Merge pull request #15 from shortmesh/staging

Staging

Author: PromiseFru

Makefile

@@ -43,18 +43,6 @@ format:
 	@echo "Running go fmt..."
 	@go fmt ./... || echo "WARNING: go fmt encountered issues (continuing...)"
 	@echo ""
-	@echo "Running prettier on HTML, CSS, JS..."
-	@if command -v npx >/dev/null 2>&1; then \
-		echo "Formatting HTML files..."; \
-		find ./internal/admin/web -name "*.html" -type f -exec npx prettier --write {} \; 2>/dev/null || echo "WARNING: prettier HTML formatting encountered issues (continuing...)"; \
-		echo "Formatting CSS files..."; \
-		find ./internal/admin/web -name "*.css" -type f -exec npx prettier --write {} \; 2>/dev/null || echo "WARNING: prettier CSS formatting encountered issues (continuing...)"; \
-		echo "Formatting JS files..."; \
-		find ./internal/admin/web -name "*.js" -type f -exec npx prettier --write {} \; 2>/dev/null || echo "WARNING: prettier JS formatting encountered issues (continuing...)"; \
-	else \
-		echo "WARNING: npx not found. Install Node.js to use prettier"; \
-	fi
-	@echo ""
 	@echo "Running swag fmt..."
 	@which swag > /dev/null && swag fmt 2>/dev/null || echo "WARNING: swag fmt encountered issues (continuing...)"
 	@echo ""

cmd/api/main.go

@@ -29,6 +29,11 @@ import (
 
 //	@securityDefinitions.basic	BasicAuth
 
+//	@securityDefinitions.apikey	CookieAuth
+//	@in							cookie
+//	@name						shortmesh_admin_token
+//	@description				Admin session cookie authentication
+
 func gracefulShutdown(apiServer *http.Server, w *worker.Worker, cw *cleanup.CleanupWorker, ww *webhookworker.WebhookWorker, done chan bool) {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
@@ -64,6 +69,11 @@ func gracefulShutdown(apiServer *http.Server, w *worker.Worker, cw *cleanup.Clea
 func main() {
 	db := database.New()
 
+	if err := database.InitializeSuperAdminCredentials(db.DB()); err != nil {
+		logger.Error(fmt.Sprintf("Credential initialization failed: %v", err))
+		os.Exit(1)
+	}
+
 	var w *worker.Worker
 	if worker.IsEnabled() {
 		w = worker.New()

docs/USAGE.md

@@ -17,8 +17,8 @@ See [SECURITY.md](./SECURITY.md) for production configuration.
 
 ## Authentication
 
-- **Token Creation** - Basic Auth with `CLIENT_ID:CLIENT_SECRET`
-- **Device Operations** - Bearer Auth with Matrix token (`mt_xxxxx`)
+- **Token/Credential Management** - Basic Auth with `CLIENT_ID:CLIENT_SECRET`
+- **Device/Webhook Operations** - Bearer Auth with Matrix token (`mt_xxxxx`)
 
 ## Token Management
 
@@ -127,6 +127,8 @@ curl -X GET http://localhost:8080/api/v1/devices \
 
 ### Send Message
 
+#### Text Only (JSON)
+
 ```bash
 curl -X POST http://localhost:8080/api/v1/devices/237123456789/message \
   -H "Authorization: Bearer $TOKEN" \
@@ -138,6 +140,19 @@ curl -X POST http://localhost:8080/api/v1/devices/237123456789/message \
   }'
 ```
 
+#### Text + File (Multipart)
+
+```bash
+curl -X POST http://localhost:8080/api/v1/devices/237123456789/message \
+  -H "Authorization: Bearer $TOKEN" \
+  -F "contact=1234567890" \
+  -F "platform=wa" \
+  -F "text=Check out this document" \
+  -F "file=@/path/to/document.pdf"
+```
+
+File must have an extension.
+
 ### Delete Device
 
 ```bash
@@ -150,6 +165,109 @@ curl -X DELETE http://localhost:8080/api/v1/devices \
   }'
 ```
 
+## Webhooks
+
+Receive incoming message notifications via HTTP POST.
+
+### Add Webhook
+
+```bash
+curl -X POST http://localhost:8080/api/v1/webhooks \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"url": "https://your-server.com/webhook"}'
+```
+
+**Response:**
+
+```json
+{
+  "id": 1,
+  "url": "https://your-server.com/webhook",
+  "active": true,
+  "created_at": "2026-04-27T10:00:00Z",
+  "updated_at": "2026-04-27T10:00:00Z"
+}
+```
+
+### List Webhooks
+
+```bash
+curl -X GET http://localhost:8080/api/v1/webhooks \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+### Update Webhook
+
+```bash
+curl -X PUT http://localhost:8080/api/v1/webhooks/1 \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"url": "https://new-url.com/webhook", "active": false}'
+```
+
+Fields are optional. Omit to keep current value.
+
+### Delete Webhook
+
+```bash
+curl -X DELETE http://localhost:8080/api/v1/webhooks/1 \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+## Credentials (Admin Only)
+
+Manage API client credentials. Requires Basic Auth with admin credentials.
+
+### Create Credential
+
+```bash
+curl -X POST http://localhost:8080/api/v1/credentials \
+  -u "$CLIENT_ID:$CLIENT_SECRET" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "client_id": "my-app",
+    "description": "Production API client"
+  }'
+```
+
+**Response:**
+
+```json
+{
+  "message": "Credential created successfully",
+  "credential": {
+    "client_id": "my-app",
+    "role": "user",
+    "scopes": [],
+    "description": "Production API client",
+    "active": true,
+    "created_at": "2026-04-27T10:00:00Z",
+    "updated_at": "2026-04-27T10:00:00Z"
+  },
+  "client_secret": "xxxxxxxxxxxx"
+}
+```
+
+> [!IMPORTANT]
+> Save `client_secret` immediately. It's only shown once.
+
+### List Credentials
+
+```bash
+curl -X GET http://localhost:8080/api/v1/credentials \
+  -u "$CLIENT_ID:$CLIENT_SECRET"
+```
+
+### Delete Credential
+
+```bash
+curl -X DELETE http://localhost:8080/api/v1/credentials/my-app \
+  -u "$CLIENT_ID:$CLIENT_SECRET"
+```
+
+Cannot delete super admin credentials.
+
 ## API Reference
 
 Swagger UI: **<http://localhost:8080/docs/index.html>**