Rename root folders

server/internal/handlers/admin_handlers.go

@@ -0,0 +1,294 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"novamd/internal/db"
+	"novamd/internal/filesystem"
+	"novamd/internal/httpcontext"
+	"novamd/internal/models"
+	"strconv"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type createUserRequest struct {
+	Email       string          `json:"email"`
+	DisplayName string          `json:"displayName"`
+	Password    string          `json:"password"`
+	Role        models.UserRole `json:"role"`
+}
+
+type updateUserRequest struct {
+	Email       string          `json:"email,omitempty"`
+	DisplayName string          `json:"displayName,omitempty"`
+	Password    string          `json:"password,omitempty"`
+	Role        models.UserRole `json:"role,omitempty"`
+}
+
+// AdminListUsers returns a list of all users
+func (h *Handler) AdminListUsers() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		users, err := h.DB.GetAllUsers()
+		if err != nil {
+			http.Error(w, "Failed to list users", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, users)
+	}
+}
+
+// AdminCreateUser creates a new user
+func (h *Handler) AdminCreateUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req createUserRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Validate request
+		if req.Email == "" || req.Password == "" || req.Role == "" {
+			http.Error(w, "Email, password, and role are required", http.StatusBadRequest)
+			return
+		}
+
+		// Check if email already exists
+		existingUser, err := h.DB.GetUserByEmail(req.Email)
+		if err == nil && existingUser != nil {
+			http.Error(w, "Email already exists", http.StatusConflict)
+			return
+		}
+
+		// Check if password is long enough
+		if len(req.Password) < 8 {
+			http.Error(w, "Password must be at least 8 characters", http.StatusBadRequest)
+			return
+		}
+
+		// Hash password
+		hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+		if err != nil {
+			http.Error(w, "Failed to hash password", http.StatusInternalServerError)
+			return
+		}
+
+		// Create user
+		user := &models.User{
+			Email:        req.Email,
+			DisplayName:  req.DisplayName,
+			PasswordHash: string(hashedPassword),
+			Role:         req.Role,
+		}
+
+		insertedUser, err := h.DB.CreateUser(user)
+		if err != nil {
+			http.Error(w, "Failed to create user", http.StatusInternalServerError)
+			return
+		}
+
+		// Initialize user workspace
+		if err := h.FS.InitializeUserWorkspace(insertedUser.ID, insertedUser.LastWorkspaceID); err != nil {
+			http.Error(w, "Failed to initialize user workspace", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, insertedUser)
+	}
+}
+
+// AdminGetUser gets a specific user by ID
+func (h *Handler) AdminGetUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		userID, err := strconv.Atoi(chi.URLParam(r, "userId"))
+		if err != nil {
+			http.Error(w, "Invalid user ID", http.StatusBadRequest)
+			return
+		}
+
+		user, err := h.DB.GetUserByID(userID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		respondJSON(w, user)
+	}
+}
+
+// AdminUpdateUser updates a specific user
+func (h *Handler) AdminUpdateUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		userID, err := strconv.Atoi(chi.URLParam(r, "userId"))
+		if err != nil {
+			http.Error(w, "Invalid user ID", http.StatusBadRequest)
+			return
+		}
+
+		// Get existing user
+		user, err := h.DB.GetUserByID(userID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		var req updateUserRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Update fields if provided
+		if req.Email != "" {
+			user.Email = req.Email
+		}
+		if req.DisplayName != "" {
+			user.DisplayName = req.DisplayName
+		}
+		if req.Role != "" {
+			user.Role = req.Role
+		}
+		if req.Password != "" {
+			hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+			if err != nil {
+				http.Error(w, "Failed to hash password", http.StatusInternalServerError)
+				return
+			}
+			user.PasswordHash = string(hashedPassword)
+		}
+
+		if err := h.DB.UpdateUser(user); err != nil {
+			http.Error(w, "Failed to update user", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, user)
+	}
+}
+
+// AdminDeleteUser deletes a specific user
+func (h *Handler) AdminDeleteUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		userID, err := strconv.Atoi(chi.URLParam(r, "userId"))
+		if err != nil {
+			http.Error(w, "Invalid user ID", http.StatusBadRequest)
+			return
+		}
+
+		// Prevent admin from deleting themselves
+		if userID == ctx.UserID {
+			http.Error(w, "Cannot delete your own account", http.StatusBadRequest)
+			return
+		}
+
+		// Get user before deletion to check role
+		user, err := h.DB.GetUserByID(userID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		// Prevent deletion of other admin users
+		if user.Role == models.RoleAdmin && ctx.UserID != userID {
+			http.Error(w, "Cannot delete other admin users", http.StatusForbidden)
+			return
+		}
+
+		if err := h.DB.DeleteUser(userID); err != nil {
+			http.Error(w, "Failed to delete user", http.StatusInternalServerError)
+			return
+		}
+
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// WorkspaceStats holds workspace statistics
+type WorkspaceStats struct {
+	UserID             int       `json:"userID"`
+	UserEmail          string    `json:"userEmail"`
+	WorkspaceID        int       `json:"workspaceID"`
+	WorkspaceName      string    `json:"workspaceName"`
+	WorkspaceCreatedAt time.Time `json:"workspaceCreatedAt"`
+	*filesystem.FileCountStats
+}
+
+// AdminListWorkspaces returns a list of all workspaces and their stats
+func (h *Handler) AdminListWorkspaces() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		workspaces, err := h.DB.GetAllWorkspaces()
+		if err != nil {
+			http.Error(w, "Failed to list workspaces", http.StatusInternalServerError)
+			return
+		}
+
+		workspacesStats := make([]*WorkspaceStats, 0, len(workspaces))
+
+		for _, ws := range workspaces {
+
+			workspaceData := &WorkspaceStats{}
+
+			user, err := h.DB.GetUserByID(ws.UserID)
+			if err != nil {
+				http.Error(w, "Failed to get user", http.StatusInternalServerError)
+				return
+			}
+
+			workspaceData.UserID = ws.UserID
+			workspaceData.UserEmail = user.Email
+			workspaceData.WorkspaceID = ws.ID
+			workspaceData.WorkspaceName = ws.Name
+			workspaceData.WorkspaceCreatedAt = ws.CreatedAt
+
+			fileStats, err := h.FS.GetFileStats(ws.UserID, ws.ID)
+			if err != nil {
+				http.Error(w, "Failed to get file stats", http.StatusInternalServerError)
+				return
+			}
+
+			workspaceData.FileCountStats = fileStats
+
+			workspacesStats = append(workspacesStats, workspaceData)
+		}
+
+		respondJSON(w, workspacesStats)
+	}
+}
+
+// SystemStats holds system-wide statistics
+type SystemStats struct {
+	*db.UserStats
+	*filesystem.FileCountStats
+}
+
+// AdminGetSystemStats returns system-wide statistics for admins
+func (h *Handler) AdminGetSystemStats() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		userStats, err := h.DB.GetSystemStats()
+		if err != nil {
+			http.Error(w, "Failed to get user stats", http.StatusInternalServerError)
+			return
+		}
+
+		fileStats, err := h.FS.GetTotalFileStats()
+		if err != nil {
+			http.Error(w, "Failed to get file stats", http.StatusInternalServerError)
+			return
+		}
+
+		stats := &SystemStats{
+			UserStats:      userStats,
+			FileCountStats: fileStats,
+		}
+
+		respondJSON(w, stats)
+	}
+}

server/internal/handlers/auth_handlers.go

@@ -0,0 +1,146 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"novamd/internal/auth"
+	"novamd/internal/httpcontext"
+	"novamd/internal/models"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+type LoginRequest struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+}
+
+type LoginResponse struct {
+	AccessToken  string        `json:"accessToken"`
+	RefreshToken string        `json:"refreshToken"`
+	User         *models.User  `json:"user"`
+	Session      *auth.Session `json:"session"`
+}
+
+type RefreshRequest struct {
+	RefreshToken string `json:"refreshToken"`
+}
+
+type RefreshResponse struct {
+	AccessToken string `json:"accessToken"`
+}
+
+// Login handles user authentication and returns JWT tokens
+func (h *Handler) Login(authService *auth.SessionService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req LoginRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Validate request
+		if req.Email == "" || req.Password == "" {
+			http.Error(w, "Email and password are required", http.StatusBadRequest)
+			return
+		}
+
+		// Get user from database
+		user, err := h.DB.GetUserByEmail(req.Email)
+		if err != nil {
+			http.Error(w, "Invalid credentials", http.StatusUnauthorized)
+			return
+		}
+
+		// Verify password
+		err = bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password))
+		if err != nil {
+			http.Error(w, "Invalid credentials", http.StatusUnauthorized)
+			return
+		}
+
+		// Create session and generate tokens
+		session, accessToken, err := authService.CreateSession(user.ID, string(user.Role))
+		if err != nil {
+			http.Error(w, "Failed to create session", http.StatusInternalServerError)
+			return
+		}
+
+		// Prepare response
+		response := LoginResponse{
+			AccessToken:  accessToken,
+			RefreshToken: session.RefreshToken,
+			User:         user,
+			Session:      session,
+		}
+
+		respondJSON(w, response)
+	}
+}
+
+// Logout invalidates the user's session
+func (h *Handler) Logout(authService *auth.SessionService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		sessionID := r.Header.Get("X-Session-ID")
+		if sessionID == "" {
+			http.Error(w, "Session ID required", http.StatusBadRequest)
+			return
+		}
+
+		err := authService.InvalidateSession(sessionID)
+		if err != nil {
+			http.Error(w, "Failed to logout", http.StatusInternalServerError)
+			return
+		}
+
+		w.WriteHeader(http.StatusOK)
+	}
+}
+
+// RefreshToken generates a new access token using a refresh token
+func (h *Handler) RefreshToken(authService *auth.SessionService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req RefreshRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		if req.RefreshToken == "" {
+			http.Error(w, "Refresh token required", http.StatusBadRequest)
+			return
+		}
+
+		// Generate new access token
+		accessToken, err := authService.RefreshSession(req.RefreshToken)
+		if err != nil {
+			http.Error(w, "Invalid refresh token", http.StatusUnauthorized)
+			return
+		}
+
+		response := RefreshResponse{
+			AccessToken: accessToken,
+		}
+
+		respondJSON(w, response)
+	}
+}
+
+// GetCurrentUser returns the currently authenticated user
+func (h *Handler) GetCurrentUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		// Get user from database
+		user, err := h.DB.GetUserByID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		respondJSON(w, user)
+	}
+}

server/internal/handlers/file_handlers.go

@@ -0,0 +1,168 @@
+package handlers
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+
+	"novamd/internal/httpcontext"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func (h *Handler) ListFiles() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		files, err := h.FS.ListFilesRecursively(ctx.UserID, ctx.Workspace.ID)
+		if err != nil {
+			http.Error(w, "Failed to list files", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, files)
+	}
+}
+
+func (h *Handler) LookupFileByName() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		filename := r.URL.Query().Get("filename")
+		if filename == "" {
+			http.Error(w, "Filename is required", http.StatusBadRequest)
+			return
+		}
+
+		filePaths, err := h.FS.FindFileByName(ctx.UserID, ctx.Workspace.ID, filename)
+		if err != nil {
+			http.Error(w, "File not found", http.StatusNotFound)
+			return
+		}
+
+		respondJSON(w, map[string][]string{"paths": filePaths})
+	}
+}
+
+func (h *Handler) GetFileContent() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		filePath := chi.URLParam(r, "*")
+		content, err := h.FS.GetFileContent(ctx.UserID, ctx.Workspace.ID, filePath)
+		if err != nil {
+			http.Error(w, "Failed to read file", http.StatusNotFound)
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/plain")
+		w.Write(content)
+	}
+}
+
+func (h *Handler) SaveFile() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		filePath := chi.URLParam(r, "*")
+		content, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, "Failed to read request body", http.StatusBadRequest)
+			return
+		}
+
+		err = h.FS.SaveFile(ctx.UserID, ctx.Workspace.ID, filePath, content)
+		if err != nil {
+			http.Error(w, "Failed to save file", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "File saved successfully"})
+	}
+}
+
+func (h *Handler) DeleteFile() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		filePath := chi.URLParam(r, "*")
+		err := h.FS.DeleteFile(ctx.UserID, ctx.Workspace.ID, filePath)
+		if err != nil {
+			http.Error(w, "Failed to delete file", http.StatusInternalServerError)
+			return
+		}
+
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("File deleted successfully"))
+	}
+}
+
+func (h *Handler) GetLastOpenedFile() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		filePath, err := h.DB.GetLastOpenedFile(ctx.Workspace.ID)
+		if err != nil {
+			http.Error(w, "Failed to get last opened file", http.StatusInternalServerError)
+			return
+		}
+
+		if _, err := h.FS.ValidatePath(ctx.UserID, ctx.Workspace.ID, filePath); err != nil {
+			http.Error(w, "Invalid file path", http.StatusBadRequest)
+			return
+		}
+
+		respondJSON(w, map[string]string{"lastOpenedFilePath": filePath})
+	}
+}
+
+func (h *Handler) UpdateLastOpenedFile() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var requestBody struct {
+			FilePath string `json:"filePath"`
+		}
+
+		if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Validate the file path exists in the workspace
+		if requestBody.FilePath != "" {
+			if _, err := h.FS.ValidatePath(ctx.UserID, ctx.Workspace.ID, requestBody.FilePath); err != nil {
+				http.Error(w, "Invalid file path", http.StatusBadRequest)
+				return
+			}
+		}
+
+		if err := h.DB.UpdateLastOpenedFile(ctx.Workspace.ID, requestBody.FilePath); err != nil {
+			http.Error(w, "Failed to update last opened file", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "Last opened file updated successfully"})
+	}
+}

server/internal/handlers/git_handlers.go

@@ -0,0 +1,56 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"novamd/internal/httpcontext"
+)
+
+func (h *Handler) StageCommitAndPush() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var requestBody struct {
+			Message string `json:"message"`
+		}
+
+		if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		if requestBody.Message == "" {
+			http.Error(w, "Commit message is required", http.StatusBadRequest)
+			return
+		}
+
+		err := h.FS.StageCommitAndPush(ctx.UserID, ctx.Workspace.ID, requestBody.Message)
+		if err != nil {
+			http.Error(w, "Failed to stage, commit, and push changes: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "Changes staged, committed, and pushed successfully"})
+	}
+}
+
+func (h *Handler) PullChanges() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		err := h.FS.Pull(ctx.UserID, ctx.Workspace.ID)
+		if err != nil {
+			http.Error(w, "Failed to pull changes: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "Pulled changes from remote"})
+	}
+}

server/internal/handlers/handlers.go

@@ -0,0 +1,30 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"novamd/internal/db"
+	"novamd/internal/filesystem"
+)
+
+// Handler provides common functionality for all handlers
+type Handler struct {
+	DB *db.DB
+	FS *filesystem.FileSystem
+}
+
+// NewHandler creates a new handler with the given dependencies
+func NewHandler(db *db.DB, fs *filesystem.FileSystem) *Handler {
+	return &Handler{
+		DB: db,
+		FS: fs,
+	}
+}
+
+// respondJSON is a helper to send JSON responses
+func respondJSON(w http.ResponseWriter, data interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(data); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}

server/internal/handlers/static_handler.go

@@ -0,0 +1,70 @@
+package handlers
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// StaticHandler serves static files with support for SPA routing and pre-compressed files
+type StaticHandler struct {
+	staticPath string
+}
+
+func NewStaticHandler(staticPath string) *StaticHandler {
+	return &StaticHandler{
+		staticPath: staticPath,
+	}
+}
+
+func (h *StaticHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Get the requested path
+	requestedPath := r.URL.Path
+	fullPath := filepath.Join(h.staticPath, requestedPath)
+	cleanPath := filepath.Clean(fullPath)
+
+	// Security check to prevent directory traversal
+	if !strings.HasPrefix(cleanPath, h.staticPath) {
+		http.Error(w, "Invalid path", http.StatusBadRequest)
+		return
+	}
+
+	// Set cache headers for assets
+	if strings.HasPrefix(requestedPath, "/assets/") {
+		w.Header().Set("Cache-Control", "public, max-age=31536000") // 1 year
+	}
+
+	// Check if file exists (not counting .gz files)
+	stat, err := os.Stat(cleanPath)
+	if err != nil || stat.IsDir() {
+		// Serve index.html for SPA routing
+		indexPath := filepath.Join(h.staticPath, "index.html")
+		http.ServeFile(w, r, indexPath)
+		return
+	}
+
+	// Check for pre-compressed version
+	if strings.Contains(r.Header.Get("Accept-Encoding"), "gzip") {
+		gzPath := cleanPath + ".gz"
+		if _, err := os.Stat(gzPath); err == nil {
+			w.Header().Set("Content-Encoding", "gzip")
+
+			// Set proper content type based on original file
+			switch filepath.Ext(cleanPath) {
+			case ".js":
+				w.Header().Set("Content-Type", "application/javascript")
+			case ".css":
+				w.Header().Set("Content-Type", "text/css")
+			case ".html":
+				w.Header().Set("Content-Type", "text/html")
+			}
+
+			http.ServeFile(w, r, gzPath)
+			return
+		}
+	}
+
+	// Serve original file
+	http.ServeFile(w, r, cleanPath)
+}

server/internal/handlers/user_handlers.go

@@ -0,0 +1,222 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"novamd/internal/httpcontext"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+type UpdateProfileRequest struct {
+	DisplayName     string `json:"displayName"`
+	Email           string `json:"email"`
+	CurrentPassword string `json:"currentPassword"`
+	NewPassword     string `json:"newPassword"`
+}
+
+type DeleteAccountRequest struct {
+	Password string `json:"password"`
+}
+
+func (h *Handler) GetUser() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		user, err := h.DB.GetUserByID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "Failed to get user", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, user)
+	}
+}
+
+// UpdateProfile updates the current user's profile
+func (h *Handler) UpdateProfile() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var req UpdateProfileRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Get current user
+		user, err := h.DB.GetUserByID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		// Start transaction for atomic updates
+		tx, err := h.DB.Begin()
+		if err != nil {
+			http.Error(w, "Failed to start transaction", http.StatusInternalServerError)
+			return
+		}
+		defer tx.Rollback()
+
+		// Handle password update if requested
+		if req.NewPassword != "" {
+			// Current password must be provided to change password
+			if req.CurrentPassword == "" {
+				http.Error(w, "Current password is required to change password", http.StatusBadRequest)
+				return
+			}
+
+			// Verify current password
+			if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.CurrentPassword)); err != nil {
+				http.Error(w, "Current password is incorrect", http.StatusUnauthorized)
+				return
+			}
+
+			// Validate new password
+			if len(req.NewPassword) < 8 {
+				http.Error(w, "New password must be at least 8 characters long", http.StatusBadRequest)
+				return
+			}
+
+			// Hash new password
+			hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost)
+			if err != nil {
+				http.Error(w, "Failed to process new password", http.StatusInternalServerError)
+				return
+			}
+			user.PasswordHash = string(hashedPassword)
+		}
+
+		// Handle email update if requested
+		if req.Email != "" && req.Email != user.Email {
+			// Check if email change requires password verification
+			if req.CurrentPassword == "" {
+				http.Error(w, "Current password is required to change email", http.StatusBadRequest)
+				return
+			}
+
+			// Verify current password if not already verified for password change
+			if req.NewPassword == "" {
+				if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.CurrentPassword)); err != nil {
+					http.Error(w, "Current password is incorrect", http.StatusUnauthorized)
+					return
+				}
+			}
+
+			// Check if new email is already in use
+			existingUser, err := h.DB.GetUserByEmail(req.Email)
+			if err == nil && existingUser.ID != user.ID {
+				http.Error(w, "Email already in use", http.StatusConflict)
+				return
+			}
+			user.Email = req.Email
+		}
+
+		// Update display name if provided (no password required)
+		if req.DisplayName != "" {
+			user.DisplayName = req.DisplayName
+		}
+
+		// Update user in database
+		if err := h.DB.UpdateUser(user); err != nil {
+			http.Error(w, "Failed to update profile", http.StatusInternalServerError)
+			return
+		}
+
+		if err := tx.Commit(); err != nil {
+			http.Error(w, "Failed to commit changes", http.StatusInternalServerError)
+			return
+		}
+
+		// Return updated user data
+		respondJSON(w, user)
+	}
+}
+
+// DeleteAccount handles user account deletion
+func (h *Handler) DeleteAccount() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var req DeleteAccountRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Get current user
+		user, err := h.DB.GetUserByID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "User not found", http.StatusNotFound)
+			return
+		}
+
+		// Verify password
+		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
+			http.Error(w, "Password is incorrect", http.StatusUnauthorized)
+			return
+		}
+
+		// Prevent admin from deleting their own account if they're the last admin
+		if user.Role == "admin" {
+			// Count number of admin users
+			adminCount := 0
+			err := h.DB.QueryRow("SELECT COUNT(*) FROM users WHERE role = 'admin'").Scan(&adminCount)
+			if err != nil {
+				http.Error(w, "Failed to verify admin status", http.StatusInternalServerError)
+				return
+			}
+			if adminCount <= 1 {
+				http.Error(w, "Cannot delete the last admin account", http.StatusForbidden)
+				return
+			}
+		}
+
+		// Start transaction for consistent deletion
+		tx, err := h.DB.Begin()
+		if err != nil {
+			http.Error(w, "Failed to start transaction", http.StatusInternalServerError)
+			return
+		}
+		defer tx.Rollback()
+
+		// Get user's workspaces for cleanup
+		workspaces, err := h.DB.GetWorkspacesByUserID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "Failed to get user workspaces", http.StatusInternalServerError)
+			return
+		}
+
+		// Delete workspace directories
+		for _, workspace := range workspaces {
+			if err := h.FS.DeleteUserWorkspace(ctx.UserID, workspace.ID); err != nil {
+				http.Error(w, "Failed to delete workspace files", http.StatusInternalServerError)
+				return
+			}
+		}
+
+		// Delete user from database (this will cascade delete workspaces and sessions)
+		if err := h.DB.DeleteUser(ctx.UserID); err != nil {
+			http.Error(w, "Failed to delete account", http.StatusInternalServerError)
+			return
+		}
+
+		if err := tx.Commit(); err != nil {
+			http.Error(w, "Failed to commit transaction", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "Account deleted successfully"})
+	}
+}

server/internal/handlers/workspace_handlers.go

@@ -0,0 +1,240 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"novamd/internal/httpcontext"
+	"novamd/internal/models"
+)
+
+func (h *Handler) ListWorkspaces() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		workspaces, err := h.DB.GetWorkspacesByUserID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "Failed to list workspaces", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, workspaces)
+	}
+}
+
+func (h *Handler) CreateWorkspace() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var workspace models.Workspace
+		if err := json.NewDecoder(r.Body).Decode(&workspace); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		workspace.UserID = ctx.UserID
+		if err := h.DB.CreateWorkspace(&workspace); err != nil {
+			http.Error(w, "Failed to create workspace", http.StatusInternalServerError)
+			return
+		}
+
+		if err := h.FS.InitializeUserWorkspace(workspace.UserID, workspace.ID); err != nil {
+			http.Error(w, "Failed to initialize workspace directory", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, workspace)
+	}
+}
+
+func (h *Handler) GetWorkspace() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		respondJSON(w, ctx.Workspace)
+	}
+}
+
+func gitSettingsChanged(new, old *models.Workspace) bool {
+	// Check if Git was enabled/disabled
+	if new.GitEnabled != old.GitEnabled {
+		return true
+	}
+
+	// If Git is enabled, check if any settings changed
+	if new.GitEnabled {
+		return new.GitURL != old.GitURL ||
+			new.GitUser != old.GitUser ||
+			new.GitToken != old.GitToken
+	}
+
+	return false
+}
+
+func (h *Handler) UpdateWorkspace() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var workspace models.Workspace
+		if err := json.NewDecoder(r.Body).Decode(&workspace); err != nil {
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		// Set IDs from the request
+		workspace.ID = ctx.Workspace.ID
+		workspace.UserID = ctx.UserID
+
+		// Validate the workspace
+		if err := workspace.Validate(); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		// Handle Git repository setup/teardown if Git settings changed
+		if gitSettingsChanged(&workspace, ctx.Workspace) {
+			if workspace.GitEnabled {
+				if err := h.FS.SetupGitRepo(
+					ctx.UserID,
+					ctx.Workspace.ID,
+					workspace.GitURL,
+					workspace.GitUser,
+					workspace.GitToken,
+				); err != nil {
+					http.Error(w, "Failed to setup git repo: "+err.Error(), http.StatusInternalServerError)
+					return
+				}
+
+			} else {
+				h.FS.DisableGitRepo(ctx.UserID, ctx.Workspace.ID)
+			}
+		}
+
+		if err := h.DB.UpdateWorkspace(&workspace); err != nil {
+			http.Error(w, "Failed to update workspace", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, workspace)
+	}
+}
+
+func (h *Handler) DeleteWorkspace() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		// Check if this is the user's last workspace
+		workspaces, err := h.DB.GetWorkspacesByUserID(ctx.UserID)
+		if err != nil {
+			http.Error(w, "Failed to get workspaces", http.StatusInternalServerError)
+			return
+		}
+
+		if len(workspaces) <= 1 {
+			http.Error(w, "Cannot delete the last workspace", http.StatusBadRequest)
+			return
+		}
+
+		// Find another workspace to set as last
+		var nextWorkspaceName string
+		var nextWorkspaceID int
+		for _, ws := range workspaces {
+			if ws.ID != ctx.Workspace.ID {
+				nextWorkspaceID = ws.ID
+				nextWorkspaceName = ws.Name
+				break
+			}
+		}
+
+		// Start transaction
+		tx, err := h.DB.Begin()
+		if err != nil {
+			http.Error(w, "Failed to start transaction", http.StatusInternalServerError)
+			return
+		}
+		defer tx.Rollback()
+
+		// Update last workspace ID first
+		err = h.DB.UpdateLastWorkspaceTx(tx, ctx.UserID, nextWorkspaceID)
+		if err != nil {
+			http.Error(w, "Failed to update last workspace", http.StatusInternalServerError)
+			return
+		}
+
+		// Delete the workspace
+		err = h.DB.DeleteWorkspaceTx(tx, ctx.Workspace.ID)
+		if err != nil {
+			http.Error(w, "Failed to delete workspace", http.StatusInternalServerError)
+			return
+		}
+
+		// Commit transaction
+		if err = tx.Commit(); err != nil {
+			http.Error(w, "Failed to commit transaction", http.StatusInternalServerError)
+			return
+		}
+
+		// Return the next workspace ID in the response so frontend knows where to redirect
+		respondJSON(w, map[string]string{"nextWorkspaceName": nextWorkspaceName})
+	}
+}
+
+func (h *Handler) GetLastWorkspaceName() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		workspaceName, err := h.DB.GetLastWorkspaceName(ctx.UserID)
+		if err != nil {
+			http.Error(w, "Failed to get last workspace", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"lastWorkspaceName": workspaceName})
+	}
+}
+
+func (h *Handler) UpdateLastWorkspaceName() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx, ok := httpcontext.GetRequestContext(w, r)
+		if !ok {
+			return
+		}
+
+		var requestBody struct {
+			WorkspaceName string `json:"workspaceName"`
+		}
+
+		if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
+			fmt.Println(err)
+			http.Error(w, "Invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		if err := h.DB.UpdateLastWorkspace(ctx.UserID, requestBody.WorkspaceName); err != nil {
+			fmt.Println(err)
+			http.Error(w, "Failed to update last workspace", http.StatusInternalServerError)
+			return
+		}
+
+		respondJSON(w, map[string]string{"message": "Last workspace updated successfully"})
+	}
+}