  string            `json:"checksum_sha256"`
 	ID              string            `json:"id"`
-	StorageKey      string            `json:"storage_key"`
-	Version         string            `json:"version"`
-	Name            string            `json:"name"`
-	Registry        string            `json:"registry"`
-	AuthProvider    string            `json:"auth_provider"`
-	Size            int64             `json:"size"`
-	DownloadCount   int64             `json:"download_count"`
-	SecurityScanned bool              `json:"security_scanned"`
-	RequiresAuth    bool              `json:"requires_auth"`
+	Registry        string            `json:"registry"`         // npm, pypi, go
+	Name            string            `json:"name"`             // Package name
+	Version         string            `json:"version"`          // Package version
+	StorageKey      string            `json:"storage_key"`      // Key in storage backend
+	Size            int64             `json:"size"`             // Package size in bytes
+	ChecksumMD5     string            `json:"checksum_md5"`     // MD5 checksum
+	ChecksumSHA256  string            `json:"checksum_sha256"`  // SHA256 checksum
+	UpstreamURL     string            `json:"upstream_url"`     // Original upstream URL
+	CachedAt        time.Time         `json:"cached_at"`        // When cached
+	LastAccessed    time.Time         `json:"last_accessed"`    // Last access time
+	ExpiresAt       *time.Time        `json:"expires_at"`       // Expiration time (nil = never)
+	DownloadCount   int64             `json:"download_count"`   // Download counter
+	Metadata        map[string]string `json:"metadata"`         // Additional metadata
+	SecurityScanned bool              `json:"security_scanned"` // Has been scanned
+	RequiresAuth    bool              `json:"requires_auth"`    // Package requires authentication
+	AuthProvider    string            `json:"auth_provider"`    // Auth provider (github.com, npm.pkg.github.com, etc.)
 }
 
 // ScanResult represents a security scan result
 type ScanResult struct {
-	ScannedAt          time.Time              `json:"scanned_at"`
-	Details            map[string]interface{} `json:"details"`
 	ID                 string                 `json:"id"`
 	Registry           string                 `json:"registry"`
 	PackageName        string                 `json:"package_name"`
 	PackageVersion     string                 `json:"package_version"`
-	Scanner            string                 `json:"scanner"`
-	Status             ScanStatus             `json:"status"`
-	Vulnerabilities    []Vulnerability        `json:"vulnerabilities"`
+	Scanner            string                 `json:"scanner"` // trivy, osv, etc.
+	ScannedAt          time.Time              `json:"scanned_at"`
+	Status             ScanStatus             `json:"status"` // clean, vulnerable, error
 	VulnerabilityCount int                    `json:"vulnerability_count"`
+	Vulnerabilities    []Vulnerability        `json:"vulnerabilities"`
+	Details            map[string]interface{} `json:"details"` // Scanner-specific details
 }
 
 // Vulnerability represents a security vulnerability
@@ -143,18 +143,13 @@ const (
 
 // Stats represents metadata statistics
 type Stats struct {
-	LastUpdated             time.Time `json:"last_updated"`
-	Registry                string    `json:"registry"`
-	TotalPackages           int64     `json:"total_packages"`
-	TotalSize               int64     `json:"total_size"`
-	TotalDownloads          int64     `json:"total_downloads"`
-	ScannedPackages         int64     `json:"scanned_packages"`
-	VulnerablePackages      int64     `json:"vulnerable_packages"`
-	BlockedPackages         int64     `json:"blocked_packages"`
-	CriticalVulnerabilities int64     `json:"critical_vulnerabilities"`
-	HighVulnerabilities     int64     `json:"high_vulnerabilities"`
-	ModerateVulnerabilities int64     `json:"moderate_vulnerabilities"`
-	LowVulnerabilities      int64     `json:"low_vulnerabilities"`
+	Registry           string    `json:"registry"`
+	TotalPackages      int64     `json:"total_packages"`
+	TotalSize          int64     `json:"total_size"`
+	TotalDownloads     int64     `json:"total_downloads"`
+	ScannedPackages    int64     `json:"scanned_packages"`
+	VulnerablePackages int64     `json:"vulnerable_packages"`
+	LastUpdated        time.Time `json:"last_updated"`
 }
 
 // TimeSeriesDataPoint represents a single data point in time-series
@@ -203,14 +198,14 @@ type BypassListOptions struct {
 
 // ListOptions contains options for listing packages
 type ListOptions struct {
-	SinceDate   time.Time
-	Registry    string
-	NamePrefix  string
-	SortBy      string
-	MinSize     int64
-	MaxSize     int64
-	Limit       int
-	Offset      int
-	ScannedOnly bool
-	SortDesc    bool
+	Registry    string    // Filter by registry
+	NamePrefix  string    // Filter by name prefix
+	MinSize     int64     // Minimum package size
+	MaxSize     int64     // Maximum package size
+	ScannedOnly bool      // Only scanned packages
+	SinceDate   time.Time // Packages cached since date
+	Limit       int       // Max results
+	Offset      int       // Pagination offset
+	SortBy      string    // Sort field (name, size, cached_at, download_count)
+	SortDesc    bool      // Sort descending
 }

pkg/metrics/metrics.go

@@ -137,11 +137,21 @@ func RecordCacheMiss(handler string) {
 	CacheRequests.WithLabelValues("miss", handler).Inc()
 }
 
+// RecordCacheError records a cache error
+func RecordCacheError(handler string) {
+	CacheRequests.WithLabelValues("error", handler).Inc()
+}
+
 // UpdateCacheSize updates the cache size metric
 func UpdateCacheSize(backend string, bytes int64) {
 	CacheSizeBytes.WithLabelValues(backend).Set(float64(bytes))
 }
 
+// UpdateCacheItems updates the cache items metric
+func UpdateCacheItems(handler string, count int64) {
+	CacheItemsTotal.WithLabelValues(handler).Set(float64(count))
+}
+
 // RecordCacheEviction records a cache eviction
 func RecordCacheEviction(reason string) {
 	CacheEvictions.WithLabelValues(reason).Inc()
@@ -152,11 +162,26 @@ func RecordStorageOperation(backend, operation, status string) {
 	StorageOperations.WithLabelValues(backend, operation, status).Inc()
 }
 
+// UpdateStorageQuota updates the storage quota metric
+func UpdateStorageQuota(project string, bytes int64) {
+	StorageQuotaBytes.WithLabelValues(project).Set(float64(bytes))
+}
+
 // RecordUpstreamRequest records an upstream request
 func RecordUpstreamRequest(registry, status string) {
 	UpstreamRequests.WithLabelValues(registry, status).Inc()
 }
 
+// RecordSecurityScan records a security scan
+func RecordSecurityScan(scanner, result string) {
+	SecurityScans.WithLabelValues(scanner, result).Inc()
+}
+
+// RecordVulnerability records a vulnerability finding
+func RecordVulnerability(severity string) {
+	VulnerabilitiesFound.WithLabelValues(severity).Inc()
+}
+
 // UpdateCircuitBreakerState updates the circuit breaker state
 func UpdateCircuitBreakerState(name string, state int) {
 	CircuitBreakerState.WithLabelValues(name).Set(float64(state))

pkg/network/client.go

@@ -24,23 +24,23 @@ type Client struct {
 
 // Config holds client configuration
 type Config struct {
-	UserAgent       string
+	Timeout         time.Duration // Request timeout
+	MaxRetries      int           // Max retry attempts
+	RetryDelay      time.Duration // Initial retry delay
+	RateLimit       float64       // Requests per second (0 = unlimited)
+	RateBurst       int           // Rate limiter burst
 	CircuitBreaker  CircuitBreakerConfig
-	Timeout         time.Duration
-	MaxRetries      int
-	RetryDelay      time.Duration
-	RateLimit       float64
-	RateBurst       int
+	UserAgent       string
 	MaxConnsPerHost int
 }
 
 // RetryConfig holds retry configuration
 type RetryConfig struct {
-	FixedDelays  []time.Duration
 	MaxAttempts  int
 	InitialDelay time.Duration
 	MaxDelay     time.Duration
 	Multiplier   float64
+	FixedDelays  []time.Duration // If set, use these delays instead of exponential backoff
 }
 
 // CircuitBreakerConfig holds circuit breaker configuration
@@ -63,11 +63,11 @@ const (
 
 // CircuitBreaker implements the circuit breaker pattern
 type CircuitBreaker struct {
-	lastFailureTime time.Time
 	config          CircuitBreakerConfig
 	state           CircuitBreakerState
 	failures        int
 	successes       int
+	lastFailureTime time.Time
 	halfOpenCalls   int
 	mu              sync.RWMutex
 }

pkg/network/client_test.go

@@ -19,14 +19,14 @@ import (
 // TestClientGet tests the HTTP client Get method with various scenarios
 func TestClientGet(t *testing.T) {
 	tests := []struct {
+		name           string
 		serverBehavior func(*testing.T) *httptest.Server
+		config         network.Config
 		headers        map[string]string
+		wantErr        bool
+		errContains    string
 		validateBody   func(*testing.T, io.ReadCloser)
 		validateStatus func(*testing.T, int)
-		name           string
-		errContains    string
-		config         network.Config
-		wantErr        bool
 	}{
 		// GOOD: Successful GET request
 		{

pkg/prewarming/worker.go

@@ -24,22 +24,22 @@ type Worker struct {
 	cache         *cache.Manager
 	analytics     *analytics.Engine
 	client        *network.Client
-	stopChan      chan struct{}
-	wg            sync.WaitGroup
 	interval      time.Duration
 	maxConcurrent int
 	enabled       bool
+	stopChan      chan struct{}
+	wg            sync.WaitGroup
 }
 
 // Config holds pre-warming worker configuration
 type Config struct {
-	CacheManager  *cache.Manager
-	Analytics     *analytics.Engine
-	NetworkClient *network.Client
+	Enabled       bool
 	Interval      time.Duration
 	MaxConcurrent int
 	TopPackages   int
-	Enabled       bool
+	CacheManager  *cache.Manager
+	Analytics     *analytics.Engine
+	NetworkClient *network.Client
 }
 
 // NewWorker creates a new pre-warming worker

pkg/proxy/common/base.go

@@ -0,0 +1,34 @@
+package common
+
+import (
+	"github.com/lukaszraczylo/gohoarder/pkg/cache"
+	"github.com/lukaszraczylo/gohoarder/pkg/network"
+)
+
+// BaseHandler provides common functionality for all proxy handlers
+type BaseHandler struct {
+	Cache    *cache.Manager
+	Client   *network.Client
+	Upstream string
+	Registry string
+}
+
+// Config holds common proxy configuration
+type Config struct {
+	Upstream string // Upstream registry URL (e.g., registry.npmjs.org)
+}
+
+// GetRegistry returns the registry type
+func (h *BaseHandler) GetRegistry() string {
+	return h.Registry
+}
+
+// NewBaseHandler creates a new base handler with common fields
+func NewBaseHandler(cache *cache.Manager, client *network.Client, registry, upstream string) *BaseHandler {
+	return &BaseHandler{
+		Cache:    cache,
+		Client:   client,
+		Upstream: upstream,
+		Registry: registry,
+	}
+}

pkg/proxy/common/common_test.go

@@ -0,0 +1,385 @@
+package common
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/lukaszraczylo/gohoarder/pkg/cache"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestNewBaseHandler tests base handler creation
+func TestNewBaseHandler(t *testing.T) {
+	// Use nil for cache and client since we're only testing structure
+	handler := NewBaseHandler(nil, nil, "npm", "https://registry.npmjs.org")
+
+	require.NotNil(t, handler)
+	assert.Equal(t, "npm", handler.Registry)
+	assert.Equal(t, "https://registry.npmjs.org", handler.Upstream)
+	assert.Nil(t, handler.Cache)
+	assert.Nil(t, handler.Client)
+}
+
+// TestGetRegistry tests registry type retrieval
+func TestGetRegistry(t *testing.T) {
+	tests := []struct {
+		name     string
+		registry string
+	}{
+		{"npm registry", "npm"},
+		{"pypi registry", "pypi"},
+		{"go registry", "go"},
+		{"custom registry", "custom"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			handler := &BaseHandler{Registry: tt.registry}
+			assert.Equal(t, tt.registry, handler.GetRegistry())
+		})
+	}
+}
+
+// TestHandleUpstreamError tests upstream error handling
+func TestHandleUpstreamError(t *testing.T) {
+	tests := []struct {
+		name        string
+		err         error
+		url         string
+		context     string
+		wantStatus  int
+		wantContain string
+	}{
+		// GOOD: Standard error
+		{
+			name:        "connection error",
+			err:         errors.New("connection refused"),
+			url:         "https://registry.npmjs.org/react",
+			context:     "package",
+			wantStatus:  http.StatusBadGateway,
+			wantContain: "Failed to fetch package",
+		},
+		// WRONG: Timeout error
+		{
+			name:        "timeout error",
+			err:         context.DeadlineExceeded,
+			url:         "https://registry.npmjs.org/lodash",
+			context:     "metadata",
+			wantStatus:  http.StatusBadGateway,
+			wantContain: "Failed to fetch metadata",
+		},
+		// EDGE: Empty context
+		{
+			name:        "empty context",
+			err:         errors.New("error"),
+			url:         "https://example.com",
+			context:     "",
+			wantStatus:  http.StatusBadGateway,
+			wantContain: "Failed to fetch",
+		},
+		// EDGE: Long URL
+		{
+			name:        "long URL",
+			err:         errors.New("error"),
+			url:         "https://registry.npmjs.org/@scope/very-long-package-name/versions/1.2.3",
+			context:     "package",
+			wantStatus:  http.StatusBadGateway,
+			wantContain: "Failed to fetch package",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			HandleUpstreamError(w, tt.err, tt.url, tt.context)
+
+			assert.Equal(t, tt.wantStatus, w.Code)
+			assert.Contains(t, w.Body.String(), tt.wantContain)
+		})
+	}
+}
+
+// TestCheckUpstreamStatus tests upstream status validation
+func TestCheckUpstreamStatus(t *testing.T) {
+	tests := []struct {
+		name        string
+		statusCode  int
+		body        io.ReadCloser
+		wantErr     bool
+		errContains string
+		bodyClosed  bool
+	}{
+		// GOOD: OK status
+		{
+			name:       "200 OK",
+			statusCode: http.StatusOK,
+			body:       io.NopCloser(strings.NewReader("success")),
+			wantErr:    false,
+		},
+		// WRONG: Not found
+		{
+			name:        "404 Not Found",
+			statusCode:  http.StatusNotFound,
+			body:        io.NopCloser(strings.NewReader("not found")),
+			wantErr:     true,
+			errContains: "upstream returned status 404",
+		},
+		// WRONG: Server error
+		{
+			name:        "500 Internal Server Error",
+			statusCode:  http.StatusInternalServerError,
+			body:        io.NopCloser(strings.NewReader("error")),
+			wantErr:     true,
+			errContains: "upstream returned status 500",
+		},
+		// BAD: Unauthorized
+		{
+			name:        "401 Unauthorized",
+			statusCode:  http.StatusUnauthorized,
+			body:        io.NopCloser(strings.NewReader("unauthorized")),
+			wantErr:     true,
+			errContains: "upstream returned status 401",
+		},
+		// EDGE: Nil body
+		{
+			name:        "nil body with error",
+			statusCode:  http.StatusNotFound,
+			body:        nil,
+			wantErr:     true,
+			errContains: "upstream returned status 404",
+		},
+		// EDGE: Redirect status
+		{
+			name:        "302 Found",
+			statusCode:  http.StatusFound,
+			body:        io.NopCloser(strings.NewReader("redirect")),
+			wantErr:     true,
+			errContains: "upstream returned status 302",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := CheckUpstreamStatus(tt.statusCode, tt.body)
+
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errContains)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestHandleInvalidRequest tests invalid request handling
+func TestHandleInvalidRequest(t *testing.T) {
+	tests := []struct {
+		name        string
+		registry    string
+		wantStatus  int
+		wantContain string
+	}{
+		{
+			name:        "npm invalid request",
+			registry:    "npm",
+			wantStatus:  http.StatusBadRequest,
+			wantContain: "Invalid npm request",
+		},
+		{
+			name:        "pypi invalid request",
+			registry:    "pypi",
+			wantStatus:  http.StatusBadRequest,
+			wantContain: "Invalid pypi request",
+		},
+		{
+			name:        "go invalid request",
+			registry:    "go",
+			wantStatus:  http.StatusBadRequest,
+			wantContain: "Invalid go request",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			HandleInvalidRequest(w, tt.registry)
+
+			assert.Equal(t, tt.wantStatus, w.Code)
+			assert.Contains(t, w.Body.String(), tt.wantContain)
+		})
+	}
+}
+
+// TestHandleInternalError tests internal error handling
+func TestHandleInternalError(t *testing.T) {
+	tests := []struct {
+		name        string
+		err         error
+		context     string
+		wantStatus  int
+		wantContain string
+	}{
+		{
+			name:        "database error",
+			err:         errors.New("database connection failed"),
+			context:     "database",
+			wantStatus:  http.StatusInternalServerError,
+			wantContain: "Internal error: database",
+		},
+		{
+			name:        "cache error",
+			err:         errors.New("cache write failed"),
+			context:     "cache",
+			wantStatus:  http.StatusInternalServerError,
+			wantContain: "Internal error: cache",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			HandleInternalError(w, tt.err, tt.context)
+
+			assert.Equal(t, tt.wantStatus, w.Code)
+			assert.Contains(t, w.Body.String(), tt.wantContain)
+		})
+	}
+}
+
+// Note: FetchFromUpstream tests would require mocking cache.Manager and network.Client
+// which requires concrete implementations. Integration tests cover this functionality.
+
+// TestWriteResponse tests HTTP response writing
+func TestWriteResponse(t *testing.T) {
+	tests := []struct {
+		name        string
+		data        string
+		contentType string
+		wantStatus  int
+		wantBody    string
+		wantErr     bool
+	}{
+		// GOOD: Write tarball
+		{
+			name:        "write tarball",
+			data:        "package data here",
+			contentType: "application/octet-stream",
+			wantStatus:  http.StatusOK,
+			wantBody:    "package data here",
+			wantErr:     false,
+		},
+		// GOOD: Write JSON
+		{
+			name:        "write JSON metadata",
+			data:        `{"name":"react","version":"18.2.0"}`,
+			contentType: "application/json",
+			wantStatus:  http.StatusOK,
+			wantBody:    `{"name":"react","version":"18.2.0"}`,
+			wantErr:     false,
+		},
+		// EDGE: Empty data
+		{
+			name:        "empty data",
+			data:        "",
+			contentType: "text/plain",
+			wantStatus:  http.StatusOK,
+			wantBody:    "",
+			wantErr:     false,
+		},
+		// EDGE: Large data
+		{
+			name:        "large data",
+			data:        strings.Repeat("x", 100000),
+			contentType: "application/octet-stream",
+			wantStatus:  http.StatusOK,
+			wantBody:    strings.Repeat("x", 100000),
+			wantErr:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			entry := &cache.CacheEntry{
+				Data: io.NopCloser(bytes.NewReader([]byte(tt.data))),
+			}
+
+			err := WriteResponse(w, entry, tt.contentType)
+
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.contentType, w.Header().Get("Content-Type"))
+				assert.Equal(t, tt.wantBody, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestBaseHandlerFields tests that BaseHandler fields are properly set
+func TestBaseHandlerFields(t *testing.T) {
+	handler := NewBaseHandler(nil, nil, "npm", "https://registry.npmjs.org")
+
+	tests := []struct {
+		name     string
+		field    string
+		expected interface{}
+	}{
+		{"registry field", "registry", "npm"},
+		{"upstream field", "upstream", "https://registry.npmjs.org"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			switch tt.field {
+			case "registry":
+				assert.Equal(t, tt.expected, handler.Registry)
+			case "upstream":
+				assert.Equal(t, tt.expected, handler.Upstream)
+			}
+		})
+	}
+}
+
+// TestProxyHandlerInterface tests that BaseHandler can be used as ProxyHandler
+func TestProxyHandlerInterface(t *testing.T) {
+	handler := NewBaseHandler(nil, nil, "npm", "https://registry.npmjs.org")
+
+	// Verify GetRegistry works
+	registry := handler.GetRegistry()
+	assert.Equal(t, "npm", registry)
+}
+
+// TestConcurrentWriteResponse tests that WriteResponse is safe for concurrent use
+func TestConcurrentWriteResponse(t *testing.T) {
+	const numGoroutines = 10
+
+	errs := make(chan error, numGoroutines)
+	for i := 0; i < numGoroutines; i++ {
+		go func(n int) {
+			w := httptest.NewRecorder()
+			data := strings.Repeat("x", 1000)
+			entry := &cache.CacheEntry{
+				Data: io.NopCloser(bytes.NewReader([]byte(data))),
+			}
+
+			err := WriteResponse(w, entry, "text/plain")
+			errs <- err
+		}(i)
+	}
+
+	// Collect results
+	for i := 0; i < numGoroutines; i++ {
+		err := <-errs
+		assert.NoError(t, err)
+	}
+}

pkg/proxy/common/errors.go

@@ -0,0 +1,48 @@
+package common
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/rs/zerolog/log"
+)
+
+// HandleUpstreamError logs an error and sends an HTTP 502 Bad Gateway response
+// This is the common pattern used across all proxy handlers when upstream fetch fails
+func HandleUpstreamError(w http.ResponseWriter, err error, url, context string) {
+	log.Error().
+		Err(err).
+		Str("url", url).
+		Str("context", context).
+		Msg("Failed to fetch from upstream")
+
+	http.Error(w, fmt.Sprintf("Failed to fetch %s", context), http.StatusBadGateway)
+}
+
+// CheckUpstreamStatus validates HTTP status code from upstream
+// Returns error if status is not OK, closing body if needed
+func CheckUpstreamStatus(statusCode int, body io.ReadCloser) error {
+	if statusCode != http.StatusOK {
+		if body != nil {
+			body.Close() // #nosec G104 -- Cleanup, error not critical
+		}
+		return fmt.Errorf("upstream returned status %d", statusCode)
+	}
+	return nil
+}
+
+// HandleInvalidRequest sends a 400 Bad Request response for invalid proxy requests
+func HandleInvalidRequest(w http.ResponseWriter, registry string) {
+	http.Error(w, fmt.Sprintf("Invalid %s request", registry), http.StatusBadRequest)
+}
+
+// HandleInternalError logs an internal error and sends 500 response
+func HandleInternalError(w http.ResponseWriter, err error, context string) {
+	log.Error().
+		Err(err).
+		Str("context", context).
+		Msg("Internal error processing request")
+
+	http.Error(w, fmt.Sprintf("Internal error: %s", context), http.StatusInternalServerError)
+}

pkg/proxy/common/http.go

@@ -0,0 +1,58 @@
+package common
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/lukaszraczylo/gohoarder/pkg/cache"
+	"github.com/lukaszraczylo/gohoarder/pkg/network"
+	"github.com/rs/zerolog/log"
+)
+
+// FetchFromUpstream is a common helper to fetch content from upstream with caching
+// This encapsulates the common pattern of: cache.Get -> network.Get -> error handling
+func FetchFromUpstream(
+	ctx context.Context,
+	cacheManager *cache.Manager,
+	client *network.Client,
+	registry, name, version, upstreamURL string,
+) (*cache.CacheEntry, error) {
+	entry, err := cacheManager.Get(ctx, registry, name, version, func(ctx context.Context) (io.ReadCloser, string, error) {
+		body, statusCode, err := client.Get(ctx, upstreamURL, nil)
+		if err != nil {
+			return nil, "", err
+		}
+		if err := CheckUpstreamStatus(statusCode, body); err != nil {
+			return nil, "", err
+		}
+		return body, upstreamURL, nil
+	})
+
+	if err != nil {
+		log.Error().
+			Err(err).
+			Str("url", upstreamURL).
+			Str("registry", registry).
+			Str("name", name).
+			Str("version", version).
+			Msg("Failed to fetch package from upstream")
+		return nil, err
+	}
+
+	return entry, nil
+}
+
+// WriteResponse writes the cache entry data to the HTTP response writer
+// Sets appropriate content type and handles errors
+func WriteResponse(w http.ResponseWriter, entry *cache.CacheEntry, contentType string) error {
+	defer entry.Data.Close() // #nosec G104 -- Cleanup, error not critical
+
+	w.Header().Set("Content-Type", contentType)
+	if _, err := io.Copy(w, entry.Data); err != nil {
+		log.Error().Err(err).Msg("Failed to write response")
+		return err
+	}
+
+	return nil
+}

pkg/proxy/common/interface.go

@@ -0,0 +1,29 @@
+package common
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+// ProxyHandler defines the common interface for all registry proxies
+type ProxyHandler interface {
+	http.Handler // ServeHTTP(w http.ResponseWriter, r *http.Request)
+
+	// GetRegistry returns the registry type (npm, pypi, go)
+	GetRegistry() string
+
+	// Health checks if the proxy can reach its upstream
+	Health(ctx context.Context) error
+}
+
+// Stats represents proxy statistics
+type Stats struct {
+	Registry        string
+	TotalRequests   int64
+	CacheHits       int64
+	CacheMisses     int64
+	UpstreamErrors  int64
+	AvgResponseTime time.Duration
+	LastUpdated     time.Time
+}

pkg/proxy/goproxy/goproxy.go

@@ -20,21 +20,21 @@ import (
 type Handler struct {
 	cache           *cache.Manager
 	client          *network.Client
+	upstream        string
+	sumDBURL        string
 	credExtractor   *auth.CredentialExtractor
 	credHasher      *auth.CredentialHasher
 	credValidator   *auth.GoValidator
 	validationCache *auth.ValidationCache
 	gitFetcher      *vcs.GitFetcher
 	moduleBuilder   *vcs.ModuleBuilder
-	upstream        string
-	sumDBURL        string
 }
 
 // Config holds Go proxy configuration
 type Config struct {
-	CredStore *vcs.CredentialStore
-	Upstream  string
-	SumDBURL  string
+	Upstream  string               // Upstream Go proxy (e.g., proxy.golang.org)
+	SumDBURL  string               // Checksum database URL
+	CredStore *vcs.CredentialStore // Optional credential store for git access
 }
 
 // New creates a new Go proxy handler

pkg/proxy/npm/npm.go

@@ -21,11 +21,11 @@ import (
 type Handler struct {
 	cache           *cache.Manager
 	client          *network.Client
+	upstream        string
 	credExtractor   *auth.CredentialExtractor
 	credHasher      *auth.CredentialHasher
 	credValidator   *auth.NPMValidator
 	validationCache *auth.ValidationCache
-	upstream        string
 }
 
 // Config holds NPM proxy configuration

pkg/proxy/pypi/pypi.go

@@ -21,11 +21,11 @@ import (
 type Handler struct {
 	cache           *cache.Manager
 	client          *network.Client
+	upstream        string
 	credExtractor   *auth.CredentialExtractor
 	credHasher      *auth.CredentialHasher
 	credValidator   *auth.PyPIValidator
 	validationCache *auth.ValidationCache
-	upstream        string
 }
 
 // Config holds PyPI proxy configuration
@@ -148,17 +148,6 @@ func (h *Handler) handlePackagePage(ctx context.Context, w http.ResponseWriter,
 func (h *Handler) handlePackageFile(ctx context.Context, w http.ResponseWriter, r *http.Request, path string) {
 	packageName, version := extractPackageFileInfo(path)
 
-	// Make version unique by appending file type to avoid cache collisions
-	// between .whl and .metadata files with same version
-	cacheVersion := version
-	if strings.HasSuffix(path, ".metadata") {
-		cacheVersion = version + ".metadata"
-	} else if strings.HasSuffix(path, ".whl") {
-		cacheVersion = version + ".whl"
-	} else if strings.HasSuffix(path, ".tar.gz") {
-		cacheVersion = version + ".tar.gz"
-	}
-
 	// Extract credentials from request
 	credentials := h.credExtractor.Extract(r)
 	credHash := h.credHasher.Hash(credentials)
@@ -181,13 +170,12 @@ func (h *Handler) handlePackageFile(ctx context.Context, w http.ResponseWriter,
 		Str("path", path).
 		Str("package", packageName).
 		Str("version", version).
-		Str("cache_version", cacheVersion).
 		Str("url", originalURL).
 		Str("cred_hash", credHash).
 		Bool("has_credentials", credentials != "").
 		Msg("Handling PyPI package file request")
 
-	entry, err := h.cache.Get(ctx, "pypi", packageName, cacheVersion, func(ctx context.Context) (io.ReadCloser, string, error) {
+	entry, err := h.cache.Get(ctx, "pypi", packageName, version, func(ctx context.Context) (io.ReadCloser, string, error) {
 		// Prepare headers for upstream request
 		headers := make(map[string]string)
 		if credentials != "" {
@@ -293,12 +281,11 @@ func isPackagePage(path string) bool {
 
 // isPackageFile checks if the request is for a package file
 func isPackageFile(path string) bool {
-	// Package files including .metadata files for PEP 658 support
+	// Package files (not including .metadata files which need special handling)
 	return strings.HasSuffix(path, ".whl") ||
 		strings.HasSuffix(path, ".tar.gz") ||
 		strings.HasSuffix(path, ".zip") ||
-		strings.HasSuffix(path, ".egg") ||
-		strings.HasSuffix(path, ".metadata")
+		strings.HasSuffix(path, ".egg")
 }
 
 // extractPackageName extracts package name from path

pkg/scanner/ghsa/ghsa.go

@@ -20,8 +20,8 @@ const ScannerName = "github-advisory-database"
 
 // Scanner implements the GitHub Advisory Database vulnerability scanner
 type Scanner struct {
-	httpClient *http.Client
 	config     config.GHSAConfig
+	httpClient *http.Client
 }
 
 // New creates a new GitHub Advisory Database scanner
@@ -107,17 +107,11 @@ func (s *Scanner) Health(ctx context.Context) error {
 	}
 	defer resp.Body.Close() // #nosec G104 -- Cleanup, error not critical
 
-	// Accept any 2xx or 403 (rate limit) as healthy
-	// Rate limits are expected without a GitHub token and shouldn't fail health checks
-	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-		return nil
-	}
-	if resp.StatusCode == http.StatusForbidden {
-		log.Debug().Msg("GitHub API rate limited (expected without token)")
-		return nil
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("github api returned status: %d", resp.StatusCode)
 	}
 
-	return fmt.Errorf("github api returned status: %d", resp.StatusCode)
+	return nil
 }
 
 // mapRegistryToEcosystem maps our registry names to GitHub ecosystem names
@@ -263,10 +257,10 @@ type GHSAAdvisory struct {
 	Description     string              `json:"description"`
 	Severity        string              `json:"severity"`
 	HTMLURL         string              `json:"html_url"`
-	PublishedAt     string              `json:"published_at"`
-	UpdatedAt       string              `json:"updated_at"`
 	References      []GHSAReference     `json:"references"`
 	Vulnerabilities []GHSAVulnerability `json:"vulnerabilities"`
+	PublishedAt     string              `json:"published_at"`
+	UpdatedAt       string              `json:"updated_at"`
 }
 
 type GHSAReference struct {
@@ -274,9 +268,9 @@ type GHSAReference struct {
 }
 
 type GHSAVulnerability struct {
-	FirstPatchedVersion *GHSAPatchVersion `json:"first_patched_version"`
 	Package             GHSAPackage       `json:"package"`
 	VulnerableVersions  string            `json:"vulnerable_version_range"`
+	FirstPatchedVersion *GHSAPatchVersion `json:"first_patched_version"`
 }
 
 type GHSAPackage struct {

pkg/scanner/grype/grype.go

@@ -153,9 +153,9 @@ func (s *Scanner) convertGrypeResult(grypeResult *GrypeResult, registry, package
 
 // GrypeResult represents Grype JSON output structure
 type GrypeResult struct {
-	Source     GrypeSource     `json:"source"`
-	Descriptor GrypeDescriptor `json:"descriptor"`
 	Matches    []GrypeMatch    `json:"matches"`
+	Descriptor GrypeDescriptor `json:"descriptor"`
+	Source     GrypeSource     `json:"source"`
 }
 
 type GrypeDescriptor struct {
@@ -164,13 +164,13 @@ type GrypeDescriptor struct {
 }
 
 type GrypeSource struct {
-	Target map[string]interface{} `json:"target"`
 	Type   string                 `json:"type"`
+	Target map[string]interface{} `json:"target"`
 }
 
 type GrypeMatch struct {
-	Artifact      GrypeArtifact      `json:"artifact"`
 	Vulnerability GrypeVulnerability `json:"vulnerability"`
+	Artifact      GrypeArtifact      `json:"artifact"`
 }
 
 type GrypeVulnerability struct {

pkg/scanner/npmaudit/npmaudit.go

@@ -199,9 +199,9 @@ func (s *Scanner) convertResult(auditResult *NpmAuditResult, registry, packageNa
 
 // NpmAuditResult represents npm audit JSON output
 type NpmAuditResult struct {
+	AuditReportVersion int                         `json:"auditReportVersion"`
 	Vulnerabilities    map[string]NpmVulnerability `json:"vulnerabilities"`
 	Metadata           NpmAuditMetadata            `json:"metadata"`
-	AuditReportVersion int                         `json:"auditReportVersion"`
 }
 
 type NpmVulnerability struct {

pkg/scanner/osv/osv.go

@@ -25,8 +25,8 @@ const (
 
 // Scanner implements the Scanner interface using OSV.dev API
 type Scanner struct {
-	httpClient *http.Client
 	config     config.OSVConfig
+	httpClient *http.Client
 }
 
 // OSVRequest represents the request structure for OSV API
@@ -48,13 +48,13 @@ type OSVResponse struct {
 
 // OSVVulnerability represents a vulnerability in OSV format
 type OSVVulnerability struct {
-	DatabaseSpecific map[string]interface{} `json:"database_specific,omitempty"`
 	ID               string                 `json:"id"`
 	Summary          string                 `json:"summary"`
 	Details          string                 `json:"details"`
 	Severity         []OSVSeverity          `json:"severity,omitempty"`
 	References       []OSVReference         `json:"references,omitempty"`
 	Affected         []OSVAffected          `json:"affected"`
+	DatabaseSpecific map[string]interface{} `json:"database_specific,omitempty"`
 }
 
 // OSVSeverity represents severity information
@@ -71,11 +71,11 @@ type OSVReference struct {
 
 // OSVAffected represents affected package versions
 type OSVAffected struct {
-	DatabaseSpecific  map[string]interface{} `json:"database_specific,omitempty"`
-	EcosystemSpecific map[string]interface{} `json:"ecosystem_specific,omitempty"`
 	Package           PackageInfo            `json:"package"`
 	Ranges            []OSVRange             `json:"ranges,omitempty"`
 	Versions          []string               `json:"versions,omitempty"`
+	DatabaseSpecific  map[string]interface{} `json:"database_specific,omitempty"`
+	EcosystemSpecific map[string]interface{} `json:"ecosystem_specific,omitempty"`
 }
 
 // OSVRange represents version ranges
@@ -121,17 +121,13 @@ func (s *Scanner) Scan(ctx context.Context, registry, packageName, version strin
 	// Convert registry to OSV ecosystem
 	ecosystem := s.registryToEcosystem(registry)
 
-	// Clean package name and version for Go modules
-	// Go proxy cache keys include /@v/version.suffix which OSV doesn't understand
-	cleanName, cleanVersion := s.cleanGoModuleName(packageName, version, ecosystem)
-
 	// Build request
 	req := OSVRequest{
 		Package: PackageInfo{
-			Name:      cleanName,
+			Name:      packageName,
 			Ecosystem: ecosystem,
 		},
-		Version: cleanVersion,
+		Version: version,
 	}
 
 	// Marshal request
@@ -203,52 +199,6 @@ func (s *Scanner) registryToEcosystem(registry string) string {
 	}
 }
 
-// cleanGoModuleName cleans Go module cache keys to extract the actual module path and version
-// Go proxy cache keys include /@v/version.suffix patterns that need to be cleaned
-// Examples:
-//   - "gorm.io/driver/sqlite/@v/v1.6.0.zip" -> "gorm.io/driver/sqlite", "v1.6.0"
-//   - "github.com/pkg/errors/@v/v0.9.1.mod" -> "github.com/pkg/errors", "v0.9.1"
-//   - "regular-package" -> "regular-package", "version" (unchanged for non-Go)
-func (s *Scanner) cleanGoModuleName(packageName, version, ecosystem string) (string, string) {
-	// Only clean for Go modules
-	if ecosystem != "Go" {
-		return packageName, version
-	}
-
-	// Check if package name contains /@v/ pattern (Go module proxy format)
-	if strings.Contains(packageName, "/@v/") {
-		// Split on /@v/ to get the module path
-		parts := strings.Split(packageName, "/@v/")
-		if len(parts) == 2 {
-			// parts[0] is the clean module path (e.g., "gorm.io/driver/sqlite")
-			// parts[1] might be "v1.6.0.zip" or "v1.6.0.mod" or "v1.6.0.info"
-			cleanName := parts[0]
-
-			// Extract version from the second part if version wasn't already clean
-			// Remove file suffixes like .zip, .mod, .info
-			versionPart := parts[1]
-			versionPart = strings.TrimSuffix(versionPart, ".zip")
-			versionPart = strings.TrimSuffix(versionPart, ".mod")
-			versionPart = strings.TrimSuffix(versionPart, ".info")
-
-			// Use the extracted version if it looks valid, otherwise use the provided version
-			if versionPart != "" && strings.HasPrefix(versionPart, "v") {
-				return cleanName, versionPart
-			}
-
-			return cleanName, version
-		}
-	}
-
-	// Also clean version of any file suffixes
-	cleanVersion := version
-	cleanVersion = strings.TrimSuffix(cleanVersion, ".zip")
-	cleanVersion = strings.TrimSuffix(cleanVersion, ".mod")
-	cleanVersion = strings.TrimSuffix(cleanVersion, ".info")
-
-	return packageName, cleanVersion
-}
-
 // convertOSVResult converts OSV response to metadata.ScanResult
 func (s *Scanner) convertOSVResult(osvResp *OSVResponse, registry, packageName, version string) *metadata.ScanResult {
 	vulnerabilities := make([]metadata.Vulnerability, 0, len(osvResp.Vulns))

pkg/scanner/rescanner.go

@@ -11,11 +11,11 @@ import (
 
 // RescanWorker handles periodic re-scanning of cached packages
 type RescanWorker struct {
+	manager       *Manager
 	metadataStore metadata.MetadataStore
 	storage       storage.StorageBackend
-	manager       *Manager
-	stopCh        chan struct{}
 	interval      time.Duration
+	stopCh        chan struct{}
 }
 
 // NewRescanWorker creates a new rescan worker

pkg/scanner/scanner.go

@@ -36,10 +36,10 @@ type DatabaseUpdater interface {
 
 // Manager manages multiple security scanners
 type Manager struct {
-	metadataStore metadata.MetadataStore
-	config        config.SecurityConfig
 	scanners      []Scanner
 	enabled       bool
+	config        config.SecurityConfig
+	metadataStore metadata.MetadataStore
 }
 
 // New creates a new scanner manager with configured scanners

pkg/scanner/trivy/trivy.go

@@ -25,18 +25,18 @@ type Scanner struct {
 
 // TrivyResult represents Trivy JSON output structure
 type TrivyResult struct {
-	Metadata      TrivyMetadata     `json:"Metadata"`
+	SchemaVersion int               `json:"SchemaVersion"`
 	ArtifactName  string            `json:"ArtifactName"`
 	ArtifactType  string            `json:"ArtifactType"`
+	Metadata      TrivyMetadata     `json:"Metadata"`
 	Results       []TrivyVulnResult `json:"Results"`
-	SchemaVersion int               `json:"SchemaVersion"`
 }
 
 type TrivyMetadata struct {
 	OS          *TrivyOS          `json:"OS,omitempty"`
-	ImageConfig *TrivyImageConfig `json:"ImageConfig,omitempty"`
 	RepoTags    []string          `json:"RepoTags,omitempty"`
 	RepoDigests []string          `json:"RepoDigests,omitempty"`
+	ImageConfig *TrivyImageConfig `json:"ImageConfig,omitempty"`
 }
 
 type TrivyOS struct {
@@ -64,8 +64,8 @@ type TrivyVulnerability struct {
 	Severity         string   `json:"Severity"`
 	Title            string   `json:"Title"`
 	Description      string   `json:"Description"`
-	PrimaryURL       string   `json:"PrimaryURL"`
 	References       []string `json:"References"`
+	PrimaryURL       string   `json:"PrimaryURL"`
 }
 
 // New creates a new Trivy scanner

pkg/server/server.go

@@ -0,0 +1,130 @@
+package server
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/lukaszraczylo/gohoarder/pkg/config"
+	"github.com/lukaszraczylo/gohoarder/pkg/health"
+	"github.com/lukaszraczylo/gohoarder/pkg/logger"
+	"github.com/lukaszraczylo/gohoarder/pkg/metrics"
+)
+
+// Server wraps http.Server with configuration
+type Server struct {
+	*http.Server
+	config        *config.Config
+	healthChecker *health.Checker
+}
+
+// New creates a new HTTP server
+func New(cfg *config.Config, healthChecker *health.Checker) (*Server, error) {
+	mux := http.NewServeMux()
+
+	// Register routes
+	registerRoutes(mux, cfg, healthChecker)
+
+	srv := &http.Server{
+		Addr:         fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port),
+		Handler:      logger.Middleware(mux),
+		ReadTimeout:  cfg.Server.ReadTimeout,
+		WriteTimeout: cfg.Server.WriteTimeout,
+		IdleTimeout:  cfg.Server.IdleTimeout,
+	}
+
+	return &Server{
+		Server:        srv,
+		config:        cfg,
+		healthChecker: healthChecker,
+	}, nil
+}
+
+// registerRoutes registers all HTTP routes
+func registerRoutes(mux *http.ServeMux, cfg *config.Config, healthChecker *health.Checker) {
+	// Health endpoints
+	mux.HandleFunc("/health", healthChecker.HealthHandler())
+	mux.HandleFunc("/health/ready", healthChecker.ReadyHandler())
+
+	// Metrics endpoint
+	mux.Handle("/metrics", metrics.Handler())
+
+	// API endpoints
+	mux.HandleFunc("/api/v1/info", handleInfo(cfg))
+
+	// Package manager proxy endpoints (placeholders for now)
+	if cfg.Handlers.Go.Enabled {
+		mux.HandleFunc("/go/", handleGoProxy())
+	}
+	if cfg.Handlers.NPM.Enabled {
+		mux.HandleFunc("/npm/", handleNPMProxy())
+	}
+	if cfg.Handlers.PyPI.Enabled {
+		mux.HandleFunc("/pypi/", handlePyPIProxy())
+	}
+
+	// Root endpoint
+	mux.HandleFunc("/", handleRoot())
+}
+
+// handleInfo returns server information
+func handleInfo(cfg *config.Config) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		info := map[string]interface{}{
+			"name":    "GoHoarder",
+			"version": "dev",
+			"handlers": map[string]bool{
+				"go":   cfg.Handlers.Go.Enabled,
+				"npm":  cfg.Handlers.NPM.Enabled,
+				"pypi": cfg.Handlers.PyPI.Enabled,
+			},
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprintf(w, `{"success":true,"data":%v}`, toJSON(info))
+	}
+}
+
+// handleGoProxy handles Go module proxy requests
+func handleGoProxy() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// TODO: Implement Go proxy handler
+		http.Error(w, `{"success":false,"error":{"code":"NOT_IMPLEMENTED","message":"Go proxy not yet implemented"}}`, http.StatusNotImplemented)
+	}
+}
+
+// handleNPMProxy handles NPM registry requests
+func handleNPMProxy() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// TODO: Implement NPM proxy handler
+		http.Error(w, `{"success":false,"error":{"code":"NOT_IMPLEMENTED","message":"NPM proxy not yet implemented"}}`, http.StatusNotImplemented)
+	}
+}
+
+// handlePyPIProxy handles PyPI requests
+func handlePyPIProxy() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// TODO: Implement PyPI proxy handler
+		http.Error(w, `{"success":false,"error":{"code":"NOT_IMPLEMENTED","message":"PyPI proxy not yet implemented"}}`, http.StatusNotImplemented)
+	}
+}
+
+// handleRoot handles root path
+func handleRoot() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/" {
+			http.NotFound(w, r)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, `{"success":true,"data":{"message":"GoHoarder - Universal Package Cache Proxy","docs":"https://github.com/lukaszraczylo/gohoarder"}}`)
+	}
+}
+
+// toJSON is a simple JSON encoder (replace with proper implementation)
+func toJSON(v interface{}) string {
+	// Simplified for now - proper implementation would use goccy/go-json
+	return fmt.Sprintf("%v", v)
+}

pkg/storage/filesystem/filesystem_test.go

@@ -17,8 +17,8 @@ import (
 
 type FilesystemStorageTestSuite struct {
 	suite.Suite
-	fs      *FilesystemStorage
 	tempDir string
+	fs      *FilesystemStorage
 }
 
 func (s *FilesystemStorageTestSuite) SetupTest() {
@@ -46,12 +46,12 @@ func TestFilesystemStorageTestSuite(t *testing.T) {
 // Test Put operation
 func (s *FilesystemStorageTestSuite) TestPut() {
 	tests := []struct {
-		opts        *storage.PutOptions
-		errorCheck  func(error) bool
 		name        string
 		key         string
 		data        string
+		opts        *storage.PutOptions
 		expectError bool
+		errorCheck  func(error) bool
 	}{
 		{
 			name:        "successful put",
@@ -122,8 +122,8 @@ func (s *FilesystemStorageTestSuite) TestGet() {
 	tests := []struct {
 		name        string
 		key         string
-		expectData  string
 		expectError bool
+		expectData  string
 	}{
 		{
 			name:        "get existing file",
@@ -258,11 +258,11 @@ func (s *FilesystemStorageTestSuite) TestList() {
 	}
 
 	tests := []struct {
-		opts          *storage.ListOptions
 		name          string
 		prefix        string
-		expectedKeys  []string
+		opts          *storage.ListOptions
 		expectedCount int
+		expectedKeys  []string
 	}{
 		{
 			name:          "list all npm packages",
@@ -422,8 +422,8 @@ func (s *FilesystemStorageTestSuite) TestContextCancellation() {
 	cancel()
 
 	tests := []struct {
-		fn   func() error
 		name string
+		fn   func() error
 	}{
 		{
 			name: "Get with cancelled context",
@@ -679,8 +679,8 @@ func (s *FilesystemStorageTestSuite) TestChecksumValidation() {
 	correctMD5 := "7dd7323e8ce3e087972f93d3711ef62b"
 
 	tests := []struct {
-		opts        *storage.PutOptions
 		name        string
+		opts        *storage.PutOptions
 		expectError bool
 	}{
 		{

pkg/storage/interface.go

@@ -52,21 +52,21 @@ type ListOptions struct {
 
 // StorageObject represents a stored object
 type StorageObject struct {
-	Modified time.Time
 	Key      string
-	ETag     string
 	Size     int64
+	Modified time.Time
+	ETag     string
 }
 
 // StorageInfo contains detailed object information
 type StorageInfo struct {
-	Modified    time.Time
-	Metadata    map[string]string
-	Checksums   *Checksums
 	Key         string
+	Size        int64
+	Modified    time.Time
 	ETag        string
 	ContentType string
-	Size        int64
+	Metadata    map[string]string
+	Checksums   *Checksums
 }
 
 // Checksums contains file checksums

pkg/storage/s3/s3.go

@@ -3,10 +3,14 @@ package s3
 import (
 	"bytes"
 	"context"
+	"crypto/md5" // #nosec G501 -- MD5 used for S3 Content-MD5 header, not cryptographic security
+	"crypto/sha256"
+	"encoding/hex"
 	stderrors "errors"
 	"fmt"
 	"io"
 	"strings"
+	"sync"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/config"
@@ -14,210 +18,261 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/lukaszraczylo/gohoarder/pkg/errors"
+	"github.com/lukaszraczylo/gohoarder/pkg/metrics"
 	"github.com/lukaszraczylo/gohoarder/pkg/storage"
 	"github.com/rs/zerolog/log"
 )
 
-// Config holds S3 storage configuration
-type Config struct {
-	Region          string
-	Bucket          string
-	Prefix          string
-	AccessKeyID     string
-	SecretAccessKey string
-	Endpoint        string // Optional: for S3-compatible services like MinIO
-	ForcePathStyle  bool   // Optional: for S3-compatible services
-	MaxSizeBytes    int64
+// S3Storage implements storage.StorageBackend for AWS S3
+type S3Storage struct {
+	client *s3.Client
+	bucket string
+	prefix string
+	quota  int64
+	mu     sync.RWMutex
+	used   int64
 }
 
-// S3Storage implements storage.StorageBackend using AWS S3
-type S3Storage struct {
-	client       *s3.Client
-	bucket       string
-	prefix       string
-	maxSizeBytes int64
+// Config holds S3 configuration
+type Config struct {
+	Bucket          string
+	Region          string
+	Endpoint        string // For S3-compatible services (MinIO, etc.)
+	AccessKeyID     string
+	SecretAccessKey string
+	Prefix          string // Optional prefix for all keys
+	Quota           int64  // Quota in bytes (0 = unlimited)
+	ForcePathStyle  bool   // For S3-compatible services
 }
 
 // New creates a new S3 storage backend
-func New(cfg Config) (*S3Storage, error) {
+func New(ctx context.Context, cfg Config) (*S3Storage, error) {
 	if cfg.Bucket == "" {
-		return nil, fmt.Errorf("S3 bucket is required")
+		return nil, errors.New(errors.ErrCodeInvalidConfig, "S3 bucket is required")
 	}
 
 	if cfg.Region == "" {
-		cfg.Region = "us-east-1" // Default region
+		return nil, errors.New(errors.ErrCodeInvalidConfig, "S3 region is required")
 	}
 
 	// Build AWS config
-	var awsConfig aws.Config
+	var awsCfg aws.Config
 	var err error
 
-	// Build config options
-	configOpts := []func(*config.LoadOptions) error{
-		config.WithRegion(cfg.Region),
-	}
-
-	// Add credentials if provided
 	if cfg.AccessKeyID != "" && cfg.SecretAccessKey != "" {
-		configOpts = append(configOpts, config.WithCredentialsProvider(
-			credentials.NewStaticCredentialsProvider(
+		// Use static credentials
+		awsCfg, err = config.LoadDefaultConfig(ctx,
+			config.WithRegion(cfg.Region),
+			config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
 				cfg.AccessKeyID,
 				cfg.SecretAccessKey,
 				"",
-			),
-		))
+			)),
+		)
+	} else {
+		// Use default credential chain
+		awsCfg, err = config.LoadDefaultConfig(ctx,
+			config.WithRegion(cfg.Region),
+		)
 	}
 
-	awsConfig, err = config.LoadDefaultConfig(context.Background(), configOpts...)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+		return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to load AWS config")
 	}
 
-	// Create S3 client with service-specific options
-	client := s3.NewFromConfig(awsConfig, func(o *s3.Options) {
-		// Use custom endpoint if provided (for MinIO, S3-compatible services, etc.)
-		if cfg.Endpoint != "" {
+	// Create S3 client
+	var s3Options []func(*s3.Options)
+
+	if cfg.Endpoint != "" {
+		s3Options = append(s3Options, func(o *s3.Options) {
 			o.BaseEndpoint = aws.String(cfg.Endpoint)
-		}
-		if cfg.ForcePathStyle {
-			o.UsePathStyle = true
-		}
-	})
-
-	storage := &S3Storage{
-		client:       client,
-		bucket:       cfg.Bucket,
-		prefix:       strings.TrimSuffix(cfg.Prefix, "/"),
-		maxSizeBytes: cfg.MaxSizeBytes,
+			o.UsePathStyle = cfg.ForcePathStyle
+		})
 	}
 
-	log.Info().
-		Str("bucket", cfg.Bucket).
-		Str("region", cfg.Region).
-		Str("prefix", cfg.Prefix).
-		Msg("S3 storage initialized")
+	client := s3.NewFromConfig(awsCfg, s3Options...)
 
-	return storage, nil
+	s3Storage := &S3Storage{
+		client: client,
+		bucket: cfg.Bucket,
+		prefix: strings.TrimSuffix(cfg.Prefix, "/"),
+		quota:  cfg.Quota,
+	}
+
+	// Calculate initial usage
+	if err := s3Storage.calculateUsage(ctx); err != nil {
+		log.Warn().Err(err).Msg("Failed to calculate initial S3 storage usage")
+	}
+
+	return s3Storage, nil
 }
 
-// Get retrieves data from S3
+// Get retrieves a file from S3
 func (s *S3Storage) Get(ctx context.Context, key string) (io.ReadCloser, error) {
-	fullKey := s.buildKey(key)
+	s3Key := s.buildKey(key)
 
-	log.Debug().Str("key", fullKey).Msg("Getting object from S3")
-
-	result, err := s.client.GetObject(ctx, &s3.GetObjectInput{
+	input := &s3.GetObjectInput{
 		Bucket: aws.String(s.bucket),
-		Key:    aws.String(fullKey),
-	})
+		Key:    aws.String(s3Key),
+	}
 
+	result, err := s.client.GetObject(ctx, input)
 	if err != nil {
 		if isNotFoundError(err) {
-			return nil, errors.NotFound(fmt.Sprintf("S3 object not found: %s", key))
+			metrics.RecordStorageOperation("s3", "get", "not_found")
+			return nil, errors.NotFound(fmt.Sprintf("file not found: %s", key))
 		}
+		metrics.RecordStorageOperation("s3", "get", "error")
 		return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to get object from S3")
 	}
 
+	metrics.RecordStorageOperation("s3", "get", "success")
 	return result.Body, nil
 }
 
-// Put stores data in S3
+// Put stores a file in S3
 func (s *S3Storage) Put(ctx context.Context, key string, data io.Reader, opts *storage.PutOptions) error {
-	fullKey := s.buildKey(key)
+	s3Key := s.buildKey(key)
 
-	// Read data into buffer to get size
-	buf := new(bytes.Buffer)
-	size, err := io.Copy(buf, data)
+	// Read data into buffer to calculate checksums and size
+	var buf bytes.Buffer
+	md5Hash := md5.New() // #nosec G401 -- MD5 used for S3 integrity check, not cryptographic security
+	sha256Hash := sha256.New()
+	multiWriter := io.MultiWriter(&buf, md5Hash, sha256Hash)
+
+	written, err := io.Copy(multiWriter, data)
 	if err != nil {
-		return fmt.Errorf("failed to read data: %w", err)
+		metrics.RecordStorageOperation("s3", "put", "error")
+		return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to read data")
 	}
 
-	log.Debug().
-		Str("key", fullKey).
-		Int64("size", size).
-		Msg("Putting object to S3")
+	// Check quota before upload
+	if s.quota > 0 {
+		s.mu.RLock()
+		used := s.used
+		s.mu.RUnlock()
 
-	// Check quota if set
-	if s.maxSizeBytes > 0 {
-		currentUsage, err := s.calculateUsage(ctx)
-		if err != nil {
-			log.Warn().Err(err).Msg("Failed to calculate current usage, skipping quota check")
-		} else if currentUsage+size > s.maxSizeBytes {
-			return errors.QuotaExceeded(s.maxSizeBytes)
+		if used+written > s.quota {
+			metrics.RecordStorageOperation("s3", "put", "quota_exceeded")
+			return errors.QuotaExceeded(s.quota)
 		}
 	}
 
-	// Convert metadata to S3 metadata format
-	s3Metadata := make(map[string]string)
+	// Verify checksums if provided
+	if opts != nil {
+		md5Sum := hex.EncodeToString(md5Hash.Sum(nil))
+		sha256Sum := hex.EncodeToString(sha256Hash.Sum(nil))
+
+		if opts.ChecksumMD5 != "" && opts.ChecksumMD5 != md5Sum {
+			metrics.RecordStorageOperation("s3", "put", "checksum_error")
+			return errors.New(errors.ErrCodeChecksumMismatch, "MD5 checksum mismatch")
+		}
+
+		if opts.ChecksumSHA256 != "" && opts.ChecksumSHA256 != sha256Sum {
+			metrics.RecordStorageOperation("s3", "put", "checksum_error")
+			return errors.New(errors.ErrCodeChecksumMismatch, "SHA256 checksum mismatch")
+		}
+	}
+
+	// Prepare metadata
+	metadata := make(map[string]string)
 	if opts != nil && opts.Metadata != nil {
-		for k, v := range opts.Metadata {
-			s3Metadata[k] = v
-		}
+		metadata = opts.Metadata
+	}
+
+	// Build put input
+	input := &s3.PutObjectInput{
+		Bucket:   aws.String(s.bucket),
+		Key:      aws.String(s3Key),
+		Body:     bytes.NewReader(buf.Bytes()),
+		Metadata: metadata,
+	}
+
+	if opts != nil && opts.ContentType != "" {
+		input.ContentType = aws.String(opts.ContentType)
 	}
 
 	// Upload to S3
-	_, err = s.client.PutObject(ctx, &s3.PutObjectInput{
-		Bucket:   aws.String(s.bucket),
-		Key:      aws.String(fullKey),
-		Body:     bytes.NewReader(buf.Bytes()),
-		Metadata: s3Metadata,
-	})
-
+	_, err = s.client.PutObject(ctx, input)
 	if err != nil {
-		return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to put object to S3")
+		metrics.RecordStorageOperation("s3", "put", "error")
+		return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to upload to S3")
 	}
 
+	// Update usage
+	s.mu.Lock()
+	s.used += written
+	currentUsed := s.used
+	s.mu.Unlock()
+
+	metrics.RecordStorageOperation("s3", "put", "success")
+	metrics.UpdateCacheSize("s3", currentUsed)
 	return nil
 }
 
-// Delete removes data from S3
+// Delete removes a file from S3
 func (s *S3Storage) Delete(ctx context.Context, key string) error {
-	fullKey := s.buildKey(key)
-
-	log.Debug().Str("key", fullKey).Msg("Deleting object from S3")
-
-	_, err := s.client.DeleteObject(ctx, &s3.DeleteObjectInput{
-		Bucket: aws.String(s.bucket),
-		Key:    aws.String(fullKey),
-	})
+	s3Key := s.buildKey(key)
 
+	// Get size before deletion for quota tracking
+	statInfo, err := s.Stat(ctx, key)
 	if err != nil {
-		return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to delete object from S3")
+		return err
 	}
 
+	input := &s3.DeleteObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(s3Key),
+	}
+
+	_, err = s.client.DeleteObject(ctx, input)
+	if err != nil {
+		metrics.RecordStorageOperation("s3", "delete", "error")
+		return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to delete from S3")
+	}
+
+	// Update usage
+	s.mu.Lock()
+	s.used -= statInfo.Size
+	currentUsed := s.used
+	s.mu.Unlock()
+
+	metrics.RecordStorageOperation("s3", "delete", "success")
+	metrics.UpdateCacheSize("s3", currentUsed)
 	return nil
 }
 
-// Exists checks if data exists in S3
+// Exists checks if a file exists in S3
 func (s *S3Storage) Exists(ctx context.Context, key string) (bool, error) {
-	fullKey := s.buildKey(key)
+	s3Key := s.buildKey(key)
 
-	_, err := s.client.HeadObject(ctx, &s3.HeadObjectInput{
+	input := &s3.HeadObjectInput{
 		Bucket: aws.String(s.bucket),
-		Key:    aws.String(fullKey),
-	})
+		Key:    aws.String(s3Key),
+	}
 
+	_, err := s.client.HeadObject(ctx, input)
 	if err != nil {
 		if isNotFoundError(err) {
 			return false, nil
 		}
-		return false, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to check object existence in S3")
+		return false, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to check existence in S3")
 	}
 
 	return true, nil
 }
 
-// List returns a list of objects with the given prefix
+// List lists files with prefix in S3
 func (s *S3Storage) List(ctx context.Context, prefix string, opts *storage.ListOptions) ([]storage.StorageObject, error) {
-	fullPrefix := s.buildKey(prefix)
+	s3Prefix := s.buildKey(prefix)
 
-	log.Debug().Str("prefix", fullPrefix).Msg("Listing objects in S3")
+	input := &s3.ListObjectsV2Input{
+		Bucket: aws.String(s.bucket),
+		Prefix: aws.String(s3Prefix),
+	}
 
 	var objects []storage.StorageObject
-	paginator := s3.NewListObjectsV2Paginator(s.client, &s3.ListObjectsV2Input{
-		Bucket: aws.String(s.bucket),
-		Prefix: aws.String(fullPrefix),
-	})
+	paginator := s3.NewListObjectsV2Paginator(s.client, input)
 
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
@@ -226,58 +281,56 @@ func (s *S3Storage) List(ctx context.Context, prefix string, opts *storage.ListO
 		}
 
 		for _, obj := range page.Contents {
-			if obj.Key != nil {
-				// Strip prefix from key
-				key := s.stripPrefix(*obj.Key)
+			key := s.stripPrefix(*obj.Key)
+			objects = append(objects, storage.StorageObject{
+				Key:      key,
+				Size:     *obj.Size,
+				Modified: *obj.LastModified,
+				ETag:     strings.Trim(*obj.ETag, "\""),
+			})
+		}
+	}
 
-				object := storage.StorageObject{
-					Key:  key,
-					Size: aws.ToInt64(obj.Size),
-				}
-
-				if obj.LastModified != nil {
-					object.Modified = *obj.LastModified
-				}
-
-				if obj.ETag != nil {
-					object.ETag = *obj.ETag
-				}
-
-				objects = append(objects, object)
-			}
+	// Apply pagination if requested
+	if opts != nil {
+		start := opts.Offset
+		end := len(objects)
+		if opts.MaxResults > 0 && start+opts.MaxResults < end {
+			end = start + opts.MaxResults
+		}
+		if start < len(objects) {
+			objects = objects[start:end]
+		} else {
+			objects = []storage.StorageObject{}
 		}
 	}
 
 	return objects, nil
 }
 
-// Stat returns metadata about stored data
+// Stat gets file metadata from S3
 func (s *S3Storage) Stat(ctx context.Context, key string) (*storage.StorageInfo, error) {
-	fullKey := s.buildKey(key)
+	s3Key := s.buildKey(key)
 
-	result, err := s.client.HeadObject(ctx, &s3.HeadObjectInput{
+	input := &s3.HeadObjectInput{
 		Bucket: aws.String(s.bucket),
-		Key:    aws.String(fullKey),
-	})
+		Key:    aws.String(s3Key),
+	}
 
+	result, err := s.client.HeadObject(ctx, input)
 	if err != nil {
 		if isNotFoundError(err) {
-			return nil, errors.NotFound(fmt.Sprintf("S3 object not found: %s", key))
+			return nil, errors.NotFound(fmt.Sprintf("file not found: %s", key))
 		}
 		return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to stat object in S3")
 	}
 
 	info := &storage.StorageInfo{
-		Key:  key,
-		Size: aws.ToInt64(result.ContentLength),
-	}
-
-	if result.LastModified != nil {
-		info.Modified = *result.LastModified
-	}
-
-	if result.ETag != nil {
-		info.ETag = *result.ETag
+		Key:      key,
+		Size:     *result.ContentLength,
+		Modified: *result.LastModified,
+		ETag:     strings.Trim(*result.ETag, "\""),
+		Metadata: result.Metadata,
 	}
 
 	if result.ContentType != nil {
@@ -287,27 +340,33 @@ func (s *S3Storage) Stat(ctx context.Context, key string) (*storage.StorageInfo,
 	return info, nil
 }
 
-// GetQuota returns current usage and quota information
+// GetQuota returns quota information
 func (s *S3Storage) GetQuota(ctx context.Context) (*storage.QuotaInfo, error) {
-	usage, err := s.calculateUsage(ctx)
-	if err != nil {
-		return nil, err
+	s.mu.RLock()
+	used := s.used
+	s.mu.RUnlock()
+
+	available := s.quota - used
+	if available < 0 {
+		available = 0
 	}
 
 	return &storage.QuotaInfo{
-		Used:  usage,
-		Limit: s.maxSizeBytes,
+		Used:      used,
+		Available: available,
+		Limit:     s.quota,
 	}, nil
 }
 
-// Health checks if the S3 backend is healthy
+// Health checks S3 health
 func (s *S3Storage) Health(ctx context.Context) error {
-	// Try to list objects (lightweight operation)
-	_, err := s.client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
+	// Try to list bucket to verify connectivity
+	input := &s3.ListObjectsV2Input{
 		Bucket:  aws.String(s.bucket),
 		MaxKeys: aws.Int32(1),
-	})
+	}
 
+	_, err := s.client.ListObjectsV2(ctx, input)
 	if err != nil {
 		return errors.Wrap(err, errors.ErrCodeStorageFailure, "S3 health check failed")
 	}
@@ -315,51 +374,60 @@ func (s *S3Storage) Health(ctx context.Context) error {
 	return nil
 }
 
-// Close closes the S3 storage backend
+// Close closes the storage backend
 func (s *S3Storage) Close() error {
-	log.Info().Msg("S3 storage closed")
+	// No cleanup needed for S3 client
 	return nil
 }
 
-// buildKey constructs the full S3 key with prefix
+// buildKey builds the full S3 key with prefix
 func (s *S3Storage) buildKey(key string) string {
-	if s.prefix == "" {
-		return key
+	key = strings.TrimPrefix(key, "/")
+	if s.prefix != "" {
+		return s.prefix + "/" + key
 	}
-	return s.prefix + "/" + key
+	return key
 }
 
-// stripPrefix removes the prefix from an S3 key
-func (s *S3Storage) stripPrefix(key string) string {
-	if s.prefix == "" {
-		return key
+// stripPrefix removes the configured prefix from an S3 key
+func (s *S3Storage) stripPrefix(s3Key string) string {
+	if s.prefix != "" {
+		return strings.TrimPrefix(s3Key, s.prefix+"/")
 	}
-	return strings.TrimPrefix(key, s.prefix+"/")
+	return s3Key
 }
 
-// calculateUsage calculates total storage usage
-func (s *S3Storage) calculateUsage(ctx context.Context) (int64, error) {
-	var totalSize int64
+// calculateUsage calculates current S3 storage usage
+func (s *S3Storage) calculateUsage(ctx context.Context) error {
+	var total int64
 
-	paginator := s3.NewListObjectsV2Paginator(s.client, &s3.ListObjectsV2Input{
+	input := &s3.ListObjectsV2Input{
 		Bucket: aws.String(s.bucket),
-		Prefix: aws.String(s.prefix),
-	})
+	}
+
+	if s.prefix != "" {
+		input.Prefix = aws.String(s.prefix + "/")
+	}
+
+	paginator := s3.NewListObjectsV2Paginator(s.client, input)
 
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
 		if err != nil {
-			return 0, fmt.Errorf("failed to calculate usage: %w", err)
+			return err
 		}
 
 		for _, obj := range page.Contents {
-			if obj.Size != nil {
-				totalSize += aws.ToInt64(obj.Size)
-			}
+			total += *obj.Size
 		}
 	}
 
-	return totalSize, nil
+	s.mu.Lock()
+	s.used = total
+	s.mu.Unlock()
+
+	metrics.UpdateCacheSize("s3", total)
+	return nil
 }
 
 // isNotFoundError checks if an error is a "not found" error
@@ -368,21 +436,8 @@ func isNotFoundError(err error) bool {
 		return false
 	}
 
-	// Check for specific S3 error types
 	var notFound *types.NotFound
 	var noSuchKey *types.NoSuchKey
 
-	// Use errors.As to check for wrapped errors
-	if ok := stderrors.As(err, &notFound); ok {
-		return true
-	}
-	if ok := stderrors.As(err, &noSuchKey); ok {
-		return true
-	}
-
-	// Check error message as fallback
-	errMsg := err.Error()
-	return strings.Contains(errMsg, "NoSuchKey") ||
-		strings.Contains(errMsg, "NotFound") ||
-		strings.Contains(errMsg, "404")
+	return stderrors.As(err, &notFound) || stderrors.As(err, &noSuchKey)
 }