Release v0.5.1: namespace integrity, dashboard parity and QR hardening

tests/analytics_parity_tests.rs

@@ -0,0 +1,333 @@
+use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+use std::time::Instant;
+use tokio::net::TcpListener;
+
+use bzod::analytics::AnalyticsQueue;
+use bzod::config::Config;
+use bzod::db::Db;
+use bzod::state::AppState;
+use bzod::web::create_router;
+
+fn compute_sha256(value: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn create_temp_config(temp_dir: PathBuf) -> Config {
+    let mut config = Config::load();
+    config.data_dir = temp_dir.clone();
+    config.backup_dir = temp_dir.clone();
+    config.admin_username = "admin".to_string();
+    config.base_url = Some("http://localhost:8080".to_string());
+    config.cookie_secure = false;
+    config.bootstrap_password_sha256 = compute_sha256("bootstrap-secret");
+    config
+}
+
+fn extract_csrf_token(html: &str) -> Option<String> {
+    let marker = "name=\"csrf_token\" value=\"";
+    if let Some(pos) = html.find(marker) {
+        let start = pos + marker.len();
+        if let Some(end) = html[start..].find('"') {
+            return Some(html[start..start + end].to_string());
+        }
+    }
+    None
+}
+
+async fn start_test_server(
+    temp_dir: PathBuf,
+) -> (reqwest::Client, String, tokio::task::JoinHandle<()>, Db) {
+    let config = create_temp_config(temp_dir);
+    let db = Db::init(&config).expect("Failed to init Db");
+    let queue = AnalyticsQueue::new(db.clone(), 100);
+
+    let state = AppState {
+        admin_db: db.admin.clone(),
+        content_db: db.content.clone(),
+        analytics_db: db.analytics.clone(),
+        system_db: db.system.clone(),
+        users_db: db.users.clone(),
+        user_dbs: std::sync::Arc::new(std::sync::Mutex::new(HashMap::new())),
+        db: db.clone(),
+        config,
+        analytics_queue: queue,
+        start_time: Instant::now(),
+    };
+
+    let router = create_router(state);
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let url = format!("http://{}", addr);
+
+    let handle = tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    });
+
+    let client = reqwest::Client::builder()
+        .cookie_store(true)
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+
+    (client, url, handle, db)
+}
+
+#[tokio::test]
+async fn test_analytics_and_table_parity() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_parity_test_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let (client, base_url, _server_handle, db) = start_test_server(temp_dir.clone()).await;
+
+    // 1. Log in as admin FIRST (Bootstrap phase: zero users exist)
+    let admin_client = reqwest::Client::builder()
+        .cookie_store(true)
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+
+    let admin_login_url = format!("{}/admin/login", base_url);
+    let res = admin_client.get(&admin_login_url).send().await.unwrap();
+    let html = res.text().await.unwrap();
+    let csrf_token = extract_csrf_token(&html).unwrap();
+
+    let mut admin_login_params = HashMap::new();
+    admin_login_params.insert("username", "admin");
+    admin_login_params.insert("password", "bootstrap-secret");
+    admin_login_params.insert("csrf_token", &csrf_token);
+
+    let res = admin_client
+        .post(&admin_login_url)
+        .form(&admin_login_params)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::SEE_OTHER);
+
+    // Admin adds a URL to the global content_db
+    let _admin_url_id = {
+        let conn_admin = db.content.lock().unwrap();
+        let url = bzod::db::content::create_url_extended(
+            &conn_admin,
+            "!admin-slug",
+            "https://admin.com",
+            None,
+            None,
+            &vec![],
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!admin-slug",
+            1,
+            "url",
+            &url.id,
+            "active",
+        )
+        .unwrap();
+        url.id
+    };
+
+    // Admin adds a Landing Page to the global content_db
+    let _admin_page_id = {
+        let conn_admin = db.content.lock().unwrap();
+        let page = bzod::db::content::create_landing_page(
+            &conn_admin,
+            "!admin-page",
+            "admin-page",
+            "Title Admin",
+            "<html></html>",
+            "published",
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!admin-page",
+            1,
+            "page",
+            &page.id,
+            "active",
+        )
+        .unwrap();
+        page.id
+    };
+
+    // 2. Create User A
+    let _ = bzod::cli::create_user::run(
+        Some("usera".to_string()),
+        Some("password123".to_string()),
+        None,
+        create_temp_config(temp_dir.clone()),
+    )
+    .await
+    .unwrap();
+
+    let id_a = {
+        let conn = db.users.lock().unwrap();
+        bzod::db::users::get_user_by_username(&conn, "usera")
+            .unwrap()
+            .unwrap()
+            .id
+    };
+
+    // User A adds a URL
+    let urla_id = {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let url = bzod::db::content::create_url_extended(
+            &conn_a,
+            "!usera-slug",
+            "https://usera.com",
+            None,
+            None,
+            &vec![],
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!usera-slug",
+            id_a,
+            "url",
+            &url.id,
+            "active",
+        )
+        .unwrap();
+        url.id
+    };
+
+    // User A adds a Landing Page
+    let pagea_id = {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let page = bzod::db::content::create_landing_page(
+            &conn_a,
+            "!usera-page",
+            "usera-page",
+            "Title A",
+            "<html></html>",
+            "published",
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!usera-page",
+            id_a,
+            "page",
+            &page.id,
+            "active",
+        )
+        .unwrap();
+        page.id
+    };
+
+    // --- Log in as User A ---
+    let login_url = format!("{}/login", base_url);
+    let res = client.get(&login_url).send().await.unwrap();
+    let html = res.text().await.unwrap();
+    let csrf_token = extract_csrf_token(&html).unwrap();
+
+    let mut login_params = HashMap::new();
+    login_params.insert("username", "usera");
+    login_params.insert("password", "password123");
+    login_params.insert("csrf_token", &csrf_token);
+
+    let res = client
+        .post(&login_url)
+        .form(&login_params)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::SEE_OTHER);
+
+    // 1. Get user URLs dashboard and check for QR Code preview
+    let res = client
+        .get(format!("{}/user/urls", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let user_urls_html = res.text().await.unwrap();
+    assert!(user_urls_html.contains("QR Code"));
+    assert!(user_urls_html.contains("/api/qr/!usera-slug.svg"));
+
+    // 2. Get user Pages dashboard and check for QR Code preview
+    let res = client
+        .get(format!("{}/user/pages", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let user_pages_html = res.text().await.unwrap();
+    assert!(user_pages_html.contains("QR Code"));
+    assert!(user_pages_html.contains("/api/qr/!usera-page.svg"));
+
+    // 3. Get user URL analytics and verify dashboard features exist
+    let res = client
+        .get(format!("{}/user/analytics/url/{}", base_url, urla_id))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let user_url_analytics = res.text().await.unwrap();
+    assert!(user_url_analytics.contains("Export CSV"));
+    assert!(user_url_analytics.contains("Export JSON"));
+    assert!(user_url_analytics.contains("date_from"));
+    assert!(user_url_analytics.contains("Daily Click Traffic"));
+    assert!(user_url_analytics.contains("Referrer Channels"));
+    assert!(user_url_analytics.contains("Browser breakdown"));
+
+    // 4. Get user Page analytics and verify dashboard features exist
+    let res = client
+        .get(format!("{}/user/analytics/page/{}", base_url, pagea_id))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let user_page_analytics = res.text().await.unwrap();
+    assert!(user_page_analytics.contains("Export CSV"));
+    assert!(user_page_analytics.contains("Export JSON"));
+    assert!(user_page_analytics.contains("date_from"));
+    assert!(user_page_analytics.contains("Daily Page Views"));
+    assert!(user_page_analytics.contains("Referrer Channels"));
+
+    // 5. Get admin URLs dashboard and check for QR Code preview
+    let res = admin_client
+        .get(format!("{}/admin/urls", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let admin_urls_html = res.text().await.unwrap();
+    assert!(admin_urls_html.contains("QR Code"));
+    assert!(admin_urls_html.contains("/api/qr/!admin-slug.svg"));
+
+    // 6. Get admin Pages dashboard and check for QR Code preview
+    let res = admin_client
+        .get(format!("{}/admin/pages", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    let admin_pages_html = res.text().await.unwrap();
+    assert!(admin_pages_html.contains("QR Code"));
+    assert!(admin_pages_html.contains("/api/qr/!admin-page.svg"));
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}

tests/backup_restore_tests.rs

@@ -135,8 +135,15 @@ async fn test_backup_restore_roundtrip() {
 
         // Register global slug
         let system_conn = db.system.lock().unwrap();
-        bzod::db::users::register_global_slug(&system_conn, "!rt-slug", user_id, "url", "rt-id")
-            .unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!rt-slug",
+            user_id,
+            "url",
+            "rt-id",
+            "active",
+        )
+        .unwrap();
     }
 
     // Backup user
@@ -234,8 +241,15 @@ async fn test_restore_slug_collision_rejection() {
         .unwrap();
 
         let system_conn = db.system.lock().unwrap();
-        bzod::db::users::register_global_slug(&system_conn, "!collision-slug", id_a, "url", "a-id")
-            .unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!collision-slug",
+            id_a,
+            "url",
+            "a-id",
+            "active",
+        )
+        .unwrap();
     }
 
     // Backup User A
@@ -289,18 +303,25 @@ async fn test_restore_slug_collision_rejection() {
         .unwrap();
 
         let system_conn = db.system.lock().unwrap();
-        bzod::db::users::register_global_slug(&system_conn, "!collision-slug", id_b, "url", "b-id")
-            .unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!collision-slug",
+            id_b,
+            "url",
+            "b-id",
+            "active",
+        )
+        .unwrap();
     }
 
-    // Attempt to restore User A from backup
-    bzod::cli::restore_user::run(
+    // Attempt to restore User A from backup - must fail on collision
+    let res = bzod::cli::restore_user::run(
         backup_file.to_string_lossy().to_string(),
         None,
         config.clone(),
     )
-    .await
-    .unwrap();
+    .await;
+    assert!(res.is_err());
 
     // Verify that User B still owns the slug in global_slugs and User A's slug registration was skipped/rejected
     {

tests/business_workflow_tests.rs

@@ -177,7 +177,7 @@ async fn test_scenario_a_user_create_login_shorten_visit_analytics() {
     let redir_url = format!("{}/!mygoogle", base_url);
     let res = client.get(&redir_url).send().await.unwrap();
     // It should redirect to google.com
-    assert_eq!(res.status(), reqwest::StatusCode::TEMPORARY_REDIRECT);
+    assert_eq!(res.status(), reqwest::StatusCode::MOVED_PERMANENTLY);
     assert_eq!(
         res.headers().get("location").unwrap().to_str().unwrap(),
         "https://google.com"
@@ -573,7 +573,7 @@ async fn test_scenario_c_slug_transfer_workflow() {
         .send()
         .await
         .unwrap();
-    assert_eq!(res.status(), reqwest::StatusCode::TEMPORARY_REDIRECT);
+    assert_eq!(res.status(), reqwest::StatusCode::MOVED_PERMANENTLY);
     assert_eq!(
         res.headers().get("location").unwrap().to_str().unwrap(),
         "https://yahoo.com"

tests/concurrency_tests.rs

@@ -30,7 +30,7 @@ async fn test_concurrent_slug_creation() {
     let task1 = tokio::spawn(async move {
         let conn = rusqlite::Connection::open(&path1).unwrap();
         b1.wait().await;
-        bzod::db::users::register_global_slug(&conn, "!conc-slug", 10, "url", "url10")
+        bzod::db::users::register_global_slug(&conn, "!conc-slug", 10, "url", "url10", "active")
     });
 
     let b2 = barrier.clone();
@@ -38,7 +38,7 @@ async fn test_concurrent_slug_creation() {
     let task2 = tokio::spawn(async move {
         let conn = rusqlite::Connection::open(&path2).unwrap();
         b2.wait().await;
-        bzod::db::users::register_global_slug(&conn, "!conc-slug", 20, "url", "url20")
+        bzod::db::users::register_global_slug(&conn, "!conc-slug", 20, "url", "url20", "active")
     });
 
     let res1 = task1.await.unwrap();

tests/integrity_tests.rs

@@ -58,8 +58,15 @@ async fn test_global_slug_index_consistency() {
     // Register globally
     {
         let system_conn = db.system.lock().unwrap();
-        bzod::db::users::register_global_slug(&system_conn, "!integ-slug", user_id, "url", &url_id)
-            .unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!integ-slug",
+            user_id,
+            "url",
+            &url_id,
+            "active",
+        )
+        .unwrap();
     }
 
     // Consistency Check:

tests/moderation_tests.rs

@@ -25,7 +25,8 @@ async fn test_content_flagging_and_disabling() {
     let system_conn = db.system.lock().unwrap();
 
     // Register slug
-    bzod::db::users::register_global_slug(&system_conn, "!badslug", 10, "url", "url_abc").unwrap();
+    bzod::db::users::register_global_slug(&system_conn, "!badslug", 10, "url", "url_abc", "active")
+        .unwrap();
 
     // Verify it is active initially
     let status: String = system_conn

tests/ownership_tests.rs

@@ -0,0 +1,226 @@
+use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+use std::time::Instant;
+use tokio::net::TcpListener;
+
+use bzod::analytics::AnalyticsQueue;
+use bzod::config::Config;
+use bzod::db::Db;
+use bzod::state::AppState;
+use bzod::web::create_router;
+
+fn compute_sha256(value: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn create_temp_config(temp_dir: PathBuf) -> Config {
+    let mut config = Config::load();
+    config.data_dir = temp_dir.clone();
+    config.backup_dir = temp_dir.clone();
+    config.admin_username = "admin".to_string();
+    config.base_url = Some("http://localhost:8080".to_string());
+    config.cookie_secure = false;
+    config.bootstrap_password_sha256 = compute_sha256("bootstrap-secret");
+    config
+}
+
+fn extract_csrf_token(html: &str) -> Option<String> {
+    let marker = "name=\"csrf_token\" value=\"";
+    if let Some(pos) = html.find(marker) {
+        let start = pos + marker.len();
+        if let Some(end) = html[start..].find('"') {
+            return Some(html[start..start + end].to_string());
+        }
+    }
+    None
+}
+
+async fn start_test_server(
+    temp_dir: PathBuf,
+) -> (reqwest::Client, String, tokio::task::JoinHandle<()>, Db) {
+    let config = create_temp_config(temp_dir);
+    let db = Db::init(&config).expect("Failed to init Db");
+    let queue = AnalyticsQueue::new(db.clone(), 100);
+
+    let state = AppState {
+        admin_db: db.admin.clone(),
+        content_db: db.content.clone(),
+        analytics_db: db.analytics.clone(),
+        system_db: db.system.clone(),
+        users_db: db.users.clone(),
+        user_dbs: std::sync::Arc::new(std::sync::Mutex::new(HashMap::new())),
+        db: db.clone(),
+        config,
+        analytics_queue: queue,
+        start_time: Instant::now(),
+    };
+
+    let router = create_router(state);
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let url = format!("http://{}", addr);
+
+    let handle = tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    });
+
+    let client = reqwest::Client::builder()
+        .cookie_store(true)
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+
+    (client, url, handle, db)
+}
+
+#[tokio::test]
+async fn test_ownership_isolation_endpoints() {
+    let temp_dir =
+        std::env::temp_dir().join(format!("bzod_ownership_test_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let (client, base_url, _server_handle, db) = start_test_server(temp_dir.clone()).await;
+
+    // Create User A
+    let _ = bzod::cli::create_user::run(
+        Some("usera".to_string()),
+        Some("password123".to_string()),
+        None,
+        create_temp_config(temp_dir.clone()),
+    )
+    .await
+    .unwrap();
+
+    // Create User B
+    let _ = bzod::cli::create_user::run(
+        Some("userb".to_string()),
+        Some("password123".to_string()),
+        None,
+        create_temp_config(temp_dir.clone()),
+    )
+    .await
+    .unwrap();
+
+    let (id_a, _id_b) = {
+        let conn = db.users.lock().unwrap();
+        let a = bzod::db::users::get_user_by_username(&conn, "usera")
+            .unwrap()
+            .unwrap()
+            .id;
+        let b = bzod::db::users::get_user_by_username(&conn, "userb")
+            .unwrap()
+            .unwrap()
+            .id;
+        (a, b)
+    };
+
+    // User A adds a URL
+    let urla_id = {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let url = bzod::db::content::create_url_extended(
+            &conn_a,
+            "!usera-slug",
+            "https://usera.com",
+            None,
+            None,
+            &vec![],
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!usera-slug",
+            id_a,
+            "url",
+            &url.id,
+            "active",
+        )
+        .unwrap();
+        url.id
+    };
+
+    // User A adds a Landing Page
+    let pagea_id = {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let page = bzod::db::content::create_landing_page(
+            &conn_a,
+            "!usera-page",
+            "usera-page",
+            "Title A",
+            "<html></html>",
+            "published",
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!usera-page",
+            id_a,
+            "page",
+            &page.id,
+            "active",
+        )
+        .unwrap();
+        page.id
+    };
+
+    // 1. Log in as User B
+    let login_url = format!("{}/login", base_url);
+    let res = client.get(&login_url).send().await.unwrap();
+    let html = res.text().await.unwrap();
+    let csrf_token = extract_csrf_token(&html).unwrap();
+
+    let mut login_params = HashMap::new();
+    login_params.insert("username", "userb");
+    login_params.insert("password", "password123");
+    login_params.insert("csrf_token", &csrf_token);
+
+    let res = client
+        .post(&login_url)
+        .form(&login_params)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::SEE_OTHER); // Redirects after login
+
+    // 2. User B tries to view User A's URL analytics -> 403 Forbidden
+    let url_analytics_url = format!("{}/user/analytics/url/{}", base_url, urla_id);
+    let res = client.get(&url_analytics_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // 3. User B tries to view User A's Page analytics -> 403 Forbidden
+    let page_analytics_url = format!("{}/user/analytics/page/{}", base_url, pagea_id);
+    let res = client.get(&page_analytics_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // 4. User B tries to export CSV of User A's URL analytics -> 403 Forbidden
+    let csv_export_url = format!("{}/user/analytics/url/{}/export/csv", base_url, urla_id);
+    let res = client.get(&csv_export_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // 5. User B tries to export JSON of User A's URL analytics -> 403 Forbidden
+    let json_export_url = format!("{}/user/analytics/url/{}/export/json", base_url, urla_id);
+    let res = client.get(&json_export_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // 6. User B tries to export CSV of User A's Page analytics -> 403 Forbidden
+    let csv_page_export_url = format!("{}/user/analytics/page/{}/export/csv", base_url, pagea_id);
+    let res = client.get(&csv_page_export_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // 7. User B tries to export JSON of User A's Page analytics -> 403 Forbidden
+    let json_page_export_url = format!("{}/user/analytics/page/{}/export/json", base_url, pagea_id);
+    let res = client.get(&json_page_export_url).send().await.unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::FORBIDDEN);
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}

tests/qr_endpoint_tests.rs

@@ -0,0 +1,300 @@
+use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+use std::fs;
+use std::path::PathBuf;
+use std::time::Instant;
+use tokio::net::TcpListener;
+
+use bzod::analytics::AnalyticsQueue;
+use bzod::config::Config;
+use bzod::db::Db;
+use bzod::state::AppState;
+use bzod::web::create_router;
+
+fn compute_sha256(value: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn create_temp_config(temp_dir: PathBuf) -> Config {
+    let mut config = Config::load();
+    config.data_dir = temp_dir.clone();
+    config.backup_dir = temp_dir.clone();
+    config.admin_username = "admin".to_string();
+    config.base_url = Some("http://localhost:8080".to_string());
+    config.cookie_secure = false;
+    config.bootstrap_password_sha256 = compute_sha256("bootstrap-secret");
+    config
+}
+
+async fn start_test_server(
+    temp_dir: PathBuf,
+) -> (reqwest::Client, String, tokio::task::JoinHandle<()>, Db) {
+    let config = create_temp_config(temp_dir);
+    let db = Db::init(&config).expect("Failed to init Db");
+    let queue = AnalyticsQueue::new(db.clone(), 100);
+
+    let state = AppState {
+        admin_db: db.admin.clone(),
+        content_db: db.content.clone(),
+        analytics_db: db.analytics.clone(),
+        system_db: db.system.clone(),
+        users_db: db.users.clone(),
+        user_dbs: std::sync::Arc::new(std::sync::Mutex::new(HashMap::new())),
+        db: db.clone(),
+        config,
+        analytics_queue: queue,
+        start_time: Instant::now(),
+    };
+
+    let router = create_router(state);
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let url = format!("http://{}", addr);
+
+    let handle = tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    });
+
+    let client = reqwest::Client::builder()
+        .cookie_store(true)
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+
+    (client, url, handle, db)
+}
+
+#[tokio::test]
+async fn test_qr_endpoints_and_redirection_hardening() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_qr_test_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+
+    let (client, base_url, _server_handle, db) = start_test_server(temp_dir.clone()).await;
+
+    // Create User A
+    let _ = bzod::cli::create_user::run(
+        Some("usera".to_string()),
+        Some("password123".to_string()),
+        None,
+        create_temp_config(temp_dir.clone()),
+    )
+    .await
+    .unwrap();
+
+    let id_a = {
+        let conn = db.users.lock().unwrap();
+        bzod::db::users::get_user_by_username(&conn, "usera")
+            .unwrap()
+            .unwrap()
+            .id
+    };
+
+    // User A adds an active URL
+    {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let url = bzod::db::content::create_url_extended(
+            &conn_a,
+            "a1b2c3",
+            "https://active.com",
+            Some("active-url-title"),
+            None,
+            &vec![],
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "a1b2c3",
+            id_a,
+            "url",
+            &url.id,
+            "active",
+        )
+        .unwrap();
+    }
+
+    // User A adds a disabled URL
+    {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let url = bzod::db::content::create_url_extended(
+            &conn_a,
+            "d4e5f6",
+            "https://disabled.com",
+            Some("disabled-url-title"),
+            None,
+            &vec![],
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "d4e5f6",
+            id_a,
+            "url",
+            &url.id,
+            "disabled",
+        )
+        .unwrap();
+    }
+
+    // User A adds an active Page
+    {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let page = bzod::db::content::create_landing_page(
+            &conn_a,
+            "a1b2",
+            "active-page",
+            "Active Page",
+            "<html></html>",
+            "published",
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "a1b2",
+            id_a,
+            "page",
+            &page.id,
+            "active",
+        )
+        .unwrap();
+    }
+
+    // User A adds a disabled Page
+    {
+        let conn_a = bzod::jobs::open_user_content_conn(&db, id_a).unwrap();
+        let page = bzod::db::content::create_landing_page(
+            &conn_a,
+            "c3d4",
+            "disabled-page",
+            "Disabled Page",
+            "<html></html>",
+            "draft",
+        )
+        .unwrap();
+
+        let system_conn = db.system.lock().unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "c3d4",
+            id_a,
+            "page",
+            &page.id,
+            "disabled",
+        )
+        .unwrap();
+    }
+
+    // 1. Verify Active URL QR endpoints return 200 with correct content types
+    let res = client
+        .get(format!("{}/api/qr/a1b2c3.png", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    assert_eq!(
+        res.headers().get("content-type").unwrap().to_str().unwrap(),
+        "image/png"
+    );
+
+    let res = client
+        .get(format!("{}/api/qr/a1b2c3.svg", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+    assert_eq!(
+        res.headers().get("content-type").unwrap().to_str().unwrap(),
+        "image/svg+xml"
+    );
+
+    // 2. Verify Disabled URL redirect returns 410 Gone
+    let res = client
+        .get(format!("{}/a1b2c3", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::MOVED_PERMANENTLY); // Redirects to destination
+
+    let res = client
+        .get(format!("{}/d4e5f6", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    // 3. Verify Disabled URL QR endpoints return 410 Gone
+    let res = client
+        .get(format!("{}/api/qr/d4e5f6.png", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    let res = client
+        .get(format!("{}/api/qr/d4e5f6.svg", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    // 4. Verify Active Page QR endpoints return 200
+    let res = client
+        .get(format!("{}/api/qr/a1b2.png", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+
+    let res = client
+        .get(format!("{}/api/qr/a1b2.svg", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::OK);
+
+    // 5. Verify Disabled Page redirection returns 410 Gone
+    let res = client
+        .get(format!("{}/p/c3d4", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    // 6. Verify Disabled Page QR endpoints return 410 Gone
+    let res = client
+        .get(format!("{}/api/qr/c3d4.png", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    let res = client
+        .get(format!("{}/api/qr/c3d4.svg", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::GONE);
+
+    // 7. Verify Missing URL/Page QR endpoints return 404 Not Found
+    let res = client
+        .get(format!("{}/api/qr/missing-slug.png", base_url))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), reqwest::StatusCode::NOT_FOUND);
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}

tests/routing_tests.rs

@@ -80,6 +80,7 @@ async fn test_global_slug_lookup_and_redirection() {
             user_id,
             "url",
             "xyz",
+            "active",
         )
         .unwrap();
     }
@@ -173,6 +174,7 @@ async fn test_disabled_slug_returns_410() {
             user_id,
             "url",
             "xyz",
+            "active",
         )
         .unwrap();
 

tests/slug_namespace_tests.rs

@@ -23,7 +23,8 @@ async fn test_global_slug_uniqueness() {
     let system_conn = db.system.lock().unwrap();
 
     // Register a slug
-    bzod::db::users::register_global_slug(&system_conn, "!myslug", 1, "url", "url1").unwrap();
+    bzod::db::users::register_global_slug(&system_conn, "!myslug", 1, "url", "url1", "active")
+        .unwrap();
 
     // Verify it is not available
     let avail = bzod::db::users::is_slug_available(&system_conn, "!myslug").unwrap();
@@ -113,6 +114,7 @@ async fn test_slug_release_on_user_deletion() {
             user_id,
             "url",
             "url_xyz",
+            "active",
         )
         .unwrap();
         let avail = bzod::db::users::is_slug_available(&system_conn, "!user-slug").unwrap();

tests/slug_registry_tests.rs

@@ -0,0 +1,242 @@
+use bzod::config::Config;
+use bzod::db::Db;
+use std::fs;
+use std::path::PathBuf;
+
+fn create_temp_config(temp_dir: PathBuf) -> Config {
+    let mut config = Config::load();
+    config.data_dir = temp_dir.clone();
+    config.backup_dir = temp_dir.clone();
+    config.base_url = Some("http://bzo.in".to_string());
+    config
+}
+
+#[tokio::test]
+async fn test_admin_url_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_1_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 1, "url", "url1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        1,
+        "url",
+        "url2",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_admin_page_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_2_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 1, "page", "page1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        1,
+        "page",
+        "page2",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_user_url_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_3_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 2, "url", "url1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        2,
+        "url",
+        "url2",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_user_page_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_4_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 2, "page", "page1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        2,
+        "page",
+        "page2",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_url_page_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_5_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 1, "url", "url1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        1,
+        "page",
+        "page1",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_page_url_slug_collision_rejected() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_6_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "collision", 1, "page", "page1", "active")
+        .unwrap();
+    let res = bzod::db::users::register_global_slug(
+        &system_conn,
+        "collision",
+        1,
+        "url",
+        "url1",
+        "active",
+    );
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_slug_reusable_after_delete() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_7_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "slug", 1, "url", "url1", "active")
+        .unwrap();
+    assert!(!bzod::db::users::is_slug_available(&system_conn, "slug").unwrap());
+
+    bzod::db::users::release_global_slug(&system_conn, "slug", 1).unwrap();
+    assert!(bzod::db::users::is_slug_available(&system_conn, "slug").unwrap());
+
+    bzod::db::users::register_global_slug(&system_conn, "slug", 1, "page", "page1", "active")
+        .unwrap();
+    assert!(!bzod::db::users::is_slug_available(&system_conn, "slug").unwrap());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_disabled_slug_still_blocks_registration() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_8_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "slug", 1, "url", "url1", "disabled")
+        .unwrap();
+    assert!(!bzod::db::users::is_slug_available(&system_conn, "slug").unwrap());
+
+    let res =
+        bzod::db::users::register_global_slug(&system_conn, "slug", 2, "page", "page1", "active");
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_transferred_slug_remains_unique() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_9_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "slug", 1, "url", "url1", "active")
+        .unwrap();
+    assert!(!bzod::db::users::is_slug_available(&system_conn, "slug").unwrap());
+
+    // Transfer slug (by setting owner_user_id to 2)
+    system_conn
+        .execute(
+            "UPDATE global_slugs SET owner_user_id = 2 WHERE slug = 'slug'",
+            [],
+        )
+        .unwrap();
+
+    let res =
+        bzod::db::users::register_global_slug(&system_conn, "slug", 1, "url", "url2", "active");
+    assert!(res.is_err());
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_transfer_preserves_global_slug_record() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_test_col_10_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+    let system_conn = db.system.lock().unwrap();
+
+    bzod::db::users::register_global_slug(&system_conn, "slug", 1, "url", "url1", "active")
+        .unwrap();
+
+    // Verify it exists in global_slugs
+    let owner_id: i64 = system_conn
+        .query_row(
+            "SELECT owner_user_id FROM global_slugs WHERE slug = 'slug'",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert_eq!(owner_id, 1);
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}

tests/slug_transfer_tests.rs

@@ -72,8 +72,15 @@ async fn test_slug_transfer() {
     // Register globally
     {
         let system_conn = db.system.lock().unwrap();
-        bzod::db::users::register_global_slug(&system_conn, "!trans-slug", id_a, "url", &url.id)
-            .unwrap();
+        bzod::db::users::register_global_slug(
+            &system_conn,
+            "!trans-slug",
+            id_a,
+            "url",
+            &url.id,
+            "active",
+        )
+        .unwrap();
 
         let users_conn = db.users.lock().unwrap();
         bzod::db::users::increment_quota_counter(&users_conn, id_a, "urls").unwrap();

tests/soft_delete_tests.rs

@@ -22,8 +22,15 @@ async fn test_soft_delete_reserves_slug() {
     let system_conn = db.system.lock().unwrap();
 
     // Register slug
-    bzod::db::users::register_global_slug(&system_conn, "!slug-to-delete", 10, "url", "url_123")
-        .unwrap();
+    bzod::db::users::register_global_slug(
+        &system_conn,
+        "!slug-to-delete",
+        10,
+        "url",
+        "url_123",
+        "active",
+    )
+    .unwrap();
 
     // Soft delete slug
     bzod::db::users::soft_delete_global_slug(&system_conn, "!slug-to-delete", 10).unwrap();
@@ -39,7 +46,7 @@ async fn test_soft_delete_reserves_slug() {
             |row| row.get(0),
         )
         .unwrap();
-    assert_eq!(status, "soft_deleted");
+    assert_eq!(status, "disabled");
 
     let _ = fs::remove_dir_all(&temp_dir);
 }
@@ -55,8 +62,15 @@ async fn test_permanent_delete_releases_slug() {
     let system_conn = db.system.lock().unwrap();
 
     // Register slug
-    bzod::db::users::register_global_slug(&system_conn, "!slug-to-purge", 10, "url", "url_456")
-        .unwrap();
+    bzod::db::users::register_global_slug(
+        &system_conn,
+        "!slug-to-purge",
+        10,
+        "url",
+        "url_456",
+        "active",
+    )
+    .unwrap();
 
     // Release global slug (permanent deletion)
     bzod::db::users::release_global_slug(&system_conn, "!slug-to-purge", 10).unwrap();

tests/transaction_tests.rs

@@ -0,0 +1,90 @@
+use bzod::config::Config;
+use bzod::db::Db;
+use std::fs;
+use std::path::PathBuf;
+
+fn create_temp_config(temp_dir: PathBuf) -> Config {
+    let mut config = Config::load();
+    config.data_dir = temp_dir.clone();
+    config.backup_dir = temp_dir.clone();
+    config.base_url = Some("http://bzo.in".to_string());
+    config
+}
+
+#[tokio::test]
+async fn test_cleanup_stale_reservations() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_tx_test_1_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+
+    let system_conn = db.system.lock().unwrap();
+
+    // Insert a reserving slug older than 15 minutes (e.g. 20 minutes ago)
+    let old_time = (chrono::Utc::now() - chrono::Duration::minutes(20)).to_rfc3339();
+    system_conn.execute(
+        "INSERT INTO global_slugs (slug, owner_user_id, target_type, target_id, created_at, updated_at, status)
+         VALUES ('stale-slug', 2, 'url', '', ?1, ?1, 'reserving')",
+        [&old_time]
+    ).unwrap();
+
+    // Verify it exists before cleanup
+    let exists: bool = system_conn
+        .query_row(
+            "SELECT EXISTS(SELECT 1 FROM global_slugs WHERE slug = 'stale-slug')",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert!(exists);
+
+    // Run cleanup
+    let cleaned = bzod::db::users::cleanup_stale_reservations(&system_conn, &temp_dir).unwrap();
+    assert_eq!(cleaned, 1);
+
+    // Verify it is gone
+    let exists: bool = system_conn
+        .query_row(
+            "SELECT EXISTS(SELECT 1 FROM global_slugs WHERE slug = 'stale-slug')",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert!(!exists);
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}
+
+#[tokio::test]
+async fn test_cleanup_preserves_valid_reservations() {
+    let temp_dir = std::env::temp_dir().join(format!("bzod_tx_test_2_{}", uuid::Uuid::new_v4()));
+    fs::create_dir_all(&temp_dir).unwrap();
+    let config = create_temp_config(temp_dir.clone());
+    let db = Db::init(&config).expect("Failed to init Db");
+
+    let system_conn = db.system.lock().unwrap();
+
+    // Insert a reserving slug that is brand new (e.g. 1 minute ago)
+    let new_time = (chrono::Utc::now() - chrono::Duration::minutes(1)).to_rfc3339();
+    system_conn.execute(
+        "INSERT INTO global_slugs (slug, owner_user_id, target_type, target_id, created_at, updated_at, status)
+         VALUES ('fresh-slug', 2, 'url', '', ?1, ?1, 'reserving')",
+        [&new_time]
+    ).unwrap();
+
+    // Run cleanup
+    let cleaned = bzod::db::users::cleanup_stale_reservations(&system_conn, &temp_dir).unwrap();
+    assert_eq!(cleaned, 0);
+
+    // Verify it is still there
+    let exists: bool = system_conn
+        .query_row(
+            "SELECT EXISTS(SELECT 1 FROM global_slugs WHERE slug = 'fresh-slug')",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert!(exists);
+
+    let _ = fs::remove_dir_all(&temp_dir);
+}