perf(storage): use scalar comparison for single-element slices in query builder

In InsertEntryForFeed, there is no need to check if an entry exists and then
get its hash. Instead, try to get its hash, and consider the ErrNoRows error as
an existence check.

.devcontainer/devcontainer.json

@@ -9,7 +9,9 @@
   ],
   "features": {
     "ghcr.io/devcontainers/features/github-cli:1": {},
-    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+      "moby": false
+    }
   },
   "customizations": {
     "vscode": {
@@ -28,4 +30,4 @@
       ]
     }
   }
-}
+}

.devcontainer/docker-compose.yml

@@ -1,7 +1,6 @@
-version: '3.8'
 services:
   app:
-    image: mcr.microsoft.com/devcontainers/go:1.23
+    image: mcr.microsoft.com/devcontainers/go:1-trixie # https://www.debian.org/releases/trixie/index.en.html
     volumes:
       - ..:/workspace:cached
     command: sleep infinity
@@ -11,10 +10,10 @@ services:
       - ADMIN_USERNAME=admin
       - ADMIN_PASSWORD=test123
   db:
-    image: postgres:15
+    image: postgres:latest
     restart: unless-stopped
     volumes:
-      - postgres-data:/var/lib/postgresql/data
+      - postgres-data:/var/lib/postgresql
     hostname: postgres
     environment:
       POSTGRES_DB: miniflux2

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -63,3 +63,5 @@ body:
           required: true
         - label: "I understand that feature requests are not guaranteed to be implemented."
           required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/ISSUE_TEMPLATE/proposal.yml

@@ -84,3 +84,5 @@ body:
           required: true
         - label: "I agree to provide follow-up updates and maintain discussion on this proposal."
           required: true
+        - label: "I agree to follow the project's contribution guidelines."
+          required: true

.github/pull_request_template.md

@@ -4,4 +4,4 @@ Have you followed these guidelines?
 - [ ] There are no breaking changes
 - [ ] I have thoroughly tested my changes and verified there are no regressions
 - [ ] My commit messages follow the [Conventional Commits specification](https://www.conventionalcommits.org/)
-- [ ] I have read this document: https://miniflux.app/faq.html#pull-request
+- [ ] I have read and understood the [contribution guidelines](https://github.com/miniflux/v2/blob/main/CONTRIBUTING.md)

.github/workflows/build_binaries.yml

@@ -1,4 +1,6 @@
 name: Build Binaries
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   push:
@@ -7,21 +9,22 @@ on:
 jobs:
   build:
     name: Build
+    if: github.repository_owner == 'miniflux'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Set up Golang
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24.x"
+          go-version: stable
           check-latest: true
       - name: Compile binaries
         env:
           CGO_ENABLED: 0
         run: make build
       - name: Upload binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: binaries
           path: miniflux-*

.github/workflows/codeberg_mirror.yml

@@ -0,0 +1,26 @@
+name: Mirror to Codeberg
+
+on:
+  push:
+    branches: [ main ]
+  delete:
+  workflow_dispatch:
+
+jobs:
+  mirror:
+    if: github.repository_owner == 'miniflux'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Mirror to Codeberg
+        env:
+          CODEBERG_USERNAME: ${{ secrets.CODEBERG_USERNAME }}
+          CODEBERG_TOKEN: ${{ secrets.CODEBERG_TOKEN }}
+        run: |
+          git remote add codeberg https://${{ secrets.CODEBERG_USERNAME }}:${{ secrets.CODEBERG_TOKEN }}@codeberg.org/miniflux/v2.git
+          git push --force --prune codeberg \
+            "refs/heads/*:refs/heads/*" \
+            "refs/tags/*:refs/tags/*"

.github/workflows/codeql-analysis.yml

@@ -9,6 +9,7 @@ on:
       - '**.js'
       - '**.go'
       - '!**_test.go'
+      - '.github/workflows/codeql-analysis.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ main ]
@@ -16,12 +17,14 @@ on:
       - '**.js'
       - '**.go'
       - '!**_test.go'
+      - '.github/workflows/codeql-analysis.yml'
   schedule:
     - cron: '45 22 * * 3'
+  workflow_dispatch:
 
 jobs:
   analyze:
-    name: Analyze
+    name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -30,20 +33,27 @@ jobs:
 
     strategy:
       fail-fast: false
+      matrix:
+        language: [ 'go', 'javascript' ]
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
+      if: matrix.language == 'go'
       with:
-        go-version: "1.24.x"
+        go-version: stable
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{ matrix.language }}"

.github/workflows/debian_packages.yml

@@ -13,17 +13,18 @@ on:
       - 'packaging/debian/**' # Only run on changes to the debian packaging files
 jobs:
   test-packages:
-    if: github.event_name == 'schedule' || github.event_name == 'pull_request'
+    if: (github.event_name == 'schedule' && github.repository_owner == 'miniflux')
+      || github.event_name == 'pull_request'
     name: Test Packages
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       id: buildx
       with:
           install: true
@@ -38,13 +39,13 @@ jobs:
     name: Build Packages Manually
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       id: buildx
       with:
           install: true
@@ -53,24 +54,24 @@ jobs:
     - name: Build Debian Packages
       run: make debian-packages
     - name: Upload package
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: packages
         path: "*.deb"
         if-no-files-found: error
         retention-days: 3
   publish-packages:
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.repository_owner == 'miniflux'
     name: Publish Packages
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       id: buildx
       with:
           install: true

.github/workflows/docker.yml

@@ -12,18 +12,19 @@ on:
 jobs:
   docker-images:
     name: Docker Images
+    if: github.repository_owner == 'miniflux'
     permissions:
       packages: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Generate Alpine Docker tags
         id: docker_alpine_tags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             docker.io/${{ github.repository_owner }}/miniflux
@@ -36,7 +37,7 @@ jobs:
 
       - name: Generate Distroless Docker tags
         id: docker_distroless_tags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             docker.io/${{ github.repository_owner }}/miniflux
@@ -50,21 +51,21 @@ jobs:
             suffix=-distroless,onlatest=true
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to DockerHub
         if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
         if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -72,14 +73,14 @@ jobs:
 
       - name: Login to Quay Container Registry
         if: ${{ github.event_name != 'pull_request' && vars.PUBLISH_DOCKER_IMAGES == 'true' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_TOKEN }}
 
       - name: Build and Push Alpine images
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: ${{ vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         with:
           context: .
@@ -89,7 +90,7 @@ jobs:
           tags: ${{ steps.docker_alpine_tags.outputs.tags }}
 
       - name: Build and Push Distroless images
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: ${{ vars.PUBLISH_DOCKER_IMAGES == 'true' }}
         with:
           context: .

.github/workflows/linters.yml

@@ -12,7 +12,7 @@ jobs:
     name: Javascript Linter
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Install linters
       run: |
         sudo npm install -g jshint@2.13.6 eslint@8.57.0
@@ -25,16 +25,11 @@ jobs:
     name: Golang Linters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
-          go-version: "1.24.x"
-      - uses: golangci/golangci-lint-action@v8
-        with:
-          args: >
-            --timeout 10m
-            --disable errcheck
-            --enable sqlclosecheck,misspell,whitespace,gocritic
+          go-version: stable
+      - uses: golangci/golangci-lint-action@v9
       - name: Run gofmt linter
         run: gofmt -d -e .
 
@@ -43,11 +38,11 @@ jobs:
     name: Commit Linter
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.13'
       - name: Validate PR commits

.github/workflows/rpm_packages.yml

@@ -11,17 +11,19 @@ on:
     branches: [ main ]
     paths:
       - 'packaging/rpm/**' # Only run on changes to the rpm packaging files
+      - '.github/workflows/rpm_packages.yml'
 jobs:
   test-package:
-    if: github.event_name == 'schedule' || github.event_name == 'pull_request'
+    if: (github.event_name == 'schedule' && github.repository_owner == 'miniflux')
+      || github.event_name == 'pull_request'
     name: Test Packages
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Build RPM Package
-      run: make rpm
+      run: make rpm VERSION=2.2.x_dev
     - name: List generated files
       run: ls -l *.rpm
   build-package-manually:
@@ -29,24 +31,24 @@ jobs:
     name: Build Packages Manually
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Build RPM Package
       run: make rpm
     - name: Upload package
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: packages
         path: "*.rpm"
         if-no-files-found: error
         retention-days: 3
   publish-package:
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.repository_owner == 'miniflux'
     name: Publish Packages
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
           fetch-depth: 0
     - name: Build RPM Package

.github/workflows/scripts/commit-checker.py

@@ -4,8 +4,10 @@ import sys
 import argparse
 from typing import Match
 
-# Conventional commit pattern
-CONVENTIONAL_COMMIT_PATTERN: str = r"^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9-]+\))?!?: .{1,100}"
+# Conventional commit pattern (including Git revert messages)
+CONVENTIONAL_COMMIT_PATTERN: str = (
+    r"^((build|chore|ci|docs|feat|fix|perf|refactor|revert|security|style|test)(\([a-z0-9-]+\))?!?: .{1,100}|Revert .+)"
+)
 
 
 def get_commit_message(commit_hash: str) -> str:
@@ -23,9 +25,7 @@ def get_commit_message(commit_hash: str) -> str:
         sys.exit(1)
 
 
-def check_commit_message(
-    message: str, pattern: str = CONVENTIONAL_COMMIT_PATTERN
-) -> bool:
+def check_commit_message(message: str, pattern: str = CONVENTIONAL_COMMIT_PATTERN) -> bool:
     """Check if commit message follows conventional commit format."""
     first_line: str = message.split("\n")[0]
     match: Match[str] | None = re.match(pattern, first_line)
@@ -50,9 +50,7 @@ def check_commit_range(base_ref: str, head_ref: str) -> list[dict[str, str]]:
         for commit_hash in commit_hashes:
             message: str = get_commit_message(commit_hash)
             if not check_commit_message(message):
-                non_compliant.append(
-                    {"hash": commit_hash, "message": message.split("\n")[0]}
-                )
+                non_compliant.append({"hash": commit_hash, "message": message.split("\n")[0]})
 
         return non_compliant
     except subprocess.CalledProcessError as e:
@@ -61,15 +59,9 @@ def check_commit_range(base_ref: str, head_ref: str) -> list[dict[str, str]]:
 
 
 def main() -> None:
-    parser: argparse.ArgumentParser = argparse.ArgumentParser(
-        description="Check conventional commit compliance"
-    )
-    parser.add_argument(
-        "--base", required=True, help="Base ref (starting commit, exclusive)"
-    )
-    parser.add_argument(
-        "--head", required=True, help="Head ref (ending commit, inclusive)"
-    )
+    parser: argparse.ArgumentParser = argparse.ArgumentParser(description="Check conventional commit compliance")
+    parser.add_argument("--base", required=True, help="Base ref (starting commit, exclusive)")
+    parser.add_argument("--head", required=True, help="Head ref (ending commit, inclusive)")
     args: argparse.Namespace = parser.parse_args()
 
     non_compliant: list[dict[str, str]] = check_commit_range(args.base, args.head)
@@ -80,9 +72,7 @@ def main() -> None:
             print(f"- {commit['hash'][:8]}: {commit['message']}")
         print("\nPlease ensure your commit messages follow the format:")
         print("type(scope): subject")
-        print(
-            "\nWhere type is one of: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
-        )
+        print("\nWhere type is one of: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test")
         sys.exit(1)
     else:
         print("All commits follow the conventional commit format!")

.github/workflows/tests.yml

@@ -15,14 +15,13 @@ jobs:
       max-parallel: 4
       matrix:
         os: [ubuntu-latest, windows-latest, macOS-latest]
-        go-version: ["1.24.x"]
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version: ${{ matrix.go-version }}
+        go-version: stable
     - name: Run unit tests with coverage and race conditions checking
       if: matrix.os == 'ubuntu-latest'
       run: make test
@@ -45,16 +44,15 @@ jobs:
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version: "1.24.x"
+        go-version: stable
     - name: Install Postgres client
       run: sudo apt update && sudo apt install -y postgresql-client
     - name: Run integration tests
       run: make integration-test
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         PGHOST: 127.0.0.1
         PGPASSWORD: postgres

.golangci.yml

@@ -0,0 +1,22 @@
+version: "2"
+linters:
+  default: standard
+  disable:
+    - errcheck
+  enable:
+    - errname
+    - gocritic
+    - goheader
+    - loggercheck
+    - misspell
+    - perfsprint
+    - sqlclosecheck
+    - staticcheck
+    - whitespace
+  settings:
+    loggercheck:
+      slog: true
+    goheader:
+      template: |-
+        SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+        SPDX-License-Identifier: Apache-2.0

CONTRIBUTING.md

@@ -0,0 +1,178 @@
+# Contributing to Miniflux
+
+This document outlines how to contribute effectively to Miniflux.
+
+## Philosophy
+
+Miniflux follows a **minimalist philosophy**. The feature set is intentionally kept limited to avoid bloatware. Before contributing, please understand that:
+
+- **Improving existing features takes priority over adding new ones**
+- **Quality over quantity** - well-implemented, focused features are preferred
+- **Simplicity is key** - complex solutions are discouraged in favor of simple, maintainable code
+
+## Before You Start
+
+### Feature Requests
+
+Before implementing a new feature:
+
+- Check if it aligns with Miniflux's philosophy
+- Consider if the feature could be implemented differently to maintain simplicity
+- Remember that developing software takes significant time, and this is a volunteer-driven project
+- If you need a specific feature, the best approach is to contribute it yourself
+
+### Bug Reports
+
+When reporting bugs:
+
+- Search existing issues first to avoid duplicates
+- Provide clear reproduction steps
+- Include relevant system information (OS, browser, Miniflux version)
+- Include error messages, screenshots, and logs when applicable
+
+## Development Setup
+
+### Requirements
+
+- **Git**
+- **Go >= 1.24**
+- **PostgreSQL**
+
+### Getting Started
+
+1. **Fork the repository** on GitHub
+2. **Clone your fork locally:**
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/miniflux.git
+   cd miniflux
+   ```
+
+3. **Build the application binary:**
+   ```bash
+   make miniflux
+   ```
+
+4. **Run locally in debug mode:**
+   ```bash
+   make run
+   ```
+
+### Database Setup
+
+For development and testing, you can run a local PostgreSQL database with Docker:
+
+```bash
+# Start PostgreSQL container
+docker run --rm --name miniflux2-db -p 5432:5432 \
+  -e POSTGRES_DB=miniflux2 \
+  -e POSTGRES_USER=postgres \
+  -e POSTGRES_PASSWORD=postgres \
+  postgres
+```
+
+You can also use an existing PostgreSQL instance. Make sure to set the `DATABASE_URL` environment variable accordingly.
+
+## Development Workflow
+
+### Code Quality
+
+1. **Run the linter:**
+   ```bash
+   make lint
+   ```
+   Requires `staticcheck` and `golangci-lint` to be installed.
+
+2. **Run unit tests:**
+   ```bash
+   make test
+   ```
+
+3. **Run integration tests:**
+   ```bash
+   make integration-test
+   make clean-integration-test
+   ```
+
+### Building
+
+- **Current platform:** `make miniflux`
+- **All platforms:** `make build`
+- **Specific platforms:** `make linux-amd64`, `make darwin-arm64`, etc.
+- **Docker image:** `make docker-image`
+
+### Cross-Platform Support
+
+Miniflux supports multiple architectures. When making changes, ensure compatibility across:
+- Linux (amd64, arm64, armv7, armv6, armv5)
+- macOS (amd64, arm64)
+- FreeBSD, OpenBSD, Windows (amd64)
+
+## Pull Request Guidelines
+
+### What Is Preferred
+
+✅ **Good Pull Requests:**
+
+- Focus on a single issue or feature
+- Include tests for new functionality
+- Maintain or improve performance
+- Follow existing code style and patterns
+- The commit messages follow the [conventional commit format](https://www.conventionalcommits.org/) (e.g., `feat: add new feature`, `fix: resolve bug`)
+- Update documentation when necessary
+
+### What to Avoid
+
+❌ **Pull Requests That Cannot Be Accepted:**
+
+- **Too many changes** - makes review difficult
+- **Breaking changes** - disrupts existing functionality
+- **New bugs or regressions** - reduces software quality
+- **Unnecessary dependencies** - conflicts with minimalist approach
+- **Performance degradation** - slows down the software
+- **Poor-quality code** - hard to maintain
+- **Dependent PRs** - creates review complexity
+- **Radical UI changes** - disrupts user experience
+- **Conflicts with philosophy** - doesn't align with minimalist approach
+
+### Pull Request Template
+
+When creating a pull request, please include:
+
+- **Description:** What does this PR do?
+- **Motivation:** Why is this change needed?
+- **Testing:** How was this tested?
+- **Breaking Changes:** Are there any breaking changes?
+- **Related Issues:** Link to any related issues
+
+## Code Style
+
+- Follow Go conventions and best practices
+- Use `gofmt` to format your Go code, and `jshint` for JavaScript
+- Write clear, descriptive variable and function names
+- Include comments for complex logic
+- Keep functions small and focused
+
+## Testing
+
+### Unit Tests
+- Write unit tests for new functions and methods
+- Ensure tests are fast and don't require external dependencies
+- Aim for good test coverage
+
+### Integration Tests
+- Add integration tests for new API endpoints
+- Tests run against a real PostgreSQL database
+- Ensure tests clean up after themselves
+
+## Communication
+
+- **Discussions:** Use GitHub Discussions for general questions and community interaction
+- **Issues:** Use GitHub issues for bug reports and feature requests
+- **Pull Requests:** Use PR comments for code-specific discussions
+- **Philosophy Questions:** Refer to the FAQ for common questions about project direction
+
+## Questions?
+
+- Check the [FAQ](https://miniflux.app/faq.html) for common questions
+- Review the [development documentation](https://miniflux.app/docs/development.html) and [internationalization guide](https://miniflux.app/docs/i18n.html)
+- Look at existing issues and pull requests for examples

Makefile

@@ -1,9 +1,7 @@
 APP             := miniflux
 DOCKER_IMAGE    := miniflux/miniflux
-VERSION         := $(shell git describe --tags --abbrev=0 2>/dev/null)
-COMMIT          := $(shell git rev-parse --short HEAD 2>/dev/null)
-BUILD_DATE      := `date +%FT%T%z`
-LD_FLAGS        := "-s -w -X 'miniflux.app/v2/internal/version.Version=$(VERSION)' -X 'miniflux.app/v2/internal/version.Commit=$(COMMIT)' -X 'miniflux.app/v2/internal/version.BuildDate=$(BUILD_DATE)'"
+VERSION         := $(shell git describe --tags --exact-match 2>/dev/null)
+LD_FLAGS        := "-s -w -X 'miniflux.app/v2/internal/version.Version=$(VERSION)'"
 PKG_LIST        := $(shell go list ./... | grep -v /vendor/)
 DB_URL          := postgres://postgres:postgres@localhost/miniflux_test?sslmode=disable
 DOCKER_PLATFORM := amd64
@@ -18,20 +16,14 @@ export PGPASSWORD := postgres
 	linux-armv7 \
 	linux-armv6 \
 	linux-armv5 \
-	linux-x86 \
 	darwin-amd64 \
 	darwin-arm64 \
 	freebsd-amd64 \
-	freebsd-x86 \
 	openbsd-amd64 \
-	openbsd-x86 \
-	netbsd-x86 \
-	netbsd-amd64 \
-	windows-amd64 \
-	windows-x86 \
 	build \
 	run \
 	clean \
+	add-string \
 	test \
 	lint \
 	integration-test \
@@ -44,71 +36,48 @@ export PGPASSWORD := postgres
 	debian-packages
 
 miniflux:
-	@ go build -buildmode=pie -ldflags=$(LD_FLAGS) -o $(APP) main.go
+	@ go build -buildmode=pie -ldflags=$(LD_FLAGS) -o $(APP)
 
 miniflux-no-pie:
-	@ go build -ldflags=$(LD_FLAGS) -o $(APP) main.go
+	@ go build -ldflags=$(LD_FLAGS) -o $(APP)
 
 linux-amd64:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-arm64:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv7:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv6:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 linux-armv5:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=5 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 darwin-amd64:
-	@ GOOS=darwin GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ GOOS=darwin GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 darwin-arm64:
-	@ GOOS=darwin GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ GOOS=darwin GOARCH=arm64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 freebsd-amd64:
-	@ CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
 openbsd-amd64:
-	@ GOOS=openbsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
+	@ GOOS=openbsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@
 	@ sha256sum $(APP)-$@ > $(APP)-$@.sha256
 
-windows-amd64:
-	@ GOOS=windows GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@.exe main.go
-	@ sha256sum $(APP)-$@.exe > $(APP)-$@.exe.sha256
-
-build: linux-amd64 linux-arm64 linux-armv7 linux-armv6 linux-armv5 darwin-amd64 darwin-arm64 freebsd-amd64 openbsd-amd64 windows-amd64
-
-# NOTE: unsupported targets
-netbsd-amd64:
-	@ CGO_ENABLED=0 GOOS=netbsd GOARCH=amd64 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
-
-linux-x86:
-	@ CGO_ENABLED=0 GOOS=linux GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
-
-freebsd-x86:
-	@ CGO_ENABLED=0 GOOS=freebsd GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
-
-netbsd-x86:
-	@ CGO_ENABLED=0 GOOS=netbsd GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
-
-openbsd-x86:
-	@ GOOS=openbsd GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@ main.go
-
-windows-x86:
-	@ GOOS=windows GOARCH=386 go build -ldflags=$(LD_FLAGS) -o $(APP)-$@.exe main.go
+build: linux-amd64 linux-arm64 linux-armv7 linux-armv6 linux-armv5 darwin-amd64 darwin-arm64 freebsd-amd64 openbsd-amd64
 
 run:
 	@ LOG_DATE_TIME=1 LOG_LEVEL=debug RUN_MIGRATIONS=1 CREATE_ADMIN=1 ADMIN_USERNAME=admin ADMIN_PASSWORD=test123 go run main.go
@@ -116,7 +85,6 @@ run:
 clean:
 	@ rm -f $(APP)-* $(APP) $(APP)*.rpm $(APP)*.deb $(APP)*.exe $(APP)*.sha256
 
-.PHONY: add-string
 add-string:
 	cd internal/locale/translations && \
 	for file in *.json; do \
@@ -125,19 +93,17 @@ add-string:
 		mv tmp "$$file"; \
 	done
 
-
 test:
 	go test -cover -race -count=1 ./...
 
 lint:
 	go vet ./...
-	staticcheck ./...
-	golangci-lint run --disable errcheck --enable sqlclosecheck --enable misspell --enable gofmt --enable goimports --enable whitespace
+	test -z "$$(gofmt -l .)"
+	golangci-lint run
 
 integration-test:
 	psql -U postgres -c 'drop database if exists miniflux_test;'
 	psql -U postgres -c 'create database miniflux_test;'
-	go build -o miniflux-test main.go
 
 	DATABASE_URL=$(DB_URL) \
 	ADMIN_USERNAME=admin \
@@ -145,7 +111,9 @@ integration-test:
 	CREATE_ADMIN=1 \
 	RUN_MIGRATIONS=1 \
 	LOG_LEVEL=debug \
-	./miniflux-test >/tmp/miniflux.log 2>&1 & echo "$$!" > "/tmp/miniflux.pid"
+	FETCHER_ALLOW_PRIVATE_NETWORKS=1 \
+	INTEGRATION_ALLOW_PRIVATE_NETWORKS=1 \
+	go run main.go >/tmp/miniflux.log 2>&1 & echo "$$!" > "/tmp/miniflux.pid"
 
 	while ! nc -z localhost 8080; do sleep 1; done
 
@@ -157,7 +125,6 @@ integration-test:
 clean-integration-test:
 	@ kill -9 `cat /tmp/miniflux.pid`
 	@ rm -f /tmp/miniflux.pid /tmp/miniflux.log
-	@ rm miniflux-test
 	@ psql -U postgres -c 'drop database if exists miniflux_test;'
 
 docker-image:

README.md

@@ -22,7 +22,7 @@ Features
 - Provides full-text search (powered by Postgres).
 - Available in 20 languages: Portuguese (Brazilian), Chinese (Simplified and Traditional), Dutch, English (US), Finnish, French, German, Greek, Hindi, Indonesian, Italian, Japanese, Polish, Romanian, Russian, Taiwanese POJ, Ukrainian, Spanish, and Turkish.
 
-### Privacy
+### Privacy and Security
 
 - Removes pixel trackers.
 - Strips tracking parameters from URLs (e.g., `utm_source`, `utm_medium`, `utm_campaign`, `fbclid`, etc.).
@@ -33,6 +33,8 @@ Features
 - Plays YouTube videos via the privacy-focused domain `youtube-nocookie.com`.
 - Supports alternative YouTube video players such as [Invidious](https://invidio.us).
 - Blocks external JavaScript to prevent tracking and enhance security.
+- Sanitizes external content before rendering it.
+- Enforces a [Content Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and a [Trusted Types Policy](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) to only application JavaScript and blocks inline scripts and styles. 
 
 ### Bot Protection Bypass Mechanisms
 
@@ -70,7 +72,7 @@ Features
 
 ### Integrations
 
-- 25+ integrations with third-party services: [Apprise](https://github.com/caronc/apprise), [Betula](https://sr.ht/~bouncepaw/betula/), [Cubox](https://cubox.cc/), [Discord](https://discord.com/), [Espial](https://github.com/jonschoning/espial), [Instapaper](https://www.instapaper.com/), [LinkAce](https://www.linkace.org/), [Linkding](https://github.com/sissbruecker/linkding), [LinkWarden](https://linkwarden.app/), [Matrix](https://matrix.org), [Notion](https://www.notion.com/), [Ntfy](https://ntfy.sh/), [Nunux Keeper](https://keeper.nunux.org/), [Pinboard](https://pinboard.in/), [Pocket](https://getpocket.com/), [Pushover](https://pushover.net), [RainDrop](https://raindrop.io/), [Readeck](https://readeck.org/en/), [Readwise Reader](https://readwise.io/read), [RssBridge](https://rss-bridge.org/), [Shaarli](https://github.com/shaarli/Shaarli), [Shiori](https://github.com/go-shiori/shiori), [Slack](https://slack.com/), [Telegram](https://telegram.org), [Wallabag](https://www.wallabag.org/), etc.
+- 25+ integrations with third-party services: [Apprise](https://github.com/caronc/apprise), [Betula](https://sr.ht/~bouncepaw/betula/), [Cubox](https://cubox.cc/), [Discord](https://discord.com/), [Espial](https://github.com/jonschoning/espial), [Instapaper](https://www.instapaper.com/), [LinkAce](https://www.linkace.org/), [Linkding](https://github.com/sissbruecker/linkding), [LinkTaco](https://linktaco.com), [LinkWarden](https://linkwarden.app/), [Matrix](https://matrix.org), [Notion](https://www.notion.com/), [Ntfy](https://ntfy.sh/), [Nunux Keeper](https://keeper.nunux.org/), [Pinboard](https://pinboard.in/), [Pushover](https://pushover.net), [RainDrop](https://raindrop.io/), [Readeck](https://readeck.org/en/), [Readwise Reader](https://readwise.io/read), [RssBridge](https://rss-bridge.org/), [Shaarli](https://github.com/shaarli/Shaarli), [Shiori](https://github.com/go-shiori/shiori), [Slack](https://slack.com/), [Telegram](https://telegram.org), [Wallabag](https://www.wallabag.org/), etc.
 - Bookmarklet for subscribing to websites directly from any web browser.
 - Webhooks for real-time notifications or custom integrations.
 - Compatibility with existing mobile applications using the Fever or Google Reader API.
@@ -97,13 +99,15 @@ Features
 - Allows the use of custom <abbr title="Secure Sockets Layer">SSL</abbr> certificates.
 - Supports [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) when TLS is enabled.
 - Updates feeds in the background using an internal scheduler or a traditional cron job.
-- Sanitizes external content before rendering it.
-- Enforces a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) that permits only application JavaScript and blocks inline scripts and styles.
 - Uses native lazy loading for images and iframes.
 - Compatible only with modern browsers.
 - Adheres to the [Twelve-Factor App](https://12factor.net/) methodology.
 - Provides official Debian/RPM packages and pre-built binaries.
 - Publishes a Docker image to Docker Hub, GitHub Registry, and Quay.io Registry, with ARM architecture support.
+- Uses a limited amount of third-party go dependencies
+- Has a comprehensive testsuite, with both unit tests and integration tests.
+- Only uses a couple of MB of memory and a negligible amount of CPU, even with several hundreds of feeds.
+- Respects/sends Last-Modified, If-Modified-Since, If-None-Match, Cache-Control, Expires and ETags headers, and has a default polling interval of 1h.
 
 Documentation
 -------------

client/README.md

@@ -3,7 +3,7 @@ Miniflux API Client
 
 [![PkgGoDev](https://pkg.go.dev/badge/miniflux.app/v2/client)](https://pkg.go.dev/miniflux.app/v2/client)
 
-Client library for Miniflux REST API.
+Go client for the Miniflux REST API. It supports API tokens or basic authentication and mirrors the server endpoints closely.
 
 Installation
 ------------

client/client.go

@@ -4,9 +4,11 @@
 package client // import "miniflux.app/v2/client"
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
+	"net/http"
 	"net/url"
 	"strconv"
 	"strings"
@@ -20,28 +22,53 @@ type Client struct {
 // New returns a new Miniflux client.
 //
 // Deprecated: use NewClient instead.
+//
+//go:fix inline
 func New(endpoint string, credentials ...string) *Client {
 	return NewClient(endpoint, credentials...)
 }
 
 // NewClient returns a new Miniflux client.
 func NewClient(endpoint string, credentials ...string) *Client {
+	switch len(credentials) {
+	case 2:
+		return NewClientWithOptions(endpoint, WithCredentials(credentials[0], credentials[1]))
+	case 1:
+		return NewClientWithOptions(endpoint, WithAPIKey(credentials[0]))
+	default:
+		return NewClientWithOptions(endpoint)
+	}
+}
+
+// NewClientWithOptions returns a new Miniflux client with options.
+func NewClientWithOptions(endpoint string, options ...Option) *Client {
 	// Trim trailing slashes and /v1 from the endpoint.
 	endpoint = strings.TrimSuffix(endpoint, "/")
 	endpoint = strings.TrimSuffix(endpoint, "/v1")
-	switch len(credentials) {
-	case 2:
-		return &Client{request: &request{endpoint: endpoint, username: credentials[0], password: credentials[1]}}
-	case 1:
-		return &Client{request: &request{endpoint: endpoint, apiKey: credentials[0]}}
-	default:
-		return &Client{request: &request{endpoint: endpoint}}
+	request := &request{endpoint: endpoint, client: http.DefaultClient}
+
+	for _, option := range options {
+		option(request)
 	}
+
+	return &Client{request: request}
+}
+
+func withDefaultTimeout() (context.Context, func()) {
+	ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
+	return ctx, cancel
 }
 
 // Healthcheck checks if the application is up and running.
 func (c *Client) Healthcheck() error {
-	body, err := c.request.Get("/healthcheck")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.HealthcheckContext(ctx)
+}
+
+// HealthcheckContext checks if the application is up and running.
+func (c *Client) HealthcheckContext(ctx context.Context) error {
+	body, err := c.request.Get(ctx, "/healthcheck")
 	if err != nil {
 		return fmt.Errorf("miniflux: unable to perform healthcheck: %w", err)
 	}
@@ -61,7 +88,14 @@ func (c *Client) Healthcheck() error {
 
 // Version returns the version of the Miniflux instance.
 func (c *Client) Version() (*VersionResponse, error) {
-	body, err := c.request.Get("/v1/version")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.VersionContext(ctx)
+}
+
+// VersionContext returns the version of the Miniflux instance.
+func (c *Client) VersionContext(ctx context.Context) (*VersionResponse, error) {
+	body, err := c.request.Get(ctx, "/v1/version")
 	if err != nil {
 		return nil, err
 	}
@@ -77,7 +111,14 @@ func (c *Client) Version() (*VersionResponse, error) {
 
 // Me returns the logged user information.
 func (c *Client) Me() (*User, error) {
-	body, err := c.request.Get("/v1/me")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.MeContext(ctx)
+}
+
+// MeContext returns the logged user information.
+func (c *Client) MeContext(ctx context.Context) (*User, error) {
+	body, err := c.request.Get(ctx, "/v1/me")
 	if err != nil {
 		return nil, err
 	}
@@ -93,7 +134,14 @@ func (c *Client) Me() (*User, error) {
 
 // Users returns all users.
 func (c *Client) Users() (Users, error) {
-	body, err := c.request.Get("/v1/users")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UsersContext(ctx)
+}
+
+// UsersContext returns all users.
+func (c *Client) UsersContext(ctx context.Context) (Users, error) {
+	body, err := c.request.Get(ctx, "/v1/users")
 	if err != nil {
 		return nil, err
 	}
@@ -109,7 +157,14 @@ func (c *Client) Users() (Users, error) {
 
 // UserByID returns a single user.
 func (c *Client) UserByID(userID int64) (*User, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/users/%d", userID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UserByIDContext(ctx, userID)
+}
+
+// UserByIDContext returns a single user.
+func (c *Client) UserByIDContext(ctx context.Context, userID int64) (*User, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/users/%d", userID))
 	if err != nil {
 		return nil, err
 	}
@@ -125,7 +180,14 @@ func (c *Client) UserByID(userID int64) (*User, error) {
 
 // UserByUsername returns a single user.
 func (c *Client) UserByUsername(username string) (*User, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/users/%s", username))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UserByUsernameContext(ctx, username)
+}
+
+// UserByUsernameContext returns a single user.
+func (c *Client) UserByUsernameContext(ctx context.Context, username string) (*User, error) {
+	body, err := c.request.Get(ctx, "/v1/users/"+username)
 	if err != nil {
 		return nil, err
 	}
@@ -141,7 +203,14 @@ func (c *Client) UserByUsername(username string) (*User, error) {
 
 // CreateUser creates a new user in the system.
 func (c *Client) CreateUser(username, password string, isAdmin bool) (*User, error) {
-	body, err := c.request.Post("/v1/users", &UserCreationRequest{
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CreateUserContext(ctx, username, password, isAdmin)
+}
+
+// CreateUserContext creates a new user in the system.
+func (c *Client) CreateUserContext(ctx context.Context, username, password string, isAdmin bool) (*User, error) {
+	body, err := c.request.Post(ctx, "/v1/users", &UserCreationRequest{
 		Username: username,
 		Password: password,
 		IsAdmin:  isAdmin,
@@ -161,7 +230,14 @@ func (c *Client) CreateUser(username, password string, isAdmin bool) (*User, err
 
 // UpdateUser updates a user in the system.
 func (c *Client) UpdateUser(userID int64, userChanges *UserModificationRequest) (*User, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/users/%d", userID), userChanges)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateUserContext(ctx, userID, userChanges)
+}
+
+// UpdateUserContext updates a user in the system.
+func (c *Client) UpdateUserContext(ctx context.Context, userID int64, userChanges *UserModificationRequest) (*User, error) {
+	body, err := c.request.Put(ctx, fmt.Sprintf("/v1/users/%d", userID), userChanges)
 	if err != nil {
 		return nil, err
 	}
@@ -177,12 +253,26 @@ func (c *Client) UpdateUser(userID int64, userChanges *UserModificationRequest)
 
 // DeleteUser removes a user from the system.
 func (c *Client) DeleteUser(userID int64) error {
-	return c.request.Delete(fmt.Sprintf("/v1/users/%d", userID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.DeleteUserContext(ctx, userID)
+}
+
+// DeleteUserContext removes a user from the system.
+func (c *Client) DeleteUserContext(ctx context.Context, userID int64) error {
+	return c.request.Delete(ctx, fmt.Sprintf("/v1/users/%d", userID))
 }
 
 // APIKeys returns all API keys for the authenticated user.
 func (c *Client) APIKeys() (APIKeys, error) {
-	body, err := c.request.Get("/v1/api-keys")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.APIKeysContext(ctx)
+}
+
+// APIKeysContext returns all API keys for the authenticated user.
+func (c *Client) APIKeysContext(ctx context.Context) (APIKeys, error) {
+	body, err := c.request.Get(ctx, "/v1/api-keys")
 	if err != nil {
 		return nil, err
 	}
@@ -198,7 +288,14 @@ func (c *Client) APIKeys() (APIKeys, error) {
 
 // CreateAPIKey creates a new API key for the authenticated user.
 func (c *Client) CreateAPIKey(description string) (*APIKey, error) {
-	body, err := c.request.Post("/v1/api-keys", &APIKeyCreationRequest{
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CreateAPIKeyContext(ctx, description)
+}
+
+// CreateAPIKeyContext creates a new API key for the authenticated user.
+func (c *Client) CreateAPIKeyContext(ctx context.Context, description string) (*APIKey, error) {
+	body, err := c.request.Post(ctx, "/v1/api-keys", &APIKeyCreationRequest{
 		Description: description,
 	})
 	if err != nil {
@@ -216,18 +313,39 @@ func (c *Client) CreateAPIKey(description string) (*APIKey, error) {
 
 // DeleteAPIKey removes an API key for the authenticated user.
 func (c *Client) DeleteAPIKey(apiKeyID int64) error {
-	return c.request.Delete(fmt.Sprintf("/v1/api-keys/%d", apiKeyID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.DeleteAPIKeyContext(ctx, apiKeyID)
+}
+
+// DeleteAPIKeyContext removes an API key for the authenticated user.
+func (c *Client) DeleteAPIKeyContext(ctx context.Context, apiKeyID int64) error {
+	return c.request.Delete(ctx, fmt.Sprintf("/v1/api-keys/%d", apiKeyID))
 }
 
 // MarkAllAsRead marks all unread entries as read for a given user.
 func (c *Client) MarkAllAsRead(userID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/users/%d/mark-all-as-read", userID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.MarkAllAsReadContext(ctx, userID)
+}
+
+// MarkAllAsReadContext marks all unread entries as read for a given user.
+func (c *Client) MarkAllAsReadContext(ctx context.Context, userID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/users/%d/mark-all-as-read", userID), nil)
 	return err
 }
 
-// IntegrationsStatus fetches the integrations status for the logged user.
+// IntegrationsStatus fetches the integrations status for the signed-in user.
 func (c *Client) IntegrationsStatus() (bool, error) {
-	body, err := c.request.Get("/v1/integrations/status")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.IntegrationsStatusContext(ctx)
+}
+
+// IntegrationsStatusContext fetches the integrations status for the signed-in user.
+func (c *Client) IntegrationsStatusContext(ctx context.Context) (bool, error) {
+	body, err := c.request.Get(ctx, "/v1/integrations/status")
 	if err != nil {
 		return false, err
 	}
@@ -244,9 +362,16 @@ func (c *Client) IntegrationsStatus() (bool, error) {
 	return response.HasIntegrations, nil
 }
 
-// Discover try to find subscriptions from a website.
+// Discover tries to find subscriptions on a website.
 func (c *Client) Discover(url string) (Subscriptions, error) {
-	body, err := c.request.Post("/v1/discover", map[string]string{"url": url})
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.DiscoverContext(ctx, url)
+}
+
+// DiscoverContext tries to find subscriptions from a website.
+func (c *Client) DiscoverContext(ctx context.Context, url string) (Subscriptions, error) {
+	body, err := c.request.Post(ctx, "/v1/discover", map[string]string{"url": url})
 	if err != nil {
 		return nil, err
 	}
@@ -260,9 +385,39 @@ func (c *Client) Discover(url string) (Subscriptions, error) {
 	return subscriptions, nil
 }
 
-// Categories gets the list of categories.
+// Categories retrieves the list of categories.
 func (c *Client) Categories() (Categories, error) {
-	body, err := c.request.Get("/v1/categories")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CategoriesContext(ctx)
+}
+
+// CategoriesContext retrieves the list of categories.
+func (c *Client) CategoriesContext(ctx context.Context) (Categories, error) {
+	body, err := c.request.Get(ctx, "/v1/categories")
+	if err != nil {
+		return nil, err
+	}
+	defer body.Close()
+
+	var categories Categories
+	if err := json.NewDecoder(body).Decode(&categories); err != nil {
+		return nil, fmt.Errorf("miniflux: response error (%v)", err)
+	}
+
+	return categories, nil
+}
+
+// CategoriesWithCounters fetches the categories with their respective feed and unread counts.
+func (c *Client) CategoriesWithCounters() (Categories, error) {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CategoriesWithCountersContext(ctx)
+}
+
+// CategoriesWithCountersContext fetches the categories with their respective feed and unread counts.
+func (c *Client) CategoriesWithCountersContext(ctx context.Context) (Categories, error) {
+	body, err := c.request.Get(ctx, "/v1/categories?counts=true")
 	if err != nil {
 		return nil, err
 	}
@@ -278,7 +433,14 @@ func (c *Client) Categories() (Categories, error) {
 
 // CreateCategory creates a new category.
 func (c *Client) CreateCategory(title string) (*Category, error) {
-	body, err := c.request.Post("/v1/categories", &CategoryCreationRequest{
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CreateCategoryContext(ctx, title)
+}
+
+// CreateCategoryContext creates a new category.
+func (c *Client) CreateCategoryContext(ctx context.Context, title string) (*Category, error) {
+	body, err := c.request.Post(ctx, "/v1/categories", &CategoryCreationRequest{
 		Title: title,
 	})
 	if err != nil {
@@ -296,7 +458,14 @@ func (c *Client) CreateCategory(title string) (*Category, error) {
 
 // CreateCategoryWithOptions creates a new category with options.
 func (c *Client) CreateCategoryWithOptions(createRequest *CategoryCreationRequest) (*Category, error) {
-	body, err := c.request.Post("/v1/categories", createRequest)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CreateCategoryWithOptionsContext(ctx, createRequest)
+}
+
+// CreateCategoryWithOptionsContext creates a new category with options.
+func (c *Client) CreateCategoryWithOptionsContext(ctx context.Context, createRequest *CategoryCreationRequest) (*Category, error) {
+	body, err := c.request.Post(ctx, "/v1/categories", createRequest)
 	if err != nil {
 		return nil, err
 	}
@@ -311,8 +480,15 @@ func (c *Client) CreateCategoryWithOptions(createRequest *CategoryCreationReques
 
 // UpdateCategory updates a category.
 func (c *Client) UpdateCategory(categoryID int64, title string) (*Category, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/categories/%d", categoryID), &CategoryModificationRequest{
-		Title: SetOptionalField(title),
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateCategoryContext(ctx, categoryID, title)
+}
+
+// UpdateCategoryContext updates a category.
+func (c *Client) UpdateCategoryContext(ctx context.Context, categoryID int64, title string) (*Category, error) {
+	body, err := c.request.Put(ctx, fmt.Sprintf("/v1/categories/%d", categoryID), &CategoryModificationRequest{
+		Title: new(title),
 	})
 	if err != nil {
 		return nil, err
@@ -329,7 +505,14 @@ func (c *Client) UpdateCategory(categoryID int64, title string) (*Category, erro
 
 // UpdateCategoryWithOptions updates a category with options.
 func (c *Client) UpdateCategoryWithOptions(categoryID int64, categoryChanges *CategoryModificationRequest) (*Category, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/categories/%d", categoryID), categoryChanges)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateCategoryWithOptionsContext(ctx, categoryID, categoryChanges)
+}
+
+// UpdateCategoryWithOptionsContext updates a category with options.
+func (c *Client) UpdateCategoryWithOptionsContext(ctx context.Context, categoryID int64, categoryChanges *CategoryModificationRequest) (*Category, error) {
+	body, err := c.request.Put(ctx, fmt.Sprintf("/v1/categories/%d", categoryID), categoryChanges)
 	if err != nil {
 		return nil, err
 	}
@@ -345,13 +528,27 @@ func (c *Client) UpdateCategoryWithOptions(categoryID int64, categoryChanges *Ca
 
 // MarkCategoryAsRead marks all unread entries in a category as read.
 func (c *Client) MarkCategoryAsRead(categoryID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/categories/%d/mark-all-as-read", categoryID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.MarkCategoryAsReadContext(ctx, categoryID)
+}
+
+// MarkCategoryAsReadContext marks all unread entries in a category as read.
+func (c *Client) MarkCategoryAsReadContext(ctx context.Context, categoryID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/categories/%d/mark-all-as-read", categoryID), nil)
 	return err
 }
 
-// CategoryFeeds gets feeds of a category.
+// CategoryFeeds returns all feeds for a category.
 func (c *Client) CategoryFeeds(categoryID int64) (Feeds, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/categories/%d/feeds", categoryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CategoryFeedsContext(ctx, categoryID)
+}
+
+// CategoryFeedsContext returns all feeds for a category.
+func (c *Client) CategoryFeedsContext(ctx context.Context, categoryID int64) (Feeds, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/categories/%d/feeds", categoryID))
 	if err != nil {
 		return nil, err
 	}
@@ -367,18 +564,39 @@ func (c *Client) CategoryFeeds(categoryID int64) (Feeds, error) {
 
 // DeleteCategory removes a category.
 func (c *Client) DeleteCategory(categoryID int64) error {
-	return c.request.Delete(fmt.Sprintf("/v1/categories/%d", categoryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.DeleteCategoryContext(ctx, categoryID)
+}
+
+// DeleteCategoryContext removes a category.
+func (c *Client) DeleteCategoryContext(ctx context.Context, categoryID int64) error {
+	return c.request.Delete(ctx, fmt.Sprintf("/v1/categories/%d", categoryID))
 }
 
 // RefreshCategory refreshes a category.
 func (c *Client) RefreshCategory(categoryID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/categories/%d/refresh", categoryID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.RefreshCategoryContext(ctx, categoryID)
+}
+
+// RefreshCategoryContext refreshes a category.
+func (c *Client) RefreshCategoryContext(ctx context.Context, categoryID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/categories/%d/refresh", categoryID), nil)
 	return err
 }
 
 // Feeds gets all feeds.
 func (c *Client) Feeds() (Feeds, error) {
-	body, err := c.request.Get("/v1/feeds")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FeedsContext(ctx)
+}
+
+// FeedsContext gets all feeds.
+func (c *Client) FeedsContext(ctx context.Context) (Feeds, error) {
+	body, err := c.request.Get(ctx, "/v1/feeds")
 	if err != nil {
 		return nil, err
 	}
@@ -392,9 +610,16 @@ func (c *Client) Feeds() (Feeds, error) {
 	return feeds, nil
 }
 
-// Export creates OPML file.
+// Export exports subscriptions as an OPML document.
 func (c *Client) Export() ([]byte, error) {
-	body, err := c.request.Get("/v1/export")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.ExportContext(ctx)
+}
+
+// ExportContext exports subscriptions as an OPML document.
+func (c *Client) ExportContext(ctx context.Context) ([]byte, error) {
+	body, err := c.request.Get(ctx, "/v1/export")
 	if err != nil {
 		return nil, err
 	}
@@ -410,13 +635,27 @@ func (c *Client) Export() ([]byte, error) {
 
 // Import imports an OPML file.
 func (c *Client) Import(f io.ReadCloser) error {
-	_, err := c.request.PostFile("/v1/import", f)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.ImportContext(ctx, f)
+}
+
+// ImportContext imports an OPML file.
+func (c *Client) ImportContext(ctx context.Context, f io.ReadCloser) error {
+	_, err := c.request.PostFile(ctx, "/v1/import", f)
 	return err
 }
 
 // Feed gets a feed.
 func (c *Client) Feed(feedID int64) (*Feed, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/feeds/%d", feedID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FeedContext(ctx, feedID)
+}
+
+// FeedContext gets a feed.
+func (c *Client) FeedContext(ctx context.Context, feedID int64) (*Feed, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/feeds/%d", feedID))
 	if err != nil {
 		return nil, err
 	}
@@ -432,7 +671,14 @@ func (c *Client) Feed(feedID int64) (*Feed, error) {
 
 // CreateFeed creates a new feed.
 func (c *Client) CreateFeed(feedCreationRequest *FeedCreationRequest) (int64, error) {
-	body, err := c.request.Post("/v1/feeds", feedCreationRequest)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CreateFeedContext(ctx, feedCreationRequest)
+}
+
+// CreateFeedContext creates a new feed.
+func (c *Client) CreateFeedContext(ctx context.Context, feedCreationRequest *FeedCreationRequest) (int64, error) {
+	body, err := c.request.Post(ctx, "/v1/feeds", feedCreationRequest)
 	if err != nil {
 		return 0, err
 	}
@@ -452,7 +698,14 @@ func (c *Client) CreateFeed(feedCreationRequest *FeedCreationRequest) (int64, er
 
 // UpdateFeed updates a feed.
 func (c *Client) UpdateFeed(feedID int64, feedChanges *FeedModificationRequest) (*Feed, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/feeds/%d", feedID), feedChanges)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateFeedContext(ctx, feedID, feedChanges)
+}
+
+// UpdateFeedContext updates a feed.
+func (c *Client) UpdateFeedContext(ctx context.Context, feedID int64, feedChanges *FeedModificationRequest) (*Feed, error) {
+	body, err := c.request.Put(ctx, fmt.Sprintf("/v1/feeds/%d", feedID), feedChanges)
 	if err != nil {
 		return nil, err
 	}
@@ -466,32 +719,93 @@ func (c *Client) UpdateFeed(feedID int64, feedChanges *FeedModificationRequest)
 	return f, nil
 }
 
+// ImportFeedEntry imports a single entry into a feed.
+func (c *Client) ImportFeedEntry(feedID int64, payload any) (int64, error) {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+
+	body, err := c.request.Post(
+		ctx,
+		fmt.Sprintf("/v1/feeds/%d/entries/import", feedID),
+		payload,
+	)
+	if err != nil {
+		return 0, err
+	}
+	defer body.Close()
+
+	var response struct {
+		ID int64 `json:"id"`
+	}
+
+	if err := json.NewDecoder(body).Decode(&response); err != nil {
+		return 0, fmt.Errorf("miniflux: json error (%v)", err)
+	}
+
+	return response.ID, nil
+}
+
 // MarkFeedAsRead marks all unread entries of the feed as read.
 func (c *Client) MarkFeedAsRead(feedID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/feeds/%d/mark-all-as-read", feedID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.MarkFeedAsReadContext(ctx, feedID)
+}
+
+// MarkFeedAsReadContext marks all unread entries of the feed as read.
+func (c *Client) MarkFeedAsReadContext(ctx context.Context, feedID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/feeds/%d/mark-all-as-read", feedID), nil)
 	return err
 }
 
 // RefreshAllFeeds refreshes all feeds.
 func (c *Client) RefreshAllFeeds() error {
-	_, err := c.request.Put("/v1/feeds/refresh", nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.RefreshAllFeedsContext(ctx)
+}
+
+// RefreshAllFeedsContext refreshes all feeds.
+func (c *Client) RefreshAllFeedsContext(ctx context.Context) error {
+	_, err := c.request.Put(ctx, "/v1/feeds/refresh", nil)
 	return err
 }
 
 // RefreshFeed refreshes a feed.
 func (c *Client) RefreshFeed(feedID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/feeds/%d/refresh", feedID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.RefreshFeedContext(ctx, feedID)
+}
+
+// RefreshFeedContext refreshes a feed.
+func (c *Client) RefreshFeedContext(ctx context.Context, feedID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/feeds/%d/refresh", feedID), nil)
 	return err
 }
 
 // DeleteFeed removes a feed.
 func (c *Client) DeleteFeed(feedID int64) error {
-	return c.request.Delete(fmt.Sprintf("/v1/feeds/%d", feedID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.DeleteFeedContext(ctx, feedID)
+}
+
+// DeleteFeedContext removes a feed.
+func (c *Client) DeleteFeedContext(ctx context.Context, feedID int64) error {
+	return c.request.Delete(ctx, fmt.Sprintf("/v1/feeds/%d", feedID))
 }
 
 // FeedIcon gets a feed icon.
 func (c *Client) FeedIcon(feedID int64) (*FeedIcon, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/feeds/%d/icon", feedID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FeedIconContext(ctx, feedID)
+}
+
+// FeedIconContext gets a feed icon.
+func (c *Client) FeedIconContext(ctx context.Context, feedID int64) (*FeedIcon, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/feeds/%d/icon", feedID))
 	if err != nil {
 		return nil, err
 	}
@@ -507,7 +821,14 @@ func (c *Client) FeedIcon(feedID int64) (*FeedIcon, error) {
 
 // FeedEntry gets a single feed entry.
 func (c *Client) FeedEntry(feedID, entryID int64) (*Entry, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/feeds/%d/entries/%d", feedID, entryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FeedEntryContext(ctx, feedID, entryID)
+}
+
+// FeedEntryContext gets a single feed entry.
+func (c *Client) FeedEntryContext(ctx context.Context, feedID, entryID int64) (*Entry, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/feeds/%d/entries/%d", feedID, entryID))
 	if err != nil {
 		return nil, err
 	}
@@ -523,7 +844,14 @@ func (c *Client) FeedEntry(feedID, entryID int64) (*Entry, error) {
 
 // CategoryEntry gets a single category entry.
 func (c *Client) CategoryEntry(categoryID, entryID int64) (*Entry, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/categories/%d/entries/%d", categoryID, entryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CategoryEntryContext(ctx, categoryID, entryID)
+}
+
+// CategoryEntryContext gets a single category entry.
+func (c *Client) CategoryEntryContext(ctx context.Context, categoryID, entryID int64) (*Entry, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/categories/%d/entries/%d", categoryID, entryID))
 	if err != nil {
 		return nil, err
 	}
@@ -539,7 +867,14 @@ func (c *Client) CategoryEntry(categoryID, entryID int64) (*Entry, error) {
 
 // Entry gets a single entry.
 func (c *Client) Entry(entryID int64) (*Entry, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/entries/%d", entryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.EntryContext(ctx, entryID)
+}
+
+// EntryContext gets a single entry.
+func (c *Client) EntryContext(ctx context.Context, entryID int64) (*Entry, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/entries/%d", entryID))
 	if err != nil {
 		return nil, err
 	}
@@ -553,11 +888,18 @@ func (c *Client) Entry(entryID int64) (*Entry, error) {
 	return entry, nil
 }
 
-// Entries fetch entries.
+// Entries fetches entries using the given filter.
 func (c *Client) Entries(filter *Filter) (*EntryResultSet, error) {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.EntriesContext(ctx, filter)
+}
+
+// EntriesContext fetches entries.
+func (c *Client) EntriesContext(ctx context.Context, filter *Filter) (*EntryResultSet, error) {
 	path := buildFilterQueryString("/v1/entries", filter)
 
-	body, err := c.request.Get(path)
+	body, err := c.request.Get(ctx, path)
 	if err != nil {
 		return nil, err
 	}
@@ -571,11 +913,18 @@ func (c *Client) Entries(filter *Filter) (*EntryResultSet, error) {
 	return &result, nil
 }
 
-// FeedEntries fetch feed entries.
+// FeedEntries fetches entries for a feed using the given filter.
 func (c *Client) FeedEntries(feedID int64, filter *Filter) (*EntryResultSet, error) {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FeedEntriesContext(ctx, feedID, filter)
+}
+
+// FeedEntriesContext fetches feed entries.
+func (c *Client) FeedEntriesContext(ctx context.Context, feedID int64, filter *Filter) (*EntryResultSet, error) {
 	path := buildFilterQueryString(fmt.Sprintf("/v1/feeds/%d/entries", feedID), filter)
 
-	body, err := c.request.Get(path)
+	body, err := c.request.Get(ctx, path)
 	if err != nil {
 		return nil, err
 	}
@@ -589,11 +938,18 @@ func (c *Client) FeedEntries(feedID int64, filter *Filter) (*EntryResultSet, err
 	return &result, nil
 }
 
-// CategoryEntries fetch entries of a category.
+// CategoryEntries fetches entries for a category using the given filter.
 func (c *Client) CategoryEntries(categoryID int64, filter *Filter) (*EntryResultSet, error) {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.CategoryEntriesContext(ctx, categoryID, filter)
+}
+
+// CategoryEntriesContext fetches category entries.
+func (c *Client) CategoryEntriesContext(ctx context.Context, categoryID int64, filter *Filter) (*EntryResultSet, error) {
 	path := buildFilterQueryString(fmt.Sprintf("/v1/categories/%d/entries", categoryID), filter)
 
-	body, err := c.request.Get(path)
+	body, err := c.request.Get(ctx, path)
 	if err != nil {
 		return nil, err
 	}
@@ -609,18 +965,32 @@ func (c *Client) CategoryEntries(categoryID int64, filter *Filter) (*EntryResult
 
 // UpdateEntries updates the status of a list of entries.
 func (c *Client) UpdateEntries(entryIDs []int64, status string) error {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateEntriesContext(ctx, entryIDs, status)
+}
+
+// UpdateEntriesContext updates the status of a list of entries.
+func (c *Client) UpdateEntriesContext(ctx context.Context, entryIDs []int64, status string) error {
 	type payload struct {
 		EntryIDs []int64 `json:"entry_ids"`
 		Status   string  `json:"status"`
 	}
 
-	_, err := c.request.Put("/v1/entries", &payload{EntryIDs: entryIDs, Status: status})
+	_, err := c.request.Put(ctx, "/v1/entries", &payload{EntryIDs: entryIDs, Status: status})
 	return err
 }
 
 // UpdateEntry updates an entry.
 func (c *Client) UpdateEntry(entryID int64, entryChanges *EntryModificationRequest) (*Entry, error) {
-	body, err := c.request.Put(fmt.Sprintf("/v1/entries/%d", entryID), entryChanges)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateEntryContext(ctx, entryID, entryChanges)
+}
+
+// UpdateEntryContext updates an entry.
+func (c *Client) UpdateEntryContext(ctx context.Context, entryID int64, entryChanges *EntryModificationRequest) (*Entry, error) {
+	body, err := c.request.Put(ctx, fmt.Sprintf("/v1/entries/%d", entryID), entryChanges)
 	if err != nil {
 		return nil, err
 	}
@@ -634,21 +1004,42 @@ func (c *Client) UpdateEntry(entryID int64, entryChanges *EntryModificationReque
 	return entry, nil
 }
 
-// ToggleBookmark toggles entry bookmark value.
-func (c *Client) ToggleBookmark(entryID int64) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/entries/%d/bookmark", entryID), nil)
+// ToggleStarred toggles the starred flag of an entry.
+func (c *Client) ToggleStarred(entryID int64) error {
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.ToggleStarredContext(ctx, entryID)
+}
+
+// ToggleStarredContext toggles entry starred value.
+func (c *Client) ToggleStarredContext(ctx context.Context, entryID int64) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/entries/%d/star", entryID), nil)
 	return err
 }
 
 // SaveEntry sends an entry to a third-party service.
 func (c *Client) SaveEntry(entryID int64) error {
-	_, err := c.request.Post(fmt.Sprintf("/v1/entries/%d/save", entryID), nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.SaveEntryContext(ctx, entryID)
+}
+
+// SaveEntryContext sends an entry to a third-party service.
+func (c *Client) SaveEntryContext(ctx context.Context, entryID int64) error {
+	_, err := c.request.Post(ctx, fmt.Sprintf("/v1/entries/%d/save", entryID), nil)
 	return err
 }
 
 // FetchEntryOriginalContent fetches the original content of an entry using the scraper.
 func (c *Client) FetchEntryOriginalContent(entryID int64) (string, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/entries/%d/fetch-content", entryID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FetchEntryOriginalContentContext(ctx, entryID)
+}
+
+// FetchEntryOriginalContentContext fetches the original content of an entry using the scraper.
+func (c *Client) FetchEntryOriginalContentContext(ctx context.Context, entryID int64) (string, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/entries/%d/fetch-content", entryID))
 	if err != nil {
 		return "", err
 	}
@@ -667,7 +1058,14 @@ func (c *Client) FetchEntryOriginalContent(entryID int64) (string, error) {
 
 // FetchCounters fetches feed counters.
 func (c *Client) FetchCounters() (*FeedCounters, error) {
-	body, err := c.request.Get("/v1/feeds/counters")
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FetchCountersContext(ctx)
+}
+
+// FetchCountersContext fetches feed counters.
+func (c *Client) FetchCountersContext(ctx context.Context) (*FeedCounters, error) {
+	body, err := c.request.Get(ctx, "/v1/feeds/counters")
 	if err != nil {
 		return nil, err
 	}
@@ -683,13 +1081,27 @@ func (c *Client) FetchCounters() (*FeedCounters, error) {
 
 // FlushHistory changes all entries with the status "read" to "removed".
 func (c *Client) FlushHistory() error {
-	_, err := c.request.Put("/v1/flush-history", nil)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.FlushHistoryContext(ctx)
+}
+
+// FlushHistoryContext changes all entries with the status "read" to "removed".
+func (c *Client) FlushHistoryContext(ctx context.Context) error {
+	_, err := c.request.Put(ctx, "/v1/flush-history", nil)
 	return err
 }
 
 // Icon fetches a feed icon.
 func (c *Client) Icon(iconID int64) (*FeedIcon, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/icons/%d", iconID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.IconContext(ctx, iconID)
+}
+
+// IconContext fetches a feed icon.
+func (c *Client) IconContext(ctx context.Context, iconID int64) (*FeedIcon, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/icons/%d", iconID))
 	if err != nil {
 		return nil, err
 	}
@@ -705,7 +1117,14 @@ func (c *Client) Icon(iconID int64) (*FeedIcon, error) {
 
 // Enclosure fetches a specific enclosure.
 func (c *Client) Enclosure(enclosureID int64) (*Enclosure, error) {
-	body, err := c.request.Get(fmt.Sprintf("/v1/enclosures/%d", enclosureID))
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.EnclosureContext(ctx, enclosureID)
+}
+
+// EnclosureContext fetches a specific enclosure.
+func (c *Client) EnclosureContext(ctx context.Context, enclosureID int64) (*Enclosure, error) {
+	body, err := c.request.Get(ctx, fmt.Sprintf("/v1/enclosures/%d", enclosureID))
 	if err != nil {
 		return nil, err
 	}
@@ -721,7 +1140,14 @@ func (c *Client) Enclosure(enclosureID int64) (*Enclosure, error) {
 
 // UpdateEnclosure updates an enclosure.
 func (c *Client) UpdateEnclosure(enclosureID int64, enclosureUpdate *EnclosureUpdateRequest) error {
-	_, err := c.request.Put(fmt.Sprintf("/v1/enclosures/%d", enclosureID), enclosureUpdate)
+	ctx, cancel := withDefaultTimeout()
+	defer cancel()
+	return c.UpdateEnclosureContext(ctx, enclosureID, enclosureUpdate)
+}
+
+// UpdateEnclosureContext updates an enclosure.
+func (c *Client) UpdateEnclosureContext(ctx context.Context, enclosureID int64, enclosureUpdate *EnclosureUpdateRequest) error {
+	_, err := c.request.Put(ctx, fmt.Sprintf("/v1/enclosures/%d", enclosureID), enclosureUpdate)
 	return err
 }
 

client/doc.go

@@ -6,7 +6,7 @@ Package client implements a client library for the Miniflux REST API.
 
 # Examples
 
-This code snippet fetch the list of users:
+This example fetches the list of users:
 
 	import (
 		miniflux "miniflux.app/v2/client"
@@ -20,7 +20,7 @@ This code snippet fetch the list of users:
 	}
 	fmt.Println(users, err)
 
-This one discover subscriptions on a website:
+This example discovers subscriptions on a website:
 
 	subscriptions, err := client.Discover("https://example.org/")
 	if err != nil {

client/model.go

@@ -17,36 +17,37 @@ const (
 
 // User represents a user in the system.
 type User struct {
-	ID                      int64      `json:"id"`
-	Username                string     `json:"username"`
-	Password                string     `json:"password,omitempty"`
-	IsAdmin                 bool       `json:"is_admin"`
-	Theme                   string     `json:"theme"`
-	Language                string     `json:"language"`
-	Timezone                string     `json:"timezone"`
-	EntryDirection          string     `json:"entry_sorting_direction"`
-	EntryOrder              string     `json:"entry_sorting_order"`
-	Stylesheet              string     `json:"stylesheet"`
-	CustomJS                string     `json:"custom_js"`
-	GoogleID                string     `json:"google_id"`
-	OpenIDConnectID         string     `json:"openid_connect_id"`
-	EntriesPerPage          int        `json:"entries_per_page"`
-	KeyboardShortcuts       bool       `json:"keyboard_shortcuts"`
-	ShowReadingTime         bool       `json:"show_reading_time"`
-	EntrySwipe              bool       `json:"entry_swipe"`
-	GestureNav              string     `json:"gesture_nav"`
-	LastLoginAt             *time.Time `json:"last_login_at"`
-	DisplayMode             string     `json:"display_mode"`
-	DefaultReadingSpeed     int        `json:"default_reading_speed"`
-	CJKReadingSpeed         int        `json:"cjk_reading_speed"`
-	DefaultHomePage         string     `json:"default_home_page"`
-	CategoriesSortingOrder  string     `json:"categories_sorting_order"`
-	MarkReadOnView          bool       `json:"mark_read_on_view"`
-	MediaPlaybackRate       float64    `json:"media_playback_rate"`
-	BlockFilterEntryRules   string     `json:"block_filter_entry_rules"`
-	KeepFilterEntryRules    string     `json:"keep_filter_entry_rules"`
-	ExternalFontHosts       string     `json:"external_font_hosts"`
-	AlwaysOpenExternalLinks bool       `json:"always_open_external_links"`
+	ID                        int64      `json:"id"`
+	Username                  string     `json:"username"`
+	Password                  string     `json:"password,omitempty"`
+	IsAdmin                   bool       `json:"is_admin"`
+	Theme                     string     `json:"theme"`
+	Language                  string     `json:"language"`
+	Timezone                  string     `json:"timezone"`
+	EntryDirection            string     `json:"entry_sorting_direction"`
+	EntryOrder                string     `json:"entry_sorting_order"`
+	Stylesheet                string     `json:"stylesheet"`
+	CustomJS                  string     `json:"custom_js"`
+	GoogleID                  string     `json:"google_id"`
+	OpenIDConnectID           string     `json:"openid_connect_id"`
+	EntriesPerPage            int        `json:"entries_per_page"`
+	KeyboardShortcuts         bool       `json:"keyboard_shortcuts"`
+	ShowReadingTime           bool       `json:"show_reading_time"`
+	EntrySwipe                bool       `json:"entry_swipe"`
+	GestureNav                string     `json:"gesture_nav"`
+	LastLoginAt               *time.Time `json:"last_login_at"`
+	DisplayMode               string     `json:"display_mode"`
+	DefaultReadingSpeed       int        `json:"default_reading_speed"`
+	CJKReadingSpeed           int        `json:"cjk_reading_speed"`
+	DefaultHomePage           string     `json:"default_home_page"`
+	CategoriesSortingOrder    string     `json:"categories_sorting_order"`
+	MarkReadOnView            bool       `json:"mark_read_on_view"`
+	MediaPlaybackRate         float64    `json:"media_playback_rate"`
+	BlockFilterEntryRules     string     `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules      string     `json:"keep_filter_entry_rules"`
+	ExternalFontHosts         string     `json:"external_font_hosts"`
+	AlwaysOpenExternalLinks   bool       `json:"always_open_external_links"`
+	OpenExternalLinksInNewTab bool       `json:"open_external_links_in_new_tab"`
 }
 
 func (u User) String() string {
@@ -64,34 +65,35 @@ type UserCreationRequest struct {
 
 // UserModificationRequest represents the request to update a user.
 type UserModificationRequest struct {
-	Username                *string  `json:"username"`
-	Password                *string  `json:"password"`
-	IsAdmin                 *bool    `json:"is_admin"`
-	Theme                   *string  `json:"theme"`
-	Language                *string  `json:"language"`
-	Timezone                *string  `json:"timezone"`
-	EntryDirection          *string  `json:"entry_sorting_direction"`
-	EntryOrder              *string  `json:"entry_sorting_order"`
-	Stylesheet              *string  `json:"stylesheet"`
-	CustomJS                *string  `json:"custom_js"`
-	GoogleID                *string  `json:"google_id"`
-	OpenIDConnectID         *string  `json:"openid_connect_id"`
-	EntriesPerPage          *int     `json:"entries_per_page"`
-	KeyboardShortcuts       *bool    `json:"keyboard_shortcuts"`
-	ShowReadingTime         *bool    `json:"show_reading_time"`
-	EntrySwipe              *bool    `json:"entry_swipe"`
-	GestureNav              *string  `json:"gesture_nav"`
-	DisplayMode             *string  `json:"display_mode"`
-	DefaultReadingSpeed     *int     `json:"default_reading_speed"`
-	CJKReadingSpeed         *int     `json:"cjk_reading_speed"`
-	DefaultHomePage         *string  `json:"default_home_page"`
-	CategoriesSortingOrder  *string  `json:"categories_sorting_order"`
-	MarkReadOnView          *bool    `json:"mark_read_on_view"`
-	MediaPlaybackRate       *float64 `json:"media_playback_rate"`
-	BlockFilterEntryRules   *string  `json:"block_filter_entry_rules"`
-	KeepFilterEntryRules    *string  `json:"keep_filter_entry_rules"`
-	ExternalFontHosts       *string  `json:"external_font_hosts"`
-	AlwaysOpenExternalLinks *bool    `json:"always_open_external_links"`
+	Username                  *string  `json:"username"`
+	Password                  *string  `json:"password"`
+	IsAdmin                   *bool    `json:"is_admin"`
+	Theme                     *string  `json:"theme"`
+	Language                  *string  `json:"language"`
+	Timezone                  *string  `json:"timezone"`
+	EntryDirection            *string  `json:"entry_sorting_direction"`
+	EntryOrder                *string  `json:"entry_sorting_order"`
+	Stylesheet                *string  `json:"stylesheet"`
+	CustomJS                  *string  `json:"custom_js"`
+	GoogleID                  *string  `json:"google_id"`
+	OpenIDConnectID           *string  `json:"openid_connect_id"`
+	EntriesPerPage            *int     `json:"entries_per_page"`
+	KeyboardShortcuts         *bool    `json:"keyboard_shortcuts"`
+	ShowReadingTime           *bool    `json:"show_reading_time"`
+	EntrySwipe                *bool    `json:"entry_swipe"`
+	GestureNav                *string  `json:"gesture_nav"`
+	DisplayMode               *string  `json:"display_mode"`
+	DefaultReadingSpeed       *int     `json:"default_reading_speed"`
+	CJKReadingSpeed           *int     `json:"cjk_reading_speed"`
+	DefaultHomePage           *string  `json:"default_home_page"`
+	CategoriesSortingOrder    *string  `json:"categories_sorting_order"`
+	MarkReadOnView            *bool    `json:"mark_read_on_view"`
+	MediaPlaybackRate         *float64 `json:"media_playback_rate"`
+	BlockFilterEntryRules     *string  `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules      *string  `json:"keep_filter_entry_rules"`
+	ExternalFontHosts         *string  `json:"external_font_hosts"`
+	AlwaysOpenExternalLinks   *bool    `json:"always_open_external_links"`
+	OpenExternalLinksInNewTab *bool    `json:"open_external_links_in_new_tab"`
 }
 
 // Users represents a list of users.
@@ -147,7 +149,7 @@ type Feed struct {
 	FeedURL                     string    `json:"feed_url"`
 	SiteURL                     string    `json:"site_url"`
 	Title                       string    `json:"title"`
-	CheckedAt                   time.Time `json:"checked_at,omitempty"`
+	CheckedAt                   time.Time `json:"checked_at"`
 	EtagHeader                  string    `json:"etag_header,omitempty"`
 	LastModifiedHeader          string    `json:"last_modified_header,omitempty"`
 	ParsingErrorMsg             string    `json:"parsing_error_message,omitempty"`
@@ -158,9 +160,13 @@ type Feed struct {
 	FetchViaProxy               bool      `json:"fetch_via_proxy"`
 	ScraperRules                string    `json:"scraper_rules"`
 	RewriteRules                string    `json:"rewrite_rules"`
+	UrlRewriteRules             string    `json:"urlrewrite_rules"`
 	BlocklistRules              string    `json:"blocklist_rules"`
 	KeeplistRules               string    `json:"keeplist_rules"`
+	BlockFilterEntryRules       string    `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        string    `json:"keep_filter_entry_rules"`
 	Crawler                     bool      `json:"crawler"`
+	IgnoreEntryUpdates          bool      `json:"ignore_entry_updates"`
 	UserAgent                   string    `json:"user_agent"`
 	Cookie                      string    `json:"cookie"`
 	Username                    string    `json:"username"`
@@ -180,14 +186,18 @@ type FeedCreationRequest struct {
 	Username                    string `json:"username"`
 	Password                    string `json:"password"`
 	Crawler                     bool   `json:"crawler"`
+	IgnoreEntryUpdates          bool   `json:"ignore_entry_updates"`
 	Disabled                    bool   `json:"disabled"`
 	IgnoreHTTPCache             bool   `json:"ignore_http_cache"`
 	AllowSelfSignedCertificates bool   `json:"allow_self_signed_certificates"`
 	FetchViaProxy               bool   `json:"fetch_via_proxy"`
 	ScraperRules                string `json:"scraper_rules"`
 	RewriteRules                string `json:"rewrite_rules"`
+	UrlRewriteRules             string `json:"urlrewrite_rules"`
 	BlocklistRules              string `json:"blocklist_rules"`
 	KeeplistRules               string `json:"keeplist_rules"`
+	BlockFilterEntryRules       string `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        string `json:"keep_filter_entry_rules"`
 	HideGlobally                bool   `json:"hide_globally"`
 	DisableHTTP2                bool   `json:"disable_http2"`
 	ProxyURL                    string `json:"proxy_url"`
@@ -200,9 +210,13 @@ type FeedModificationRequest struct {
 	Title                       *string `json:"title"`
 	ScraperRules                *string `json:"scraper_rules"`
 	RewriteRules                *string `json:"rewrite_rules"`
+	UrlRewriteRules             *string `json:"urlrewrite_rules"`
 	BlocklistRules              *string `json:"blocklist_rules"`
 	KeeplistRules               *string `json:"keeplist_rules"`
+	BlockFilterEntryRules       *string `json:"block_filter_entry_rules"`
+	KeepFilterEntryRules        *string `json:"keep_filter_entry_rules"`
 	Crawler                     *bool   `json:"crawler"`
+	IgnoreEntryUpdates          *bool   `json:"ignore_entry_updates"`
 	UserAgent                   *string `json:"user_agent"`
 	Cookie                      *string `json:"cookie"`
 	Username                    *string `json:"username"`
@@ -345,6 +359,9 @@ type APIKeyCreationRequest struct {
 	Description string `json:"description"`
 }
 
+// SetOptionalField returns a pointer to the given value so optional request fields can be marked as set.
+//
+//go:fix inline
 func SetOptionalField[T any](value T) *T {
-	return &value
+	return new(value)
 }

client/options.go

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package client // import "miniflux.app/v2/client"
+
+import "net/http"
+
+type Option func(*request)
+
+// WithAPIKey sets the API key for the client.
+func WithAPIKey(apiKey string) Option {
+	return func(r *request) {
+		r.apiKey = apiKey
+	}
+}
+
+// WithCredentials sets the username and password for the client.
+func WithCredentials(username, password string) Option {
+	return func(r *request) {
+		r.username = username
+		r.password = password
+	}
+}
+
+// WithHTTPClient sets the HTTP client for the client.
+func WithHTTPClient(client *http.Client) Option {
+	return func(r *request) {
+		r.client = client
+	}
+}

client/request.go

@@ -5,6 +5,7 @@ package client // import "miniflux.app/v2/client"
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -17,7 +18,7 @@ import (
 
 const (
 	userAgent      = "Miniflux Client Library"
-	defaultTimeout = 80
+	defaultTimeout = 80 * time.Second
 )
 
 // List of exposed errors.
@@ -39,30 +40,36 @@ type request struct {
 	username string
 	password string
 	apiKey   string
+	client   *http.Client
 }
 
-func (r *request) Get(path string) (io.ReadCloser, error) {
-	return r.execute(http.MethodGet, path, nil)
+func (r *request) Get(ctx context.Context, path string) (io.ReadCloser, error) {
+	return r.execute(ctx, http.MethodGet, path, nil)
 }
 
-func (r *request) Post(path string, data interface{}) (io.ReadCloser, error) {
-	return r.execute(http.MethodPost, path, data)
+func (r *request) Post(ctx context.Context, path string, data any) (io.ReadCloser, error) {
+	return r.execute(ctx, http.MethodPost, path, data)
 }
 
-func (r *request) PostFile(path string, f io.ReadCloser) (io.ReadCloser, error) {
-	return r.execute(http.MethodPost, path, f)
+func (r *request) PostFile(ctx context.Context, path string, f io.ReadCloser) (io.ReadCloser, error) {
+	return r.execute(ctx, http.MethodPost, path, f)
 }
 
-func (r *request) Put(path string, data interface{}) (io.ReadCloser, error) {
-	return r.execute(http.MethodPut, path, data)
+func (r *request) Put(ctx context.Context, path string, data any) (io.ReadCloser, error) {
+	return r.execute(ctx, http.MethodPut, path, data)
 }
 
-func (r *request) Delete(path string) error {
-	_, err := r.execute(http.MethodDelete, path, nil)
+func (r *request) Delete(ctx context.Context, path string) error {
+	_, err := r.execute(ctx, http.MethodDelete, path, nil)
 	return err
 }
 
-func (r *request) execute(method, path string, data interface{}) (io.ReadCloser, error) {
+func (r *request) execute(
+	ctx context.Context,
+	method string,
+	path string,
+	data any,
+) (io.ReadCloser, error) {
 	if r.endpoint == "" {
 		return nil, ErrEmptyEndpoint
 	}
@@ -75,12 +82,13 @@ func (r *request) execute(method, path string, data interface{}) (io.ReadCloser,
 		return nil, err
 	}
 
-	request := &http.Request{
-		URL:    u,
-		Method: method,
-		Header: r.buildHeaders(),
+	request, err := http.NewRequestWithContext(ctx, method, u.String(), nil)
+	if err != nil {
+		return nil, err
 	}
 
+	request.Header = r.buildHeaders()
+
 	if r.username != "" && r.password != "" {
 		request.SetBasicAuth(r.username, r.password)
 	}
@@ -94,7 +102,7 @@ func (r *request) execute(method, path string, data interface{}) (io.ReadCloser,
 		}
 	}
 
-	client := r.buildClient()
+	client := r.client
 	response, err := client.Do(request)
 	if err != nil {
 		return nil, err
@@ -143,12 +151,6 @@ func (r *request) execute(method, path string, data interface{}) (io.ReadCloser,
 	return response.Body, nil
 }
 
-func (r *request) buildClient() http.Client {
-	return http.Client{
-		Timeout: defaultTimeout * time.Second,
-	}
-}
-
 func (r *request) buildHeaders() http.Header {
 	headers := make(http.Header)
 	headers.Add("User-Agent", userAgent)
@@ -160,7 +162,7 @@ func (r *request) buildHeaders() http.Header {
 	return headers
 }
 
-func (r *request) toJSON(v interface{}) []byte {
+func (r *request) toJSON(v any) []byte {
 	b, err := json.Marshal(v)
 	if err != nil {
 		log.Println("Unable to convert interface to JSON:", err)

contrib/docker-compose/basic.yml

@@ -19,14 +19,14 @@ services:
     # healthcheck:
     #  test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
   db:
-    image: postgres:15
+    image: postgres:latest
     container_name: postgres
     environment:
       - POSTGRES_USER=miniflux
       - POSTGRES_PASSWORD=secret
       - POSTGRES_DB=miniflux
     volumes:
-      - miniflux-db:/var/lib/postgresql/data
+      - miniflux-db:/var/lib/postgresql
     healthcheck:
       test: ["CMD", "pg_isready", "-U", "miniflux"]
       interval: 10s

contrib/docker-compose/caddy.yml

@@ -25,13 +25,13 @@ services:
       - ADMIN_PASSWORD=test123
       - BASE_URL=https://miniflux.example.org
   db:
-    image: postgres:15
+    image: postgres:latest
     container_name: postgres
     environment:
       - POSTGRES_USER=miniflux
       - POSTGRES_PASSWORD=secret
     volumes:
-      - miniflux-db:/var/lib/postgresql/data
+      - miniflux-db:/var/lib/postgresql
     healthcheck:
       test: ["CMD", "pg_isready", "-U", "miniflux"]
       interval: 10s

contrib/docker-compose/traefik.yml

@@ -37,13 +37,13 @@ services:
       - "traefik.http.routers.miniflux.entrypoints=websecure"
       - "traefik.http.routers.miniflux.tls.certresolver=myresolver"
   db:
-    image: postgres:15
+    image: postgres:latest
     container_name: postgres
     environment:
       - POSTGRES_USER=miniflux
       - POSTGRES_PASSWORD=secret
     volumes:
-      - miniflux-db:/var/lib/postgresql/data
+      - miniflux-db:/var/lib/postgresql
     healthcheck:
       test: ["CMD", "pg_isready", "-U", "miniflux"]
       interval: 10s

go.mod

@@ -1,49 +1,49 @@
 module miniflux.app/v2
 
-// +heroku goVersion go1.23
+// +heroku goVersion go1.26
 
 require (
-	github.com/PuerkitoBio/goquery v1.10.3
-	github.com/andybalholm/brotli v1.1.1
-	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/go-webauthn/webauthn v0.13.0
-	github.com/gorilla/mux v1.8.1
-	github.com/lib/pq v1.10.9
-	github.com/mattn/go-sqlite3 v1.14.28
-	github.com/prometheus/client_golang v1.22.0
-	github.com/tdewolff/minify/v2 v2.23.8
-	golang.org/x/crypto v0.38.0
-	golang.org/x/image v0.27.0
-	golang.org/x/net v0.40.0
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/term v0.32.0
+	github.com/PuerkitoBio/goquery v1.12.0
+	github.com/andybalholm/brotli v1.2.1
+	github.com/coreos/go-oidc/v3 v3.17.0
+	github.com/go-webauthn/webauthn v0.16.2
+	github.com/lib/pq v1.12.3
+	github.com/prometheus/client_golang v1.23.2
+	github.com/tdewolff/minify/v2 v2.24.11
+	golang.org/x/crypto v0.49.0
+	golang.org/x/image v0.38.0
+	golang.org/x/net v0.52.0
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/term v0.41.0
+	golang.org/x/text v0.35.0
 )
 
 require (
-	github.com/go-webauthn/x v0.1.21 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
-	github.com/google/go-tpm v0.9.5 // indirect
+	github.com/go-webauthn/x v0.2.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
 )
 
 require (
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/tdewolff/parse/v2 v2.8.1 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/tdewolff/parse/v2 v2.8.11 // indirect
+	github.com/tinylib/msgp v1.6.3 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 )
 
-go 1.23.0
-
-toolchain go1.24.1
+go 1.26.0

go.sum

@@ -1,81 +1,96 @@
-github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
-github.com/PuerkitoBio/goquery v1.10.3/go.mod h1:tMUX0zDMHXYlAQk6p35XxQMqMweEKB7iK7iLNd4RH4Y=
-github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
-github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
+github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
+github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
-github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-webauthn/webauthn v0.13.0 h1:cJIL1/1l+22UekVhipziAaSgESJxokYkowUqAIsWs0Y=
-github.com/go-webauthn/webauthn v0.13.0/go.mod h1:Oy9o2o79dbLKRPZWWgRIOdtBGAhKnDIaBp2PFkICRHs=
-github.com/go-webauthn/x v0.1.21 h1:nFbckQxudvHEJn2uy1VEi713MeSpApoAv9eRqsb9AdQ=
-github.com/go-webauthn/x v0.1.21/go.mod h1:sEYohtg1zL4An1TXIUIQ5csdmoO+WO0R4R2pGKaHYKA=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.16.2 h1:n116UuvIa7nUVGFP2hO9U24gBqhJTcmbU3ph0wgVzFM=
+github.com/go-webauthn/webauthn v0.16.2/go.mod h1:R2xjJxSPat5PYKg5r6cUmqXgbHtbv4GmF6uGkqFMLNI=
+github.com/go-webauthn/x v0.2.2 h1:zIiipvMbr48CXi5RG0XdBJR94kd8I5LfzHPb/q+YYmk=
+github.com/go-webauthn/x v0.2.2/go.mod h1:IpJ5qyWB9NRhLX3C7gIfjTU7RZLXEP6kzFkoVSE7Fz4=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-tpm v0.9.5 h1:ocUmnDebX54dnW+MQWGQRbdaAcJELsa6PqZhJ48KwVU=
-github.com/google/go-tpm v0.9.5/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
-github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/tdewolff/minify/v2 v2.23.8 h1:tvjHzRer46kwOfpdCBCWsDblCw3QtnLJRd61pTVkyZ8=
-github.com/tdewolff/minify/v2 v2.23.8/go.mod h1:VW3ISUd3gDOZuQ/jwZr4sCzsuX+Qvsx87FDMjk6Rvno=
-github.com/tdewolff/parse/v2 v2.8.1 h1:J5GSHru6o3jF1uLlEKVXkDxxcVx6yzOlIVIotK4w2po=
-github.com/tdewolff/parse/v2 v2.8.1/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tdewolff/minify/v2 v2.24.11 h1:JlANsiWaRBXedoYtsiZgY3YFkdr42oF32vp2SLgQKi4=
+github.com/tdewolff/minify/v2 v2.24.11/go.mod h1:exq1pjdrh9uAICdfVKQwqz6MsJmWmQahZuTC6pTO6ro=
+github.com/tdewolff/parse/v2 v2.8.11 h1:SGyjEy3xEqd+W9WVzTlTQ5GkP/en4a1AZNZVJ1cvgm0=
+github.com/tdewolff/parse/v2 v2.8.11/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
 github.com/tdewolff/test v1.0.11 h1:FdLbwQVHxqG16SlkGveC0JVyrJN62COWTRyUFzfbtBE=
 github.com/tdewolff/test v1.0.11/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
+github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
+github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
-golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
-golang.org/x/image v0.27.0/go.mod h1:xbdrClrAUway1MUTEZDq9mz/UpRwYAkFFNUslZtcB+g=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
+golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -90,10 +105,10 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
-golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -112,8 +127,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -123,8 +138,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -134,8 +149,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
@@ -143,7 +158,10 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/api/api.go

@@ -5,90 +5,73 @@ package api // import "miniflux.app/v2/internal/api"
 
 import (
 	"net/http"
-	"runtime"
 
-	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/storage"
-	"miniflux.app/v2/internal/version"
 	"miniflux.app/v2/internal/worker"
-
-	"github.com/gorilla/mux"
 )
 
 type handler struct {
-	store  *storage.Storage
-	pool   *worker.Pool
-	router *mux.Router
+	store *storage.Storage
+	pool  *worker.Pool
 }
 
-// Serve declares API routes for the application.
-func Serve(router *mux.Router, store *storage.Storage, pool *worker.Pool) {
-	handler := &handler{store, pool, router}
-
-	sr := router.PathPrefix("/v1").Subrouter()
+// NewHandler returns an http.Handler that handles API v1 calls.
+// The returned handler expects the base path to be stripped from the request URL.
+func NewHandler(store *storage.Storage, pool *worker.Pool) http.Handler {
+	handler := &handler{store: store, pool: pool}
 	middleware := newMiddleware(store)
-	sr.Use(middleware.handleCORS)
-	sr.Use(middleware.apiKeyAuth)
-	sr.Use(middleware.basicAuth)
-	sr.Methods(http.MethodOptions)
-	sr.HandleFunc("/users", handler.createUser).Methods(http.MethodPost)
-	sr.HandleFunc("/users", handler.users).Methods(http.MethodGet)
-	sr.HandleFunc("/users/{userID:[0-9]+}", handler.userByID).Methods(http.MethodGet)
-	sr.HandleFunc("/users/{userID:[0-9]+}", handler.updateUser).Methods(http.MethodPut)
-	sr.HandleFunc("/users/{userID:[0-9]+}", handler.removeUser).Methods(http.MethodDelete)
-	sr.HandleFunc("/users/{userID:[0-9]+}/mark-all-as-read", handler.markUserAsRead).Methods(http.MethodPut)
-	sr.HandleFunc("/users/{username}", handler.userByUsername).Methods(http.MethodGet)
-	sr.HandleFunc("/me", handler.currentUser).Methods(http.MethodGet)
-	sr.HandleFunc("/categories", handler.createCategory).Methods(http.MethodPost)
-	sr.HandleFunc("/categories", handler.getCategories).Methods(http.MethodGet)
-	sr.HandleFunc("/categories/{categoryID}", handler.updateCategory).Methods(http.MethodPut)
-	sr.HandleFunc("/categories/{categoryID}", handler.removeCategory).Methods(http.MethodDelete)
-	sr.HandleFunc("/categories/{categoryID}/mark-all-as-read", handler.markCategoryAsRead).Methods(http.MethodPut)
-	sr.HandleFunc("/categories/{categoryID}/feeds", handler.getCategoryFeeds).Methods(http.MethodGet)
-	sr.HandleFunc("/categories/{categoryID}/refresh", handler.refreshCategory).Methods(http.MethodPut)
-	sr.HandleFunc("/categories/{categoryID}/entries", handler.getCategoryEntries).Methods(http.MethodGet)
-	sr.HandleFunc("/categories/{categoryID}/entries/{entryID}", handler.getCategoryEntry).Methods(http.MethodGet)
-	sr.HandleFunc("/discover", handler.discoverSubscriptions).Methods(http.MethodPost)
-	sr.HandleFunc("/feeds", handler.createFeed).Methods(http.MethodPost)
-	sr.HandleFunc("/feeds", handler.getFeeds).Methods(http.MethodGet)
-	sr.HandleFunc("/feeds/counters", handler.fetchCounters).Methods(http.MethodGet)
-	sr.HandleFunc("/feeds/refresh", handler.refreshAllFeeds).Methods(http.MethodPut)
-	sr.HandleFunc("/feeds/{feedID}/refresh", handler.refreshFeed).Methods(http.MethodPut)
-	sr.HandleFunc("/feeds/{feedID}", handler.getFeed).Methods(http.MethodGet)
-	sr.HandleFunc("/feeds/{feedID}", handler.updateFeed).Methods(http.MethodPut)
-	sr.HandleFunc("/feeds/{feedID}", handler.removeFeed).Methods(http.MethodDelete)
-	sr.HandleFunc("/feeds/{feedID}/icon", handler.getIconByFeedID).Methods(http.MethodGet)
-	sr.HandleFunc("/feeds/{feedID}/mark-all-as-read", handler.markFeedAsRead).Methods(http.MethodPut)
-	sr.HandleFunc("/export", handler.exportFeeds).Methods(http.MethodGet)
-	sr.HandleFunc("/import", handler.importFeeds).Methods(http.MethodPost)
-	sr.HandleFunc("/feeds/{feedID}/entries", handler.getFeedEntries).Methods(http.MethodGet)
-	sr.HandleFunc("/feeds/{feedID}/entries/{entryID}", handler.getFeedEntry).Methods(http.MethodGet)
-	sr.HandleFunc("/entries", handler.getEntries).Methods(http.MethodGet)
-	sr.HandleFunc("/entries", handler.setEntryStatus).Methods(http.MethodPut)
-	sr.HandleFunc("/entries/{entryID}", handler.getEntry).Methods(http.MethodGet)
-	sr.HandleFunc("/entries/{entryID}", handler.updateEntry).Methods(http.MethodPut)
-	sr.HandleFunc("/entries/{entryID}/bookmark", handler.toggleBookmark).Methods(http.MethodPut)
-	sr.HandleFunc("/entries/{entryID}/save", handler.saveEntry).Methods(http.MethodPost)
-	sr.HandleFunc("/entries/{entryID}/fetch-content", handler.fetchContent).Methods(http.MethodGet)
-	sr.HandleFunc("/flush-history", handler.flushHistory).Methods(http.MethodPut, http.MethodDelete)
-	sr.HandleFunc("/icons/{iconID}", handler.getIconByIconID).Methods(http.MethodGet)
-	sr.HandleFunc("/enclosures/{enclosureID}", handler.getEnclosureByID).Methods(http.MethodGet)
-	sr.HandleFunc("/enclosures/{enclosureID}", handler.updateEnclosureByID).Methods(http.MethodPut)
-	sr.HandleFunc("/integrations/status", handler.getIntegrationsStatus).Methods(http.MethodGet)
-	sr.HandleFunc("/version", handler.versionHandler).Methods(http.MethodGet)
-	sr.HandleFunc("/api-keys", handler.createAPIKey).Methods(http.MethodPost)
-	sr.HandleFunc("/api-keys", handler.getAPIKeys).Methods(http.MethodGet)
-	sr.HandleFunc("/api-keys/{apiKeyID}", handler.deleteAPIKey).Methods(http.MethodDelete)
-}
 
-func (h *handler) versionHandler(w http.ResponseWriter, r *http.Request) {
-	json.OK(w, r, &versionResponse{
-		Version:   version.Version,
-		Commit:    version.Commit,
-		BuildDate: version.BuildDate,
-		GoVersion: runtime.Version(),
-		Compiler:  runtime.Compiler,
-		Arch:      runtime.GOARCH,
-		OS:        runtime.GOOS,
-	})
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /v1/users", handler.createUserHandler)
+	mux.HandleFunc("GET /v1/users", handler.usersHandler)
+	mux.HandleFunc("GET /v1/users/{identifier}", handler.dispatchUserLookupHandler)
+	mux.HandleFunc("PUT /v1/users/{userID}", handler.updateUserHandler)
+	mux.HandleFunc("DELETE /v1/users/{userID}", handler.removeUserHandler)
+	mux.HandleFunc("PUT /v1/users/{userID}/mark-all-as-read", handler.markUserAsReadHandler)
+	mux.HandleFunc("GET /v1/me", handler.currentUserHandler)
+	mux.HandleFunc("POST /v1/categories", handler.createCategoryHandler)
+	mux.HandleFunc("GET /v1/categories", handler.getCategoriesHandler)
+	mux.HandleFunc("PUT /v1/categories/{categoryID}", handler.updateCategoryHandler)
+	mux.HandleFunc("DELETE /v1/categories/{categoryID}", handler.removeCategoryHandler)
+	mux.HandleFunc("PUT /v1/categories/{categoryID}/mark-all-as-read", handler.markCategoryAsReadHandler)
+	mux.HandleFunc("GET /v1/categories/{categoryID}/feeds", handler.getCategoryFeedsHandler)
+	mux.HandleFunc("PUT /v1/categories/{categoryID}/refresh", handler.refreshCategoryHandler)
+	mux.HandleFunc("GET /v1/categories/{categoryID}/entries", handler.getCategoryEntriesHandler)
+	mux.HandleFunc("GET /v1/categories/{categoryID}/entries/{entryID}", handler.getCategoryEntryHandler)
+	mux.HandleFunc("POST /v1/discover", handler.discoverSubscriptionsHandler)
+	mux.HandleFunc("POST /v1/feeds", handler.createFeedHandler)
+	mux.HandleFunc("GET /v1/feeds", handler.getFeedsHandler)
+	mux.HandleFunc("GET /v1/feeds/counters", handler.fetchCountersHandler)
+	mux.HandleFunc("PUT /v1/feeds/refresh", handler.refreshAllFeedsHandler)
+	mux.HandleFunc("PUT /v1/feeds/{feedID}/refresh", handler.refreshFeedHandler)
+	mux.HandleFunc("GET /v1/feeds/{feedID}", handler.getFeedHandler)
+	mux.HandleFunc("PUT /v1/feeds/{feedID}", handler.updateFeedHandler)
+	mux.HandleFunc("DELETE /v1/feeds/{feedID}", handler.removeFeedHandler)
+	mux.HandleFunc("GET /v1/feeds/{feedID}/icon", handler.getIconByFeedIDHandler)
+	mux.HandleFunc("PUT /v1/feeds/{feedID}/mark-all-as-read", handler.markFeedAsReadHandler)
+	mux.HandleFunc("GET /v1/export", handler.exportFeedsHandler)
+	mux.HandleFunc("POST /v1/import", handler.importFeedsHandler)
+	mux.HandleFunc("GET /v1/feeds/{feedID}/entries", handler.getFeedEntriesHandler)
+	mux.HandleFunc("POST /v1/feeds/{feedID}/entries/import", handler.importFeedEntryHandler)
+	mux.HandleFunc("GET /v1/feeds/{feedID}/entries/{entryID}", handler.getFeedEntryHandler)
+	mux.HandleFunc("GET /v1/entries", handler.getEntriesHandler)
+	mux.HandleFunc("PUT /v1/entries", handler.setEntryStatusHandler)
+	mux.HandleFunc("GET /v1/entries/{entryID}", handler.getEntryHandler)
+	mux.HandleFunc("PUT /v1/entries/{entryID}", handler.updateEntryHandler)
+	mux.HandleFunc("PUT /v1/entries/{entryID}/bookmark", handler.toggleStarredHandler)
+	mux.HandleFunc("PUT /v1/entries/{entryID}/star", handler.toggleStarredHandler)
+	mux.HandleFunc("POST /v1/entries/{entryID}/save", handler.saveEntryHandler)
+	mux.HandleFunc("GET /v1/entries/{entryID}/fetch-content", handler.fetchContentHandler)
+	mux.HandleFunc("PUT /v1/flush-history", handler.flushHistoryHandler)
+	mux.HandleFunc("DELETE /v1/flush-history", handler.flushHistoryHandler)
+	mux.HandleFunc("GET /v1/icons/{iconID}", handler.getIconByIconIDHandler)
+	mux.HandleFunc("GET /v1/enclosures/{enclosureID}", handler.getEnclosureByIDHandler)
+	mux.HandleFunc("PUT /v1/enclosures/{enclosureID}", handler.updateEnclosureByIDHandler)
+	mux.HandleFunc("GET /v1/integrations/status", handler.getIntegrationsStatusHandler)
+	mux.HandleFunc("GET /v1/version", handler.versionHandler)
+	mux.HandleFunc("POST /v1/api-keys", handler.createAPIKeyHandler)
+	mux.HandleFunc("GET /v1/api-keys", handler.getAPIKeysHandler)
+	mux.HandleFunc("DELETE /v1/api-keys/{apiKeyID}", handler.deleteAPIKeyHandler)
+
+	return middleware.withCORSHeaders(middleware.validateAPIKeyAuth(middleware.validateBasicAuth(mux)))
 }

internal/api/api_integration_test.go

@@ -8,12 +8,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math/rand"
+	"math/rand/v2"
 	"os"
 	"strings"
 	"testing"
 
 	miniflux "miniflux.app/v2/client"
+	"miniflux.app/v2/internal/model"
 )
 
 const skipIntegrationTestsMessage = `Set TEST_MINIFLUX_* environment variables to run the API integration tests`
@@ -579,7 +580,7 @@ func TestUpdateUserEndpointByChangingDefaultTheme(t *testing.T) {
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		Theme: miniflux.SetOptionalField("dark_serif"),
+		Theme: new("dark_serif"),
 	}
 
 	updatedUser, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest)
@@ -608,7 +609,7 @@ func TestUpdateUserEndpointByChangingExternalFonts(t *testing.T) {
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		ExternalFontHosts: miniflux.SetOptionalField("  fonts.example.org  "),
+		ExternalFontHosts: new("  fonts.example.org  "),
 	}
 
 	updatedUser, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest)
@@ -637,7 +638,7 @@ func TestUpdateUserEndpointByChangingExternalFontsWithInvalidValue(t *testing.T)
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		ExternalFontHosts: miniflux.SetOptionalField("'self' *"),
+		ExternalFontHosts: new("'self' *"),
 	}
 
 	if _, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest); err == nil {
@@ -661,7 +662,7 @@ func TestUpdateUserEndpointByChangingCustomJS(t *testing.T) {
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		CustomJS: miniflux.SetOptionalField("alert('Hello, World!');"),
+		CustomJS: new("alert('Hello, World!');"),
 	}
 
 	updatedUser, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest)
@@ -690,7 +691,7 @@ func TestUpdateUserEndpointByChangingDefaultThemeToInvalidValue(t *testing.T) {
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		Theme: miniflux.SetOptionalField("invalid_theme"),
+		Theme: new("invalid_theme"),
 	}
 
 	_, err = regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest)
@@ -720,7 +721,7 @@ func TestRegularUsersCannotUpdateOtherUsers(t *testing.T) {
 	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
 
 	userUpdateRequest := &miniflux.UserModificationRequest{
-		Theme: miniflux.SetOptionalField("dark_serif"),
+		Theme: new("dark_serif"),
 	}
 
 	_, err = regularUserClient.UpdateUser(adminUser.ID, userUpdateRequest)
@@ -1089,7 +1090,7 @@ func TestUpdateCategoryWithOptions(t *testing.T) {
 	}
 
 	updatedCategory, err := regularUserClient.UpdateCategoryWithOptions(newCategory.ID, &miniflux.CategoryModificationRequest{
-		Title: miniflux.SetOptionalField("new title"),
+		Title: new("new title"),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -1108,7 +1109,7 @@ func TestUpdateCategoryWithOptions(t *testing.T) {
 	}
 
 	updatedCategory, err = regularUserClient.UpdateCategoryWithOptions(newCategory.ID, &miniflux.CategoryModificationRequest{
-		HideGlobally: miniflux.SetOptionalField(true),
+		HideGlobally: new(true),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -1127,14 +1128,14 @@ func TestUpdateCategoryWithOptions(t *testing.T) {
 	}
 
 	updatedCategory, err = regularUserClient.UpdateCategoryWithOptions(newCategory.ID, &miniflux.CategoryModificationRequest{
-		HideGlobally: miniflux.SetOptionalField(false),
+		HideGlobally: new(false),
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	if updatedCategory.ID != newCategory.ID {
-		t.Errorf(`Invalid categoryID, got %q`, updatedCategory.ID)
+		t.Errorf(`Invalid categoryID, got %d`, updatedCategory.ID)
 	}
 
 	if updatedCategory.Title != "new title" {
@@ -1262,6 +1263,14 @@ func TestGetCategoriesEndpoint(t *testing.T) {
 		t.Fatalf(`Invalid title, got %q instead of %q`, categories[0].Title, "All")
 	}
 
+	if categories[0].FeedCount != nil {
+		t.Errorf(`Expected FeedCount to be nil, got %d`, *categories[0].FeedCount)
+	}
+
+	if categories[0].TotalUnread != nil {
+		t.Errorf(`Expected TotalUnread to be nil, got %d`, *categories[0].TotalUnread)
+	}
+
 	if categories[1].ID != category.ID {
 		t.Fatalf(`Invalid categoryID, got %d`, categories[0].ID)
 	}
@@ -1273,6 +1282,40 @@ func TestGetCategoriesEndpoint(t *testing.T) {
 	if categories[1].Title != "My category" {
 		t.Fatalf(`Invalid title, got %q instead of %q`, categories[0].Title, "My category")
 	}
+
+	if categories[1].FeedCount != nil {
+		t.Errorf(`Expected FeedCount to be nil, got %d`, *categories[1].FeedCount)
+	}
+
+	if categories[1].TotalUnread != nil {
+		t.Errorf(`Expected TotalUnread to be nil, got %d`, *categories[1].TotalUnread)
+	}
+
+	categories, err = regularUserClient.CategoriesWithCounters()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(categories) != 2 {
+		t.Fatalf(`Invalid number of categories, got %d instead of %d`, len(categories), 1)
+	}
+
+	if categories[1].FeedCount == nil {
+		t.Fatalf(`Expected FeedCount to be not nil`)
+	}
+
+	if categories[1].TotalUnread == nil {
+		t.Fatalf(`Expected TotalUnread to be not nil`)
+	}
+
+	expectedCounterValue := 0
+	if *categories[1].FeedCount != expectedCounterValue {
+		t.Errorf(`Expected FeedCount to be %d, got %d`, expectedCounterValue, *categories[1].FeedCount)
+	}
+
+	if *categories[1].TotalUnread != expectedCounterValue {
+		t.Errorf(`Expected TotalUnread to be %d, got %d`, expectedCounterValue, *categories[1].TotalUnread)
+	}
 }
 
 func TestMarkCategoryAsReadEndpoint(t *testing.T) {
@@ -1569,7 +1612,7 @@ func TestUpdateFeedEndpoint(t *testing.T) {
 	}
 
 	feedUpdateRequest := &miniflux.FeedModificationRequest{
-		FeedURL: miniflux.SetOptionalField("https://example.org/feed.xml"),
+		FeedURL: new("https://example.org/feed.xml"),
 	}
 
 	updatedFeed, err := regularUserClient.UpdateFeed(feedID, feedUpdateRequest)
@@ -1610,7 +1653,7 @@ func TestCannotHaveDuplicateFeedWhenUpdatingFeed(t *testing.T) {
 	}
 
 	feedUpdateRequest := &miniflux.FeedModificationRequest{
-		FeedURL: miniflux.SetOptionalField(testConfig.testFeedURL),
+		FeedURL: new(testConfig.testFeedURL),
 	}
 
 	if _, err := regularUserClient.UpdateFeed(feedID, feedUpdateRequest); err == nil {
@@ -1642,7 +1685,7 @@ func TestUpdateFeedWithInvalidCategory(t *testing.T) {
 	}
 
 	feedUpdateRequest := &miniflux.FeedModificationRequest{
-		CategoryID: miniflux.SetOptionalField(int64(123456789)),
+		CategoryID: new(int64(123456789)),
 	}
 
 	if _, err := regularUserClient.UpdateFeed(feedID, feedUpdateRequest); err == nil {
@@ -2339,7 +2382,6 @@ func TestGetGlobalEntriesEndpoint(t *testing.T) {
 	}
 
 	feedIDEntry, err := regularUserClient.Feed(feedID)
-
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2371,6 +2413,64 @@ func TestGetGlobalEntriesEndpoint(t *testing.T) {
 	}
 }
 
+func TestCannotGetRemovedEntries(t *testing.T) {
+	testConfig := newIntegrationTestConfig()
+	if !testConfig.isConfigured() {
+		t.Skip(skipIntegrationTestsMessage)
+	}
+
+	adminClient := miniflux.NewClient(testConfig.testBaseURL, testConfig.testAdminUsername, testConfig.testAdminPassword)
+
+	regularTestUser, err := adminClient.CreateUser(testConfig.genRandomUsername(), testConfig.testRegularPassword, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer adminClient.DeleteUser(regularTestUser.ID)
+
+	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
+
+	feedID, err := regularUserClient.CreateFeed(&miniflux.FeedCreationRequest{
+		FeedURL: testConfig.testFeedURL,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	feedEntries, err := regularUserClient.Entries(&miniflux.Filter{FeedID: feedID})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if feedEntries.Total == 0 {
+		t.Fatalf(`Expected at least one entry, got none`)
+	}
+
+	if err := regularUserClient.UpdateEntries([]int64{feedEntries.Entries[0].ID}, miniflux.EntryStatusRemoved); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := regularUserClient.Entry(feedEntries.Entries[0].ID); err != miniflux.ErrNotFound {
+		t.Fatalf(`Expected entry to be not found, got %v`, err)
+	}
+
+	if _, err := regularUserClient.FeedEntry(feedID, feedEntries.Entries[0].ID); err != miniflux.ErrNotFound {
+		t.Fatalf(`Expected entry to be not found, got %v`, err)
+	}
+
+	if _, err := regularUserClient.CategoryEntry(feedEntries.Entries[0].Feed.Category.ID, feedEntries.Entries[0].ID); err != miniflux.ErrNotFound {
+		t.Fatalf(`Expected entry to be not found, got %v`, err)
+	}
+
+	updatedFeedEntries, err := regularUserClient.Entries(&miniflux.Filter{FeedID: feedID})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if updatedFeedEntries.Total != feedEntries.Total-1 {
+		t.Fatalf(`Expected %d entries, got %d`, feedEntries.Total-1, updatedFeedEntries.Total)
+	}
+}
+
 func TestUpdateEnclosureEndpoint(t *testing.T) {
 	testConfig := newIntegrationTestConfig()
 	if !testConfig.isConfigured() {
@@ -2618,8 +2718,8 @@ func TestUpdateEntryEndpoint(t *testing.T) {
 	}
 
 	entryUpdateRequest := &miniflux.EntryModificationRequest{
-		Title:   miniflux.SetOptionalField("New title"),
-		Content: miniflux.SetOptionalField("New content"),
+		Title:   new("New title"),
+		Content: new("New content"),
 	}
 
 	updatedEntry, err := regularUserClient.UpdateEntry(result.Entries[0].ID, entryUpdateRequest)
@@ -2649,7 +2749,7 @@ func TestUpdateEntryEndpoint(t *testing.T) {
 	}
 }
 
-func TestToggleBookmarkEndpoint(t *testing.T) {
+func TestToggleStarredEndpoint(t *testing.T) {
 	testConfig := newIntegrationTestConfig()
 	if !testConfig.isConfigured() {
 		t.Skip(skipIntegrationTestsMessage)
@@ -2677,7 +2777,7 @@ func TestToggleBookmarkEndpoint(t *testing.T) {
 		t.Fatalf(`Failed to get entries: %v`, err)
 	}
 
-	if err := regularUserClient.ToggleBookmark(result.Entries[0].ID); err != nil {
+	if err := regularUserClient.ToggleStarred(result.Entries[0].ID); err != nil {
 		t.Fatal(err)
 	}
 
@@ -2687,7 +2787,7 @@ func TestToggleBookmarkEndpoint(t *testing.T) {
 	}
 
 	if !entry.Starred {
-		t.Fatalf(`The entry should be bookmarked`)
+		t.Fatalf(`The entry should be starred`)
 	}
 }
 
@@ -2832,13 +2932,56 @@ func TestFlushHistoryEndpoint(t *testing.T) {
 	if readEntries.Total != 0 {
 		t.Fatalf(`Invalid total, got %d`, readEntries.Total)
 	}
+}
 
-	removedEntries, err := regularUserClient.Entries(&miniflux.Filter{Status: miniflux.EntryStatusRemoved})
+func TestImportFeedEntryEndpoint(t *testing.T) {
+	testConfig := newIntegrationTestConfig()
+	if !testConfig.isConfigured() {
+		t.Skip(skipIntegrationTestsMessage)
+	}
+
+	client := miniflux.NewClient(
+		testConfig.testBaseURL,
+		testConfig.testAdminUsername,
+		testConfig.testAdminPassword,
+	)
+
+	// Create a feed
+	feedID, err := client.CreateFeed(&miniflux.FeedCreationRequest{
+		FeedURL: testConfig.testFeedURL,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.DeleteFeed(feedID)
+
+	payload := map[string]any{
+		"title":        "Imported Entry",
+		"url":          "https://example.org/imported-entry",
+		"content":      "Hello world",
+		"external_id":  "integration-test-entry-1",
+		"status":       model.EntryStatusUnread,
+		"starred":      false,
+		"published_at": 0,
+	}
+
+	// First import
+	firstID, err := client.ImportFeedEntry(feedID, payload)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	if removedEntries.Total != 2 {
-		t.Fatalf(`Invalid total, got %d`, removedEntries.Total)
+	if firstID == 0 {
+		t.Fatal("expected non-zero entry ID on first import")
+	}
+
+	// Second import (same payload)
+	secondID, err := client.ImportFeedEntry(feedID, payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if secondID != firstID {
+		t.Fatalf("expected same entry ID on re-import, got %d and %d", firstID, secondID)
 	}
 }

internal/api/api_key_handlers.go

@@ -9,56 +9,60 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/storage"
 	"miniflux.app/v2/internal/validator"
 )
 
-func (h *handler) createAPIKey(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createAPIKeyHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
 	var apiKeyCreationRequest model.APIKeyCreationRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&apiKeyCreationRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if validationErr := validator.ValidateAPIKeyCreation(h.store, userID, &apiKeyCreationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	apiKey, err := h.store.CreateAPIKey(userID, apiKeyCreationRequest.Description)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, apiKey)
+	response.JSONCreated(w, r, apiKey)
 }
 
-func (h *handler) getAPIKeys(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getAPIKeysHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	apiKeys, err := h.store.APIKeys(userID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
-	json.OK(w, r, apiKeys)
+	response.JSON(w, r, apiKeys)
 }
 
-func (h *handler) deleteAPIKey(w http.ResponseWriter, r *http.Request) {
+func (h *handler) deleteAPIKeyHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	apiKeyID := request.RouteInt64Param(r, "apiKeyID")
+	if apiKeyID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid API key ID"))
+		return
+	}
 
 	if err := h.store.DeleteAPIKey(userID, apiKeyID); err != nil {
 		if errors.Is(err, storage.ErrAPIKeyNotFound) {
-			json.NotFound(w, r)
+			response.JSONNotFound(w, r)
 			return
 		}
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }

internal/api/api_test.go

@@ -0,0 +1,118 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package api // import "miniflux.app/v2/internal/api"
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"testing"
+
+	"miniflux.app/v2/internal/version"
+)
+
+func TestNewHandlerHandlesOptionsRequests(t *testing.T) {
+	handler := NewHandler(nil, nil)
+
+	r := httptest.NewRequest(http.MethodOptions, "/v1/users", nil)
+	w := httptest.NewRecorder()
+
+	handler.ServeHTTP(w, r)
+
+	if got := w.Code; got != http.StatusNoContent {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, got, http.StatusNoContent)
+	}
+
+	if got := w.Header().Get("Access-Control-Allow-Origin"); got != "*" {
+		t.Fatalf(`Unexpected Access-Control-Allow-Origin header, got %q`, got)
+	}
+
+	if got := w.Header().Get("Access-Control-Allow-Methods"); got != "GET, POST, PUT, DELETE, OPTIONS" {
+		t.Fatalf(`Unexpected Access-Control-Allow-Methods header, got %q`, got)
+	}
+
+	if got := w.Header().Get("Access-Control-Allow-Headers"); got != "X-Auth-Token, Authorization, Content-Type, Accept" {
+		t.Fatalf(`Unexpected Access-Control-Allow-Headers header, got %q`, got)
+	}
+
+	if got := w.Header().Get("Access-Control-Max-Age"); got != "3600" {
+		t.Fatalf(`Unexpected Access-Control-Max-Age header, got %q`, got)
+	}
+}
+
+func TestVersionHandler(t *testing.T) {
+	h := &handler{}
+	r := httptest.NewRequest(http.MethodGet, "/v1/version", nil)
+	w := httptest.NewRecorder()
+
+	h.versionHandler(w, r)
+
+	if got := w.Code; got != http.StatusOK {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, got, http.StatusOK)
+	}
+
+	if got := w.Header().Get("Content-Type"); got != "application/json" {
+		t.Fatalf(`Unexpected Content-Type header, got %q`, got)
+	}
+
+	var responseBody versionResponse
+	if err := json.NewDecoder(w.Body).Decode(&responseBody); err != nil {
+		t.Fatalf("Unexpected JSON decoding error: %v", err)
+	}
+
+	if responseBody.Version != version.Version {
+		t.Fatalf(`Unexpected version, got %q instead of %q`, responseBody.Version, version.Version)
+	}
+
+	if responseBody.Commit != version.Commit {
+		t.Fatalf(`Unexpected commit, got %q instead of %q`, responseBody.Commit, version.Commit)
+	}
+
+	if responseBody.BuildDate != version.BuildDate {
+		t.Fatalf(`Unexpected build date, got %q instead of %q`, responseBody.BuildDate, version.BuildDate)
+	}
+
+	if responseBody.GoVersion != runtime.Version() {
+		t.Fatalf(`Unexpected Go version, got %q instead of %q`, responseBody.GoVersion, runtime.Version())
+	}
+
+	if responseBody.Compiler != runtime.Compiler {
+		t.Fatalf(`Unexpected compiler, got %q instead of %q`, responseBody.Compiler, runtime.Compiler)
+	}
+
+	if responseBody.Arch != runtime.GOARCH {
+		t.Fatalf(`Unexpected architecture, got %q instead of %q`, responseBody.Arch, runtime.GOARCH)
+	}
+
+	if responseBody.OS != runtime.GOOS {
+		t.Fatalf(`Unexpected OS, got %q instead of %q`, responseBody.OS, runtime.GOOS)
+	}
+}
+
+func TestNewHandlerSupportsBasePathStripping(t *testing.T) {
+	scenarios := []struct {
+		name   string
+		prefix string
+		path   string
+	}{
+		{name: "empty base path", prefix: "", path: "/v1/users"},
+		{name: "non empty base path", prefix: "/base", path: "/base/v1/users"},
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.name, func(t *testing.T) {
+			handler := http.StripPrefix(scenario.prefix, NewHandler(nil, nil))
+
+			r := httptest.NewRequest(http.MethodOptions, scenario.path, nil)
+			w := httptest.NewRecorder()
+
+			handler.ServeHTTP(w, r)
+
+			if got := w.Code; got != http.StatusNoContent {
+				t.Fatalf(`Unexpected status code, got %d instead of %d`, got, http.StatusNoContent)
+			}
+		})
+	}
+}

internal/api/category_handlers.go

@@ -5,100 +5,111 @@ package api // import "miniflux.app/v2/internal/api"
 
 import (
 	json_parser "encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"time"
 
 	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/validator"
 )
 
-func (h *handler) createCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createCategoryHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
 	var categoryCreationRequest model.CategoryCreationRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&categoryCreationRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if validationErr := validator.ValidateCategoryCreation(h.store, userID, &categoryCreationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	category, err := h.store.CreateCategory(userID, &categoryCreationRequest)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, category)
+	response.JSONCreated(w, r, category)
 }
 
-func (h *handler) updateCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateCategoryHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 
 	category, err := h.store.Category(userID, categoryID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if category == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	var categoryModificationRequest model.CategoryModificationRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&categoryModificationRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if validationErr := validator.ValidateCategoryModification(h.store, userID, category.ID, &categoryModificationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	categoryModificationRequest.Patch(category)
 
 	if err := h.store.UpdateCategory(category); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, category)
+	response.JSONCreated(w, r, category)
 }
 
-func (h *handler) markCategoryAsRead(w http.ResponseWriter, r *http.Request) {
+func (h *handler) markCategoryAsReadHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 
 	category, err := h.store.Category(userID, categoryID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if category == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if err = h.store.MarkCategoryAsRead(userID, categoryID, time.Now()); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) getCategories(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getCategoriesHandler(w http.ResponseWriter, r *http.Request) {
 	var categories model.Categories
 	var err error
 	includeCounts := request.QueryStringParam(r, "counts", "false")
@@ -110,32 +121,42 @@ func (h *handler) getCategories(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
-	json.OK(w, r, categories)
+	response.JSON(w, r, categories)
 }
 
-func (h *handler) removeCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) removeCategoryHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 
 	if !h.store.CategoryIDExists(userID, categoryID) {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if err := h.store.RemoveCategory(userID, categoryID); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) refreshCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) refreshCategoryHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 
 	batchBuilder := h.store.NewBatchBuilder()
 	batchBuilder.WithErrorLimit(config.Opts.PollingParsingErrorLimit())
@@ -143,10 +164,11 @@ func (h *handler) refreshCategory(w http.ResponseWriter, r *http.Request) {
 	batchBuilder.WithUserID(userID)
 	batchBuilder.WithCategoryID(categoryID)
 	batchBuilder.WithNextCheckExpired()
+	batchBuilder.WithLimitPerHost(config.Opts.PollingLimitPerHost())
 
 	jobs, err := batchBuilder.FetchJobs()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -159,5 +181,5 @@ func (h *handler) refreshCategory(w http.ResponseWriter, r *http.Request) {
 
 	go h.pool.Push(jobs)
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }

internal/api/enclosure_handlers.go

@@ -5,75 +5,85 @@ package api // import "miniflux.app/v2/internal/api"
 
 import (
 	json_parser "encoding/json"
+	"errors"
 	"net/http"
 
+	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/validator"
 )
 
-func (h *handler) getEnclosureByID(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getEnclosureByIDHandler(w http.ResponseWriter, r *http.Request) {
 	enclosureID := request.RouteInt64Param(r, "enclosureID")
+	if enclosureID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid enclosure ID"))
+		return
+	}
 
 	enclosure, err := h.store.GetEnclosure(enclosureID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if enclosure == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	userID := request.UserID(r)
 	if enclosure.UserID != userID {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	enclosure.ProxifyEnclosureURL(h.router)
+	enclosure.ProxifyEnclosureURL(config.Opts.MediaProxyMode(), config.Opts.MediaProxyResourceTypes())
 
-	json.OK(w, r, enclosure)
+	response.JSON(w, r, enclosure)
 }
 
-func (h *handler) updateEnclosureByID(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateEnclosureByIDHandler(w http.ResponseWriter, r *http.Request) {
 	enclosureID := request.RouteInt64Param(r, "enclosureID")
+	if enclosureID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid enclosure ID"))
+		return
+	}
 
 	var enclosureUpdateRequest model.EnclosureUpdateRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&enclosureUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if err := validator.ValidateEnclosureUpdateRequest(&enclosureUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	enclosure, err := h.store.GetEnclosure(enclosureID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if enclosure == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	userID := request.UserID(r)
 	if enclosure.UserID != userID {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	enclosure.MediaProgression = enclosureUpdateRequest.MediaProgression
 	if err := h.store.UpdateEnclosure(enclosure); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }

internal/api/entry_handlers.go

@@ -10,13 +10,16 @@ import (
 	"strconv"
 	"time"
 
+	"miniflux.app/v2/internal/config"
+	"miniflux.app/v2/internal/crypto"
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/integration"
 	"miniflux.app/v2/internal/mediaproxy"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/reader/processor"
 	"miniflux.app/v2/internal/reader/readingtime"
+	"miniflux.app/v2/internal/reader/sanitizer"
 	"miniflux.app/v2/internal/storage"
 	"miniflux.app/v2/internal/validator"
 )
@@ -24,63 +27,97 @@ import (
 func (h *handler) getEntryFromBuilder(w http.ResponseWriter, r *http.Request, b *storage.EntryQueryBuilder) {
 	entry, err := b.GetEntry()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if entry == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	entry.Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entry.Content)
+	entry.Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(entry.Content)
+	entry.Enclosures.ProxifyEnclosureURL(config.Opts.MediaProxyMode(), config.Opts.MediaProxyResourceTypes())
 
-	entry.Enclosures.ProxifyEnclosureURL(h.router)
-
-	json.OK(w, r, entry)
+	response.JSON(w, r, entry)
 }
 
-func (h *handler) getFeedEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedEntryHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
+
 	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
+		return
+	}
 
 	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithFeedID(feedID)
 	builder.WithEntryID(entryID)
+	builder.WithoutStatus(model.EntryStatusRemoved)
 
 	h.getEntryFromBuilder(w, r, builder)
 }
 
-func (h *handler) getCategoryEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getCategoryEntryHandler(w http.ResponseWriter, r *http.Request) {
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
+
 	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
+		return
+	}
 
 	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithCategoryID(categoryID)
 	builder.WithEntryID(entryID)
+	builder.WithoutStatus(model.EntryStatusRemoved)
 
 	h.getEntryFromBuilder(w, r, builder)
 }
 
-func (h *handler) getEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getEntryHandler(w http.ResponseWriter, r *http.Request) {
 	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
+		return
+	}
+
 	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithEntryID(entryID)
+	builder.WithoutStatus(model.EntryStatusRemoved)
 
 	h.getEntryFromBuilder(w, r, builder)
 }
 
-func (h *handler) getFeedEntries(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedEntriesHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
+
 	h.findEntries(w, r, feedID, 0)
 }
 
-func (h *handler) getCategoryEntries(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getCategoryEntriesHandler(w http.ResponseWriter, r *http.Request) {
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 	h.findEntries(w, r, 0, categoryID)
 }
 
-func (h *handler) getEntries(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getEntriesHandler(w http.ResponseWriter, r *http.Request) {
 	h.findEntries(w, r, 0, 0)
 }
 
@@ -88,40 +125,40 @@ func (h *handler) findEntries(w http.ResponseWriter, r *http.Request, feedID int
 	statuses := request.QueryStringParamList(r, "status")
 	for _, status := range statuses {
 		if err := validator.ValidateEntryStatus(status); err != nil {
-			json.BadRequest(w, r, err)
+			response.JSONBadRequest(w, r, err)
 			return
 		}
 	}
 
 	order := request.QueryStringParam(r, "order", model.DefaultSortingOrder)
 	if err := validator.ValidateEntryOrder(order); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	direction := request.QueryStringParam(r, "direction", model.DefaultSortingDirection)
 	if err := validator.ValidateDirection(direction); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	limit := request.QueryIntParam(r, "limit", 100)
 	offset := request.QueryIntParam(r, "offset", 0)
 	if err := validator.ValidateRange(offset, limit); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	userID := request.UserID(r)
 	categoryID = request.QueryInt64Param(r, "category_id", categoryID)
 	if categoryID > 0 && !h.store.CategoryIDExists(userID, categoryID) {
-		json.BadRequest(w, r, errors.New("invalid category ID"))
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
 		return
 	}
 
 	feedID = request.QueryInt64Param(r, "feed_id", feedID)
 	if feedID > 0 && !h.store.FeedExists(userID, feedID) {
-		json.BadRequest(w, r, errors.New("invalid feed ID"))
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
 		return
 	}
 
@@ -136,6 +173,7 @@ func (h *handler) findEntries(w http.ResponseWriter, r *http.Request, feedID int
 	builder.WithLimit(limit)
 	builder.WithTags(tags)
 	builder.WithEnclosures()
+	builder.WithoutStatus(model.EntryStatusRemoved)
 
 	if request.HasQueryParam(r, "globally_visible") {
 		globallyVisible := request.QueryBoolParam(r, "globally_visible", true)
@@ -147,145 +185,267 @@ func (h *handler) findEntries(w http.ResponseWriter, r *http.Request, feedID int
 
 	configureFilters(builder, r)
 
-	entries, err := builder.GetEntries()
+	entries, count, err := builder.GetEntriesWithCount()
 	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	count, err := builder.CountEntries()
-	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	for i := range entries {
-		entries[i].Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entries[i].Content)
+		entries[i].Content = mediaproxy.RewriteDocumentWithAbsoluteProxyURL(entries[i].Content)
 	}
 
-	json.OK(w, r, &entriesResponse{Total: count, Entries: entries})
+	response.JSON(w, r, &entriesResponse{Total: count, Entries: entries})
 }
 
-func (h *handler) setEntryStatus(w http.ResponseWriter, r *http.Request) {
+func (h *handler) setEntryStatusHandler(w http.ResponseWriter, r *http.Request) {
 	var entriesStatusUpdateRequest model.EntriesStatusUpdateRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&entriesStatusUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if err := validator.ValidateEntriesStatusUpdateRequest(&entriesStatusUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if err := h.store.SetEntriesStatus(request.UserID(r), entriesStatusUpdateRequest.EntryIDs, entriesStatusUpdateRequest.Status); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) toggleBookmark(w http.ResponseWriter, r *http.Request) {
+func (h *handler) toggleStarredHandler(w http.ResponseWriter, r *http.Request) {
 	entryID := request.RouteInt64Param(r, "entryID")
-	if err := h.store.ToggleBookmark(request.UserID(r), entryID); err != nil {
-		json.ServerError(w, r, err)
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
 		return
 	}
 
-	json.NoContent(w, r)
+	if err := h.store.ToggleStarred(request.UserID(r), entryID); err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	response.NoContent(w, r)
 }
 
-func (h *handler) saveEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) saveEntryHandler(w http.ResponseWriter, r *http.Request) {
 	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
+		return
+	}
+
 	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithEntryID(entryID)
 	builder.WithoutStatus(model.EntryStatusRemoved)
 
 	if !h.store.HasSaveEntry(request.UserID(r)) {
-		json.BadRequest(w, r, errors.New("no third-party integration enabled"))
+		response.JSONBadRequest(w, r, errors.New("no third-party integration enabled"))
 		return
 	}
 
 	entry, err := builder.GetEntry()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if entry == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	settings, err := h.store.Integration(request.UserID(r))
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	go integration.SendEntry(entry, settings)
 
-	json.Accepted(w, r)
+	response.JSONAccepted(w, r)
 }
 
-func (h *handler) updateEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateEntryHandler(w http.ResponseWriter, r *http.Request) {
 	var entryUpdateRequest model.EntryUpdateRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&entryUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if err := validator.ValidateEntryModification(&entryUpdateRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
+		return
+	}
+
+	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
 		return
 	}
 
 	loggedUserID := request.UserID(r)
-	entryID := request.RouteInt64Param(r, "entryID")
-
 	entryBuilder := h.store.NewEntryQueryBuilder(loggedUserID)
 	entryBuilder.WithEntryID(entryID)
 	entryBuilder.WithoutStatus(model.EntryStatusRemoved)
 
 	entry, err := entryBuilder.GetEntry()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if entry == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	user, err := h.store.UserByID(loggedUserID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if user == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
+	if entryUpdateRequest.Content != nil {
+		sanitizedContent := sanitizer.SanitizeHTML(entry.URL, *entryUpdateRequest.Content, &sanitizer.SanitizerOptions{OpenLinksInNewTab: user.OpenExternalLinksInNewTab})
+		entryUpdateRequest.Content = &sanitizedContent
+	}
+
 	entryUpdateRequest.Patch(entry)
 	if user.ShowReadingTime {
 		entry.ReadingTime = readingtime.EstimateReadingTime(entry.Content, user.DefaultReadingSpeed, user.CJKReadingSpeed)
 	}
 
 	if err := h.store.UpdateEntryTitleAndContent(entry); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, entry)
+	response.JSONCreated(w, r, entry)
 }
 
-func (h *handler) fetchContent(w http.ResponseWriter, r *http.Request) {
+func (h *handler) importFeedEntryHandler(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+
+	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID <= 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
+
+	if !h.store.FeedExists(userID, feedID) {
+		response.JSONBadRequest(w, r, errors.New("feed does not exist"))
+		return
+	}
+
+	var importRequest entryImportRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&importRequest); err != nil {
+		response.JSONBadRequest(w, r, err)
+		return
+	}
+
+	if importRequest.URL == "" {
+		response.JSONBadRequest(w, r, errors.New("url is required"))
+		return
+	}
+
+	if importRequest.Status == "" {
+		importRequest.Status = model.EntryStatusRead
+	}
+
+	if err := validator.ValidateEntryStatus(importRequest.Status); err != nil {
+		response.JSONBadRequest(w, r, err)
+		return
+	}
+
+	entry := model.NewEntry()
+	entry.URL = importRequest.URL
+	entry.CommentsURL = importRequest.CommentsURL
+	entry.Author = importRequest.Author
+	entry.Tags = importRequest.Tags
+
+	if importRequest.PublishedAt > 0 {
+		entry.Date = time.Unix(importRequest.PublishedAt, 0).UTC()
+	} else {
+		entry.Date = time.Now().UTC()
+	}
+
+	if importRequest.Title == "" {
+		entry.Title = entry.URL
+	} else {
+		entry.Title = importRequest.Title
+	}
+
+	hashInput := importRequest.ExternalID
+	if hashInput == "" {
+		hashInput = importRequest.URL
+	}
+	entry.Hash = crypto.HashFromBytes([]byte(hashInput))
+
+	user, err := h.store.UserByID(userID)
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	if user == nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	if importRequest.Content != "" {
+		entry.Content = sanitizer.SanitizeHTML(entry.URL, importRequest.Content, &sanitizer.SanitizerOptions{OpenLinksInNewTab: user.OpenExternalLinksInNewTab})
+	}
+
+	if user.ShowReadingTime {
+		entry.ReadingTime = readingtime.EstimateReadingTime(entry.Content, user.DefaultReadingSpeed, user.CJKReadingSpeed)
+	}
+
+	created, err := h.store.InsertEntryForFeed(userID, feedID, entry)
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	if err := h.store.SetEntriesStatus(userID, []int64{entry.ID}, importRequest.Status); err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+	entry.Status = importRequest.Status
+
+	if importRequest.Starred {
+		if err := h.store.SetEntriesStarredState(userID, []int64{entry.ID}, true); err != nil {
+			response.JSONServerError(w, r, err)
+			return
+		}
+		entry.Starred = true
+	}
+
+	if created {
+		response.JSONCreated(w, r, entryIDResponse{ID: entry.ID})
+	} else {
+		response.JSON(w, r, entryIDResponse{ID: entry.ID})
+	}
+}
+
+func (h *handler) fetchContentHandler(w http.ResponseWriter, r *http.Request) {
 	loggedUserID := request.UserID(r)
+
 	entryID := request.RouteInt64Param(r, "entryID")
+	if entryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid entry ID"))
+		return
+	}
 
 	entryBuilder := h.store.NewEntryQueryBuilder(loggedUserID)
 	entryBuilder.WithEntryID(entryID)
@@ -293,23 +453,23 @@ func (h *handler) fetchContent(w http.ResponseWriter, r *http.Request) {
 
 	entry, err := entryBuilder.GetEntry()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if entry == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	user, err := h.store.UserByID(loggedUserID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if user == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
@@ -317,39 +477,35 @@ func (h *handler) fetchContent(w http.ResponseWriter, r *http.Request) {
 	feedBuilder.WithFeedID(entry.FeedID)
 	feed, err := feedBuilder.GetFeed()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if feed == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if err := processor.ProcessEntryWebPage(feed, entry, user); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	shouldUpdateContent := request.QueryBoolParam(r, "update_content", false)
 	if shouldUpdateContent {
 		if err := h.store.UpdateEntryTitleAndContent(entry); err != nil {
-			json.ServerError(w, r, err)
+			response.JSONServerError(w, r, err)
 			return
 		}
-
-		json.OK(w, r, map[string]interface{}{"content": mediaproxy.RewriteDocumentWithRelativeProxyURL(h.router, entry.Content), "reading_time": entry.ReadingTime})
-
-		return
 	}
 
-	json.OK(w, r, map[string]string{"content": entry.Content})
+	response.JSON(w, r, entryContentResponse{Content: mediaproxy.RewriteDocumentWithAbsoluteProxyURL(entry.Content), ReadingTime: entry.ReadingTime})
 }
 
-func (h *handler) flushHistory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) flushHistoryHandler(w http.ResponseWriter, r *http.Request) {
 	loggedUserID := request.UserID(r)
 	go h.store.FlushHistory(loggedUserID)
-	json.Accepted(w, r)
+	response.JSONAccepted(w, r)
 }
 
 func configureFilters(builder *storage.EntryQueryBuilder, r *http.Request) {

internal/api/feed_handlers.go

@@ -5,24 +5,25 @@ package api // import "miniflux.app/v2/internal/api"
 
 import (
 	json_parser "encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"time"
 
 	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/model"
 	feedHandler "miniflux.app/v2/internal/reader/handler"
 	"miniflux.app/v2/internal/validator"
 )
 
-func (h *handler) createFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createFeedHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
 	var feedCreationRequest model.FeedCreationRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&feedCreationRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
@@ -30,45 +31,49 @@ func (h *handler) createFeed(w http.ResponseWriter, r *http.Request) {
 	if feedCreationRequest.CategoryID == 0 {
 		category, err := h.store.FirstCategory(userID)
 		if err != nil {
-			json.ServerError(w, r, err)
+			response.JSONServerError(w, r, err)
 			return
 		}
 		feedCreationRequest.CategoryID = category.ID
 	}
 
 	if validationErr := validator.ValidateFeedCreation(h.store, userID, &feedCreationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	feed, localizedError := feedHandler.CreateFeed(h.store, userID, &feedCreationRequest)
 	if localizedError != nil {
-		json.ServerError(w, r, localizedError.Error())
+		response.JSONServerError(w, r, localizedError.Error())
 		return
 	}
 
-	json.Created(w, r, &feedCreationResponse{FeedID: feed.ID})
+	response.JSONCreated(w, r, &feedCreationResponse{FeedID: feed.ID})
 }
 
-func (h *handler) refreshFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) refreshFeedHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
-	userID := request.UserID(r)
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
 
+	userID := request.UserID(r)
 	if !h.store.FeedExists(userID, feedID) {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	localizedError := feedHandler.RefreshFeed(h.store, userID, feedID, false)
 	if localizedError != nil {
-		json.ServerError(w, r, localizedError.Error())
+		response.JSONServerError(w, r, localizedError.Error())
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) refreshAllFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *handler) refreshAllFeedsHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
 	batchBuilder := h.store.NewBatchBuilder()
@@ -76,10 +81,11 @@ func (h *handler) refreshAllFeeds(w http.ResponseWriter, r *http.Request) {
 	batchBuilder.WithoutDisabledFeeds()
 	batchBuilder.WithNextCheckExpired()
 	batchBuilder.WithUserID(userID)
+	batchBuilder.WithLimitPerHost(config.Opts.PollingLimitPerHost())
 
 	jobs, err := batchBuilder.FetchJobs()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -91,147 +97,164 @@ func (h *handler) refreshAllFeeds(w http.ResponseWriter, r *http.Request) {
 
 	go h.pool.Push(jobs)
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) updateFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateFeedHandler(w http.ResponseWriter, r *http.Request) {
+	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
+
 	var feedModificationRequest model.FeedModificationRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&feedModificationRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	userID := request.UserID(r)
-	feedID := request.RouteInt64Param(r, "feedID")
-
 	originalFeed, err := h.store.FeedByID(userID, feedID)
 	if err != nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if originalFeed == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if validationErr := validator.ValidateFeedModification(h.store, userID, originalFeed.ID, &feedModificationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
 	feedModificationRequest.Patch(originalFeed)
 	originalFeed.ResetErrorCounter()
 	if err := h.store.UpdateFeed(originalFeed); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	originalFeed, err = h.store.FeedByID(userID, feedID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, originalFeed)
+	response.JSONCreated(w, r, originalFeed)
 }
 
-func (h *handler) markFeedAsRead(w http.ResponseWriter, r *http.Request) {
-	feedID := request.RouteInt64Param(r, "feedID")
+func (h *handler) markFeedAsReadHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 
-	feed, err := h.store.FeedByID(userID, feedID)
-	if err != nil {
-		json.NotFound(w, r)
+	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
 		return
 	}
 
-	if feed == nil {
-		json.NotFound(w, r)
+	if !h.store.FeedExists(userID, feedID) {
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if err := h.store.MarkFeedAsRead(userID, feedID, time.Now()); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }
 
-func (h *handler) getCategoryFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getCategoryFeedsHandler(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
+
 	categoryID := request.RouteInt64Param(r, "categoryID")
+	if categoryID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid category ID"))
+		return
+	}
 
 	category, err := h.store.Category(userID, categoryID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if category == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	feeds, err := h.store.FeedsByCategoryWithCounters(userID, categoryID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.OK(w, r, feeds)
+	response.JSON(w, r, feeds)
 }
 
-func (h *handler) getFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedsHandler(w http.ResponseWriter, r *http.Request) {
 	feeds, err := h.store.Feeds(request.UserID(r))
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.OK(w, r, feeds)
+	response.JSON(w, r, feeds)
 }
 
-func (h *handler) fetchCounters(w http.ResponseWriter, r *http.Request) {
+func (h *handler) fetchCountersHandler(w http.ResponseWriter, r *http.Request) {
 	counters, err := h.store.FetchCounters(request.UserID(r))
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.OK(w, r, counters)
+	response.JSON(w, r, counters)
 }
 
-func (h *handler) getFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
+
 	feed, err := h.store.FeedByID(request.UserID(r), feedID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if feed == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	json.OK(w, r, feed)
+	response.JSON(w, r, feed)
 }
 
-func (h *handler) removeFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) removeFeedHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
-	userID := request.UserID(r)
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
+		return
+	}
 
+	userID := request.UserID(r)
 	if !h.store.FeedExists(userID, feedID) {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
 	if err := h.store.RemoveFeed(userID, feedID); err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.NoContent(w, r)
+	response.NoContent(w, r)
 }

internal/api/icon_handlers.go

@@ -4,53 +4,57 @@
 package api // import "miniflux.app/v2/internal/api"
 
 import (
+	"errors"
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 )
 
-func (h *handler) getIconByFeedID(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getIconByFeedIDHandler(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
-
-	if !h.store.HasFeedIcon(feedID) {
-		json.NotFound(w, r)
+	if feedID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid feed ID"))
 		return
 	}
 
 	icon, err := h.store.IconByFeedID(request.UserID(r), feedID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if icon == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	json.OK(w, r, &feedIconResponse{
+	response.JSON(w, r, &feedIconResponse{
 		ID:       icon.ID,
 		MimeType: icon.MimeType,
 		Data:     icon.DataURL(),
 	})
 }
 
-func (h *handler) getIconByIconID(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getIconByIconIDHandler(w http.ResponseWriter, r *http.Request) {
 	iconID := request.RouteInt64Param(r, "iconID")
+	if iconID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid icon ID"))
+		return
+	}
 
 	icon, err := h.store.IconByID(iconID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	if icon == nil {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	json.OK(w, r, &feedIconResponse{
+	response.JSON(w, r, &feedIconResponse{
 		ID:       icon.ID,
 		MimeType: icon.MimeType,
 		Data:     icon.DataURL(),

internal/api/messages.go

@@ -18,10 +18,40 @@ type entriesResponse struct {
 	Entries model.Entries `json:"entries"`
 }
 
+type integrationsStatusResponse struct {
+	HasIntegrations bool `json:"has_integrations"`
+}
+
+type entryIDResponse struct {
+	ID int64 `json:"id"`
+}
+
+type entryContentResponse struct {
+	Content     string `json:"content"`
+	ReadingTime int    `json:"reading_time"`
+}
+
+type entryImportRequest struct {
+	URL         string   `json:"url"`
+	Title       string   `json:"title"`
+	Content     string   `json:"content"`
+	Author      string   `json:"author"`
+	CommentsURL string   `json:"comments_url"`
+	PublishedAt int64    `json:"published_at"`
+	Status      string   `json:"status"`
+	Starred     bool     `json:"starred"`
+	Tags        []string `json:"tags"`
+	ExternalID  string   `json:"external_id"`
+}
+
 type feedCreationResponse struct {
 	FeedID int64 `json:"feed_id"`
 }
 
+type importFeedsResponse struct {
+	Message string `json:"message"`
+}
+
 type versionResponse struct {
 	Version   string `json:"version"`
 	Commit    string `json:"commit"`

internal/api/middleware.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/storage"
 )
 
@@ -20,21 +20,21 @@ type middleware struct {
 func newMiddleware(s *storage.Storage) *middleware {
 	return &middleware{s}
 }
-func (m *middleware) handleCORS(next http.Handler) http.Handler {
+func (m *middleware) withCORSHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "X-Auth-Token, Authorization, Content-Type, Accept")
 		if r.Method == http.MethodOptions {
 			w.Header().Set("Access-Control-Max-Age", "3600")
-			w.WriteHeader(http.StatusOK)
+			response.NoContent(w, r)
 			return
 		}
 		next.ServeHTTP(w, r)
 	})
 }
 
-func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
+func (m *middleware) validateAPIKeyAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		clientIP := request.ClientIP(r)
 		token := r.Header.Get("X-Auth-Token")
@@ -43,6 +43,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 			slog.Debug("[API] Skipped API token authentication because no API Key has been provided",
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
+				slog.String("request_uri", r.RequestURI),
 			)
 			next.ServeHTTP(w, r)
 			return
@@ -50,7 +51,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 
 		user, err := m.store.UserByAPIKey(token)
 		if err != nil {
-			json.ServerError(w, r, err)
+			response.JSONServerError(w, r, err)
 			return
 		}
 
@@ -59,8 +60,9 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 				slog.Bool("authentication_failed", true),
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
+				slog.String("request_uri", r.RequestURI),
 			)
-			json.Unauthorized(w, r)
+			response.JSONUnauthorized(w, r)
 			return
 		}
 
@@ -69,6 +71,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 			slog.String("client_ip", clientIP),
 			slog.String("user_agent", r.UserAgent()),
 			slog.String("username", user.Username),
+			slog.String("request_uri", r.RequestURI),
 		)
 
 		m.store.SetLastLogin(user.ID)
@@ -84,7 +87,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 	})
 }
 
-func (m *middleware) basicAuth(next http.Handler) http.Handler {
+func (m *middleware) validateBasicAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if request.IsAuthenticated(r) {
 			next.ServeHTTP(w, r)
@@ -100,8 +103,9 @@ func (m *middleware) basicAuth(next http.Handler) http.Handler {
 				slog.Bool("authentication_failed", true),
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
+				slog.String("request_uri", r.RequestURI),
 			)
-			json.Unauthorized(w, r)
+			response.JSONUnauthorized(w, r)
 			return
 		}
 
@@ -110,8 +114,9 @@ func (m *middleware) basicAuth(next http.Handler) http.Handler {
 				slog.Bool("authentication_failed", true),
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
+				slog.String("request_uri", r.RequestURI),
 			)
-			json.Unauthorized(w, r)
+			response.JSONUnauthorized(w, r)
 			return
 		}
 
@@ -121,14 +126,15 @@ func (m *middleware) basicAuth(next http.Handler) http.Handler {
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
 				slog.String("username", username),
+				slog.String("request_uri", r.RequestURI),
 			)
-			json.Unauthorized(w, r)
+			response.JSONUnauthorized(w, r)
 			return
 		}
 
 		user, err := m.store.UserByUsername(username)
 		if err != nil {
-			json.ServerError(w, r, err)
+			response.JSONServerError(w, r, err)
 			return
 		}
 
@@ -138,8 +144,9 @@ func (m *middleware) basicAuth(next http.Handler) http.Handler {
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
 				slog.String("username", username),
+				slog.String("request_uri", r.RequestURI),
 			)
-			json.Unauthorized(w, r)
+			response.JSONUnauthorized(w, r)
 			return
 		}
 
@@ -148,6 +155,7 @@ func (m *middleware) basicAuth(next http.Handler) http.Handler {
 			slog.String("client_ip", clientIP),
 			slog.String("user_agent", r.UserAgent()),
 			slog.String("username", username),
+			slog.String("request_uri", r.RequestURI),
 		)
 
 		m.store.SetLastLogin(user.ID)

internal/api/opml_handlers.go

@@ -7,30 +7,29 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
-	"miniflux.app/v2/internal/http/response/xml"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/reader/opml"
 )
 
-func (h *handler) exportFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *handler) exportFeedsHandler(w http.ResponseWriter, r *http.Request) {
 	opmlHandler := opml.NewHandler(h.store)
 	opmlExport, err := opmlHandler.Export(request.UserID(r))
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	xml.OK(w, r, opmlExport)
+	response.XML(w, r, opmlExport)
 }
 
-func (h *handler) importFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *handler) importFeedsHandler(w http.ResponseWriter, r *http.Request) {
 	opmlHandler := opml.NewHandler(h.store)
 	err := opmlHandler.Import(request.UserID(r), r.Body)
 	defer r.Body.Close()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	json.Created(w, r, map[string]string{"message": "Feeds imported successfully"})
+	response.JSONCreated(w, r, importFeedsResponse{Message: "Feeds imported successfully"})
 }

internal/api/subscription_handlers.go

@@ -9,7 +9,7 @@ import (
 
 	"miniflux.app/v2/internal/config"
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/proxyrotator"
 	"miniflux.app/v2/internal/reader/fetcher"
@@ -17,15 +17,15 @@ import (
 	"miniflux.app/v2/internal/validator"
 )
 
-func (h *handler) discoverSubscriptions(w http.ResponseWriter, r *http.Request) {
+func (h *handler) discoverSubscriptionsHandler(w http.ResponseWriter, r *http.Request) {
 	var subscriptionDiscoveryRequest model.SubscriptionDiscoveryRequest
 	if err := json_parser.NewDecoder(r.Body).Decode(&subscriptionDiscoveryRequest); err != nil {
-		json.BadRequest(w, r, err)
+		response.JSONBadRequest(w, r, err)
 		return
 	}
 
 	if validationErr := validator.ValidateSubscriptionDiscovery(&subscriptionDiscoveryRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
+		response.JSONBadRequest(w, r, validationErr.Error())
 		return
 	}
 
@@ -56,14 +56,14 @@ func (h *handler) discoverSubscriptions(w http.ResponseWriter, r *http.Request)
 	)
 
 	if localizedError != nil {
-		json.ServerError(w, r, localizedError.Error())
+		response.JSONServerError(w, r, localizedError.Error())
 		return
 	}
 
 	if len(subscriptions) == 0 {
-		json.NotFound(w, r)
+		response.JSONNotFound(w, r)
 		return
 	}
 
-	json.OK(w, r, subscriptions)
+	response.JSON(w, r, subscriptions)
 }

internal/api/user.go

@@ -1,236 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package api // import "miniflux.app/v2/internal/api"
-
-import (
-	json_parser "encoding/json"
-	"errors"
-	"net/http"
-	"regexp"
-	"strings"
-
-	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
-	"miniflux.app/v2/internal/model"
-	"miniflux.app/v2/internal/validator"
-)
-
-func (h *handler) currentUser(w http.ResponseWriter, r *http.Request) {
-	user, err := h.store.UserByID(request.UserID(r))
-	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	json.OK(w, r, user)
-}
-
-func (h *handler) createUser(w http.ResponseWriter, r *http.Request) {
-	if !request.IsAdminUser(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	var userCreationRequest model.UserCreationRequest
-	if err := json_parser.NewDecoder(r.Body).Decode(&userCreationRequest); err != nil {
-		json.BadRequest(w, r, err)
-		return
-	}
-
-	if validationErr := validator.ValidateUserCreationWithPassword(h.store, &userCreationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
-		return
-	}
-
-	user, err := h.store.CreateUser(&userCreationRequest)
-	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	json.Created(w, r, user)
-}
-
-func (h *handler) updateUser(w http.ResponseWriter, r *http.Request) {
-	userID := request.RouteInt64Param(r, "userID")
-
-	var userModificationRequest model.UserModificationRequest
-	if err := json_parser.NewDecoder(r.Body).Decode(&userModificationRequest); err != nil {
-		json.BadRequest(w, r, err)
-		return
-	}
-
-	originalUser, err := h.store.UserByID(userID)
-	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	if originalUser == nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	if !request.IsAdminUser(r) {
-		if originalUser.ID != request.UserID(r) {
-			json.Forbidden(w, r)
-			return
-		}
-
-		if userModificationRequest.IsAdmin != nil && *userModificationRequest.IsAdmin {
-			json.BadRequest(w, r, errors.New("only administrators can change permissions of standard users"))
-			return
-		}
-	}
-
-	cleanEnd := regexp.MustCompile(`(?m)\r\n\s*$`)
-	if userModificationRequest.BlockFilterEntryRules != nil {
-		*userModificationRequest.BlockFilterEntryRules = cleanEnd.ReplaceAllLiteralString(*userModificationRequest.BlockFilterEntryRules, "")
-		// Clean carriage returns for Windows environments
-		*userModificationRequest.BlockFilterEntryRules = strings.ReplaceAll(*userModificationRequest.BlockFilterEntryRules, "\r\n", "\n")
-	}
-	if userModificationRequest.KeepFilterEntryRules != nil {
-		*userModificationRequest.KeepFilterEntryRules = cleanEnd.ReplaceAllLiteralString(*userModificationRequest.KeepFilterEntryRules, "")
-		// Clean carriage returns for Windows environments
-		*userModificationRequest.KeepFilterEntryRules = strings.ReplaceAll(*userModificationRequest.KeepFilterEntryRules, "\r\n", "\n")
-	}
-
-	if validationErr := validator.ValidateUserModification(h.store, originalUser.ID, &userModificationRequest); validationErr != nil {
-		json.BadRequest(w, r, validationErr.Error())
-		return
-	}
-
-	userModificationRequest.Patch(originalUser)
-	if err = h.store.UpdateUser(originalUser); err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	json.Created(w, r, originalUser)
-}
-
-func (h *handler) markUserAsRead(w http.ResponseWriter, r *http.Request) {
-	userID := request.RouteInt64Param(r, "userID")
-	if userID != request.UserID(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	if _, err := h.store.UserByID(userID); err != nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	if err := h.store.MarkAllAsRead(userID); err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	json.NoContent(w, r)
-}
-
-func (h *handler) getIntegrationsStatus(w http.ResponseWriter, r *http.Request) {
-	userID := request.UserID(r)
-
-	if _, err := h.store.UserByID(userID); err != nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	hasIntegrations := h.store.HasSaveEntry(userID)
-
-	response := struct {
-		HasIntegrations bool `json:"has_integrations"`
-	}{
-		HasIntegrations: hasIntegrations,
-	}
-
-	json.OK(w, r, response)
-}
-
-func (h *handler) users(w http.ResponseWriter, r *http.Request) {
-	if !request.IsAdminUser(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	users, err := h.store.Users()
-	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	users.UseTimezone(request.UserTimezone(r))
-	json.OK(w, r, users)
-}
-
-func (h *handler) userByID(w http.ResponseWriter, r *http.Request) {
-	if !request.IsAdminUser(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	userID := request.RouteInt64Param(r, "userID")
-	user, err := h.store.UserByID(userID)
-	if err != nil {
-		json.BadRequest(w, r, errors.New("unable to fetch this user from the database"))
-		return
-	}
-
-	if user == nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	user.UseTimezone(request.UserTimezone(r))
-	json.OK(w, r, user)
-}
-
-func (h *handler) userByUsername(w http.ResponseWriter, r *http.Request) {
-	if !request.IsAdminUser(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	username := request.RouteStringParam(r, "username")
-	user, err := h.store.UserByUsername(username)
-	if err != nil {
-		json.BadRequest(w, r, errors.New("unable to fetch this user from the database"))
-		return
-	}
-
-	if user == nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	json.OK(w, r, user)
-}
-
-func (h *handler) removeUser(w http.ResponseWriter, r *http.Request) {
-	if !request.IsAdminUser(r) {
-		json.Forbidden(w, r)
-		return
-	}
-
-	userID := request.RouteInt64Param(r, "userID")
-	user, err := h.store.UserByID(userID)
-	if err != nil {
-		json.ServerError(w, r, err)
-		return
-	}
-
-	if user == nil {
-		json.NotFound(w, r)
-		return
-	}
-
-	if user.ID == request.UserID(r) {
-		json.BadRequest(w, r, errors.New("you cannot remove yourself"))
-		return
-	}
-
-	h.store.RemoveUserAsync(user.ID)
-	json.NoContent(w, r)
-}

internal/api/user_handlers.go

@@ -0,0 +1,247 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package api // import "miniflux.app/v2/internal/api"
+
+import (
+	json_parser "encoding/json"
+	"errors"
+	"net/http"
+
+	"miniflux.app/v2/internal/http/request"
+	"miniflux.app/v2/internal/http/response"
+	"miniflux.app/v2/internal/model"
+	"miniflux.app/v2/internal/validator"
+)
+
+func (h *handler) currentUserHandler(w http.ResponseWriter, r *http.Request) {
+	user, err := h.store.UserByID(request.UserID(r))
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	response.JSON(w, r, user)
+}
+
+func (h *handler) createUserHandler(w http.ResponseWriter, r *http.Request) {
+	if !request.IsAdminUser(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	var userCreationRequest model.UserCreationRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&userCreationRequest); err != nil {
+		response.JSONBadRequest(w, r, err)
+		return
+	}
+
+	if validationErr := validator.ValidateUserCreationWithPassword(h.store, &userCreationRequest); validationErr != nil {
+		response.JSONBadRequest(w, r, validationErr.Error())
+		return
+	}
+
+	user, err := h.store.CreateUser(&userCreationRequest)
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	response.JSONCreated(w, r, user)
+}
+
+func (h *handler) updateUserHandler(w http.ResponseWriter, r *http.Request) {
+	userID := request.RouteInt64Param(r, "userID")
+	if userID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid user ID"))
+		return
+	}
+
+	var userModificationRequest model.UserModificationRequest
+	if err := json_parser.NewDecoder(r.Body).Decode(&userModificationRequest); err != nil {
+		response.JSONBadRequest(w, r, err)
+		return
+	}
+
+	originalUser, err := h.store.UserByID(userID)
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	if originalUser == nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	if !request.IsAdminUser(r) {
+		if originalUser.ID != request.UserID(r) {
+			response.JSONForbidden(w, r)
+			return
+		}
+
+		if userModificationRequest.IsAdmin != nil && *userModificationRequest.IsAdmin {
+			response.JSONBadRequest(w, r, errors.New("only administrators can change permissions of standard users"))
+			return
+		}
+	}
+
+	if validationErr := validator.ValidateUserModification(h.store, originalUser.ID, &userModificationRequest); validationErr != nil {
+		response.JSONBadRequest(w, r, validationErr.Error())
+		return
+	}
+
+	userModificationRequest.Patch(originalUser)
+	if err = h.store.UpdateUser(originalUser); err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	response.JSONCreated(w, r, originalUser)
+}
+
+func (h *handler) markUserAsReadHandler(w http.ResponseWriter, r *http.Request) {
+	userID := request.RouteInt64Param(r, "userID")
+	if userID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid user ID"))
+		return
+	}
+
+	if userID != request.UserID(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	if _, err := h.store.UserByID(userID); err != nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	if err := h.store.MarkAllAsRead(userID); err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	response.NoContent(w, r)
+}
+
+func (h *handler) getIntegrationsStatusHandler(w http.ResponseWriter, r *http.Request) {
+	userID := request.UserID(r)
+	if _, err := h.store.UserByID(userID); err != nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	hasIntegrations := h.store.HasSaveEntry(userID)
+
+	response.JSON(w, r, integrationsStatusResponse{HasIntegrations: hasIntegrations})
+}
+
+func (h *handler) usersHandler(w http.ResponseWriter, r *http.Request) {
+	if !request.IsAdminUser(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	users, err := h.store.Users()
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	users.UseTimezone(request.UserTimezone(r))
+	response.JSON(w, r, users)
+}
+
+func (h *handler) dispatchUserLookupHandler(w http.ResponseWriter, r *http.Request) {
+	identifier := request.RouteStringParam(r, "identifier")
+	userID := request.RouteInt64Param(r, "identifier")
+	if userID > 0 {
+		r.SetPathValue("userID", identifier)
+		h.userByIDHandler(w, r)
+		return
+	}
+
+	r.SetPathValue("username", identifier)
+	h.userByUsernameHandler(w, r)
+}
+
+func (h *handler) userByIDHandler(w http.ResponseWriter, r *http.Request) {
+	if !request.IsAdminUser(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	userID := request.RouteInt64Param(r, "userID")
+	if userID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid user ID"))
+		return
+	}
+
+	user, err := h.store.UserByID(userID)
+	if err != nil {
+		response.JSONBadRequest(w, r, errors.New("unable to fetch this user from the database"))
+		return
+	}
+
+	if user == nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	user.UseTimezone(request.UserTimezone(r))
+	response.JSON(w, r, user)
+}
+
+func (h *handler) userByUsernameHandler(w http.ResponseWriter, r *http.Request) {
+	if !request.IsAdminUser(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	username := request.RouteStringParam(r, "username")
+	user, err := h.store.UserByUsername(username)
+	if err != nil {
+		response.JSONBadRequest(w, r, errors.New("unable to fetch this user from the database"))
+		return
+	}
+
+	if user == nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	response.JSON(w, r, user)
+}
+
+func (h *handler) removeUserHandler(w http.ResponseWriter, r *http.Request) {
+	if !request.IsAdminUser(r) {
+		response.JSONForbidden(w, r)
+		return
+	}
+
+	userID := request.RouteInt64Param(r, "userID")
+	if userID == 0 {
+		response.JSONBadRequest(w, r, errors.New("invalid user ID"))
+		return
+	}
+
+	user, err := h.store.UserByID(userID)
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
+
+	if user == nil {
+		response.JSONNotFound(w, r)
+		return
+	}
+
+	if user.ID == request.UserID(r) {
+		response.JSONBadRequest(w, r, errors.New("you cannot remove yourself"))
+		return
+	}
+
+	h.store.RemoveUserAsync(user.ID)
+	response.NoContent(w, r)
+}

internal/api/version_handler.go

@@ -0,0 +1,24 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package api // import "miniflux.app/v2/internal/api"
+
+import (
+	"net/http"
+	"runtime"
+
+	"miniflux.app/v2/internal/http/response"
+	"miniflux.app/v2/internal/version"
+)
+
+func (h *handler) versionHandler(w http.ResponseWriter, r *http.Request) {
+	response.JSON(w, r, &versionResponse{
+		Version:   version.Version,
+		Commit:    version.Commit,
+		BuildDate: version.BuildDate,
+		GoVersion: runtime.Version(),
+		Compiler:  runtime.Compiler,
+		Arch:      runtime.GOARCH,
+		OS:        runtime.GOOS,
+	})
+}

internal/cli/ask_credentials.go

@@ -5,6 +5,7 @@ package cli // import "miniflux.app/v2/internal/cli"
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -16,20 +17,34 @@ func askCredentials() (string, string) {
 	fd := int(os.Stdin.Fd())
 
 	if !term.IsTerminal(fd) {
-		printErrorAndExit(fmt.Errorf("this is not an interactive terminal, exiting"))
+		printErrorAndExit(errors.New("this is not an interactive terminal, exiting"))
 	}
 
 	fmt.Print("Enter Username: ")
 
 	reader := bufio.NewReader(os.Stdin)
-	username, _ := reader.ReadString('\n')
+	username, err := reader.ReadString('\n')
+	if err != nil {
+		printErrorAndExit(fmt.Errorf("unable to read username: %w", err))
+	}
 
 	fmt.Print("Enter Password: ")
 
-	state, _ := term.GetState(fd)
-	defer term.Restore(fd, state)
-	bytePassword, _ := term.ReadPassword(fd)
+	state, err := term.GetState(fd)
+	if err != nil {
+		printErrorAndExit(fmt.Errorf("unable to get terminal state: %w", err))
+	}
+	defer func() {
+		if restoreErr := term.Restore(fd, state); restoreErr != nil {
+			printErrorAndExit(fmt.Errorf("unable to restore terminal state: %w", restoreErr))
+		}
+	}()
 
-	fmt.Printf("\n")
+	bytePassword, err := term.ReadPassword(fd)
+	if err != nil {
+		printErrorAndExit(fmt.Errorf("unable to read password: %w", err))
+	}
+
+	fmt.Print("\n")
 	return strings.TrimSpace(username), strings.TrimSpace(string(bytePassword))
 }

internal/cli/cleanup_tasks.go

@@ -14,15 +14,15 @@ import (
 )
 
 func runCleanupTasks(store *storage.Storage) {
-	nbSessions := store.CleanOldSessions(config.Opts.CleanupRemoveSessionsDays())
-	nbUserSessions := store.CleanOldUserSessions(config.Opts.CleanupRemoveSessionsDays())
+	nbSessions := store.CleanOldSessions(config.Opts.CleanupRemoveSessionsInterval())
+	nbUserSessions := store.CleanOldUserSessions(config.Opts.CleanupRemoveSessionsInterval())
 	slog.Info("Sessions cleanup completed",
 		slog.Int64("application_sessions_removed", nbSessions),
 		slog.Int64("user_sessions_removed", nbUserSessions),
 	)
 
 	startTime := time.Now()
-	if rowsAffected, err := store.ArchiveEntries(model.EntryStatusRead, config.Opts.CleanupArchiveReadDays(), config.Opts.CleanupArchiveBatchSize()); err != nil {
+	if rowsAffected, err := store.ArchiveEntries(model.EntryStatusRead, config.Opts.CleanupArchiveReadInterval(), config.Opts.CleanupArchiveBatchSize()); err != nil {
 		slog.Error("Unable to archive read entries", slog.Any("error", err))
 	} else {
 		slog.Info("Archiving read entries completed",
@@ -35,7 +35,7 @@ func runCleanupTasks(store *storage.Storage) {
 	}
 
 	startTime = time.Now()
-	if rowsAffected, err := store.ArchiveEntries(model.EntryStatusUnread, config.Opts.CleanupArchiveUnreadDays(), config.Opts.CleanupArchiveBatchSize()); err != nil {
+	if rowsAffected, err := store.ArchiveEntries(model.EntryStatusUnread, config.Opts.CleanupArchiveUnreadInterval(), config.Opts.CleanupArchiveBatchSize()); err != nil {
 		slog.Error("Unable to archive unread entries", slog.Any("error", err))
 	} else {
 		slog.Info("Archiving unread entries completed",
@@ -46,4 +46,18 @@ func runCleanupTasks(store *storage.Storage) {
 			metric.ArchiveEntriesDuration.WithLabelValues(model.EntryStatusUnread).Observe(time.Since(startTime).Seconds())
 		}
 	}
+
+	if enclosuresAffected, err := store.DeleteEnclosuresOfRemovedEntries(); err != nil {
+		slog.Error("Unable to delete enclosures from removed entries", slog.Any("error", err))
+	} else {
+		slog.Info("Deleting enclosures from removed entries completed",
+			slog.Int64("removed_entries_enclosures_deleted", enclosuresAffected))
+	}
+
+	if contentAffected, err := store.ClearRemovedEntriesContent(config.Opts.CleanupArchiveBatchSize()); err != nil {
+		slog.Error("Unable to clear content from removed entries", slog.Any("error", err))
+	} else {
+		slog.Info("Clearing content from removed entries completed",
+			slog.Int64("removed_entries_content_cleared", contentAffected))
+	}
 }

internal/cli/cli.go

@@ -4,7 +4,6 @@
 package cli // import "miniflux.app/v2/internal/cli"
 
 import (
-	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -30,9 +29,9 @@ const (
 	flagDebugModeHelp        = "Show debug logs"
 	flagConfigFileHelp       = "Load configuration file"
 	flagConfigDumpHelp       = "Print parsed configuration values"
-	flagHealthCheckHelp      = `Perform a health check on the given endpoint (the value "auto" try to guess the health check endpoint).`
+	flagHealthCheckHelp      = `Perform a health check on the given endpoint (the value "auto" tries to guess the health check endpoint).`
 	flagRefreshFeedsHelp     = "Refresh a batch of feeds and exit"
-	flagRunCleanupTasksHelp  = "Run cleanup tasks (delete old sessions and archives old entries)"
+	flagRunCleanupTasksHelp  = "Run cleanup tasks (delete old sessions and archive old entries)"
 	flagExportUserFeedsHelp  = "Export user feeds (provide the username as argument)"
 	flagResetNextCheckAtHelp = "Reset the next check time for all feeds"
 )
@@ -78,7 +77,7 @@ func Parse() {
 	flag.StringVar(&flagExportUserFeeds, "export-user-feeds", "", flagExportUserFeedsHelp)
 	flag.Parse()
 
-	cfg := config.NewParser()
+	cfg := config.NewConfigParser()
 
 	if flagConfigFile != "" {
 		config.Opts, err = cfg.ParseFile(flagConfigFile)
@@ -92,21 +91,8 @@ func Parse() {
 		printErrorAndExit(err)
 	}
 
-	if oauth2Provider := config.Opts.OAuth2Provider(); oauth2Provider != "" {
-		if oauth2Provider != "oidc" && oauth2Provider != "google" {
-			printErrorAndExit(fmt.Errorf(`unsupported OAuth2 provider: %q (Possible values are "google" or "oidc")`, oauth2Provider))
-		}
-	}
-
-	if config.Opts.DisableLocalAuth() {
-		switch {
-		case config.Opts.OAuth2Provider() == "" && config.Opts.AuthProxyHeader() == "":
-			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled but neither OAUTH2_PROVIDER nor AUTH_PROXY_HEADER is not set. Please enable at least one authentication source"))
-		case config.Opts.OAuth2Provider() != "" && !config.Opts.IsOAuth2UserCreationAllowed():
-			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled and an OAUTH2_PROVIDER is configured, but OAUTH2_USER_CREATION is not enabled"))
-		case config.Opts.AuthProxyHeader() != "" && !config.Opts.IsAuthProxyUserCreationAllowed():
-			printErrorAndExit(errors.New("DISABLE_LOCAL_AUTH is enabled and an AUTH_PROXY_HEADER is configured, but AUTH_PROXY_USER_CREATION is not enabled"))
-		}
+	if err := config.Opts.Validate(); err != nil {
+		printErrorAndExit(err)
 	}
 
 	if flagConfigDump {
@@ -114,6 +100,16 @@ func Parse() {
 		return
 	}
 
+	if flagInfo {
+		info()
+		return
+	}
+
+	if flagVersion {
+		fmt.Println(version.Version)
+		return
+	}
+
 	if flagDebugMode {
 		config.Opts.SetLogLevel("debug")
 	}
@@ -142,30 +138,20 @@ func Parse() {
 		return
 	}
 
-	if flagInfo {
-		info()
-		return
-	}
-
-	if flagVersion {
-		fmt.Println(version.Version)
-		return
-	}
-
 	if config.Opts.IsDefaultDatabaseURL() {
 		slog.Info("The default value for DATABASE_URL is used")
 	}
 
-	if err := static.CalculateBinaryFileChecksums(); err != nil {
-		printErrorAndExit(fmt.Errorf("unable to calculate binary file checksums: %v", err))
+	if err := static.GenerateBinaryBundles(); err != nil {
+		printErrorAndExit(fmt.Errorf("unable to generate binary files bundle: %v", err))
 	}
 
 	if err := static.GenerateStylesheetsBundles(); err != nil {
-		printErrorAndExit(fmt.Errorf("unable to generate stylesheets bundles: %v", err))
+		printErrorAndExit(fmt.Errorf("unable to generate stylesheets bundle: %v", err))
 	}
 
-	if err := static.GenerateJavascriptBundles(); err != nil {
-		printErrorAndExit(fmt.Errorf("unable to generate javascript bundles: %v", err))
+	if err := static.GenerateJavascriptBundles(config.Opts.WebAuthn()); err != nil {
+		printErrorAndExit(fmt.Errorf("unable to generate javascript bundle: %v", err))
 	}
 
 	db, err := database.NewConnectionPool(
@@ -263,6 +249,6 @@ func Parse() {
 }
 
 func printErrorAndExit(err error) {
-	fmt.Fprintf(os.Stderr, "%v\n", err)
+	fmt.Fprintln(os.Stderr, err)
 	os.Exit(1)
 }

internal/cli/daemon.go

@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"miniflux.app/v2/internal/config"
-	httpd "miniflux.app/v2/internal/http/server"
+	"miniflux.app/v2/internal/http/server"
 	"miniflux.app/v2/internal/metric"
 	"miniflux.app/v2/internal/storage"
 	"miniflux.app/v2/internal/systemd"
@@ -33,14 +33,15 @@ func startDaemon(store *storage.Storage) {
 		runScheduler(store, pool)
 	}
 
-	var httpServer *http.Server
+	var httpServers []*http.Server
 	if config.Opts.HasHTTPService() {
-		httpServer = httpd.StartWebServer(store, pool)
+		httpServers = server.StartWebServer(store, pool)
 	}
 
+	metricsCtx, cancelMetrics := context.WithCancel(context.Background())
 	if config.Opts.HasMetricsCollector() {
 		collector := metric.NewCollector(store, config.Opts.MetricsRefreshInterval())
-		go collector.GatherStorageMetrics()
+		go collector.GatherStorageMetrics(metricsCtx)
 	}
 
 	if systemd.HasNotifySocket() {
@@ -75,12 +76,27 @@ func startDaemon(store *storage.Storage) {
 
 	<-stop
 	slog.Debug("Shutting down the process")
+	cancelMetrics()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	if httpServer != nil {
-		httpServer.Shutdown(ctx)
+	if len(httpServers) > 0 {
+		slog.Debug("Shutting down HTTP servers...")
+		for _, server := range httpServers {
+			if server != nil {
+				if err := server.Shutdown(ctx); err != nil {
+					slog.Error("HTTP server shutdown error", slog.Any("error", err), slog.String("addr", server.Addr))
+				}
+			}
+		}
+		slog.Debug("All HTTP servers shut down.")
+	} else {
+		slog.Debug("No HTTP servers to shut down.")
 	}
 
+	slog.Debug("Shutting down worker pool...")
+	pool.Shutdown()
+	slog.Debug("Worker pool shut down.")
+
 	slog.Debug("Process gracefully stopped")
 }

internal/cli/health_check.go

@@ -14,7 +14,7 @@ import (
 
 func doHealthCheck(healthCheckEndpoint string) {
 	if healthCheckEndpoint == "auto" {
-		healthCheckEndpoint = "http://" + config.Opts.ListenAddr() + config.Opts.BasePath() + "/healthcheck"
+		healthCheckEndpoint = "http://" + config.Opts.ListenAddr()[0] + config.Opts.BasePath() + "/healthcheck"
 	}
 
 	slog.Debug("Executing health check request", slog.String("endpoint", healthCheckEndpoint))

internal/cli/refresh_feeds.go

@@ -25,6 +25,7 @@ func refreshFeeds(store *storage.Storage) {
 	batchBuilder.WithErrorLimit(config.Opts.PollingParsingErrorLimit())
 	batchBuilder.WithoutDisabledFeeds()
 	batchBuilder.WithNextCheckExpired()
+	batchBuilder.WithLimitPerHost(config.Opts.PollingLimitPerHost())
 
 	jobs, err := batchBuilder.FetchJobs()
 	if err != nil {
@@ -32,13 +33,9 @@ func refreshFeeds(store *storage.Storage) {
 		return
 	}
 
+	slog.Debug("Feed URLs in this batch", slog.Any("feed_urls", jobs.FeedURLs()))
+
 	nbJobs := len(jobs)
-
-	slog.Info("Created a batch of feeds",
-		slog.Int("nb_jobs", nbJobs),
-		slog.Int("batch_size", config.Opts.BatchSize()),
-	)
-
 	var jobQueue = make(chan model.Job, nbJobs)
 
 	slog.Info("Starting a pool of workers",

internal/cli/reset_password.go

@@ -4,6 +4,7 @@
 package cli // import "miniflux.app/v2/internal/cli"
 
 import (
+	"errors"
 	"fmt"
 
 	"miniflux.app/v2/internal/model"
@@ -19,7 +20,7 @@ func resetPassword(store *storage.Storage) {
 	}
 
 	if user == nil {
-		printErrorAndExit(fmt.Errorf("user not found"))
+		printErrorAndExit(errors.New("user not found"))
 	}
 
 	userModificationRequest := &model.UserModificationRequest{

internal/cli/scheduler.go

@@ -21,36 +21,36 @@ func runScheduler(store *storage.Storage, pool *worker.Pool) {
 		config.Opts.PollingFrequency(),
 		config.Opts.BatchSize(),
 		config.Opts.PollingParsingErrorLimit(),
+		config.Opts.PollingLimitPerHost(),
 	)
 
 	go cleanupScheduler(
 		store,
-		config.Opts.CleanupFrequencyHours(),
+		config.Opts.CleanupFrequency(),
 	)
 }
 
-func feedScheduler(store *storage.Storage, pool *worker.Pool, frequency, batchSize, errorLimit int) {
-	for range time.Tick(time.Duration(frequency) * time.Minute) {
+func feedScheduler(store *storage.Storage, pool *worker.Pool, frequency time.Duration, batchSize, errorLimit, limitPerHost int) {
+	for range time.Tick(frequency) {
 		// Generate a batch of feeds for any user that has feeds to refresh.
 		batchBuilder := store.NewBatchBuilder()
 		batchBuilder.WithBatchSize(batchSize)
 		batchBuilder.WithErrorLimit(errorLimit)
 		batchBuilder.WithoutDisabledFeeds()
 		batchBuilder.WithNextCheckExpired()
+		batchBuilder.WithLimitPerHost(limitPerHost)
 
 		if jobs, err := batchBuilder.FetchJobs(); err != nil {
 			slog.Error("Unable to fetch jobs from database", slog.Any("error", err))
 		} else if len(jobs) > 0 {
-			slog.Info("Created a batch of feeds",
-				slog.Int("nb_jobs", len(jobs)),
-			)
+			slog.Debug("Feed URLs in this batch", slog.Any("feed_urls", jobs.FeedURLs()))
 			pool.Push(jobs)
 		}
 	}
 }
 
-func cleanupScheduler(store *storage.Storage, frequency int) {
-	for range time.Tick(time.Duration(frequency) * time.Hour) {
+func cleanupScheduler(store *storage.Storage, frequency time.Duration) {
+	for range time.Tick(frequency) {
 		runCleanupTasks(store)
 	}
 }

internal/config/config.go

@@ -3,5 +3,9 @@
 
 package config // import "miniflux.app/v2/internal/config"
 
+import "miniflux.app/v2/internal/version"
+
 // Opts holds parsed configuration options.
-var Opts *Options
+var Opts *configOptions
+
+var defaultHTTPClientUserAgent = "Mozilla/5.0 (compatible; Miniflux/" + version.Version + "; +https://miniflux.app)"

internal/config/parser.go

@@ -15,330 +15,259 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"time"
 )
 
-// Parser handles configuration parsing.
-type Parser struct {
-	opts *Options
+type configParser struct {
+	options *configOptions
 }
 
-// NewParser returns a new Parser.
-func NewParser() *Parser {
-	return &Parser{
-		opts: NewOptions(),
+func NewConfigParser() *configParser {
+	return &configParser{
+		options: NewConfigOptions(),
 	}
 }
 
-// ParseEnvironmentVariables loads configuration values from environment variables.
-func (p *Parser) ParseEnvironmentVariables() (*Options, error) {
-	err := p.parseLines(os.Environ())
-	if err != nil {
+func (cp *configParser) ParseEnvironmentVariables() (*configOptions, error) {
+	if err := cp.parseLines(os.Environ()); err != nil {
 		return nil, err
 	}
-	return p.opts, nil
+
+	return cp.options, nil
 }
 
-// ParseFile loads configuration values from a local file.
-func (p *Parser) ParseFile(filename string) (*Options, error) {
+func (cp *configParser) ParseFile(filename string) (*configOptions, error) {
 	fp, err := os.Open(filename)
 	if err != nil {
 		return nil, err
 	}
 	defer fp.Close()
 
-	err = p.parseLines(p.parseFileContent(fp))
-	if err != nil {
+	if err := cp.parseLines(parseFileContent(fp)); err != nil {
 		return nil, err
 	}
-	return p.opts, nil
+
+	return cp.options, nil
 }
 
-func (p *Parser) parseFileContent(r io.Reader) (lines []string) {
-	scanner := bufio.NewScanner(r)
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if !strings.HasPrefix(line, "#") && strings.Index(line, "=") > 0 {
-			lines = append(lines, line)
-		}
+// Validate checks for invalid or incomplete option combinations.
+func (c *configOptions) Validate() error {
+	if c.OAuth2Provider() == "oidc" && c.OAuth2OIDCDiscoveryEndpoint() == "" {
+		return errors.New("OAUTH2_OIDC_DISCOVERY_ENDPOINT must be configured when using the OIDC provider")
 	}
-	return lines
-}
 
-func (p *Parser) parseLines(lines []string) (err error) {
-	var port string
-
-	for _, line := range lines {
-		fields := strings.SplitN(line, "=", 2)
-		key := strings.TrimSpace(fields[0])
-		value := strings.TrimSpace(fields[1])
-
-		switch key {
-		case "LOG_FILE":
-			p.opts.logFile = parseString(value, defaultLogFile)
-		case "LOG_DATE_TIME":
-			p.opts.logDateTime = parseBool(value, defaultLogDateTime)
-		case "LOG_LEVEL":
-			parsedValue := parseString(value, defaultLogLevel)
-			if parsedValue == "debug" || parsedValue == "info" || parsedValue == "warning" || parsedValue == "error" {
-				p.opts.logLevel = parsedValue
-			}
-		case "LOG_FORMAT":
-			parsedValue := parseString(value, defaultLogFormat)
-			if parsedValue == "json" || parsedValue == "text" {
-				p.opts.logFormat = parsedValue
-			}
-		case "DEBUG":
-			slog.Warn("The DEBUG environment variable is deprecated, use LOG_LEVEL instead")
-			parsedValue := parseBool(value, defaultDebug)
-			if parsedValue {
-				p.opts.logLevel = "debug"
-			}
-		case "SERVER_TIMING_HEADER":
-			p.opts.serverTimingHeader = parseBool(value, defaultTiming)
-		case "BASE_URL":
-			p.opts.baseURL, p.opts.rootURL, p.opts.basePath, err = parseBaseURL(value)
-			if err != nil {
-				return err
-			}
-		case "PORT":
-			port = value
-		case "LISTEN_ADDR":
-			p.opts.listenAddr = parseString(value, defaultListenAddr)
-		case "DATABASE_URL":
-			p.opts.databaseURL = parseString(value, defaultDatabaseURL)
-		case "DATABASE_URL_FILE":
-			p.opts.databaseURL = readSecretFile(value, defaultDatabaseURL)
-		case "DATABASE_MAX_CONNS":
-			p.opts.databaseMaxConns = parseInt(value, defaultDatabaseMaxConns)
-		case "DATABASE_MIN_CONNS":
-			p.opts.databaseMinConns = parseInt(value, defaultDatabaseMinConns)
-		case "DATABASE_CONNECTION_LIFETIME":
-			p.opts.databaseConnectionLifetime = parseInt(value, defaultDatabaseConnectionLifetime)
-		case "FILTER_ENTRY_MAX_AGE_DAYS":
-			p.opts.filterEntryMaxAgeDays = parseInt(value, defaultFilterEntryMaxAgeDays)
-		case "RUN_MIGRATIONS":
-			p.opts.runMigrations = parseBool(value, defaultRunMigrations)
-		case "DISABLE_HSTS":
-			p.opts.hsts = !parseBool(value, defaultHSTS)
-		case "HTTPS":
-			p.opts.HTTPS = parseBool(value, defaultHTTPS)
-		case "DISABLE_SCHEDULER_SERVICE":
-			p.opts.schedulerService = !parseBool(value, defaultSchedulerService)
-		case "DISABLE_HTTP_SERVICE":
-			p.opts.httpService = !parseBool(value, defaultHTTPService)
-		case "CERT_FILE":
-			p.opts.certFile = parseString(value, defaultCertFile)
-		case "KEY_FILE":
-			p.opts.certKeyFile = parseString(value, defaultKeyFile)
-		case "CERT_DOMAIN":
-			p.opts.certDomain = parseString(value, defaultCertDomain)
-		case "CLEANUP_FREQUENCY_HOURS":
-			p.opts.cleanupFrequencyHours = parseInt(value, defaultCleanupFrequencyHours)
-		case "CLEANUP_ARCHIVE_READ_DAYS":
-			p.opts.cleanupArchiveReadDays = parseInt(value, defaultCleanupArchiveReadDays)
-		case "CLEANUP_ARCHIVE_UNREAD_DAYS":
-			p.opts.cleanupArchiveUnreadDays = parseInt(value, defaultCleanupArchiveUnreadDays)
-		case "CLEANUP_ARCHIVE_BATCH_SIZE":
-			p.opts.cleanupArchiveBatchSize = parseInt(value, defaultCleanupArchiveBatchSize)
-		case "CLEANUP_REMOVE_SESSIONS_DAYS":
-			p.opts.cleanupRemoveSessionsDays = parseInt(value, defaultCleanupRemoveSessionsDays)
-		case "WORKER_POOL_SIZE":
-			p.opts.workerPoolSize = parseInt(value, defaultWorkerPoolSize)
-		case "POLLING_FREQUENCY":
-			p.opts.pollingFrequency = parseInt(value, defaultPollingFrequency)
-		case "FORCE_REFRESH_INTERVAL":
-			p.opts.forceRefreshInterval = parseInt(value, defaultForceRefreshInterval)
-		case "BATCH_SIZE":
-			p.opts.batchSize = parseInt(value, defaultBatchSize)
-		case "POLLING_SCHEDULER":
-			p.opts.pollingScheduler = strings.ToLower(parseString(value, defaultPollingScheduler))
-		case "SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL":
-			p.opts.schedulerEntryFrequencyMaxInterval = parseInt(value, defaultSchedulerEntryFrequencyMaxInterval)
-		case "SCHEDULER_ENTRY_FREQUENCY_MIN_INTERVAL":
-			p.opts.schedulerEntryFrequencyMinInterval = parseInt(value, defaultSchedulerEntryFrequencyMinInterval)
-		case "SCHEDULER_ENTRY_FREQUENCY_FACTOR":
-			p.opts.schedulerEntryFrequencyFactor = parseInt(value, defaultSchedulerEntryFrequencyFactor)
-		case "SCHEDULER_ROUND_ROBIN_MIN_INTERVAL":
-			p.opts.schedulerRoundRobinMinInterval = parseInt(value, defaultSchedulerRoundRobinMinInterval)
-		case "SCHEDULER_ROUND_ROBIN_MAX_INTERVAL":
-			p.opts.schedulerRoundRobinMaxInterval = parseInt(value, defaultSchedulerRoundRobinMaxInterval)
-		case "POLLING_PARSING_ERROR_LIMIT":
-			p.opts.pollingParsingErrorLimit = parseInt(value, defaultPollingParsingErrorLimit)
-		case "PROXY_IMAGES":
-			slog.Warn("The PROXY_IMAGES environment variable is deprecated, use MEDIA_PROXY_MODE instead")
-			p.opts.mediaProxyMode = parseString(value, defaultMediaProxyMode)
-		case "PROXY_HTTP_CLIENT_TIMEOUT":
-			slog.Warn("The PROXY_HTTP_CLIENT_TIMEOUT environment variable is deprecated, use MEDIA_PROXY_HTTP_CLIENT_TIMEOUT instead")
-			p.opts.mediaProxyHTTPClientTimeout = parseInt(value, defaultMediaProxyHTTPClientTimeout)
-		case "MEDIA_PROXY_HTTP_CLIENT_TIMEOUT":
-			p.opts.mediaProxyHTTPClientTimeout = parseInt(value, defaultMediaProxyHTTPClientTimeout)
-		case "PROXY_OPTION":
-			slog.Warn("The PROXY_OPTION environment variable is deprecated, use MEDIA_PROXY_MODE instead")
-			p.opts.mediaProxyMode = parseString(value, defaultMediaProxyMode)
-		case "MEDIA_PROXY_MODE":
-			p.opts.mediaProxyMode = parseString(value, defaultMediaProxyMode)
-		case "PROXY_MEDIA_TYPES":
-			slog.Warn("The PROXY_MEDIA_TYPES environment variable is deprecated, use MEDIA_PROXY_RESOURCE_TYPES instead")
-			p.opts.mediaProxyResourceTypes = parseStringList(value, []string{defaultMediaResourceTypes})
-		case "MEDIA_PROXY_RESOURCE_TYPES":
-			p.opts.mediaProxyResourceTypes = parseStringList(value, []string{defaultMediaResourceTypes})
-		case "PROXY_IMAGE_URL":
-			slog.Warn("The PROXY_IMAGE_URL environment variable is deprecated, use MEDIA_PROXY_CUSTOM_URL instead")
-			p.opts.mediaProxyCustomURL = parseString(value, defaultMediaProxyURL)
-		case "PROXY_URL":
-			slog.Warn("The PROXY_URL environment variable is deprecated, use MEDIA_PROXY_CUSTOM_URL instead")
-			p.opts.mediaProxyCustomURL = parseString(value, defaultMediaProxyURL)
-		case "PROXY_PRIVATE_KEY":
-			slog.Warn("The PROXY_PRIVATE_KEY environment variable is deprecated, use MEDIA_PROXY_PRIVATE_KEY instead")
-			randomKey := make([]byte, 16)
-			if _, err := rand.Read(randomKey); err != nil {
-				return fmt.Errorf("config: unable to generate random key: %w", err)
-			}
-			p.opts.mediaProxyPrivateKey = parseBytes(value, randomKey)
-		case "MEDIA_PROXY_PRIVATE_KEY":
-			randomKey := make([]byte, 16)
-			if _, err := rand.Read(randomKey); err != nil {
-				return fmt.Errorf("config: unable to generate random key: %w", err)
-			}
-			p.opts.mediaProxyPrivateKey = parseBytes(value, randomKey)
-		case "MEDIA_PROXY_CUSTOM_URL":
-			p.opts.mediaProxyCustomURL = parseString(value, defaultMediaProxyURL)
-		case "CREATE_ADMIN":
-			p.opts.createAdmin = parseBool(value, defaultCreateAdmin)
-		case "ADMIN_USERNAME":
-			p.opts.adminUsername = parseString(value, defaultAdminUsername)
-		case "ADMIN_USERNAME_FILE":
-			p.opts.adminUsername = readSecretFile(value, defaultAdminUsername)
-		case "ADMIN_PASSWORD":
-			p.opts.adminPassword = parseString(value, defaultAdminPassword)
-		case "ADMIN_PASSWORD_FILE":
-			p.opts.adminPassword = readSecretFile(value, defaultAdminPassword)
-		case "POCKET_CONSUMER_KEY":
-			p.opts.pocketConsumerKey = parseString(value, defaultPocketConsumerKey)
-		case "POCKET_CONSUMER_KEY_FILE":
-			p.opts.pocketConsumerKey = readSecretFile(value, defaultPocketConsumerKey)
-		case "OAUTH2_USER_CREATION":
-			p.opts.oauth2UserCreationAllowed = parseBool(value, defaultOAuth2UserCreation)
-		case "OAUTH2_CLIENT_ID":
-			p.opts.oauth2ClientID = parseString(value, defaultOAuth2ClientID)
-		case "OAUTH2_CLIENT_ID_FILE":
-			p.opts.oauth2ClientID = readSecretFile(value, defaultOAuth2ClientID)
-		case "OAUTH2_CLIENT_SECRET":
-			p.opts.oauth2ClientSecret = parseString(value, defaultOAuth2ClientSecret)
-		case "OAUTH2_CLIENT_SECRET_FILE":
-			p.opts.oauth2ClientSecret = readSecretFile(value, defaultOAuth2ClientSecret)
-		case "OAUTH2_REDIRECT_URL":
-			p.opts.oauth2RedirectURL = parseString(value, defaultOAuth2RedirectURL)
-		case "OAUTH2_OIDC_DISCOVERY_ENDPOINT":
-			p.opts.oidcDiscoveryEndpoint = parseString(value, defaultOAuth2OidcDiscoveryEndpoint)
-		case "OAUTH2_OIDC_PROVIDER_NAME":
-			p.opts.oidcProviderName = parseString(value, defaultOauth2OidcProviderName)
-		case "OAUTH2_PROVIDER":
-			p.opts.oauth2Provider = parseString(value, defaultOAuth2Provider)
-		case "DISABLE_LOCAL_AUTH":
-			p.opts.disableLocalAuth = parseBool(value, defaultDisableLocalAuth)
-		case "HTTP_CLIENT_TIMEOUT":
-			p.opts.httpClientTimeout = parseInt(value, defaultHTTPClientTimeout)
-		case "HTTP_CLIENT_MAX_BODY_SIZE":
-			p.opts.httpClientMaxBodySize = int64(parseInt(value, defaultHTTPClientMaxBodySize) * 1024 * 1024)
-		case "HTTP_CLIENT_PROXY":
-			p.opts.httpClientProxyURL, err = url.Parse(parseString(value, defaultHTTPClientProxy))
-			if err != nil {
-				return fmt.Errorf("config: invalid HTTP_CLIENT_PROXY value: %w", err)
-			}
-		case "HTTP_CLIENT_PROXIES":
-			p.opts.httpClientProxies = parseStringList(value, []string{})
-		case "HTTP_CLIENT_USER_AGENT":
-			p.opts.httpClientUserAgent = parseString(value, defaultHTTPClientUserAgent)
-		case "HTTP_SERVER_TIMEOUT":
-			p.opts.httpServerTimeout = parseInt(value, defaultHTTPServerTimeout)
-		case "AUTH_PROXY_HEADER":
-			p.opts.authProxyHeader = parseString(value, defaultAuthProxyHeader)
-		case "AUTH_PROXY_USER_CREATION":
-			p.opts.authProxyUserCreation = parseBool(value, defaultAuthProxyUserCreation)
-		case "MAINTENANCE_MODE":
-			p.opts.maintenanceMode = parseBool(value, defaultMaintenanceMode)
-		case "MAINTENANCE_MESSAGE":
-			p.opts.maintenanceMessage = parseString(value, defaultMaintenanceMessage)
-		case "METRICS_COLLECTOR":
-			p.opts.metricsCollector = parseBool(value, defaultMetricsCollector)
-		case "METRICS_REFRESH_INTERVAL":
-			p.opts.metricsRefreshInterval = parseInt(value, defaultMetricsRefreshInterval)
-		case "METRICS_ALLOWED_NETWORKS":
-			p.opts.metricsAllowedNetworks = parseStringList(value, []string{defaultMetricsAllowedNetworks})
-		case "METRICS_USERNAME":
-			p.opts.metricsUsername = parseString(value, defaultMetricsUsername)
-		case "METRICS_USERNAME_FILE":
-			p.opts.metricsUsername = readSecretFile(value, defaultMetricsUsername)
-		case "METRICS_PASSWORD":
-			p.opts.metricsPassword = parseString(value, defaultMetricsPassword)
-		case "METRICS_PASSWORD_FILE":
-			p.opts.metricsPassword = readSecretFile(value, defaultMetricsPassword)
-		case "FETCH_BILIBILI_WATCH_TIME":
-			p.opts.fetchBilibiliWatchTime = parseBool(value, defaultFetchBilibiliWatchTime)
-		case "FETCH_NEBULA_WATCH_TIME":
-			p.opts.fetchNebulaWatchTime = parseBool(value, defaultFetchNebulaWatchTime)
-		case "FETCH_ODYSEE_WATCH_TIME":
-			p.opts.fetchOdyseeWatchTime = parseBool(value, defaultFetchOdyseeWatchTime)
-		case "FETCH_YOUTUBE_WATCH_TIME":
-			p.opts.fetchYouTubeWatchTime = parseBool(value, defaultFetchYouTubeWatchTime)
-		case "YOUTUBE_API_KEY":
-			p.opts.youTubeApiKey = parseString(value, defaultYouTubeApiKey)
-		case "YOUTUBE_EMBED_URL_OVERRIDE":
-			p.opts.youTubeEmbedUrlOverride = parseString(value, defaultYouTubeEmbedUrlOverride)
-		case "WATCHDOG":
-			p.opts.watchdog = parseBool(value, defaultWatchdog)
-		case "INVIDIOUS_INSTANCE":
-			p.opts.invidiousInstance = parseString(value, defaultInvidiousInstance)
-		case "WEBAUTHN":
-			p.opts.webAuthn = parseBool(value, defaultWebAuthn)
+	if c.DisableLocalAuth() {
+		switch {
+		case c.OAuth2Provider() == "" && c.AuthProxyHeader() == "":
+			return errors.New("DISABLE_LOCAL_AUTH is enabled but neither OAUTH2_PROVIDER nor AUTH_PROXY_HEADER is set. Please enable at least one authentication source")
+		case c.OAuth2Provider() != "" && !c.IsOAuth2UserCreationAllowed():
+			return errors.New("DISABLE_LOCAL_AUTH is enabled and an OAUTH2_PROVIDER is configured, but OAUTH2_USER_CREATION is not enabled")
+		case c.AuthProxyHeader() != "" && !c.IsAuthProxyUserCreationAllowed():
+			return errors.New("DISABLE_LOCAL_AUTH is enabled and an AUTH_PROXY_HEADER is configured, but AUTH_PROXY_USER_CREATION is not enabled")
 		}
 	}
 
-	if port != "" {
-		p.opts.listenAddr = ":" + port
+	if c.AuthProxyHeader() != "" && len(c.TrustedReverseProxyNetworks()) == 0 {
+		return errors.New("TRUSTED_REVERSE_PROXY_NETWORKS must be configured when AUTH_PROXY_HEADER is used")
 	}
+
+	if (c.CertFile() != "") != (c.CertKeyFile() != "") {
+		return errors.New("CERT_FILE and KEY_FILE must both be provided")
+	}
+
+	if c.CertDomain() != "" && c.CertFile() != "" {
+		return errors.New("CERT_DOMAIN and CERT_FILE/KEY_FILE are mutually exclusive")
+	}
+
+	if (c.MetricsUsername() != "") != (c.MetricsPassword() != "") {
+		return errors.New("METRICS_USERNAME and METRICS_PASSWORD must both be provided")
+	}
+
+	if c.DatabaseMinConns() > c.DatabaseMaxConns() {
+		return errors.New("DATABASE_MIN_CONNS must be less than or equal to DATABASE_MAX_CONNS")
+	}
+
+	if c.SchedulerRoundRobinMinInterval() > c.SchedulerRoundRobinMaxInterval() {
+		return errors.New("SCHEDULER_ROUND_ROBIN_MIN_INTERVAL must be less than or equal to SCHEDULER_ROUND_ROBIN_MAX_INTERVAL")
+	}
+
+	if c.SchedulerEntryFrequencyMinInterval() > c.SchedulerEntryFrequencyMaxInterval() {
+		return errors.New("SCHEDULER_ENTRY_FREQUENCY_MIN_INTERVAL must be less than or equal to SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL")
+	}
+
 	return nil
 }
 
-func parseBaseURL(value string) (string, string, string, error) {
-	if value == "" {
-		return defaultBaseURL, defaultRootURL, "", nil
-	}
+func (cp *configParser) postParsing() error {
+	// Parse basePath and rootURL based on BASE_URL
+	baseURL := cp.options.options["BASE_URL"].parsedStringValue
+	baseURL = strings.TrimSuffix(baseURL, "/")
 
-	if value[len(value)-1:] == "/" {
-		value = value[:len(value)-1]
-	}
-
-	parsedURL, err := url.Parse(value)
+	parsedURL, err := url.Parse(baseURL)
 	if err != nil {
-		return "", "", "", fmt.Errorf("config: invalid BASE_URL: %w", err)
+		return fmt.Errorf("invalid BASE_URL: %v", err)
 	}
 
 	scheme := strings.ToLower(parsedURL.Scheme)
 	if scheme != "https" && scheme != "http" {
-		return "", "", "", errors.New("config: invalid BASE_URL: scheme must be http or https")
+		return errors.New("BASE_URL scheme must be http or https")
 	}
 
-	basePath := parsedURL.Path
+	cp.options.options["BASE_URL"].parsedStringValue = baseURL
+	cp.options.basePath = parsedURL.Path
+
 	parsedURL.Path = ""
-	return value, parsedURL.String(), basePath, nil
+	cp.options.rootURL = parsedURL.String()
+
+	// Parse YouTube embed domain based on YOUTUBE_EMBED_URL_OVERRIDE
+	youTubeEmbedURLOverride := cp.options.options["YOUTUBE_EMBED_URL_OVERRIDE"].parsedStringValue
+	if youTubeEmbedURLOverride != "" {
+		parsedYouTubeEmbedURL, err := url.Parse(youTubeEmbedURLOverride)
+		if err != nil {
+			return fmt.Errorf("invalid YOUTUBE_EMBED_URL_OVERRIDE: %v", err)
+		}
+		cp.options.youTubeEmbedDomain = parsedYouTubeEmbedURL.Hostname()
+	}
+
+	// Generate a media proxy private key if not set
+	if len(cp.options.options["MEDIA_PROXY_PRIVATE_KEY"].parsedBytesValue) == 0 {
+		randomKey := make([]byte, 16)
+		rand.Read(randomKey)
+		cp.options.options["MEDIA_PROXY_PRIVATE_KEY"].parsedBytesValue = randomKey
+	}
+
+	// Override LISTEN_ADDR with PORT if set (for compatibility reasons)
+	if cp.options.Port() != "" {
+		cp.options.options["LISTEN_ADDR"].parsedStringList = []string{":" + cp.options.Port()}
+		cp.options.options["LISTEN_ADDR"].rawValue = ":" + cp.options.Port()
+	}
+
+	return nil
 }
 
-func parseBool(value string, fallback bool) bool {
+func (cp *configParser) parseLines(lines []string) error {
+	for lineNum, line := range lines {
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			return fmt.Errorf("unable to parse configuration, invalid format on line %d", lineNum)
+		}
+
+		key, value = strings.TrimSpace(key), strings.TrimSpace(value)
+		if err := cp.parseLine(key, value); err != nil {
+			return err
+		}
+	}
+
+	if err := cp.postParsing(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (cp *configParser) parseLine(key, value string) error {
+	field, exists := cp.options.options[key]
+	if !exists {
+		if key == "FILTER_ENTRY_MAX_AGE_DAYS" {
+			slog.Warn("Configuration option FILTER_ENTRY_MAX_AGE_DAYS is deprecated; use user filter rule max-age:<duration> instead")
+		}
+		// Ignore unknown configuration keys to avoid parsing unrelated environment variables.
+		return nil
+	}
+
+	// Validate the option if a validator is provided
+	if field.validator != nil {
+		if err := field.validator(value); err != nil {
+			return fmt.Errorf("invalid value for key %s: %v", key, err)
+		}
+	}
+
+	// Convert the raw value based on its type
+	switch field.valueType {
+	case stringType:
+		field.parsedStringValue = parseStringValue(value, field.parsedStringValue)
+		field.rawValue = value
+	case stringListType:
+		field.parsedStringList = parseStringListValue(value, field.parsedStringList)
+		field.rawValue = value
+	case boolType:
+		parsedValue, err := parseBoolValue(value, field.parsedBoolValue)
+		if err != nil {
+			return fmt.Errorf("invalid boolean value for key %s: %v", key, err)
+		}
+		field.parsedBoolValue = parsedValue
+		field.rawValue = value
+	case intType:
+		field.parsedIntValue = parseIntValue(value, field.parsedIntValue)
+		field.rawValue = value
+	case int64Type:
+		field.parsedInt64Value = ParsedInt64Value(value, field.parsedInt64Value)
+		field.rawValue = value
+	case secondType:
+		field.parsedDuration = parseDurationValue(value, time.Second, field.parsedDuration)
+		field.rawValue = value
+	case minuteType:
+		field.parsedDuration = parseDurationValue(value, time.Minute, field.parsedDuration)
+		field.rawValue = value
+	case hourType:
+		field.parsedDuration = parseDurationValue(value, time.Hour, field.parsedDuration)
+		field.rawValue = value
+	case dayType:
+		field.parsedDuration = parseDurationValue(value, time.Hour*24, field.parsedDuration)
+		field.rawValue = value
+	case urlType:
+		parsedURL, err := parseURLValue(value, field.parsedURLValue)
+		if err != nil {
+			return fmt.Errorf("invalid URL for key %s: %v", key, err)
+		}
+		field.parsedURLValue = parsedURL
+		field.rawValue = value
+	case secretFileType:
+		secretValue, err := readSecretFileValue(value)
+		if err != nil {
+			return fmt.Errorf("error reading secret file for key %s: %v", key, err)
+		}
+		if field.targetKey != "" {
+			if targetField, ok := cp.options.options[field.targetKey]; ok {
+				targetField.parsedStringValue = secretValue
+				targetField.rawValue = secretValue
+			}
+		}
+		field.rawValue = value
+	case bytesType:
+		if value != "" {
+			field.parsedBytesValue = []byte(value)
+			field.rawValue = value
+		}
+	}
+
+	return nil
+}
+
+func parseStringValue(value string, fallback string) string {
 	if value == "" {
 		return fallback
 	}
+	return value
+}
+
+func parseBoolValue(value string, fallback bool) (bool, error) {
+	if value == "" {
+		return fallback, nil
+	}
 
 	value = strings.ToLower(value)
 	if value == "1" || value == "yes" || value == "true" || value == "on" {
-		return true
+		return true, nil
+	}
+	if value == "0" || value == "no" || value == "false" || value == "off" {
+		return false, nil
 	}
 
-	return false
+	return false, fmt.Errorf("invalid boolean value: %q", value)
 }
 
-func parseInt(value string, fallback int) int {
+func parseIntValue(value string, fallback int) int {
 	if value == "" {
 		return fallback
 	}
@@ -351,52 +280,86 @@ func parseInt(value string, fallback int) int {
 	return v
 }
 
-func parseString(value string, fallback string) string {
+func ParsedInt64Value(value string, fallback int64) int64 {
 	if value == "" {
 		return fallback
 	}
-	return value
+
+	v, err := strconv.ParseInt(value, 10, 64)
+	if err != nil {
+		return fallback
+	}
+
+	return v
 }
 
-func parseStringList(value string, fallback []string) []string {
+func parseStringListValue(value string, fallback []string) []string {
 	if value == "" {
 		return fallback
 	}
 
 	var strList []string
-	strMap := make(map[string]bool)
+	present := make(map[string]bool)
 
-	items := strings.Split(value, ",")
-	for _, item := range items {
-		itemValue := strings.TrimSpace(item)
-
-		if _, found := strMap[itemValue]; !found {
-			strMap[itemValue] = true
-			strList = append(strList, itemValue)
+	for item := range strings.SplitSeq(value, ",") {
+		if itemValue := strings.TrimSpace(item); itemValue != "" {
+			if !present[itemValue] {
+				present[itemValue] = true
+				strList = append(strList, itemValue)
+			}
 		}
 	}
 
 	return strList
 }
 
-func parseBytes(value string, fallback []byte) []byte {
+func parseDurationValue(value string, unit time.Duration, fallback time.Duration) time.Duration {
 	if value == "" {
 		return fallback
 	}
 
-	return []byte(value)
-}
-
-func readSecretFile(filename, fallback string) string {
-	data, err := os.ReadFile(filename)
+	v, err := strconv.Atoi(value)
 	if err != nil {
 		return fallback
 	}
 
-	value := string(bytes.TrimSpace(data))
+	return time.Duration(v) * unit
+}
+
+func parseURLValue(value string, fallback *url.URL) (*url.URL, error) {
 	if value == "" {
-		return fallback
+		return fallback, nil
 	}
 
-	return value
+	parsedURL, err := url.Parse(value)
+	if err != nil {
+		return fallback, err
+	}
+
+	return parsedURL, nil
+}
+
+func readSecretFileValue(filename string) (string, error) {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return "", err
+	}
+
+	value := string(bytes.TrimSpace(data))
+	if value == "" {
+		return "", errors.New("secret file is empty")
+	}
+
+	return value, nil
+}
+
+func parseFileContent(r io.Reader) (lines []string) {
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if !strings.HasPrefix(line, "#") && strings.Index(line, "=") > 0 {
+			lines = append(lines, line)
+		}
+	}
+	return lines
 }

internal/config/parser_test.go

@@ -4,57 +4,432 @@
 package config // import "miniflux.app/v2/internal/config"
 
 import (
+	"net/url"
+	"os"
+	"reflect"
 	"testing"
+	"time"
 )
 
-func TestParseBoolValue(t *testing.T) {
-	scenarios := map[string]bool{
-		"":        true,
-		"1":       true,
-		"Yes":     true,
-		"yes":     true,
-		"True":    true,
-		"true":    true,
-		"on":      true,
-		"false":   false,
-		"off":     false,
-		"invalid": false,
+func TestParseStringValue(t *testing.T) {
+	// Test with non-empty value
+	result := parseStringValue("test", "fallback")
+	if result != "test" {
+		t.Errorf("Expected 'test', got '%s'", result)
 	}
 
-	for input, expected := range scenarios {
-		result := parseBool(input, true)
-		if result != expected {
-			t.Errorf(`Unexpected result for %q, got %v instead of %v`, input, result, expected)
+	// Test with empty value
+	result = parseStringValue("", "fallback")
+	if result != "fallback" {
+		t.Errorf("Expected 'fallback', got '%s'", result)
+	}
+
+	// Test with empty value and empty fallback
+	result = parseStringValue("", "")
+	if result != "" {
+		t.Errorf("Expected empty string, got '%s'", result)
+	}
+}
+
+func TestParseBoolValue(t *testing.T) {
+	// Test with empty value - should return fallback
+	result, err := parseBoolValue("", true)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+	if result != true {
+		t.Errorf("Expected true, got %v", result)
+	}
+
+	// Test true values
+	trueValues := []string{"1", "yes", "true", "on", "YES", "TRUE", "ON"}
+	for _, value := range trueValues {
+		result, err := parseBoolValue(value, false)
+		if err != nil {
+			t.Errorf("Unexpected error for value '%s': %v", value, err)
+		}
+		if result != true {
+			t.Errorf("Expected true for '%s', got %v", value, result)
 		}
 	}
-}
 
-func TestParseStringValueWithUnsetVariable(t *testing.T) {
-	if parseString("", "defaultValue") != "defaultValue" {
-		t.Errorf(`Unset variables should returns the default value`)
+	// Test false values
+	falseValues := []string{"0", "no", "false", "off", "NO", "FALSE", "OFF"}
+	for _, value := range falseValues {
+		result, err := parseBoolValue(value, true)
+		if err != nil {
+			t.Errorf("Unexpected error for value '%s': %v", value, err)
+		}
+		if result != false {
+			t.Errorf("Expected false for '%s', got %v", value, result)
+		}
 	}
-}
 
-func TestParseStringValue(t *testing.T) {
-	if parseString("test", "defaultValue") != "test" {
-		t.Errorf(`Defined variables should returns the specified value`)
-	}
-}
-
-func TestParseIntValueWithUnsetVariable(t *testing.T) {
-	if parseInt("", 42) != 42 {
-		t.Errorf(`Unset variables should returns the default value`)
-	}
-}
-
-func TestParseIntValueWithInvalidInput(t *testing.T) {
-	if parseInt("invalid integer", 42) != 42 {
-		t.Errorf(`Invalid integer should returns the default value`)
+	// Test invalid value - should return error
+	_, err = parseBoolValue("invalid", false)
+	if err == nil {
+		t.Error("Expected error for invalid boolean value")
 	}
 }
 
 func TestParseIntValue(t *testing.T) {
-	if parseInt("2018", 42) != 2018 {
-		t.Errorf(`Defined variables should returns the specified value`)
+	// Test with empty value - should return fallback
+	result := parseIntValue("", 42)
+	if result != 42 {
+		t.Errorf("Expected 42, got %d", result)
+	}
+
+	// Test with valid integer
+	result = parseIntValue("123", 42)
+	if result != 123 {
+		t.Errorf("Expected 123, got %d", result)
+	}
+
+	// Test with invalid integer - should return fallback
+	result = parseIntValue("invalid", 42)
+	if result != 42 {
+		t.Errorf("Expected 42, got %d", result)
+	}
+
+	// Test with zero
+	result = parseIntValue("0", 42)
+	if result != 0 {
+		t.Errorf("Expected 0, got %d", result)
+	}
+}
+
+func TestParsedInt64Value(t *testing.T) {
+	// Test with empty value - should return fallback
+	result := ParsedInt64Value("", 42)
+	if result != 42 {
+		t.Errorf("Expected 42, got %d", result)
+	}
+
+	// Test with valid int64
+	result = ParsedInt64Value("9223372036854775807", 42)
+	if result != 9223372036854775807 {
+		t.Errorf("Expected 9223372036854775807, got %d", result)
+	}
+
+	// Test with invalid int64 - should return fallback
+	result = ParsedInt64Value("invalid", 42)
+	if result != 42 {
+		t.Errorf("Expected 42, got %d", result)
+	}
+}
+
+func TestParseStringListValue(t *testing.T) {
+	// Test with empty value - should return fallback
+	fallback := []string{"a", "b"}
+	result := parseStringListValue("", fallback)
+	if !reflect.DeepEqual(result, fallback) {
+		t.Errorf("Expected %v, got %v", fallback, result)
+	}
+
+	// Test with single value
+	result = parseStringListValue("item1", nil)
+	expected := []string{"item1"}
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+
+	// Test with multiple values
+	result = parseStringListValue("item1,item2,item3", nil)
+	expected = []string{"item1", "item2", "item3"}
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+
+	// Test with duplicates - should remove duplicates
+	result = parseStringListValue("item1,item2,item1", nil)
+	expected = []string{"item1", "item2"}
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+
+	// Test with spaces
+	result = parseStringListValue(" item1 , item2 , item3 ", nil)
+	expected = []string{"item1", "item2", "item3"}
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
+
+func TestParseDurationValue(t *testing.T) {
+	// Test with empty value - should return fallback
+	fallback := 5 * time.Second
+	result := parseDurationValue("", time.Second, fallback)
+	if result != fallback {
+		t.Errorf("Expected %v, got %v", fallback, result)
+	}
+
+	// Test with valid duration
+	result = parseDurationValue("30", time.Second, fallback)
+	expected := 30 * time.Second
+	if result != expected {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+
+	// Test with minutes
+	result = parseDurationValue("5", time.Minute, fallback)
+	expected = 5 * time.Minute
+	if result != expected {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+
+	// Test with invalid value - should return fallback
+	result = parseDurationValue("invalid", time.Second, fallback)
+	if result != fallback {
+		t.Errorf("Expected %v, got %v", fallback, result)
+	}
+}
+
+func TestParseURLValue(t *testing.T) {
+	// Test with empty value - should return fallback
+	fallbackURL, _ := url.Parse("https://fallback.com")
+	result, err := parseURLValue("", fallbackURL)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+	if result != fallbackURL {
+		t.Errorf("Expected %v, got %v", fallbackURL, result)
+	}
+
+	// Test with valid URL
+	result, err = parseURLValue("https://example.com", nil)
+	if err != nil {
+		t.Errorf("Unexpected error: %v", err)
+	}
+	if result.String() != "https://example.com" {
+		t.Errorf("Expected https://example.com, got %s", result.String())
+	}
+
+	// Test with invalid URL - should return fallback and error
+	result, err = parseURLValue("://invalid", fallbackURL)
+	if err == nil {
+		t.Error("Expected error for invalid URL")
+	}
+	if result != fallbackURL {
+		t.Errorf("Expected fallback URL, got %v", result)
+	}
+}
+
+func TestConfigFileParsing(t *testing.T) {
+	fileContent := `
+		# This is a comment
+		LOG_FILE=miniflux.log
+		LOG_DATE_TIME=1
+		LOG_FORMAT=json
+		LISTEN_ADDR=:8080,:8443
+	`
+
+	// Write a temporary config file and parse it
+	tmpFile, err := os.CreateTemp("", "miniflux-*.txt")
+	if err != nil {
+		t.Fatalf("Failed to create temporary file: %v", err)
+	}
+
+	defer os.Remove(tmpFile.Name())
+	defer tmpFile.Close()
+
+	filename := tmpFile.Name()
+	if _, err := tmpFile.WriteString(fileContent); err != nil {
+		t.Fatalf("Failed to write to temporary file: %v", err)
+	}
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseFile(filename)
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogFile() != "miniflux.log" {
+		t.Fatalf("Unexpected log file, got %q", configOptions.LogFile())
+	}
+
+	if configOptions.LogDateTime() != true {
+		t.Fatalf("Unexpected log datetime, got %v", configOptions.LogDateTime())
+	}
+
+	if configOptions.LogFormat() != "json" {
+		t.Fatalf("Unexpected log format, got %q", configOptions.LogFormat())
+	}
+
+	if configOptions.LogLevel() != "info" {
+		t.Fatalf("Unexpected log level, got %q", configOptions.LogLevel())
+	}
+
+	if len(configOptions.ListenAddr()) != 2 || configOptions.ListenAddr()[0] != ":8080" || configOptions.ListenAddr()[1] != ":8443" {
+		t.Fatalf("Unexpected listen addresses, got %v", configOptions.ListenAddr())
+	}
+}
+
+func TestConfigFileParsingWithIncorrectKeyValuePair(t *testing.T) {
+	fileContent := `
+		LOG_FILE=miniflux.log
+		INVALID_LINE
+	`
+
+	// Write a temporary config file and parse it
+	tmpFile, err := os.CreateTemp("", "miniflux-*.txt")
+	if err != nil {
+		t.Fatalf("Failed to create temporary file: %v", err)
+	}
+
+	defer os.Remove(tmpFile.Name())
+	defer tmpFile.Close()
+
+	filename := tmpFile.Name()
+	if _, err := tmpFile.WriteString(fileContent); err != nil {
+		t.Fatalf("Failed to write to temporary file: %v", err)
+	}
+
+	configParser := NewConfigParser()
+	_, err = configParser.ParseFile(filename)
+	if err != nil {
+		t.Fatal("Invalid lines should be ignored, but got error:", err)
+	}
+}
+
+func TestParseAdminPasswordFileOption(t *testing.T) {
+	tmpFile, err := os.CreateTemp("", "password-*.txt")
+	if err != nil {
+		t.Fatalf("Failed to create temporary file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+	defer tmpFile.Close()
+
+	password := "supersecret"
+	if _, err := tmpFile.WriteString(password); err != nil {
+		t.Fatalf("Failed to write to temporary file: %v", err)
+	}
+
+	os.Clearenv()
+	os.Setenv("ADMIN_PASSWORD_FILE", tmpFile.Name())
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.AdminPassword() != password {
+		t.Fatalf("Unexpected admin password, got %q", configOptions.AdminPassword())
+	}
+}
+
+func TestParseAdminPasswordFileOptionWithEmptyFile(t *testing.T) {
+	tmpFile, err := os.CreateTemp("", "empty-password-*.txt")
+	if err != nil {
+		t.Fatalf("Failed to create temporary file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+	defer tmpFile.Close()
+
+	os.Clearenv()
+	os.Setenv("ADMIN_PASSWORD_FILE", tmpFile.Name())
+
+	configParser := NewConfigParser()
+	_, err = configParser.ParseEnvironmentVariables()
+	if err == nil {
+		t.Fatal("Expected error due to empty password file, but got none")
+	}
+}
+
+func TestParseLogFileOptionDefaultValue(t *testing.T) {
+	os.Clearenv()
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogFile() != "stderr" {
+		t.Fatalf("Unexpected default log file, got %q", configOptions.LogFile())
+	}
+}
+
+func TestParseLogFileOptionWithCustomFilename(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("LOG_FILE", "miniflux.log")
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogFile() != "miniflux.log" {
+		t.Fatalf("Unexpected log file, got %q", configOptions.LogFile())
+	}
+}
+
+func TestParseLogFileOptionWithEmptyValue(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("LOG_FILE", "")
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogFile() != "stderr" {
+		t.Fatalf("Unexpected log file, got %q", configOptions.LogFile())
+	}
+}
+
+func TestParseLogDateTimeOptionDefaultValue(t *testing.T) {
+	os.Clearenv()
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogDateTime() != false {
+		t.Fatalf("Unexpected default log datetime, got %v", configOptions.LogDateTime())
+	}
+}
+
+func TestParseLogDateTimeOptionWithCustomValue(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("LOG_DATE_TIME", "true")
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogDateTime() != true {
+		t.Fatalf("Unexpected log datetime, got %v", configOptions.LogDateTime())
+	}
+}
+
+func TestParseLogDateTimeOptionWithEmptyValue(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("LOG_DATE_TIME", "")
+
+	configParser := NewConfigParser()
+	configOptions, err := configParser.ParseEnvironmentVariables()
+	if err != nil {
+		t.Fatalf("Unexpected parsing error: %v", err)
+	}
+
+	if configOptions.LogDateTime() != false {
+		t.Fatalf("Unexpected log datetime, got %v", configOptions.LogDateTime())
+	}
+}
+
+func TestParseLogDateTimeOptionWithIncorrectValue(t *testing.T) {
+	os.Clearenv()
+	os.Setenv("LOG_DATE_TIME", "invalid")
+
+	configParser := NewConfigParser()
+	if _, err := configParser.ParseEnvironmentVariables(); err == nil {
+		t.Fatal("Expected parsing error, got nil")
 	}
 }

internal/config/validators.go

@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package config // import "miniflux.app/v2/internal/config"
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+func validateChoices(rawValue string, choices []string) error {
+	if !slices.Contains(choices, rawValue) {
+		return fmt.Errorf("value must be one of: %v", strings.Join(choices, ", "))
+	}
+	return nil
+}
+
+func validateListChoices(inputValues, choices []string) error {
+	for _, value := range inputValues {
+		if err := validateChoices(value, choices); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateGreaterThan(rawValue string, min int) error {
+	intValue, err := strconv.Atoi(rawValue)
+	if err != nil {
+		return errors.New("value must be an integer")
+	}
+	if intValue > min {
+		return nil
+	}
+	return fmt.Errorf("value must be at least %d", min)
+}
+
+func validateGreaterOrEqualThan(rawValue string, min int) error {
+	intValue, err := strconv.Atoi(rawValue)
+	if err != nil {
+		return errors.New("value must be an integer")
+	}
+	if intValue >= min {
+		return nil
+	}
+	return fmt.Errorf("value must be greater or equal than %d", min)
+}
+
+func validateRange(rawValue string, min, max int) error {
+	intValue, err := strconv.Atoi(rawValue)
+	if err != nil {
+		return errors.New("value must be an integer")
+	}
+	if intValue < min || intValue > max {
+		return fmt.Errorf("value must be between %d and %d", min, max)
+	}
+	return nil
+}

internal/config/validators_test.go

@@ -0,0 +1,372 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package config // import "miniflux.app/v2/internal/config"
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestValidateChoices(t *testing.T) {
+	tests := []struct {
+		name        string
+		rawValue    string
+		choices     []string
+		expectError bool
+	}{
+		{
+			name:        "valid choice",
+			rawValue:    "option1",
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "valid choice from middle",
+			rawValue:    "option2",
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "valid choice from end",
+			rawValue:    "option3",
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "invalid choice",
+			rawValue:    "invalid",
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: true,
+		},
+		{
+			name:        "empty value with non-empty choices",
+			rawValue:    "",
+			choices:     []string{"option1", "option2"},
+			expectError: true,
+		},
+		{
+			name:        "case sensitive - different case",
+			rawValue:    "OPTION1",
+			choices:     []string{"option1", "option2"},
+			expectError: true,
+		},
+		{
+			name:        "single choice valid",
+			rawValue:    "only",
+			choices:     []string{"only"},
+			expectError: false,
+		},
+		{
+			name:        "empty choices list",
+			rawValue:    "anything",
+			choices:     []string{},
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateChoices(tt.rawValue, tt.choices)
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("expected error but got none")
+				} else {
+					// Verify error message format
+					expectedPrefix := "value must be one of:"
+					if !strings.Contains(err.Error(), expectedPrefix) {
+						t.Errorf("error message should contain '%s', got: %s", expectedPrefix, err.Error())
+					}
+				}
+			} else {
+				if err != nil {
+					t.Errorf("expected no error but got: %v", err)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateListChoices(t *testing.T) {
+	tests := []struct {
+		name        string
+		inputValues []string
+		choices     []string
+		expectError bool
+	}{
+		{
+			name:        "all valid choices",
+			inputValues: []string{"option1", "option2"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "single valid choice",
+			inputValues: []string{"option1"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "empty input list",
+			inputValues: []string{},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "all choices from available list",
+			inputValues: []string{"option1", "option2", "option3"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "duplicate valid choices",
+			inputValues: []string{"option1", "option1", "option2"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: false,
+		},
+		{
+			name:        "one invalid choice",
+			inputValues: []string{"option1", "invalid"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: true,
+		},
+		{
+			name:        "all invalid choices",
+			inputValues: []string{"invalid1", "invalid2"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: true,
+		},
+		{
+			name:        "case sensitive - different case",
+			inputValues: []string{"OPTION1"},
+			choices:     []string{"option1", "option2"},
+			expectError: true,
+		},
+		{
+			name:        "empty string in input",
+			inputValues: []string{""},
+			choices:     []string{"option1", "option2"},
+			expectError: true,
+		},
+		{
+			name:        "empty choices list with non-empty input",
+			inputValues: []string{"anything"},
+			choices:     []string{},
+			expectError: true,
+		},
+		{
+			name:        "mixed valid and invalid choices",
+			inputValues: []string{"option1", "invalid", "option2"},
+			choices:     []string{"option1", "option2", "option3"},
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateListChoices(tt.inputValues, tt.choices)
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("expected error but got none")
+				} else {
+					// Verify error message format
+					expectedPrefix := "value must be one of:"
+					if !strings.Contains(err.Error(), expectedPrefix) {
+						t.Errorf("error message should contain '%s', got: %s", expectedPrefix, err.Error())
+					}
+				}
+			} else {
+				if err != nil {
+					t.Errorf("expected no error but got: %v", err)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateGreaterThan(t *testing.T) {
+	if err := validateGreaterThan("10", 5); err != nil {
+		t.Errorf("expected no error, got: %v", err)
+	}
+
+	if err := validateGreaterThan("5", 5); err == nil {
+		t.Errorf("expected error, got none")
+	}
+
+	if err := validateGreaterThan("abc", 5); err == nil {
+		t.Errorf("expected error for non-integer input, got none")
+	}
+
+	if err := validateGreaterThan("-1", 0); err == nil {
+		t.Errorf("expected error for value below minimum, got none")
+	}
+}
+
+func TestValidateGreaterOrEqualThan(t *testing.T) {
+	if err := validateGreaterOrEqualThan("10", 5); err != nil {
+		t.Errorf("expected no error, got: %v", err)
+	}
+
+	if err := validateGreaterOrEqualThan("5", 5); err != nil {
+		t.Errorf("expected no error for equal value, got: %v", err)
+	}
+
+	if err := validateGreaterOrEqualThan("abc", 5); err == nil {
+		t.Errorf("expected error for non-integer input, got none")
+	}
+
+	if err := validateGreaterOrEqualThan("-1", 0); err == nil {
+		t.Errorf("expected error for value below minimum, got none")
+	}
+}
+
+func TestValidateRange(t *testing.T) {
+	tests := []struct {
+		name        string
+		rawValue    string
+		min         int
+		max         int
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name:        "valid integer within range",
+			rawValue:    "5",
+			min:         1,
+			max:         10,
+			expectError: false,
+		},
+		{
+			name:        "valid integer at minimum",
+			rawValue:    "1",
+			min:         1,
+			max:         10,
+			expectError: false,
+		},
+		{
+			name:        "valid integer at maximum",
+			rawValue:    "10",
+			min:         1,
+			max:         10,
+			expectError: false,
+		},
+		{
+			name:        "valid zero in range",
+			rawValue:    "0",
+			min:         -5,
+			max:         5,
+			expectError: false,
+		},
+		{
+			name:        "valid negative in range",
+			rawValue:    "-3",
+			min:         -5,
+			max:         5,
+			expectError: false,
+		},
+		{
+			name:        "integer below minimum",
+			rawValue:    "0",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be between 1 and 10",
+		},
+		{
+			name:        "integer above maximum",
+			rawValue:    "11",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be between 1 and 10",
+		},
+		{
+			name:        "integer far below minimum",
+			rawValue:    "-100",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be between 1 and 10",
+		},
+		{
+			name:        "integer far above maximum",
+			rawValue:    "100",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be between 1 and 10",
+		},
+		{
+			name:        "non-integer string",
+			rawValue:    "abc",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be an integer",
+		},
+		{
+			name:        "empty string",
+			rawValue:    "",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be an integer",
+		},
+		{
+			name:        "float string",
+			rawValue:    "5.5",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be an integer",
+		},
+		{
+			name:        "string with spaces",
+			rawValue:    " 5 ",
+			min:         1,
+			max:         10,
+			expectError: true,
+			errorMsg:    "value must be an integer",
+		},
+		{
+			name:        "single value range",
+			rawValue:    "5",
+			min:         5,
+			max:         5,
+			expectError: false,
+		},
+		{
+			name:        "single value range - below",
+			rawValue:    "4",
+			min:         5,
+			max:         5,
+			expectError: true,
+			errorMsg:    "value must be between 5 and 5",
+		},
+		{
+			name:        "single value range - above",
+			rawValue:    "6",
+			min:         5,
+			max:         5,
+			expectError: true,
+			errorMsg:    "value must be between 5 and 5",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateRange(tt.rawValue, tt.min, tt.max)
+			if tt.expectError {
+				if err == nil {
+					t.Errorf("expected error but got none")
+				} else if tt.errorMsg != "" && err.Error() != tt.errorMsg {
+					t.Errorf("expected error message '%s', got '%s'", tt.errorMsg, err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Errorf("expected no error but got: %v", err)
+				}
+			}
+		})
+	}
+}

internal/crypto/crypto.go

@@ -8,38 +8,33 @@ import (
 	"crypto/rand"
 	"crypto/sha256"
 	"crypto/subtle"
-	"encoding/base64"
 	"encoding/hex"
 	"fmt"
+	"hash/fnv"
 
 	"golang.org/x/crypto/bcrypt"
 )
 
-// HashFromBytes returns a SHA-256 checksum of the input.
+// HashFromBytes returns a non-cryptographic checksum of the input.
 func HashFromBytes(value []byte) string {
-	return fmt.Sprintf("%x", sha256.Sum256(value))
+	h := fnv.New128a()
+	h.Write(value)
+	return hex.EncodeToString(h.Sum(nil))
 }
 
-// Hash returns a SHA-256 checksum of a string.
-func Hash(value string) string {
-	return HashFromBytes([]byte(value))
+// SHA256 returns a SHA-256 checksum of a string.
+func SHA256(value string) string {
+	h := sha256.Sum256([]byte(value))
+	return hex.EncodeToString(h[:])
 }
 
 // GenerateRandomBytes returns random bytes.
 func GenerateRandomBytes(size int) []byte {
 	b := make([]byte, size)
-	if _, err := rand.Read(b); err != nil {
-		panic(err)
-	}
-
+	rand.Read(b)
 	return b
 }
 
-// GenerateRandomString returns a random string.
-func GenerateRandomString(size int) string {
-	return base64.URLEncoding.EncodeToString(GenerateRandomBytes(size))
-}
-
 // GenerateRandomStringHex returns a random hexadecimal string.
 func GenerateRandomStringHex(size int) string {
 	return hex.EncodeToString(GenerateRandomBytes(size))

internal/database/database.go

@@ -14,11 +14,9 @@ func Migrate(db *sql.DB) error {
 	var currentVersion int
 	db.QueryRow(`SELECT version FROM schema_version`).Scan(&currentVersion)
 
-	driver := getDriverStr()
 	slog.Info("Running database migrations",
 		slog.Int("current_version", currentVersion),
 		slog.Int("latest_version", schemaVersion),
-		slog.String("driver", driver),
 	)
 
 	for version := currentVersion; version < schemaVersion; version++ {
@@ -29,12 +27,12 @@ func Migrate(db *sql.DB) error {
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}
 
-		if err := migrations[version](tx, driver); err != nil {
+		if err := migrations[version](tx); err != nil {
 			tx.Rollback()
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}
 
-		if _, err := tx.Exec(`DELETE FROM schema_version`); err != nil {
+		if _, err := tx.Exec(`TRUNCATE schema_version`); err != nil {
 			tx.Rollback()
 			return fmt.Errorf("[Migration v%d] %v", newVersion, err)
 		}

internal/database/postgresql.go

@@ -1,5 +1,3 @@
-//go:build !sqlite
-
 // SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
@@ -25,7 +23,3 @@ func NewConnectionPool(dsn string, minConnections, maxConnections int, connectio
 
 	return db, nil
 }
-
-func getDriverStr() string {
-	return "postgresql"
-}

internal/database/sqlite.go

@@ -1,26 +0,0 @@
-//go:build sqlite
-
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package database // import "miniflux.app/v2/internal/database"
-
-import (
-	"database/sql"
-	"time"
-
-	_ "github.com/mattn/go-sqlite3"
-)
-
-// NewConnectionPool configures the database connection pool.
-func NewConnectionPool(dsn string, _, _ int, _ time.Duration) (*sql.DB, error) {
-	db, err := sql.Open("sqlite3", dsn)
-	if err != nil {
-		return nil, err
-	}
-	return db, nil
-}
-
-func getDriverStr() string {
-	return "sqlite3"
-}

internal/fever/README.md

@@ -0,0 +1,387 @@
+# Miniflux Fever API
+
+This document describes the Fever-compatible API implemented by the `internal/fever` package in this repository.
+
+## Endpoint
+
+- Path: `BASE_URL/fever/`
+- Methods: not restricted by the router; read requests are typically sent as `GET`, write requests should be sent as `POST`
+- Response format: JSON only
+- Reported API version: `3`
+
+## Authentication
+
+Fever authentication is enabled per user from the Miniflux integrations page.
+
+- `Fever Username` and `Fever Password` are configured in Miniflux
+- Miniflux stores the Fever token as the MD5 hash of `username:password`
+- Clients authenticate by sending that token as the `api_key` parameter
+- Token lookup is case-insensitive
+
+Example:
+
+```text
+api_key = md5("fever_username:fever_password")
+```
+
+Example shell command:
+
+```bash
+printf '%s' 'fever_username:fever_password' | md5sum
+```
+
+Authentication failure does not return HTTP 401. The middleware returns HTTP 200 with:
+
+```json
+{
+  "api_version": 3,
+  "auth": 0
+}
+```
+
+On successful authentication, every response includes:
+
+- `api_version`: always `3`
+- `auth`: always `1`
+- `last_refreshed_on_time`: current server Unix timestamp at response time
+
+## Dispatch Rules
+
+The handler selects the first matching operation in this order:
+
+1. `groups`
+2. `feeds`
+3. `favicons`
+4. `unread_item_ids`
+5. `saved_item_ids`
+6. `items`
+7. `mark=item`
+8. `mark=feed`
+9. `mark=group`
+
+If no selector is provided, the server returns the base authenticated response only.
+
+For read operations, the selector must be present in the query string. For write operations, `mark`, `as`, `id`, and `before` are read from request form values, so they may come from the query string or a form body.
+
+## Read Operations
+
+### `?groups`
+
+Returns:
+
+- `groups`: list of categories
+- `feeds_groups`: mapping of category IDs to feed IDs
+
+Response shape:
+
+```json
+{
+  "api_version": 3,
+  "auth": 1,
+  "last_refreshed_on_time": 1710000000,
+  "groups": [
+    {
+      "id": 1,
+      "title": "All"
+    }
+  ],
+  "feeds_groups": [
+    {
+      "group_id": 1,
+      "feed_ids": "10,11"
+    }
+  ]
+}
+```
+
+Notes:
+
+- `groups` are Miniflux categories
+- `feeds_groups.feed_ids` is a comma-separated string
+- categories with no feeds are returned in `groups` but have no `feeds_groups` entry
+
+### `?feeds`
+
+Returns:
+
+- `feeds`: list of feeds
+- `feeds_groups`: mapping of category IDs to feed IDs
+
+Feed fields:
+
+- `id`
+- `favicon_id`
+- `title`
+- `url`
+- `site_url`
+- `is_spark`
+- `last_updated_on_time`
+
+Notes:
+
+- `favicon_id` is `0` when the feed has no icon
+- `is_spark` is always `0` in this implementation
+- `last_updated_on_time` is the feed check time as a Unix timestamp
+
+### `?favicons`
+
+Returns:
+
+- `favicons`: list of favicon objects
+
+Favicon fields:
+
+- `id`
+- `data`
+
+Notes:
+
+- `data` is a data URL such as `image/png;base64,...`
+
+### `?unread_item_ids`
+
+Returns:
+
+- `unread_item_ids`: comma-separated list of unread entry IDs
+
+Response shape:
+
+```json
+{
+  "api_version": 3,
+  "auth": 1,
+  "last_refreshed_on_time": 1710000000,
+  "unread_item_ids": "100,101,102"
+}
+```
+
+### `?saved_item_ids`
+
+Returns:
+
+- `saved_item_ids`: comma-separated list of starred entry IDs
+
+### `?items`
+
+Returns:
+
+- `items`: list of entries
+- `total_items`: total number of non-removed entries for the user
+
+Item fields:
+
+- `id`
+- `feed_id`
+- `title`
+- `author`
+- `html`
+- `url`
+- `is_saved`
+- `is_read`
+- `created_on_time`
+
+The implementation always excludes entries whose status is `removed`.
+
+#### Pagination and filtering
+
+The handler applies a fixed limit of 50 items.
+
+Supported parameters:
+
+- `since_id`: when greater than `0`, returns entries with `id > since_id`, ordered by `id ASC`
+- `max_id`: when equal to `0`, returns the most recent entries ordered by `id DESC`; when greater than `0`, returns entries with `id < max_id`, ordered by `id DESC`
+- `with_ids`: comma-separated list of entry IDs to fetch
+
+Selector precedence inside `?items` is:
+
+1. `since_id`
+2. `max_id`
+3. `with_ids`
+4. no item filter
+
+Notes:
+
+- `with_ids` does not enforce the 50-ID maximum mentioned in older Fever documentation
+- invalid `with_ids` members are parsed as `0` and do not match normal entries
+- when `items` is requested without `since_id`, `max_id`, or `with_ids`, the code applies no explicit `ORDER BY`, so result ordering is not guaranteed by SQL
+- `html` is returned after Miniflux content rewriting and may include media-proxy-rewritten URLs
+
+Example:
+
+```json
+{
+  "api_version": 3,
+  "auth": 1,
+  "last_refreshed_on_time": 1710000000,
+  "total_items": 245,
+  "items": [
+    {
+      "id": 100,
+      "feed_id": 10,
+      "title": "Example entry",
+      "author": "Author",
+      "html": "<p>Content</p>",
+      "url": "https://example.org/post",
+      "is_saved": 0,
+      "is_read": 1,
+      "created_on_time": 1709990000
+    }
+  ]
+}
+```
+
+## Write Operations
+
+Normal successful write operations return the base authenticated response:
+
+```json
+{
+  "api_version": 3,
+  "auth": 1,
+  "last_refreshed_on_time": 1710000000
+}
+```
+
+### `mark=item`
+
+Parameters:
+
+- `mark=item`
+- `id=<entry_id>`
+- `as=read|unread|saved|unsaved`
+
+Behavior:
+
+- `as=read`: marks the entry as read
+- `as=unread`: marks the entry as unread
+- `as=saved`: toggles the starred flag
+- `as=unsaved`: toggles the starred flag
+
+Important:
+
+- `saved` and `unsaved` both call the same toggle operation
+- sending `as=saved` twice will save, then unsave
+- sending `as=unsaved` twice will unsave, then save
+- if `id <= 0`, the handler returns without writing a response body
+- if the entry does not exist or is already removed, the server returns the base response without an error
+
+### `mark=feed`
+
+Parameters:
+
+- `mark=feed`
+- `as=read`
+- `id=<feed_id>`
+- `before=<unix_timestamp>`
+
+Behavior:
+
+- marks unread entries in the feed as read when `published_at < before`
+- the update runs asynchronously in a goroutine after the response is returned
+
+Notes:
+
+- if `id <= 0`, the handler returns without writing a response body
+- if `before` is missing or invalid, it is treated as Unix time `0`, which usually means nothing is marked as read
+
+### `mark=group`
+
+Parameters:
+
+- `mark=group`
+- `as=read`
+- `id=<group_id>`
+- `before=<unix_timestamp>`
+
+Behavior:
+
+- `id=0`: marks all unread entries as read, ignoring `before`
+- `id>0`: marks unread entries in the matching category as read when `published_at < before`
+- the update runs asynchronously in a goroutine after the response is returned
+
+Notes:
+
+- group IDs map to Miniflux category IDs
+- if `id < 0`, the handler returns without writing a response body
+- if `before` is missing or invalid for `id>0`, it is treated as Unix time `0`, which usually means nothing is marked as read
+
+## Error Handling
+
+Authentication failures:
+
+- HTTP status: `200`
+- body: `{"api_version":3,"auth":0}`
+
+Internal errors:
+
+- HTTP status: `500`
+- body:
+
+```json
+{
+  "error_message": "..."
+}
+```
+
+## Differences From Generic Fever Documentation
+
+This implementation is Fever-compatible, but it does not match every detail of historical Fever API docs.
+
+- Responses are always JSON; `api=xml` is mentioned in code comments but is not implemented
+- `api_version` is `3`
+- `last_refreshed_on_time` is set to the current response time, not the timestamp of the most recently refreshed feed
+- the `Kindling` and `Sparks` super groups are not returned
+- `feeds[].is_spark` is always `0`
+- item ordering without explicit pagination parameters is unspecified
+- `as=saved` and `as=unsaved` toggle the saved flag instead of setting it absolutely
+
+## Examples
+
+Fetch groups:
+
+```bash
+curl -s 'https://miniflux.example.com/fever/?api_key=TOKEN&groups'
+```
+
+Fetch most recent items:
+
+```bash
+curl -s 'https://miniflux.example.com/fever/?api_key=TOKEN&items&max_id=0'
+```
+
+Fetch items after a known ID:
+
+```bash
+curl -s 'https://miniflux.example.com/fever/?api_key=TOKEN&items&since_id=123'
+```
+
+Mark an item as read:
+
+```bash
+curl -s -X POST 'https://miniflux.example.com/fever/' \
+  -d 'api_key=TOKEN' \
+  -d 'mark=item' \
+  -d 'as=read' \
+  -d 'id=123'
+```
+
+Mark a feed as read before a timestamp:
+
+```bash
+curl -s -X POST 'https://miniflux.example.com/fever/' \
+  -d 'api_key=TOKEN' \
+  -d 'mark=feed' \
+  -d 'as=read' \
+  -d 'id=10' \
+  -d 'before=1710000000'
+```
+
+Mark all items as read through the group endpoint:
+
+```bash
+curl -s -X POST 'https://miniflux.example.com/fever/' \
+  -d 'api_key=TOKEN' \
+  -d 'mark=group' \
+  -d 'as=read' \
+  -d 'id=0'
+```

internal/fever/handler.go

@@ -11,30 +11,24 @@ import (
 	"time"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/integration"
 	"miniflux.app/v2/internal/mediaproxy"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/storage"
-
-	"github.com/gorilla/mux"
 )
 
-// Serve handles Fever API calls.
-func Serve(router *mux.Router, store *storage.Storage) {
-	handler := &handler{store, router}
-
-	sr := router.PathPrefix("/fever").Subrouter()
-	sr.Use(newMiddleware(store).serve)
-	sr.HandleFunc("/", handler.serve).Name("feverEndpoint")
+// NewHandler returns an http.Handler for Fever API calls.
+func NewHandler(store *storage.Storage) http.Handler {
+	h := &feverHandler{store: store}
+	return http.HandlerFunc(h.serve)
 }
 
-type handler struct {
-	store  *storage.Storage
-	router *mux.Router
+type feverHandler struct {
+	store *storage.Storage
 }
 
-func (h *handler) serve(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) serve(w http.ResponseWriter, r *http.Request) {
 	switch {
 	case request.HasQueryParam(r, "groups"):
 		h.handleGroups(w, r)
@@ -55,7 +49,7 @@ func (h *handler) serve(w http.ResponseWriter, r *http.Request) {
 	case r.FormValue("mark") == "group":
 		h.handleWriteGroups(w, r)
 	default:
-		json.OK(w, r, newBaseResponse())
+		response.JSON(w, r, newBaseResponse())
 	}
 }
 
@@ -78,7 +72,7 @@ an is_spark equal to 0.
 The “Sparks” super group is not included in this response and is composed of all feeds with an
 is_spark equal to 1.
 */
-func (h *handler) handleGroups(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleGroups(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Fetching groups",
 		slog.Int64("user_id", userID),
@@ -86,13 +80,13 @@ func (h *handler) handleGroups(w http.ResponseWriter, r *http.Request) {
 
 	categories, err := h.store.Categories(userID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	feeds, err := h.store.Feeds(userID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -101,9 +95,9 @@ func (h *handler) handleGroups(w http.ResponseWriter, r *http.Request) {
 		result.Groups = append(result.Groups, group{ID: category.ID, Title: category.Title})
 	}
 
-	result.FeedsGroups = h.buildFeedGroups(feeds)
+	result.FeedsGroups = buildFeedGroups(feeds)
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -130,7 +124,7 @@ should be limited to feeds with an is_spark equal to 0.
 
 For the “Sparks” super group the items should be limited to feeds with an is_spark equal to 1.
 */
-func (h *handler) handleFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleFeeds(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Fetching feeds",
 		slog.Int64("user_id", userID),
@@ -138,14 +132,14 @@ func (h *handler) handleFeeds(w http.ResponseWriter, r *http.Request) {
 
 	feeds, err := h.store.Feeds(userID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
 	var result feedsResponse
-	result.Feeds = make([]feed, 0)
+	result.Feeds = make([]feed, 0, len(feeds))
 	for _, f := range feeds {
-		subscripion := feed{
+		subscription := feed{
 			ID:          f.ID,
 			Title:       f.Title,
 			URL:         f.FeedURL,
@@ -155,15 +149,15 @@ func (h *handler) handleFeeds(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if f.Icon != nil {
-			subscripion.FaviconID = f.Icon.IconID
+			subscription.FaviconID = f.Icon.IconID
 		}
 
-		result.Feeds = append(result.Feeds, subscripion)
+		result.Feeds = append(result.Feeds, subscription)
 	}
 
-	result.FeedsGroups = h.buildFeedGroups(feeds)
+	result.FeedsGroups = buildFeedGroups(feeds)
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -185,7 +179,7 @@ A PHP/HTML example:
 
 	echo '<img src="data:'.$favicon['data'].'">';
 */
-func (h *handler) handleFavicons(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleFavicons(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Fetching favicons",
 		slog.Int64("user_id", userID),
@@ -193,7 +187,7 @@ func (h *handler) handleFavicons(w http.ResponseWriter, r *http.Request) {
 
 	icons, err := h.store.Icons(userID)
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -206,7 +200,7 @@ func (h *handler) handleFavicons(w http.ResponseWriter, r *http.Request) {
 	}
 
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -239,7 +233,7 @@ Three optional arguments control determine the items included in the response.
 	Use the with_ids argument with a comma-separated list of item ids to request (a maximum of 50) specific items.
 	(added in API version 2)
 */
-func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleItems(w http.ResponseWriter, r *http.Request) {
 	var result itemsResponse
 
 	userID := request.UserID(r)
@@ -279,7 +273,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 		if csvItemIDs != "" {
 			var itemIDs []int64
 
-			for _, strItemID := range strings.Split(csvItemIDs, ",") {
+			for strItemID := range strings.SplitSeq(csvItemIDs, ",") {
 				strItemID = strings.TrimSpace(strItemID)
 				itemID, _ := strconv.ParseInt(strItemID, 10, 64)
 				itemIDs = append(itemIDs, itemID)
@@ -295,7 +289,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 
 	entries, err := builder.GetEntries()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -303,11 +297,11 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 	builder.WithoutStatus(model.EntryStatusRemoved)
 	result.Total, err = builder.CountEntries()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	result.Items = make([]item, 0)
+	result.Items = make([]item, 0, len(entries))
 	for _, entry := range entries {
 		isRead := 0
 		if entry.Status == model.EntryStatusRead {
@@ -324,7 +318,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 			FeedID:    entry.FeedID,
 			Title:     entry.Title,
 			Author:    entry.Author,
-			HTML:      mediaproxy.RewriteDocumentWithAbsoluteProxyURL(h.router, entry.Content),
+			HTML:      mediaproxy.RewriteDocumentWithAbsoluteProxyURL(entry.Content),
 			URL:       entry.URL,
 			IsSaved:   isSaved,
 			IsRead:    isRead,
@@ -333,7 +327,7 @@ func (h *handler) handleItems(w http.ResponseWriter, r *http.Request) {
 	}
 
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -344,7 +338,7 @@ A request with the unread_item_ids argument will return one additional member:
 
 	unread_item_ids (string/comma-separated list of positive integers)
 */
-func (h *handler) handleUnreadItems(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleUnreadItems(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Fetching unread items",
 		slog.Int64("user_id", userID),
@@ -354,11 +348,11 @@ func (h *handler) handleUnreadItems(w http.ResponseWriter, r *http.Request) {
 	builder.WithStatus(model.EntryStatusUnread)
 	rawEntryIDs, err := builder.GetEntryIDs()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	var itemIDs []string
+	itemIDs := make([]string, 0, len(rawEntryIDs))
 	for _, entryID := range rawEntryIDs {
 		itemIDs = append(itemIDs, strconv.FormatInt(entryID, 10))
 	}
@@ -366,7 +360,7 @@ func (h *handler) handleUnreadItems(w http.ResponseWriter, r *http.Request) {
 	var result unreadResponse
 	result.ItemIDs = strings.Join(itemIDs, ",")
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -377,7 +371,7 @@ with the remote Fever installation.
 
 	saved_item_ids (string/comma-separated list of positive integers)
 */
-func (h *handler) handleSavedItems(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleSavedItems(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Fetching saved items",
 		slog.Int64("user_id", userID),
@@ -388,18 +382,18 @@ func (h *handler) handleSavedItems(w http.ResponseWriter, r *http.Request) {
 
 	entryIDs, err := builder.GetEntryIDs()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
-	var itemsIDs []string
+	itemsIDs := make([]string, 0, len(entryIDs))
 	for _, entryID := range entryIDs {
 		itemsIDs = append(itemsIDs, strconv.FormatInt(entryID, 10))
 	}
 
 	result := &savedResponse{ItemIDs: strings.Join(itemsIDs, ",")}
 	result.SetCommonValues()
-	json.OK(w, r, result)
+	response.JSON(w, r, result)
 }
 
 /*
@@ -407,7 +401,7 @@ mark=item
 as=? where ? is replaced with read, saved or unsaved
 id=? where ? is replaced with the id of the item to modify
 */
-func (h *handler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	slog.Debug("[Fever] Receiving mark=item call",
 		slog.Int64("user_id", userID),
@@ -424,7 +418,7 @@ func (h *handler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
 
 	entry, err := builder.GetEntry()
 	if err != nil {
-		json.ServerError(w, r, err)
+		response.JSONServerError(w, r, err)
 		return
 	}
 
@@ -433,7 +427,7 @@ func (h *handler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
 			slog.Int64("user_id", userID),
 			slog.Int64("entry_id", entryID),
 		)
-		json.OK(w, r, newBaseResponse())
+		response.JSON(w, r, newBaseResponse())
 		return
 	}
 
@@ -455,14 +449,14 @@ func (h *handler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
 			slog.Int64("user_id", userID),
 			slog.Int64("entry_id", entryID),
 		)
-		if err := h.store.ToggleBookmark(userID, entryID); err != nil {
-			json.ServerError(w, r, err)
+		if err := h.store.ToggleStarred(userID, entryID); err != nil {
+			response.JSONServerError(w, r, err)
 			return
 		}
 
 		settings, err := h.store.Integration(userID)
 		if err != nil {
-			json.ServerError(w, r, err)
+			response.JSONServerError(w, r, err)
 			return
 		}
 
@@ -474,13 +468,13 @@ func (h *handler) handleWriteItems(w http.ResponseWriter, r *http.Request) {
 			slog.Int64("user_id", userID),
 			slog.Int64("entry_id", entryID),
 		)
-		if err := h.store.ToggleBookmark(userID, entryID); err != nil {
-			json.ServerError(w, r, err)
+		if err := h.store.ToggleStarred(userID, entryID); err != nil {
+			response.JSONServerError(w, r, err)
 			return
 		}
 	}
 
-	json.OK(w, r, newBaseResponse())
+	response.JSON(w, r, newBaseResponse())
 }
 
 /*
@@ -489,7 +483,7 @@ as=read
 id=? where ? is replaced with the id of the feed or group to modify
 before=? where ? is replaced with the Unix timestamp of the the local client’s most recent items API request
 */
-func (h *handler) handleWriteFeeds(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleWriteFeeds(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	feedID := request.FormInt64Value(r, "id")
 	before := time.Unix(request.FormInt64Value(r, "before"), 0)
@@ -504,18 +498,12 @@ func (h *handler) handleWriteFeeds(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	go func() {
-		if err := h.store.MarkFeedAsRead(userID, feedID, before); err != nil {
-			slog.Error("[Fever] Unable to mark feed as read",
-				slog.Int64("user_id", userID),
-				slog.Int64("feed_id", feedID),
-				slog.Time("before_ts", before),
-				slog.Any("error", err),
-			)
-		}
-	}()
+	if err := h.store.MarkFeedAsRead(userID, feedID, before); err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
 
-	json.OK(w, r, newBaseResponse())
+	response.JSON(w, r, newBaseResponse())
 }
 
 /*
@@ -524,41 +512,37 @@ as=read
 id=? where ? is replaced with the id of the feed or group to modify
 before=? where ? is replaced with the Unix timestamp of the the local client’s most recent items API request
 */
-func (h *handler) handleWriteGroups(w http.ResponseWriter, r *http.Request) {
+func (h *feverHandler) handleWriteGroups(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	groupID := request.FormInt64Value(r, "id")
-	before := time.Unix(request.FormInt64Value(r, "before"), 0)
-
-	slog.Debug("[Fever] Mark group as read before a given date",
-		slog.Int64("user_id", userID),
-		slog.Int64("group_id", groupID),
-		slog.Time("before_ts", before),
-	)
 
 	if groupID < 0 {
 		return
 	}
 
-	go func() {
-		var err error
+	var err error
 
-		if groupID == 0 {
-			err = h.store.MarkAllAsRead(userID)
-		} else {
-			err = h.store.MarkCategoryAsRead(userID, groupID, before)
-		}
+	if groupID == 0 {
+		err = h.store.MarkAllAsRead(userID)
+		slog.Debug("[Fever] Mark all items as read",
+			slog.Int64("user_id", userID),
+		)
+	} else {
+		before := time.Unix(request.FormInt64Value(r, "before"), 0)
+		err = h.store.MarkCategoryAsRead(userID, groupID, before)
+		slog.Debug("[Fever] Mark group as read before a given date",
+			slog.Int64("user_id", userID),
+			slog.Int64("group_id", groupID),
+			slog.Time("before_ts", before),
+		)
+	}
 
-		if err != nil {
-			slog.Error("[Fever] Unable to mark group as read",
-				slog.Int64("user_id", userID),
-				slog.Int64("group_id", groupID),
-				slog.Time("before_ts", before),
-				slog.Any("error", err),
-			)
-		}
-	}()
+	if err != nil {
+		response.JSONServerError(w, r, err)
+		return
+	}
 
-	json.OK(w, r, newBaseResponse())
+	response.JSON(w, r, newBaseResponse())
 }
 
 /*
@@ -567,13 +551,13 @@ A feeds_group object has the following members:
 	group_id (positive integer)
 	feed_ids (string/comma-separated list of positive integers)
 */
-func (h *handler) buildFeedGroups(feeds model.Feeds) []feedsGroups {
-	feedsGroupedByCategory := make(map[int64][]string)
+func buildFeedGroups(feeds model.Feeds) []feedsGroups {
+	feedsGroupedByCategory := make(map[int64][]string, len(feeds))
 	for _, feed := range feeds {
 		feedsGroupedByCategory[feed.Category.ID] = append(feedsGroupedByCategory[feed.Category.ID], strconv.FormatInt(feed.ID, 10))
 	}
 
-	result := make([]feedsGroups, 0)
+	result := make([]feedsGroups, 0, len(feedsGroupedByCategory))
 	for categoryID, feedIDs := range feedsGroupedByCategory {
 		result = append(result, feedsGroups{
 			GroupID: categoryID,

internal/fever/middleware.go

@@ -9,70 +9,65 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response/json"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/storage"
 )
 
-type middleware struct {
-	store *storage.Storage
-}
+// Middleware returns the Fever authentication middleware.
+func Middleware(store *storage.Storage) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			clientIP := request.ClientIP(r)
+			apiKey := r.FormValue("api_key")
+			if apiKey == "" {
+				slog.Warn("[Fever] No API key provided",
+					slog.Bool("authentication_failed", true),
+					slog.String("client_ip", clientIP),
+					slog.String("user_agent", r.UserAgent()),
+				)
+				response.JSON(w, r, newAuthFailureResponse())
+				return
+			}
 
-func newMiddleware(s *storage.Storage) *middleware {
-	return &middleware{s}
-}
+			user, err := store.UserByFeverToken(apiKey)
+			if err != nil {
+				slog.Error("[Fever] Unable to fetch user by API key",
+					slog.Bool("authentication_failed", true),
+					slog.String("client_ip", clientIP),
+					slog.String("user_agent", r.UserAgent()),
+					slog.Any("error", err),
+				)
+				response.JSON(w, r, newAuthFailureResponse())
+				return
+			}
 
-func (m *middleware) serve(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		clientIP := request.ClientIP(r)
-		apiKey := r.FormValue("api_key")
-		if apiKey == "" {
-			slog.Warn("[Fever] No API key provided",
-				slog.Bool("authentication_failed", true),
+			if user == nil {
+				slog.Warn("[Fever] No user found with the API key provided",
+					slog.Bool("authentication_failed", true),
+					slog.String("client_ip", clientIP),
+					slog.String("user_agent", r.UserAgent()),
+				)
+				response.JSON(w, r, newAuthFailureResponse())
+				return
+			}
+
+			slog.Info("[Fever] User authenticated successfully",
+				slog.Bool("authentication_successful", true),
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
+				slog.Int64("user_id", user.ID),
+				slog.String("username", user.Username),
 			)
-			json.OK(w, r, newAuthFailureResponse())
-			return
-		}
 
-		user, err := m.store.UserByFeverToken(apiKey)
-		if err != nil {
-			slog.Error("[Fever] Unable to fetch user by API key",
-				slog.Bool("authentication_failed", true),
-				slog.String("client_ip", clientIP),
-				slog.String("user_agent", r.UserAgent()),
-				slog.Any("error", err),
-			)
-			json.OK(w, r, newAuthFailureResponse())
-			return
-		}
+			store.SetLastLogin(user.ID)
 
-		if user == nil {
-			slog.Warn("[Fever] No user found with the API key provided",
-				slog.Bool("authentication_failed", true),
-				slog.String("client_ip", clientIP),
-				slog.String("user_agent", r.UserAgent()),
-			)
-			json.OK(w, r, newAuthFailureResponse())
-			return
-		}
+			ctx := r.Context()
+			ctx = context.WithValue(ctx, request.UserIDContextKey, user.ID)
+			ctx = context.WithValue(ctx, request.UserTimezoneContextKey, user.Timezone)
+			ctx = context.WithValue(ctx, request.IsAdminUserContextKey, user.IsAdmin)
+			ctx = context.WithValue(ctx, request.IsAuthenticatedContextKey, true)
 
-		slog.Info("[Fever] User authenticated successfully",
-			slog.Bool("authentication_successful", true),
-			slog.String("client_ip", clientIP),
-			slog.String("user_agent", r.UserAgent()),
-			slog.Int64("user_id", user.ID),
-			slog.String("username", user.Username),
-		)
-
-		m.store.SetLastLogin(user.ID)
-
-		ctx := r.Context()
-		ctx = context.WithValue(ctx, request.UserIDContextKey, user.ID)
-		ctx = context.WithValue(ctx, request.UserTimezoneContextKey, user.Timezone)
-		ctx = context.WithValue(ctx, request.IsAdminUserContextKey, user.IsAdmin)
-		ctx = context.WithValue(ctx, request.IsAuthenticatedContextKey, true)
-
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
 }

internal/googlereader/README.md

@@ -0,0 +1,591 @@
+# Miniflux Google Reader API
+
+This document describes the Google Reader compatible API implemented by the `internal/googlereader` package in this repository.
+
+Miniflux implements a compatibility subset intended for existing Google Reader clients. It is not a full reimplementation of the historical Google Reader API, and several behaviors are intentionally narrower or implementation-specific.
+
+## Endpoint
+
+- Client login path: `BASE_URL/accounts/ClientLogin`
+- API prefix: `BASE_URL/reader/api/0`
+- `BASE_URL` includes the Miniflux root URL and any configured `BasePath`
+- Response format:
+  - `ClientLogin`: plain text by default, JSON when `output=json`
+  - most API reads: JSON
+  - most API writes: plain text `OK`
+
+## Enabling the API
+
+Google Reader compatibility is configured per user from the Miniflux integrations page.
+
+- `Google Reader API` must be enabled
+- `Google Reader Username` must be unique across all Miniflux users
+- `Google Reader Password` is stored as a bcrypt hash
+
+The Google Reader username and password are separate integration credentials. They are not the Miniflux account password.
+
+## Authentication
+
+### `POST /accounts/ClientLogin`
+
+This endpoint exchanges the configured Google Reader username and password for an auth token.
+
+Form parameters:
+
+- `Email`: Google Reader username
+- `Passwd`: Google Reader password
+- `output`: optional, set to `json` for a JSON response
+
+Successful responses:
+
+- default: plain text
+- with `output=json`: JSON
+
+Example plain-text response:
+
+```text
+SID=readeruser/0123456789abcdef...
+LSID=readeruser/0123456789abcdef...
+Auth=readeruser/0123456789abcdef...
+```
+
+Example JSON response:
+
+```json
+{
+  "SID": "readeruser/0123456789abcdef...",
+  "LSID": "readeruser/0123456789abcdef...",
+  "Auth": "readeruser/0123456789abcdef..."
+}
+```
+
+On authentication failure, `ClientLogin` returns HTTP `401` with the normal JSON error body:
+
+```json
+{
+  "error_message": "access unauthorized"
+}
+```
+
+### Auth token format
+
+The token format is:
+
+```text
+<googlereader_username>/<hex_digest>
+```
+
+The digest is generated server-side from:
+
+- the Google Reader username
+- the stored bcrypt hash of the Google Reader password
+
+Specifically, the code computes an HMAC-SHA256 digest of an empty message using the key:
+
+```text
+googlereader_username + bcrypt_hash
+```
+
+Because the bcrypt hash is only known to the server, clients should not try to precompute the token. Use `ClientLogin` or `GET /reader/api/0/token`.
+
+### Authenticating API calls
+
+Miniflux uses different auth mechanisms for `GET` and `POST` requests:
+
+- `GET` requests must send the header `Authorization: GoogleLogin auth=<token>`
+- `POST` requests are authenticated with `T=<token>` read from the parsed form values
+
+Notes:
+
+- the auth scheme must be exactly `GoogleLogin`
+- the auth field name must be exactly lowercase `auth`
+- for `POST`, `T` may come from the URL query or the form body because the server reads merged form values
+- `POST` requests do not accept the token from the `Authorization` header
+- `GET` requests do not accept the token from the query string
+
+### `GET /reader/api/0/token`
+
+This endpoint requires normal `GET` authentication and returns the same token as plain text.
+
+Many Google Reader clients use this as the edit token for subsequent write requests. In Miniflux, the edit token and auth token are the same value.
+
+### Authentication failure on `/reader/api/0/*`
+
+When API authentication fails under `/reader/api/0`, Miniflux returns:
+
+- HTTP `401`
+- header `X-Reader-Google-Bad-Token: true`
+- content type `text/plain; charset=utf-8`
+- body `Unauthorized`
+
+This is different from `ClientLogin`, which returns a JSON `401`.
+
+## Identifier formats
+
+### Stream IDs
+
+The implementation recognizes these stream forms:
+
+- built-in streams:
+  - `user/-/state/com.google/read`
+  - `user/-/state/com.google/starred`
+  - `user/-/state/com.google/reading-list`
+  - `user/-/state/com.google/kept-unread`
+  - `user/-/state/com.google/broadcast`
+  - `user/-/state/com.google/broadcast-friends`
+  - `user/-/state/com.google/like`
+- user-specific equivalents:
+  - `user/<user_id>/state/com.google/...`
+- label streams:
+  - `user/-/label/<name>`
+  - `user/<user_id>/label/<name>`
+- feed streams:
+  - `feed/<value>`
+
+Important feed stream difference:
+
+- read APIs usually emit `feed/<numeric_feed_id>`
+- `subscription/edit` with `ac=subscribe` expects `feed/<absolute_feed_url>`
+- `subscription/edit` with `ac=edit` or `ac=unsubscribe` expects `feed/<numeric_feed_id>`
+
+So `feed/<...>` is not a single stable identifier format across all endpoints.
+
+### Item IDs
+
+`edit-tag` and `stream/items/contents` accept repeated `i` parameters in all of these formats:
+
+- long Google Reader form: `tag:google.com,2005:reader/item/00000000148b9369`
+- short prefixed hexadecimal form: `tag:google.com,2005:reader/item/2f2`
+- bare 16-character hexadecimal form: `000000000000048c`
+- decimal entry ID: `12345`
+
+Responses use different forms depending on endpoint:
+
+- `stream/items/ids` returns decimal IDs as strings
+- `stream/items/contents` returns long-form Google Reader item IDs
+
+## Common response conventions
+
+JSON errors use this shape:
+
+```json
+{
+  "error_message": "..."
+}
+```
+
+Plain-text success responses from write endpoints are usually:
+
+```text
+OK
+```
+
+## POST parameter parsing
+
+Most `POST` handlers call `ParseForm()` and read from `r.Form`, so parameters may be supplied either in the query string or in a standard form body.
+
+Important exception:
+
+- `POST /reader/api/0/edit-tag` reads `a` and `r` from `r.PostForm`, so those tag lists must come from the request body
+
+Because `GET` auth comes only from the `Authorization` header, query parameters never authenticate `GET` requests even when other parameters are read from the query string.
+
+## Endpoint reference
+
+### `GET /reader/api/0/user-info`
+
+Returns JSON only. No `output=json` parameter is required.
+
+Response fields:
+
+- `userId`: Miniflux user ID as a string
+- `userName`: Miniflux username
+- `userProfileId`: same value as `userId`
+- `userEmail`: same value as `userName`
+
+Example:
+
+```json
+{
+  "userId": "1",
+  "userName": "demo",
+  "userProfileId": "1",
+  "userEmail": "demo"
+}
+```
+
+### `GET /reader/api/0/tag/list?output=json`
+
+Returns the starred state and user labels.
+
+Notes:
+
+- `output=json` is required
+- only labels and the starred state are returned
+- built-in states such as `read` and `reading-list` are not listed here
+
+Response shape:
+
+```json
+{
+  "tags": [
+    {
+      "id": "user/1/state/com.google/starred"
+    },
+    {
+      "id": "user/1/label/Tech",
+      "label": "Tech",
+      "type": "folder"
+    }
+  ]
+}
+```
+
+### `GET /reader/api/0/subscription/list?output=json`
+
+Returns the user's feeds.
+
+Notes:
+
+- `output=json` is required
+- each feed is reported with a numeric feed stream ID such as `feed/42`
+- `categories` always contains the Miniflux category as a Google Reader folder
+
+Response shape:
+
+```json
+{
+  "subscriptions": [
+    {
+      "id": "feed/42",
+      "title": "Example Feed",
+      "categories": [
+        {
+          "id": "user/1/label/Tech",
+          "label": "Tech",
+          "type": "folder"
+        }
+      ],
+      "url": "https://example.org/feed.xml",
+      "htmlUrl": "https://example.org/",
+      "iconUrl": "https://miniflux.example.com/icon/..."
+    }
+  ]
+}
+```
+
+### `POST /reader/api/0/subscription/quickadd`
+
+Subscribes to the first discovered feed for the given absolute URL.
+
+Form parameters:
+
+- `T`: auth token
+- `quickadd`: absolute URL
+
+Response shape when a feed is found:
+
+```json
+{
+  "numResults": 1,
+  "query": "https://example.org/feed.xml",
+  "streamId": "feed/42",
+  "streamName": "Example Feed"
+}
+```
+
+Response shape when no feed is found:
+
+```json
+{
+  "numResults": 0
+}
+```
+
+Notes:
+
+- the request URL must be absolute
+- the created subscription is assigned to the user's first category when no explicit category is provided
+
+### `POST /reader/api/0/subscription/edit`
+
+Edits subscriptions. Successful requests return plain text `OK`.
+
+Form parameters:
+
+- `T`: auth token
+- `ac`: action
+- `s`: repeated stream ID
+- `a`: optional destination label stream
+- `t`: optional title
+
+Supported actions:
+
+- `ac=subscribe`
+- `ac=unsubscribe`
+- `ac=edit`
+
+Behavior by action:
+
+- `subscribe`
+  - only the first `s` value is used
+  - `s` must be `feed/<absolute_feed_url>`
+  - `a`, when present, must be a label stream
+  - `t`, when present, becomes the feed title after creation
+- `unsubscribe`
+  - every `s` must be `feed/<numeric_feed_id>`
+- `edit`
+  - only the first `s` value is used
+  - `s` must be `feed/<numeric_feed_id>`
+  - `t` renames the feed
+  - `a` moves the feed to a label, and must be a label stream
+
+Notable limitations:
+
+- removing a label is not implemented here
+- `subscribe`, `edit`, and `unsubscribe` do not share the same feed ID format
+
+### `POST /reader/api/0/rename-tag`
+
+Renames a label. Successful requests return plain text `OK`.
+
+Form parameters:
+
+- `T`: auth token
+- `s`: source label stream
+- `dest`: destination label stream
+
+Rules:
+
+- both `s` and `dest` must be label streams
+- the destination label name must not be empty
+- if the source label does not exist, the endpoint returns HTTP `404`
+
+### `POST /reader/api/0/disable-tag`
+
+Deletes one or more labels and reassigns affected feeds to the user's first remaining category.
+
+Form parameters:
+
+- `T`: auth token
+- `s`: repeated label stream
+
+Rules:
+
+- only label streams are supported
+- at least one category must remain after deletion, otherwise the operation fails
+
+Successful requests return plain text `OK`.
+
+### `POST /reader/api/0/edit-tag`
+
+Marks entries read or unread and starred or unstarred.
+
+Form parameters:
+
+- `T`: auth token
+- `i`: repeated item ID
+- `a`: repeated tag stream to add
+- `r`: repeated tag stream to remove
+
+Supported tag semantics:
+
+- add `user/.../state/com.google/read`: mark read
+- remove `user/.../state/com.google/read`: mark unread
+- add `user/.../state/com.google/kept-unread`: mark unread
+- remove `user/.../state/com.google/kept-unread`: mark read
+- add `user/.../state/com.google/starred`: star
+- remove `user/.../state/com.google/starred`: unstar
+
+Special cases:
+
+- `read` and `kept-unread` cannot be combined in conflicting ways in the same request
+- `starred` cannot be present in both add and remove
+- `broadcast` and `like` are recognized but ignored
+- unsupported tag types cause an error
+
+Successful requests return plain text `OK`.
+
+### `GET /reader/api/0/stream/items/ids?output=json`
+
+Returns item IDs for one stream.
+
+Required query parameters:
+
+- `output=json`
+- `s=<stream_id>`
+
+Optional query parameters:
+
+- `n`: maximum number of items to return
+- `c`: numeric offset continuation token
+- `r`: sort direction, `o` for ascending, anything else for descending
+- `ot`: only items published after this Unix timestamp in seconds
+- `nt`: only items published before this Unix timestamp in seconds
+- `xt`: repeated exclude target stream
+- `it`: repeated filter target stream, parsed but currently ignored
+
+Supported `s` values:
+
+- `user/.../state/com.google/reading-list`
+- `user/.../state/com.google/starred`
+- `user/.../state/com.google/read`
+- `feed/<numeric_feed_id>`
+
+Notes:
+
+- exactly one `s` value is expected
+- label streams are not supported here
+- when `xt` contains the `read` stream, `reading-list` and `feed/<id>` behave as unread-only queries
+- if `n` is omitted, the query is effectively unbounded
+- `continuation` is a numeric offset encoded as a JSON string, not an opaque token
+
+Response shape:
+
+```json
+{
+  "itemRefs": [
+    {
+      "id": "12345"
+    },
+    {
+      "id": "12344"
+    }
+  ],
+  "continuation": "2"
+}
+```
+
+### `POST /reader/api/0/stream/items/contents`
+
+Returns content for specific items.
+
+Required parameters:
+
+- `T`: auth token
+- `output=json`
+- `i`: repeated item ID
+
+Optional query parameters:
+
+- `r`: sort direction, `o` for ascending, anything else for descending
+
+Implementation notes:
+
+- the route is `POST` only
+- `T`, `output`, and `i` are read from merged form values, so they may be supplied in the query string or the form body
+- the handler parses stream filter query parameters, but in practice only the sort direction affects the result
+
+Response shape:
+
+```json
+{
+  "direction": "ltr",
+  "id": "user/-/state/com.google/reading-list",
+  "title": "Reading List",
+  "self": [
+    {
+      "href": "https://miniflux.example.com/reader/api/0/stream/items/contents"
+    }
+  ],
+  "updated": 1710000000,
+  "author": "demo",
+  "items": [
+    {
+      "id": "tag:google.com,2005:reader/item/00000000148b9369",
+      "categories": [
+        "user/1/state/com.google/reading-list",
+        "user/1/label/Tech",
+        "user/1/state/com.google/starred"
+      ],
+      "title": "Example entry",
+      "crawlTimeMsec": "1710000000123",
+      "timestampUsec": "1710000000123456",
+      "published": 1710000000,
+      "updated": 1710000300,
+      "author": "Author",
+      "alternate": [
+        {
+          "href": "https://example.org/post",
+          "type": "text/html"
+        }
+      ],
+      "summary": {
+        "direction": "ltr",
+        "content": "<p>Content</p>"
+      },
+      "content": {
+        "direction": "ltr",
+        "content": "<p>Content</p>"
+      },
+      "origin": {
+        "streamId": "feed/42",
+        "title": "Example Feed",
+        "htmlUrl": "https://example.org/"
+      },
+      "enclosure": [],
+      "canonical": [
+        {
+          "href": "https://example.org/post"
+        }
+      ]
+    }
+  ]
+}
+```
+
+Notes:
+
+- top-level `id` and `title` are hard-coded as the reading list
+- `summary.content` and `content.content` both contain the rewritten entry content
+- enclosure URLs and embedded media may be rewritten through the Miniflux media proxy
+
+### `POST /reader/api/0/mark-all-as-read`
+
+Marks items as read before a timestamp. Successful requests return plain text `OK`.
+
+Form parameters:
+
+- `T`: auth token
+- `s`: stream ID
+- `ts`: optional timestamp
+
+Supported `s` values:
+
+- `feed/<numeric_feed_id>`
+- `user/.../label/<name>`
+- `user/.../state/com.google/reading-list`
+
+Timestamp handling:
+
+- if `ts` has at least 16 digits, it is interpreted as microseconds since the Unix epoch
+- otherwise it is interpreted as seconds since the Unix epoch
+- if `ts` is omitted, Miniflux uses the current server time
+
+Notes:
+
+- only unread entries published before `ts` are marked as read
+- unsupported stream types are effectively a no-op and still return `OK`
+
+### Catch-all unimplemented endpoints
+
+Any other `GET` or `POST` path under `/reader/api/0/` is caught by the fallback handler and returns:
+
+```json
+[]
+```
+
+with HTTP `200`.
+
+## Compatibility notes and deviations
+
+These differences are important for client authors:
+
+- only a subset of Google Reader endpoints is implemented
+- feed stream IDs are numeric in read responses, but `ac=subscribe` expects `feed/<absolute_feed_url>`
+- `stream/items/ids` returns decimal entry IDs, while `stream/items/contents` returns long-form Google Reader item IDs
+- pagination uses `c` as a numeric SQL offset, not an opaque continuation token
+- `it` filter targets are parsed but currently ignored
+- `tag/list` returns only `starred` and user labels
+- API auth failures under `/reader/api/0/*` return plain text `401 Unauthorized`, not JSON
+- unknown `/reader/api/0/*` endpoints return `[]` with `200`, not `404`

internal/googlereader/item.go

@@ -4,6 +4,7 @@
 package googlereader // import "miniflux.app/v2/internal/googlereader"
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"strconv"
@@ -56,9 +57,9 @@ func parseItemID(itemIDValue string) (int64, error) {
 }
 
 func parseItemIDsFromRequest(r *http.Request) ([]int64, error) {
-	items := r.Form[ParamItemIDs]
+	items := r.Form[paramItemIDs]
 	if len(items) == 0 {
-		return nil, fmt.Errorf("googlereader: no items requested")
+		return nil, errors.New("googlereader: no items requested")
 	}
 
 	itemIDs := make([]int64, len(items))

internal/googlereader/middleware.go

@@ -6,39 +6,27 @@ package googlereader // import "miniflux.app/v2/internal/googlereader"
 import (
 	"context"
 	"crypto/hmac"
-	"crypto/sha1"
+	"crypto/sha256"
 	"encoding/hex"
 	"log/slog"
 	"net/http"
 	"strings"
 
+	"miniflux.app/v2/internal/crypto"
 	"miniflux.app/v2/internal/http/request"
 	"miniflux.app/v2/internal/model"
 	"miniflux.app/v2/internal/storage"
 )
 
-type middleware struct {
+type authMiddleware struct {
 	store *storage.Storage
 }
 
-func newMiddleware(s *storage.Storage) *middleware {
-	return &middleware{s}
+func newAuthMiddleware(s *storage.Storage) *authMiddleware {
+	return &authMiddleware{s}
 }
 
-func (m *middleware) handleCORS(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Authorization")
-		if r.Method == http.MethodOptions {
-			w.WriteHeader(http.StatusOK)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
+func (m *authMiddleware) validateApiKey(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		clientIP := request.ClientIP(r)
 
@@ -51,7 +39,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("user_agent", r.UserAgent()),
 					slog.Any("error", err),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 
@@ -62,7 +50,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 		} else {
@@ -74,7 +62,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 			fields := strings.Fields(authorization)
@@ -84,7 +72,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 			if fields[0] != "GoogleLogin" {
@@ -93,7 +81,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 			auths := strings.Split(fields[1], "=")
@@ -103,7 +91,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 			if auths[0] != "auth" {
@@ -112,7 +100,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 					slog.String("client_ip", clientIP),
 					slog.String("user_agent", r.UserAgent()),
 				)
-				Unauthorized(w, r)
+				sendUnauthorizedResponse(w, r)
 				return
 			}
 			token = auths[1]
@@ -126,7 +114,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 				slog.String("user_agent", r.UserAgent()),
 				slog.String("token", token),
 			)
-			Unauthorized(w, r)
+			sendUnauthorizedResponse(w, r)
 			return
 		}
 		var integration *model.Integration
@@ -139,17 +127,17 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 				slog.String("user_agent", r.UserAgent()),
 				slog.Any("error", err),
 			)
-			Unauthorized(w, r)
+			sendUnauthorizedResponse(w, r)
 			return
 		}
 		expectedToken := getAuthToken(integration.GoogleReaderUsername, integration.GoogleReaderPassword)
-		if expectedToken != token {
+		if !crypto.ConstantTimeCmp(expectedToken, token) {
 			slog.Warn("[GoogleReader] Token does not match",
 				slog.Bool("authentication_failed", true),
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
 			)
-			Unauthorized(w, r)
+			sendUnauthorizedResponse(w, r)
 			return
 		}
 		if user, err = m.store.UserByID(integration.UserID); err != nil {
@@ -159,7 +147,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 				slog.String("user_agent", r.UserAgent()),
 				slog.Any("error", err),
 			)
-			Unauthorized(w, r)
+			sendUnauthorizedResponse(w, r)
 			return
 		}
 
@@ -169,7 +157,7 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 				slog.String("client_ip", clientIP),
 				slog.String("user_agent", r.UserAgent()),
 			)
-			Unauthorized(w, r)
+			sendUnauthorizedResponse(w, r)
 			return
 		}
 
@@ -181,14 +169,14 @@ func (m *middleware) apiKeyAuth(next http.Handler) http.Handler {
 		ctx = context.WithValue(ctx, request.UserTimezoneContextKey, user.Timezone)
 		ctx = context.WithValue(ctx, request.IsAdminUserContextKey, user.IsAdmin)
 		ctx = context.WithValue(ctx, request.IsAuthenticatedContextKey, true)
-		ctx = context.WithValue(ctx, request.GoogleReaderToken, token)
+		ctx = context.WithValue(ctx, request.GoogleReaderTokenKey, token)
 
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }
 
 func getAuthToken(username, password string) string {
-	token := hex.EncodeToString(hmac.New(sha1.New, []byte(username+password)).Sum(nil))
+	token := hex.EncodeToString(hmac.New(sha256.New, []byte(username+password)).Sum(nil))
 	token = username + "/" + token
 	return token
 }

internal/googlereader/parameters.go

@@ -4,36 +4,36 @@
 package googlereader // import "miniflux.app/v2/internal/googlereader"
 
 const (
-	// ParamItemIDs - name of the parameter with the item ids
-	ParamItemIDs = "i"
-	// ParamStreamID - name of the parameter containing the stream to be included
-	ParamStreamID = "s"
-	// ParamStreamExcludes - name of the parameter containing streams to be excluded
-	ParamStreamExcludes = "xt"
-	// ParamStreamFilters - name of the parameter containing streams to be included
-	ParamStreamFilters = "it"
-	// ParamStreamMaxItems - name of the parameter containing number of items per page/max items returned
-	ParamStreamMaxItems = "n"
-	// ParamStreamOrder - name of the parameter containing the sort criteria
-	ParamStreamOrder = "r"
-	// ParamStreamStartTime - name of the parameter containing epoch timestamp, filtering items older than
-	ParamStreamStartTime = "ot"
-	// ParamStreamStopTime - name of the parameter containing epoch timestamp, filtering items newer than
-	ParamStreamStopTime = "nt"
-	// ParamTagsRemove - name of the parameter containing tags (streams) to be removed
-	ParamTagsRemove = "r"
-	// ParamTagsAdd - name of the parameter containing tags (streams) to be added
-	ParamTagsAdd = "a"
-	// ParamSubscribeAction - name of the parameter indicating the action to take for subscription/edit
-	ParamSubscribeAction = "ac"
-	// ParamTitle - name of the parameter for the title of the subscription
-	ParamTitle = "t"
-	// ParamQuickAdd - name of the parameter for a URL being quick subscribed to
-	ParamQuickAdd = "quickadd"
-	// ParamDestination - name of the parameter for the new name of a tag
-	ParamDestination = "dest"
-	// ParamContinuation -  name of the parameter for callers to pass to receive the next page of results
-	ParamContinuation = "c"
-	// ParamStreamType - name of the parameter for unix timestamp
-	ParamTimestamp = "ts"
+	// paramItemIDs - name of the parameter with the item ids
+	paramItemIDs = "i"
+	// paramStreamID - name of the parameter containing the stream to be included
+	paramStreamID = "s"
+	// paramStreamExcludes - name of the parameter containing streams to be excluded
+	paramStreamExcludes = "xt"
+	// paramStreamFilters - name of the parameter containing streams to be included
+	paramStreamFilters = "it"
+	// paramStreamMaxItems - name of the parameter containing number of items per page/max items returned
+	paramStreamMaxItems = "n"
+	// paramStreamOrder - name of the parameter containing the sort criteria
+	paramStreamOrder = "r"
+	// paramStreamStartTime - name of the parameter containing epoch timestamp, filtering items older than
+	paramStreamStartTime = "ot"
+	// paramStreamStopTime - name of the parameter containing epoch timestamp, filtering items newer than
+	paramStreamStopTime = "nt"
+	// paramTagsRemove - name of the parameter containing tags (streams) to be removed
+	paramTagsRemove = "r"
+	// paramTagsAdd - name of the parameter containing tags (streams) to be added
+	paramTagsAdd = "a"
+	// paramSubscribeAction - name of the parameter indicating the action to take for subscription/edit
+	paramSubscribeAction = "ac"
+	// paramTitle - name of the parameter for the title of the subscription
+	paramTitle = "t"
+	// paramQuickAdd - name of the parameter for a URL being quick subscribed to
+	paramQuickAdd = "quickadd"
+	// paramDestination - name of the parameter for the new name of a tag
+	paramDestination = "dest"
+	// paramContinuation -  name of the parameter for callers to pass to receive the next page of results
+	paramContinuation = "c"
+	// paramTimestamp - name of the parameter for unix timestamp
+	paramTimestamp = "ts"
 )

internal/googlereader/prefix_suffix.go

@@ -4,28 +4,28 @@
 package googlereader // import "miniflux.app/v2/internal/googlereader"
 
 const (
-	// StreamPrefix is the prefix for astreams (read/starred/reading list and so on)
-	StreamPrefix = "user/-/state/com.google/"
-	// UserStreamPrefix is the user specific prefix for streams (read/starred/reading list and so on)
-	UserStreamPrefix = "user/%d/state/com.google/"
-	// LabelPrefix is the prefix for a label stream
-	LabelPrefix = "user/-/label/"
-	// UserLabelPrefix is the user specific prefix prefix for a label stream
-	UserLabelPrefix = "user/%d/label/"
-	// FeedPrefix is the prefix for a feed stream
-	FeedPrefix = "feed/"
-	// Read is the suffix for read stream
-	Read = "read"
-	// Starred is the suffix for starred stream
-	Starred = "starred"
-	// ReadingList is the suffix for reading list stream
-	ReadingList = "reading-list"
-	// KeptUnread is the suffix for kept unread stream
-	KeptUnread = "kept-unread"
-	// Broadcast is the suffix for broadcast stream
-	Broadcast = "broadcast"
-	// BroadcastFriends is the suffix for broadcast friends stream
-	BroadcastFriends = "broadcast-friends"
-	// Like is the suffix for like stream
-	Like = "like"
+	// streamPrefix is the prefix for streams (read/starred/reading list and so on)
+	streamPrefix = "user/-/state/com.google/"
+	// userStreamPrefix is the user specific prefix for streams (read/starred/reading list and so on)
+	userStreamPrefix = "user/%d/state/com.google/"
+	// labelPrefix is the prefix for a label stream
+	labelPrefix = "user/-/label/"
+	// userLabelPrefix is the user specific prefix prefix for a label stream
+	userLabelPrefix = "user/%d/label/"
+	// feedPrefix is the prefix for a feed stream
+	feedPrefix = "feed/"
+	// readStreamSuffix is the suffix for read stream
+	readStreamSuffix = "read"
+	// starredStreamSuffix is the suffix for starred stream
+	starredStreamSuffix = "starred"
+	// readingListStreamSuffix is the suffix for reading list stream
+	readingListStreamSuffix = "reading-list"
+	// keptUnreadStreamSuffix is the suffix for kept unread stream
+	keptUnreadStreamSuffix = "kept-unread"
+	// broadcastStreamSuffix is the suffix for broadcast stream
+	broadcastStreamSuffix = "broadcast"
+	// broadcastFriendsStreamSuffix is the suffix for broadcast friends stream
+	broadcastFriendsStreamSuffix = "broadcast-friends"
+	// likeStreamSuffix is the suffix for like stream
+	likeStreamSuffix = "like"
 )

internal/googlereader/request_modifier.go

@@ -11,7 +11,7 @@ import (
 	"miniflux.app/v2/internal/http/request"
 )
 
-type RequestModifiers struct {
+type requestModifiers struct {
 	ExcludeTargets    []Stream
 	FilterTargets     []Stream
 	Streams           []Stream
@@ -24,24 +24,24 @@ type RequestModifiers struct {
 	UserID            int64
 }
 
-func (r RequestModifiers) String() string {
+func (r requestModifiers) String() string {
 	var results []string
 
 	results = append(results, fmt.Sprintf("UserID: %d", r.UserID))
 
-	var streamStr []string
+	streamStr := make([]string, 0, len(r.Streams))
 	for _, s := range r.Streams {
 		streamStr = append(streamStr, s.String())
 	}
 	results = append(results, fmt.Sprintf("Streams: [%s]", strings.Join(streamStr, ", ")))
 
-	var exclusions []string
+	exclusions := make([]string, 0, len(r.ExcludeTargets))
 	for _, s := range r.ExcludeTargets {
 		exclusions = append(exclusions, s.String())
 	}
 	results = append(results, fmt.Sprintf("Exclusions: [%s]", strings.Join(exclusions, ", ")))
 
-	var filters []string
+	filters := make([]string, 0, len(r.FilterTargets))
 	for _, s := range r.FilterTargets {
 		filters = append(filters, s.String())
 	}
@@ -49,43 +49,43 @@ func (r RequestModifiers) String() string {
 
 	results = append(results, fmt.Sprintf("Count: %d", r.Count))
 	results = append(results, fmt.Sprintf("Offset: %d", r.Offset))
-	results = append(results, fmt.Sprintf("Sort Direction: %s", r.SortDirection))
-	results = append(results, fmt.Sprintf("Continuation Token: %s", r.ContinuationToken))
+	results = append(results, "Sort Direction: "+r.SortDirection)
+	results = append(results, "Continuation Token: "+r.ContinuationToken)
 	results = append(results, fmt.Sprintf("Start Time: %d", r.StartTime))
 	results = append(results, fmt.Sprintf("Stop Time: %d", r.StopTime))
 
 	return strings.Join(results, "; ")
 }
 
-func parseStreamFilterFromRequest(r *http.Request) (RequestModifiers, error) {
+func parseStreamFilterFromRequest(r *http.Request) (requestModifiers, error) {
 	userID := request.UserID(r)
-	result := RequestModifiers{
+	result := requestModifiers{
 		SortDirection: "desc",
 		UserID:        userID,
 	}
 
-	streamOrder := request.QueryStringParam(r, ParamStreamOrder, "d")
+	streamOrder := request.QueryStringParam(r, paramStreamOrder, "d")
 	if streamOrder == "o" {
 		result.SortDirection = "asc"
 	}
 	var err error
-	result.Streams, err = getStreams(request.QueryStringParamList(r, ParamStreamID), userID)
+	result.Streams, err = getStreams(request.QueryStringParamList(r, paramStreamID), userID)
 	if err != nil {
-		return RequestModifiers{}, err
+		return requestModifiers{}, err
 	}
-	result.ExcludeTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamExcludes), userID)
+	result.ExcludeTargets, err = getStreams(request.QueryStringParamList(r, paramStreamExcludes), userID)
 	if err != nil {
-		return RequestModifiers{}, err
+		return requestModifiers{}, err
 	}
 
-	result.FilterTargets, err = getStreams(request.QueryStringParamList(r, ParamStreamFilters), userID)
+	result.FilterTargets, err = getStreams(request.QueryStringParamList(r, paramStreamFilters), userID)
 	if err != nil {
-		return RequestModifiers{}, err
+		return requestModifiers{}, err
 	}
 
-	result.Count = request.QueryIntParam(r, ParamStreamMaxItems, 0)
-	result.Offset = request.QueryIntParam(r, ParamContinuation, 0)
-	result.StartTime = request.QueryInt64Param(r, ParamStreamStartTime, int64(0))
-	result.StopTime = request.QueryInt64Param(r, ParamStreamStopTime, int64(0))
+	result.Count = request.QueryIntParam(r, paramStreamMaxItems, 0)
+	result.Offset = request.QueryIntParam(r, paramContinuation, 0)
+	result.StartTime = request.QueryInt64Param(r, paramStreamStartTime, int64(0))
+	result.StopTime = request.QueryInt64Param(r, paramStreamStopTime, int64(0))
 	return result, nil
 }

internal/googlereader/response.go

@@ -10,30 +10,34 @@ import (
 	"miniflux.app/v2/internal/http/response"
 )
 
-type login struct {
+type loginResponse struct {
 	SID  string `json:"SID,omitempty"`
 	LSID string `json:"LSID,omitempty"`
 	Auth string `json:"Auth,omitempty"`
 }
 
-func (l login) String() string {
+func (l loginResponse) String() string {
 	return fmt.Sprintf("SID=%s\nLSID=%s\nAuth=%s\n", l.SID, l.LSID, l.Auth)
 }
 
-type userInfo struct {
+type userInfoResponse struct {
 	UserID        string `json:"userId"`
 	UserName      string `json:"userName"`
 	UserProfileID string `json:"userProfileId"`
 	UserEmail     string `json:"userEmail"`
 }
 
-type subscription struct {
-	ID         string                 `json:"id"`
-	Title      string                 `json:"title"`
-	Categories []subscriptionCategory `json:"categories"`
-	URL        string                 `json:"url"`
-	HTMLURL    string                 `json:"htmlUrl"`
-	IconURL    string                 `json:"iconUrl"`
+type subscriptionResponse struct {
+	ID         string                         `json:"id"`
+	Title      string                         `json:"title"`
+	Categories []subscriptionCategoryResponse `json:"categories"`
+	URL        string                         `json:"url"`
+	HTMLURL    string                         `json:"htmlUrl"`
+	IconURL    string                         `json:"iconUrl"`
+}
+
+type subscriptionsResponse struct {
+	Subscriptions []subscriptionResponse `json:"subscriptions"`
 }
 
 type quickAddResponse struct {
@@ -43,14 +47,11 @@ type quickAddResponse struct {
 	StreamName string `json:"streamName,omitempty"`
 }
 
-type subscriptionCategory struct {
+type subscriptionCategoryResponse struct {
 	ID    string `json:"id"`
 	Label string `json:"label,omitempty"`
 	Type  string `json:"type,omitempty"`
 }
-type subscriptionsResponse struct {
-	Subscriptions []subscription `json:"subscriptions"`
-}
 
 type itemRef struct {
 	ID              string `json:"id"`
@@ -64,10 +65,10 @@ type streamIDResponse struct {
 }
 
 type tagsResponse struct {
-	Tags []subscriptionCategory `json:"tags"`
+	Tags []subscriptionCategoryResponse `json:"tags"`
 }
 
-type streamContentItems struct {
+type streamContentItemsResponse struct {
 	Direction string        `json:"direction"`
 	ID        string        `json:"id"`
 	Title     string        `json:"title"`
@@ -118,21 +119,11 @@ type contentItemOrigin struct {
 	HTMLUrl  string `json:"htmlUrl"`
 }
 
-// Unauthorized sends a not authorized error to the client.
-func Unauthorized(w http.ResponseWriter, r *http.Request) {
-	builder := response.New(w, r)
+func sendUnauthorizedResponse(w http.ResponseWriter, r *http.Request) {
+	builder := response.NewBuilder(w, r)
 	builder.WithStatus(http.StatusUnauthorized)
-	builder.WithHeader("Content-Type", "text/plain")
 	builder.WithHeader("X-Reader-Google-Bad-Token", "true")
-	builder.WithBody("Unauthorized")
-	builder.Write()
-}
-
-// OK sends a ok response to the client.
-func OK(w http.ResponseWriter, r *http.Request) {
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusOK)
-	builder.WithHeader("Content-Type", "text/plain")
-	builder.WithBody("OK")
+	builder.WithHeader("Content-Type", "text/plain; charset=utf-8")
+	builder.WithBodyAsString("Unauthorized")
 	builder.Write()
 }

internal/googlereader/stream.go

@@ -72,32 +72,32 @@ func (st StreamType) String() string {
 
 func getStream(streamID string, userID int64) (Stream, error) {
 	switch {
-	case strings.HasPrefix(streamID, FeedPrefix):
-		return Stream{Type: FeedStream, ID: strings.TrimPrefix(streamID, FeedPrefix)}, nil
-	case strings.HasPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID)) || strings.HasPrefix(streamID, StreamPrefix):
-		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserStreamPrefix, userID))
-		id = strings.TrimPrefix(id, StreamPrefix)
+	case strings.HasPrefix(streamID, feedPrefix):
+		return Stream{Type: FeedStream, ID: strings.TrimPrefix(streamID, feedPrefix)}, nil
+	case strings.HasPrefix(streamID, fmt.Sprintf(userStreamPrefix, userID)), strings.HasPrefix(streamID, streamPrefix):
+		id := strings.TrimPrefix(streamID, fmt.Sprintf(userStreamPrefix, userID))
+		id = strings.TrimPrefix(id, streamPrefix)
 		switch id {
-		case Read:
+		case readStreamSuffix:
 			return Stream{ReadStream, ""}, nil
-		case Starred:
+		case starredStreamSuffix:
 			return Stream{StarredStream, ""}, nil
-		case ReadingList:
+		case readingListStreamSuffix:
 			return Stream{ReadingListStream, ""}, nil
-		case KeptUnread:
+		case keptUnreadStreamSuffix:
 			return Stream{KeptUnreadStream, ""}, nil
-		case Broadcast:
+		case broadcastStreamSuffix:
 			return Stream{BroadcastStream, ""}, nil
-		case BroadcastFriends:
+		case broadcastFriendsStreamSuffix:
 			return Stream{BroadcastFriendsStream, ""}, nil
-		case Like:
+		case likeStreamSuffix:
 			return Stream{LikeStream, ""}, nil
 		default:
 			return Stream{NoStream, ""}, fmt.Errorf("googlereader: unknown stream with id: %s", id)
 		}
-	case strings.HasPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID)) || strings.HasPrefix(streamID, LabelPrefix):
-		id := strings.TrimPrefix(streamID, fmt.Sprintf(UserLabelPrefix, userID))
-		id = strings.TrimPrefix(id, LabelPrefix)
+	case strings.HasPrefix(streamID, fmt.Sprintf(userLabelPrefix, userID)), strings.HasPrefix(streamID, labelPrefix):
+		id := strings.TrimPrefix(streamID, fmt.Sprintf(userLabelPrefix, userID))
+		id = strings.TrimPrefix(id, labelPrefix)
 		return Stream{LabelStream, id}, nil
 	case streamID == "":
 		return Stream{NoStream, ""}, nil
@@ -107,7 +107,7 @@ func getStream(streamID string, userID int64) (Stream, error) {
 }
 
 func getStreams(streamIDs []string, userID int64) ([]Stream, error) {
-	streams := make([]Stream, 0)
+	streams := make([]Stream, 0, len(streamIDs))
 	for _, streamID := range streamIDs {
 		stream, err := getStream(streamID, userID)
 		if err != nil {

internal/http/client/client.go

@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package client // import "miniflux.app/v2/internal/http/client"
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+
+	"miniflux.app/v2/internal/urllib"
+)
+
+// ErrPrivateNetwork is returned when a connection to a private network is blocked.
+var ErrPrivateNetwork = errors.New("client: connection to private network is blocked")
+
+// Options holds configuration for creating an HTTP client.
+type Options struct {
+	Timeout              time.Duration
+	BlockPrivateNetworks bool
+}
+
+// NewClientWithOptions creates a new HTTP client with the specified options.
+func NewClientWithOptions(opts Options) *http.Client {
+	if !opts.BlockPrivateNetworks {
+		return &http.Client{Timeout: opts.Timeout}
+	}
+
+	dialer := &net.Dialer{
+		Timeout: opts.Timeout,
+	}
+
+	transport := &http.Transport{
+		// The check is performed at connect time on the actual resolved IP, which eliminates TOCTOU / DNS-rebinding vulnerabilities.
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			host, port, err := net.SplitHostPort(addr)
+			if err != nil {
+				return nil, fmt.Errorf("client: unable to parse address %q: %w", addr, err)
+			}
+
+			ips, err := net.LookupIP(host)
+			if err != nil {
+				return nil, fmt.Errorf("client: unable to resolve host %q: %w", host, err)
+			}
+
+			var safeIP net.IP
+			for _, ip := range ips {
+				if !urllib.IsNonPublicIP(ip) {
+					safeIP = ip
+					break
+				}
+			}
+
+			if safeIP == nil {
+				return nil, fmt.Errorf("%w: host %q resolves to a non-public IP address", ErrPrivateNetwork, host)
+			}
+
+			safeAddr := net.JoinHostPort(safeIP.String(), port)
+			return dialer.DialContext(ctx, network, safeAddr)
+		},
+	}
+
+	return &http.Client{
+		Timeout:   opts.Timeout,
+		Transport: transport,
+	}
+}

internal/http/client/client_test.go

@@ -0,0 +1,113 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package client
+
+import (
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestNewClientWithoutBlockingPrivateNetworks(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second})
+	resp, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatalf("Expected no error, got %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d", resp.StatusCode)
+	}
+}
+
+func TestBlockPrivateNetworksBlocksLoopback(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second, BlockPrivateNetworks: true})
+	_, err := client.Get(server.URL)
+	if err == nil {
+		t.Fatal("Expected an error when connecting to loopback address, got nil")
+	}
+
+	if !errors.Is(err, ErrPrivateNetwork) {
+		t.Fatalf("Expected ErrPrivateNetwork, got %v", err)
+	}
+}
+
+func TestBlockPrivateNetworksAllowsPublicIPs(t *testing.T) {
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second, BlockPrivateNetworks: true})
+	if client == nil {
+		t.Fatal("Expected non-nil client")
+	}
+
+	transport, ok := client.Transport.(*http.Transport)
+	if !ok {
+		t.Fatal("Expected custom http.Transport when blockPrivateNetworks is true")
+	}
+	if transport.DialContext == nil {
+		t.Fatal("Expected custom DialContext when blockPrivateNetworks is true")
+	}
+}
+
+func TestNoCustomTransportWhenNotBlocking(t *testing.T) {
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second})
+	if client.Transport != nil {
+		t.Fatal("Expected nil transport when blockPrivateNetworks is false")
+	}
+}
+
+func TestBlockPrivateNetworksBlocksPrivateIP(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Failed to create listener: %v", err)
+	}
+	defer listener.Close()
+
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	server.Listener = listener
+	server.Start()
+	defer server.Close()
+
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second, BlockPrivateNetworks: true})
+	_, err = client.Get(server.URL)
+	if err == nil {
+		t.Fatal("Expected error when connecting to private IP")
+	}
+
+	if !errors.Is(err, ErrPrivateNetwork) {
+		t.Fatalf("Expected ErrPrivateNetwork, got: %v", err)
+	}
+}
+
+func TestBlockPrivateNetworksAllowsLoopbackWhenDisabled(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client := NewClientWithOptions(Options{Timeout: 5 * time.Second})
+	resp, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatalf("Expected no error when blockPrivateNetworks is false, got %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d", resp.StatusCode)
+	}
+}

internal/http/cookie/cookie.go

@@ -24,7 +24,7 @@ func New(name, value string, isHTTPS bool, path string) *http.Cookie {
 		Path:     basePath(path),
 		Secure:   isHTTPS,
 		HttpOnly: true,
-		Expires:  time.Now().Add(time.Duration(config.Opts.CleanupRemoveSessionsDays()) * 24 * time.Hour),
+		Expires:  time.Now().Add(config.Opts.CleanupRemoveSessionsInterval()),
 		SameSite: http.SameSiteLaxMode,
 	}
 }

internal/http/request/client_ip.go

@@ -9,19 +9,46 @@ import (
 	"strings"
 )
 
-// FindClientIP returns the client real IP address based on trusted Reverse-Proxy HTTP headers.
-func FindClientIP(r *http.Request) string {
-	headers := []string{"X-Forwarded-For", "X-Real-Ip"}
-	for _, header := range headers {
-		value := r.Header.Get(header)
+// IsTrustedIP reports whether the given remote IP address belongs to one of the trusted networks.
+func IsTrustedIP(remoteIP string, trustedNetworks []string) bool {
+	if len(trustedNetworks) == 0 {
+		return false
+	}
 
-		if value != "" {
-			addresses := strings.Split(value, ",")
-			address := strings.TrimSpace(addresses[0])
-			address = dropIPv6zone(address)
+	ip := net.ParseIP(remoteIP)
+	if ip == nil {
+		return false
+	}
 
-			if net.ParseIP(address) != nil {
-				return address
+	for _, cidr := range trustedNetworks {
+		_, network, err := net.ParseCIDR(cidr)
+		if err != nil {
+			continue
+		}
+
+		if network.Contains(ip) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// FindClientIP returns the real client IP address using trusted reverse-proxy headers when allowed.
+func FindClientIP(r *http.Request, isTrustedProxyClient bool) string {
+	if isTrustedProxyClient {
+		headers := [...]string{"X-Forwarded-For", "X-Real-Ip"}
+		for _, header := range headers {
+			value := r.Header.Get(header)
+
+			if value != "" {
+				addresses := strings.Split(value, ",")
+				address := strings.TrimSpace(addresses[0])
+				address = dropIPv6zone(address)
+
+				if net.ParseIP(address) != nil {
+					return address
+				}
 			}
 		}
 	}
@@ -30,19 +57,35 @@ func FindClientIP(r *http.Request) string {
 	return FindRemoteIP(r)
 }
 
-// FindRemoteIP returns remote client IP address without considering HTTP headers.
+// FindRemoteIP returns the parsed remote IP address from the request,
+// falling back to 127.0.0.1 if the address is empty, a unix socket, or invalid.
 func FindRemoteIP(r *http.Request) string {
-	remoteIP, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		remoteIP = r.RemoteAddr
+	if r.RemoteAddr == "@" || r.RemoteAddr == "" {
+		return "127.0.0.1"
 	}
-	return dropIPv6zone(remoteIP)
+
+	// If it looks like it has a port (IPv4:port or [IPv6]:port), try to split it.
+	ip, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		// No port — could be a bare IPv4, IPv6, or IPv6 with zone.
+		ip = r.RemoteAddr
+	}
+
+	// Strip IPv6 zone identifier if present (e.g., %eth0).
+	ip = dropIPv6zone(ip)
+
+	// Validate the IP address.
+	if net.ParseIP(ip) == nil {
+		return "127.0.0.1"
+	}
+
+	return ip
 }
 
 func dropIPv6zone(address string) string {
-	i := strings.IndexByte(address, '%')
-	if i != -1 {
-		address = address[:i]
+	idx := strings.IndexByte(address, '%')
+	if idx != -1 {
+		address = address[:idx]
 	}
 	return address
 }

internal/http/request/client_ip_test.go

@@ -10,27 +10,37 @@ import (
 
 func TestFindClientIPWithoutHeaders(t *testing.T) {
 	r := &http.Request{RemoteAddr: "192.168.0.1:4242"}
-	if ip := FindClientIP(r); ip != "192.168.0.1" {
+	if ip := FindClientIP(r, false); ip != "192.168.0.1" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
 	r = &http.Request{RemoteAddr: "192.168.0.1"}
-	if ip := FindClientIP(r); ip != "192.168.0.1" {
+	if ip := FindClientIP(r, false); ip != "192.168.0.1" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
 	r = &http.Request{RemoteAddr: "fe80::14c2:f039:edc7:edc7"}
-	if ip := FindClientIP(r); ip != "fe80::14c2:f039:edc7:edc7" {
+	if ip := FindClientIP(r, false); ip != "fe80::14c2:f039:edc7:edc7" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
 	r = &http.Request{RemoteAddr: "fe80::14c2:f039:edc7:edc7%eth0"}
-	if ip := FindClientIP(r); ip != "fe80::14c2:f039:edc7:edc7" {
+	if ip := FindClientIP(r, false); ip != "fe80::14c2:f039:edc7:edc7" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
 	r = &http.Request{RemoteAddr: "[fe80::14c2:f039:edc7:edc7%eth0]:4242"}
-	if ip := FindClientIP(r); ip != "fe80::14c2:f039:edc7:edc7" {
+	if ip := FindClientIP(r, false); ip != "fe80::14c2:f039:edc7:edc7" {
+		t.Fatalf(`Unexpected result, got: %q`, ip)
+	}
+
+	r = &http.Request{RemoteAddr: "@"}
+	if ip := FindClientIP(r, false); ip != "127.0.0.1" {
+		t.Fatalf(`Unexpected result, got: %q`, ip)
+	}
+
+	r = &http.Request{RemoteAddr: ""}
+	if ip := FindClientIP(r, false); ip != "127.0.0.1" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 }
@@ -41,7 +51,7 @@ func TestFindClientIPWithXFFHeader(t *testing.T) {
 	headers.Set("X-Forwarded-For", "203.0.113.195, 70.41.3.18, 150.172.238.178")
 	r := &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "203.0.113.195" {
+	if ip := FindClientIP(r, true); ip != "203.0.113.195" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
@@ -50,7 +60,7 @@ func TestFindClientIPWithXFFHeader(t *testing.T) {
 	headers.Set("X-Forwarded-For", "2001:db8:85a3:8d3:1319:8a2e:370:7348")
 	r = &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "2001:db8:85a3:8d3:1319:8a2e:370:7348" {
+	if ip := FindClientIP(r, true); ip != "2001:db8:85a3:8d3:1319:8a2e:370:7348" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
@@ -59,7 +69,7 @@ func TestFindClientIPWithXFFHeader(t *testing.T) {
 	headers.Set("X-Forwarded-For", "fe80::14c2:f039:edc7:edc7%eth0")
 	r = &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "fe80::14c2:f039:edc7:edc7" {
+	if ip := FindClientIP(r, true); ip != "fe80::14c2:f039:edc7:edc7" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
@@ -68,7 +78,7 @@ func TestFindClientIPWithXFFHeader(t *testing.T) {
 	headers.Set("X-Forwarded-For", "70.41.3.18")
 	r = &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "70.41.3.18" {
+	if ip := FindClientIP(r, true); ip != "70.41.3.18" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 
@@ -77,7 +87,7 @@ func TestFindClientIPWithXFFHeader(t *testing.T) {
 	headers.Set("X-Forwarded-For", "fake IP")
 	r = &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "192.168.0.1" {
+	if ip := FindClientIP(r, true); ip != "192.168.0.1" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 }
@@ -87,7 +97,7 @@ func TestClientIPWithXRealIPHeader(t *testing.T) {
 	headers.Set("X-Real-Ip", "192.168.122.1")
 	r := &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "192.168.122.1" {
+	if ip := FindClientIP(r, true); ip != "192.168.122.1" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 }
@@ -99,15 +109,7 @@ func TestClientIPWithBothHeaders(t *testing.T) {
 
 	r := &http.Request{RemoteAddr: "192.168.0.1:4242", Header: headers}
 
-	if ip := FindClientIP(r); ip != "203.0.113.195" {
-		t.Fatalf(`Unexpected result, got: %q`, ip)
-	}
-}
-
-func TestClientIPWithUnixSocketRemoteAddress(t *testing.T) {
-	r := &http.Request{RemoteAddr: "@"}
-
-	if ip := FindClientIP(r); ip != "@" {
+	if ip := FindClientIP(r, true); ip != "203.0.113.195" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 }
@@ -119,7 +121,62 @@ func TestClientIPWithUnixSocketRemoteAddrAndBothHeaders(t *testing.T) {
 
 	r := &http.Request{RemoteAddr: "@", Header: headers}
 
-	if ip := FindClientIP(r); ip != "203.0.113.195" {
+	if ip := FindClientIP(r, true); ip != "203.0.113.195" {
 		t.Fatalf(`Unexpected result, got: %q`, ip)
 	}
 }
+
+func TestIsTrustedIP(t *testing.T) {
+	trustedNetworks := []string{"127.0.0.1/8", "10.0.0.0/8", "::1/128", "invalid"}
+
+	scenarios := []struct {
+		ip       string
+		expected bool
+	}{
+		{"127.0.0.1", true},
+		{"10.0.0.1", true},
+		{"::1", true},
+		{"192.168.1.1", false},
+		{"invalid", false},
+		{"@", false},
+		{"/tmp/miniflux.sock", false},
+		{"", false},
+	}
+
+	for _, scenario := range scenarios {
+		result := IsTrustedIP(scenario.ip, trustedNetworks)
+		if result != scenario.expected {
+			t.Errorf("Expected %v for IP %s, got %v", scenario.expected, scenario.ip, result)
+		}
+	}
+
+	if IsTrustedIP("127.0.0.1", nil) {
+		t.Error("Expected false when no trusted networks are defined")
+	}
+
+	if IsTrustedIP("127.0.0.1", []string{}) {
+		t.Error("Expected false when trusted networks list is empty")
+	}
+}
+
+func TestFindRemoteIP(t *testing.T) {
+	scenarios := []struct {
+		ip       string
+		expected string
+	}{
+		{"192.168.0.1:4242", "192.168.0.1"},
+		{"[2001:db8::1]:4242", "2001:db8::1"},
+		{"fe80::14c2:f039:edc7:edc7%eth0", "fe80::14c2:f039:edc7:edc7"},
+		{"", "127.0.0.1"},
+		{"@", "127.0.0.1"},
+		{"invalid", "127.0.0.1"},
+	}
+
+	for _, scenario := range scenarios {
+		r := &http.Request{RemoteAddr: scenario.ip}
+		result := FindRemoteIP(r)
+		if result != scenario.expected {
+			t.Errorf("Expected %q for RemoteAddr %q, got %q", scenario.expected, scenario.ip, result)
+		}
+	}
+}

internal/http/request/context.go

@@ -6,6 +6,7 @@ package request // import "miniflux.app/v2/internal/http/request"
 import (
 	"net/http"
 	"strconv"
+	"time"
 
 	"miniflux.app/v2/internal/model"
 )
@@ -29,13 +30,13 @@ const (
 	OAuth2CodeVerifierContextKey
 	FlashMessageContextKey
 	FlashErrorMessageContextKey
-	PocketRequestTokenContextKey
 	LastForceRefreshContextKey
 	ClientIPContextKey
-	GoogleReaderToken
+	GoogleReaderTokenKey
 	WebAuthnDataContextKey
 )
 
+// WebAuthnSessionData returns WebAuthn session data from the request context, or nil if absent.
 func WebAuthnSessionData(r *http.Request) *model.WebAuthnSession {
 	if v := r.Context().Value(WebAuthnDataContextKey); v != nil {
 		if value, valid := v.(model.WebAuthnSession); valid {
@@ -45,27 +46,27 @@ func WebAuthnSessionData(r *http.Request) *model.WebAuthnSession {
 	return nil
 }
 
-// GoolgeReaderToken returns the google reader token if it exists.
-func GoolgeReaderToken(r *http.Request) string {
-	return getContextStringValue(r, GoogleReaderToken)
+// GoogleReaderToken returns the Google Reader token from the request context, if present.
+func GoogleReaderToken(r *http.Request) string {
+	return getContextStringValue(r, GoogleReaderTokenKey)
 }
 
-// IsAdminUser checks if the logged user is administrator.
+// IsAdminUser reports whether the logged-in user is an administrator.
 func IsAdminUser(r *http.Request) bool {
 	return getContextBoolValue(r, IsAdminUserContextKey)
 }
 
-// IsAuthenticated returns a boolean if the user is authenticated.
+// IsAuthenticated reports whether the user is authenticated.
 func IsAuthenticated(r *http.Request) bool {
 	return getContextBoolValue(r, IsAuthenticatedContextKey)
 }
 
-// UserID returns the UserID of the logged user.
+// UserID returns the logged-in user's ID from the request context.
 func UserID(r *http.Request) int64 {
 	return getContextInt64Value(r, UserIDContextKey)
 }
 
-// UserName returns the username of the logged user.
+// UserName returns the logged-in user's username, or "unknown" when unset.
 func UserName(r *http.Request) string {
 	value := getContextStringValue(r, UserNameContextKey)
 	if value == "" {
@@ -74,7 +75,7 @@ func UserName(r *http.Request) string {
 	return value
 }
 
-// UserTimezone returns the timezone used by the logged user.
+// UserTimezone returns the user's timezone, defaulting to "UTC" when unset.
 func UserTimezone(r *http.Request) string {
 	value := getContextStringValue(r, UserTimezoneContextKey)
 	if value == "" {
@@ -83,7 +84,7 @@ func UserTimezone(r *http.Request) string {
 	return value
 }
 
-// UserLanguage get the locale used by the current logged user.
+// UserLanguage returns the user's locale, defaulting to "en_US" when unset.
 func UserLanguage(r *http.Request) string {
 	language := getContextStringValue(r, UserLanguageContextKey)
 	if language == "" {
@@ -92,7 +93,7 @@ func UserLanguage(r *http.Request) string {
 	return language
 }
 
-// UserTheme get the theme used by the current logged user.
+// UserTheme returns the user's theme, defaulting to "system_serif" when unset.
 func UserTheme(r *http.Request) string {
 	theme := getContextStringValue(r, UserThemeContextKey)
 	if theme == "" {
@@ -101,56 +102,52 @@ func UserTheme(r *http.Request) string {
 	return theme
 }
 
-// CSRF returns the current CSRF token.
+// CSRF returns the CSRF token from the request context.
 func CSRF(r *http.Request) string {
 	return getContextStringValue(r, CSRFContextKey)
 }
 
-// SessionID returns the current session ID.
+// SessionID returns the current session ID from the request context.
 func SessionID(r *http.Request) string {
 	return getContextStringValue(r, SessionIDContextKey)
 }
 
-// UserSessionToken returns the current user session token.
+// UserSessionToken returns the current user session token from the request context.
 func UserSessionToken(r *http.Request) string {
 	return getContextStringValue(r, UserSessionTokenContextKey)
 }
 
-// OAuth2State returns the current OAuth2 state.
+// OAuth2State returns the OAuth2 state value from the request context.
 func OAuth2State(r *http.Request) string {
 	return getContextStringValue(r, OAuth2StateContextKey)
 }
 
+// OAuth2CodeVerifier returns the OAuth2 PKCE code verifier from the request context.
 func OAuth2CodeVerifier(r *http.Request) string {
 	return getContextStringValue(r, OAuth2CodeVerifierContextKey)
 }
 
-// FlashMessage returns the message message if any.
+// FlashMessage returns the flash message from the request context, if any.
 func FlashMessage(r *http.Request) string {
 	return getContextStringValue(r, FlashMessageContextKey)
 }
 
-// FlashErrorMessage returns the message error message if any.
+// FlashErrorMessage returns the flash error message from the request context, if any.
 func FlashErrorMessage(r *http.Request) string {
 	return getContextStringValue(r, FlashErrorMessageContextKey)
 }
 
-// PocketRequestToken returns the Pocket Request Token if any.
-func PocketRequestToken(r *http.Request) string {
-	return getContextStringValue(r, PocketRequestTokenContextKey)
-}
-
-// LastForceRefresh returns the last force refresh timestamp.
-func LastForceRefresh(r *http.Request) int64 {
+// LastForceRefresh returns the last force refresh timestamp from the request context.
+func LastForceRefresh(r *http.Request) time.Time {
 	jsonStringValue := getContextStringValue(r, LastForceRefreshContextKey)
 	timestamp, err := strconv.ParseInt(jsonStringValue, 10, 64)
 	if err != nil {
-		return 0
+		return time.Time{}
 	}
-	return timestamp
+	return time.Unix(timestamp, 0)
 }
 
-// ClientIP returns the client IP address stored in the context.
+// ClientIP returns the client IP address stored in the request context.
 func ClientIP(r *http.Request) string {
 	return getContextStringValue(r, ClientIPContextKey)
 }

internal/http/request/context_test.go

@@ -7,6 +7,9 @@ import (
 	"context"
 	"net/http"
 	"testing"
+	"time"
+
+	"miniflux.app/v2/internal/model"
 )
 
 func TestContextStringValue(t *testing.T) {
@@ -192,6 +195,28 @@ func TestUserID(t *testing.T) {
 	}
 }
 
+func TestUserName(t *testing.T) {
+	r, _ := http.NewRequest("GET", "http://example.org", nil)
+
+	result := UserName(r)
+	expected := "unknown"
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+
+	ctx := r.Context()
+	ctx = context.WithValue(ctx, UserNameContextKey, "jane")
+	r = r.WithContext(ctx)
+
+	result = UserName(r)
+	expected = "jane"
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+}
+
 func TestUserTimezone(t *testing.T) {
 	r, _ := http.NewRequest("GET", "http://example.org", nil)
 
@@ -346,6 +371,28 @@ func TestOAuth2State(t *testing.T) {
 	}
 }
 
+func TestOAuth2CodeVerifier(t *testing.T) {
+	r, _ := http.NewRequest("GET", "http://example.org", nil)
+
+	result := OAuth2CodeVerifier(r)
+	expected := ""
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+
+	ctx := r.Context()
+	ctx = context.WithValue(ctx, OAuth2CodeVerifierContextKey, "verifier")
+	r = r.WithContext(ctx)
+
+	result = OAuth2CodeVerifier(r)
+	expected = "verifier"
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+}
+
 func TestFlashMessage(t *testing.T) {
 	r, _ := http.NewRequest("GET", "http://example.org", nil)
 
@@ -390,25 +437,64 @@ func TestFlashErrorMessage(t *testing.T) {
 	}
 }
 
-func TestPocketRequestToken(t *testing.T) {
+func TestLastForceRefresh(t *testing.T) {
 	r, _ := http.NewRequest("GET", "http://example.org", nil)
 
-	result := PocketRequestToken(r)
-	expected := ""
+	result := LastForceRefresh(r)
+	expected := time.Time{}
 
-	if result != expected {
-		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	if !result.Equal(expected) {
+		t.Errorf(`Unexpected context value, got %v instead of %v`, result, expected)
 	}
 
 	ctx := r.Context()
-	ctx = context.WithValue(ctx, PocketRequestTokenContextKey, "request token")
+	ctx = context.WithValue(ctx, LastForceRefreshContextKey, "not-a-timestamp")
 	r = r.WithContext(ctx)
 
-	result = PocketRequestToken(r)
-	expected = "request token"
+	result = LastForceRefresh(r)
+	expected = time.Time{}
 
-	if result != expected {
-		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	if !result.Equal(expected) {
+		t.Errorf(`Unexpected context value, got %v instead of %v`, result, expected)
+	}
+
+	ctx = r.Context()
+	ctx = context.WithValue(ctx, LastForceRefreshContextKey, "1700000000")
+	r = r.WithContext(ctx)
+
+	result = LastForceRefresh(r)
+	expected = time.Unix(1700000000, 0)
+
+	if !result.Equal(expected) {
+		t.Errorf(`Unexpected context value, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestWebAuthnSessionData(t *testing.T) {
+	r, _ := http.NewRequest("GET", "http://example.org", nil)
+
+	result := WebAuthnSessionData(r)
+	if result != nil {
+		t.Errorf("Unexpected context value, got %v instead of nil", result)
+	}
+
+	ctx := r.Context()
+	ctx = context.WithValue(ctx, WebAuthnDataContextKey, "invalid")
+	r = r.WithContext(ctx)
+
+	result = WebAuthnSessionData(r)
+	if result != nil {
+		t.Errorf("Unexpected context value, got %v instead of nil", result)
+	}
+
+	session := model.WebAuthnSession{}
+	ctx = r.Context()
+	ctx = context.WithValue(ctx, WebAuthnDataContextKey, session)
+	r = r.WithContext(ctx)
+
+	result = WebAuthnSessionData(r)
+	if result == nil {
+		t.Errorf("Unexpected context value, got nil instead of session")
 	}
 }
 
@@ -433,3 +519,25 @@ func TestClientIP(t *testing.T) {
 		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
 	}
 }
+
+func TestGoogleReaderToken(t *testing.T) {
+	r, _ := http.NewRequest("GET", "http://example.org", nil)
+
+	result := GoogleReaderToken(r)
+	expected := ""
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+
+	ctx := r.Context()
+	ctx = context.WithValue(ctx, GoogleReaderTokenKey, "token")
+	r = r.WithContext(ctx)
+
+	result = GoogleReaderToken(r)
+	expected = "token"
+
+	if result != expected {
+		t.Errorf(`Unexpected context value, got %q instead of %q`, result, expected)
+	}
+}

internal/http/request/cookie.go

@@ -5,7 +5,7 @@ package request // import "miniflux.app/v2/internal/http/request"
 
 import "net/http"
 
-// CookieValue returns the cookie value.
+// CookieValue returns the named cookie value, or an empty string if the cookie is missing.
 func CookieValue(r *http.Request, name string) string {
 	cookie, err := r.Cookie(name)
 	if err != nil {

internal/http/request/params.go

@@ -7,11 +7,9 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
-
-	"github.com/gorilla/mux"
 )
 
-// FormInt64Value returns a form value as integer.
+// FormInt64Value returns the named form value parsed as int64, or 0 on error.
 func FormInt64Value(r *http.Request, param string) int64 {
 	value := r.FormValue(param)
 	integer, err := strconv.ParseInt(value, 10, 64)
@@ -22,10 +20,9 @@ func FormInt64Value(r *http.Request, param string) int64 {
 	return integer
 }
 
-// RouteInt64Param returns an URL route parameter as int64.
+// RouteInt64Param returns the named route parameter parsed as int64, or 0 when missing or invalid.
 func RouteInt64Param(r *http.Request, param string) int64 {
-	vars := mux.Vars(r)
-	value, err := strconv.ParseInt(vars[param], 10, 64)
+	value, err := strconv.ParseInt(routeParam(r, param), 10, 64)
 	if err != nil {
 		return 0
 	}
@@ -37,13 +34,12 @@ func RouteInt64Param(r *http.Request, param string) int64 {
 	return value
 }
 
-// RouteStringParam returns a URL route parameter as string.
+// RouteStringParam returns the named route parameter as a string.
 func RouteStringParam(r *http.Request, param string) string {
-	vars := mux.Vars(r)
-	return vars[param]
+	return routeParam(r, param)
 }
 
-// QueryStringParam returns a query string parameter as string.
+// QueryStringParam returns the named query parameter, or defaultValue if it is empty.
 func QueryStringParam(r *http.Request, param, defaultValue string) string {
 	value := r.URL.Query().Get(param)
 	if value == "" {
@@ -52,7 +48,7 @@ func QueryStringParam(r *http.Request, param, defaultValue string) string {
 	return value
 }
 
-// QueryStringParamList returns all values associated to the parameter.
+// QueryStringParamList returns the non-empty, trimmed values for the named query parameter.
 func QueryStringParamList(r *http.Request, param string) []string {
 	var results []string
 	values := r.URL.Query()
@@ -69,7 +65,7 @@ func QueryStringParamList(r *http.Request, param string) []string {
 	return results
 }
 
-// QueryIntParam returns a query string parameter as integer.
+// QueryIntParam returns the named query parameter parsed as int, or defaultValue when missing, invalid, or negative.
 func QueryIntParam(r *http.Request, param string, defaultValue int) int {
 	value := r.URL.Query().Get(param)
 	if value == "" {
@@ -88,7 +84,7 @@ func QueryIntParam(r *http.Request, param string, defaultValue int) int {
 	return int(val)
 }
 
-// QueryInt64Param returns a query string parameter as int64.
+// QueryInt64Param returns the named query parameter parsed as int64, or defaultValue when missing, invalid, or negative.
 func QueryInt64Param(r *http.Request, param string, defaultValue int64) int64 {
 	value := r.URL.Query().Get(param)
 	if value == "" {
@@ -107,7 +103,7 @@ func QueryInt64Param(r *http.Request, param string, defaultValue int64) int64 {
 	return val
 }
 
-// QueryBoolParam returns a query string parameter as bool.
+// QueryBoolParam returns the named query parameter parsed as bool, or defaultValue when missing or invalid.
 func QueryBoolParam(r *http.Request, param string, defaultValue bool) bool {
 	value := r.URL.Query().Get(param)
 	if value == "" {
@@ -123,9 +119,13 @@ func QueryBoolParam(r *http.Request, param string, defaultValue bool) bool {
 	return val
 }
 
-// HasQueryParam checks if the query string contains the given parameter.
+// HasQueryParam reports whether the query string contains the named parameter.
 func HasQueryParam(r *http.Request, param string) bool {
 	values := r.URL.Query()
 	_, ok := values[param]
 	return ok
 }
+
+func routeParam(r *http.Request, param string) string {
+	return r.PathValue(param)
+}

internal/http/request/params_test.go

@@ -7,9 +7,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"reflect"
 	"testing"
-
-	"github.com/gorilla/mux"
 )
 
 func TestFormInt64Value(t *testing.T) {
@@ -41,9 +40,9 @@ func TestFormInt64Value(t *testing.T) {
 	}
 }
 
-func TestRouteStringParam(t *testing.T) {
-	router := mux.NewRouter()
-	router.HandleFunc("/route/{variable}/index", func(w http.ResponseWriter, r *http.Request) {
+func TestRouteStringParamWithServerMux(t *testing.T) {
+	router := http.NewServeMux()
+	router.HandleFunc("GET /route/{variable}/index", func(w http.ResponseWriter, r *http.Request) {
 		result := RouteStringParam(r, "variable")
 		expected := "value"
 
@@ -59,7 +58,7 @@ func TestRouteStringParam(t *testing.T) {
 		}
 	})
 
-	r, err := http.NewRequest("GET", "/route/value/index", nil)
+	r, err := http.NewRequest(http.MethodGet, "/route/value/index", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,9 +67,9 @@ func TestRouteStringParam(t *testing.T) {
 	router.ServeHTTP(w, r)
 }
 
-func TestRouteInt64Param(t *testing.T) {
-	router := mux.NewRouter()
-	router.HandleFunc("/a/{variable1}/b/{variable2}/c/{variable3}", func(w http.ResponseWriter, r *http.Request) {
+func TestRouteInt64ParamWithServerMux(t *testing.T) {
+	router := http.NewServeMux()
+	router.HandleFunc("GET /a/{variable1}/b/{variable2}/c/{variable3}", func(w http.ResponseWriter, r *http.Request) {
 		result := RouteInt64Param(r, "variable1")
 		expected := int64(42)
 
@@ -100,7 +99,7 @@ func TestRouteInt64Param(t *testing.T) {
 		}
 	})
 
-	r, err := http.NewRequest("GET", "/a/42/b/not-int/c/-10", nil)
+	r, err := http.NewRequest(http.MethodGet, "/a/42/b/not-int/c/-10", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -179,7 +178,7 @@ func TestQueryInt64Param(t *testing.T) {
 		t.Errorf(`Unexpected result, got %d instead of %d`, result, expected)
 	}
 
-	result = QueryInt64Param(r, "invalid", int64(69))
+	result = QueryInt64Param(r, "negative", int64(69))
 	expected = int64(69)
 
 	if result != expected {
@@ -194,6 +193,58 @@ func TestQueryInt64Param(t *testing.T) {
 	}
 }
 
+func TestQueryBoolParam(t *testing.T) {
+	u, _ := url.Parse("http://example.org/?truthy=true&falsy=false&invalid=wat")
+	r := &http.Request{URL: u}
+
+	result := QueryBoolParam(r, "truthy", false)
+	expected := true
+
+	if result != expected {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+
+	result = QueryBoolParam(r, "falsy", true)
+	expected = false
+
+	if result != expected {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+
+	result = QueryBoolParam(r, "missing", true)
+	expected = true
+
+	if result != expected {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+
+	result = QueryBoolParam(r, "invalid", true)
+	expected = true
+
+	if result != expected {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+}
+
+func TestQueryStringParamList(t *testing.T) {
+	u, _ := url.Parse("http://example.org/?tag=alpha&tag=beta&tag=+&tag=%20%20gamma%20%20&empty=")
+	r := &http.Request{URL: u}
+
+	result := QueryStringParamList(r, "tag")
+	expected := []string{"alpha", "beta", "gamma"}
+
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+
+	result = QueryStringParamList(r, "missing")
+	expected = nil
+
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf(`Unexpected result, got %v instead of %v`, result, expected)
+	}
+}
+
 func TestHasQueryParam(t *testing.T) {
 	u, _ := url.Parse("http://example.org/?key=42")
 	r := &http.Request{URL: u}

internal/http/response/builder.go

@@ -6,7 +6,6 @@ package response // import "miniflux.app/v2/internal/http/response"
 import (
 	"compress/flate"
 	"compress/gzip"
-	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
@@ -28,6 +27,11 @@ type Builder struct {
 	body              any
 }
 
+// NewBuilder creates a new response builder.
+func NewBuilder(w http.ResponseWriter, r *http.Request) *Builder {
+	return &Builder{w: w, r: r, statusCode: http.StatusOK, headers: make(map[string]string), enableCompression: true}
+}
+
 // WithStatus uses the given status code to build the response.
 func (b *Builder) WithStatus(statusCode int) *Builder {
 	b.statusCode = statusCode
@@ -40,15 +44,27 @@ func (b *Builder) WithHeader(key, value string) *Builder {
 	return b
 }
 
-// WithBody uses the given body to build the response.
-func (b *Builder) WithBody(body any) *Builder {
+// WithBodyAsBytes uses the given bytes to build the response.
+func (b *Builder) WithBodyAsBytes(body []byte) *Builder {
+	b.body = body
+	return b
+}
+
+// WithBodyAsString uses the given string to build the response.
+func (b *Builder) WithBodyAsString(body string) *Builder {
+	b.body = body
+	return b
+}
+
+// WithBodyAsReader uses the given reader to build the response.
+func (b *Builder) WithBodyAsReader(body io.Reader) *Builder {
 	b.body = body
 	return b
 }
 
 // WithAttachment forces the document to be downloaded by the web browser.
 func (b *Builder) WithAttachment(filename string) *Builder {
-	b.headers["Content-Disposition"] = fmt.Sprintf("attachment; filename=%s", filename)
+	b.headers["Content-Disposition"] = "attachment; filename=" + filename
 	return b
 }
 
@@ -60,11 +76,12 @@ func (b *Builder) WithoutCompression() *Builder {
 
 // WithCaching adds caching headers to the response.
 func (b *Builder) WithCaching(etag string, duration time.Duration, callback func(*Builder)) {
+	etag = normalizeETag(etag)
 	b.headers["ETag"] = etag
-	b.headers["Cache-Control"] = "public"
+	b.headers["Cache-Control"] = "public, immutable"
 	b.headers["Expires"] = time.Now().Add(duration).UTC().Format(http.TimeFormat)
 
-	if etag == b.r.Header.Get("If-None-Match") {
+	if ifNoneMatch(b.r.Header.Get("If-None-Match"), etag) {
 		b.statusCode = http.StatusNotModified
 		b.body = nil
 		b.Write()
@@ -85,8 +102,6 @@ func (b *Builder) Write() {
 		b.compress(v)
 	case string:
 		b.compress([]byte(v))
-	case error:
-		b.compress([]byte(v.Error()))
 	case io.Reader:
 		// Compression not implemented in this case
 		b.writeHeaders()
@@ -111,6 +126,7 @@ func (b *Builder) writeHeaders() {
 
 func (b *Builder) compress(data []byte) {
 	if b.enableCompression && len(data) > compressionThreshold {
+		b.headers["Vary"] = "Accept-Encoding"
 		acceptEncoding := b.r.Header.Get("Accept-Encoding")
 		switch {
 		case strings.Contains(acceptEncoding, "br"):
@@ -118,24 +134,24 @@ func (b *Builder) compress(data []byte) {
 			b.writeHeaders()
 
 			brotliWriter := brotli.NewWriterV2(b.w, brotli.DefaultCompression)
-			defer brotliWriter.Close()
 			brotliWriter.Write(data)
+			brotliWriter.Close()
 			return
 		case strings.Contains(acceptEncoding, "gzip"):
 			b.headers["Content-Encoding"] = "gzip"
 			b.writeHeaders()
 
 			gzipWriter := gzip.NewWriter(b.w)
-			defer gzipWriter.Close()
 			gzipWriter.Write(data)
+			gzipWriter.Close()
 			return
 		case strings.Contains(acceptEncoding, "deflate"):
 			b.headers["Content-Encoding"] = "deflate"
 			b.writeHeaders()
 
 			flateWriter, _ := flate.NewWriter(b.w, -1)
-			defer flateWriter.Close()
 			flateWriter.Write(data)
+			flateWriter.Close()
 			return
 		}
 	}
@@ -144,7 +160,24 @@ func (b *Builder) compress(data []byte) {
 	b.w.Write(data)
 }
 
-// New creates a new response builder.
-func New(w http.ResponseWriter, r *http.Request) *Builder {
-	return &Builder{w: w, r: r, statusCode: http.StatusOK, headers: make(map[string]string), enableCompression: true}
+func normalizeETag(etag string) string {
+	etag = strings.TrimSpace(etag)
+	if etag == "" {
+		return ""
+	}
+	if strings.HasPrefix(etag, `"`) || strings.HasPrefix(etag, `W/"`) {
+		return etag
+	}
+	return `"` + etag + `"`
+}
+
+func ifNoneMatch(headerValue, etag string) bool {
+	if headerValue == "" || etag == "" {
+		return false
+	}
+	if strings.TrimSpace(headerValue) == "*" {
+		return true
+	}
+	// Weak ETag comparison: the opaque-tag (quoted string without W/ prefix) must match.
+	return strings.Contains(headerValue, strings.TrimPrefix(etag, `W/`))
 }

internal/http/response/builder_test.go

@@ -4,7 +4,7 @@
 package response // import "miniflux.app/v2/internal/http/response"
 
 import (
-	"errors"
+	"bytes"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -21,7 +21,7 @@ func TestResponseHasCommonHeaders(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).Write()
+		NewBuilder(w, r).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -49,7 +49,7 @@ func TestBuildResponseWithCustomStatusCode(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithStatus(http.StatusNotAcceptable).Write()
+		NewBuilder(w, r).WithStatus(http.StatusNotAcceptable).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -70,7 +70,7 @@ func TestBuildResponseWithCustomHeader(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithHeader("X-My-Header", "Value").Write()
+		NewBuilder(w, r).WithHeader("X-My-Header", "Value").Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -92,7 +92,7 @@ func TestBuildResponseWithAttachment(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithAttachment("my_file.pdf").Write()
+		NewBuilder(w, r).WithAttachment("my_file.pdf").Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -105,27 +105,6 @@ func TestBuildResponseWithAttachment(t *testing.T) {
 	}
 }
 
-func TestBuildResponseWithError(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(errors.New("Some error")).Write()
-	})
-
-	handler.ServeHTTP(w, r)
-
-	expectedBody := `Some error`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-}
-
 func TestBuildResponseWithByteBody(t *testing.T) {
 	r, err := http.NewRequest("GET", "/", nil)
 	if err != nil {
@@ -135,7 +114,7 @@ func TestBuildResponseWithByteBody(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody([]byte("body")).Write()
+		NewBuilder(w, r).WithBodyAsBytes([]byte("body")).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -156,8 +135,8 @@ func TestBuildResponseWithCachingEnabled(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithCaching("etag", 1*time.Minute, func(b *Builder) {
-			b.WithBody("cached body")
+		NewBuilder(w, r).WithCaching("etag", 1*time.Minute, func(b *Builder) {
+			b.WithBodyAsString("cached body")
 			b.Write()
 		})
 	})
@@ -176,55 +155,118 @@ func TestBuildResponseWithCachingEnabled(t *testing.T) {
 		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
 	}
 
-	expectedHeader := "public"
+	expectedHeader := "public, immutable"
 	actualHeader := resp.Header.Get("Cache-Control")
 	if actualHeader != expectedHeader {
 		t.Fatalf(`Unexpected cache control header, got %q instead of %q`, actualHeader, expectedHeader)
 	}
 
+	if actualETag := resp.Header.Get("ETag"); actualETag != `"etag"` {
+		t.Fatalf(`Unexpected etag header, got %q instead of %q`, actualETag, `"etag"`)
+	}
+
 	if resp.Header.Get("Expires") == "" {
 		t.Fatalf(`Expires header should not be empty`)
 	}
 }
 
-func TestBuildResponseWithCachingAndEtag(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	r.Header.Set("If-None-Match", "etag")
-	if err != nil {
-		t.Fatal(err)
+func TestBuildResponseWithCachingAndIfNoneMatch(t *testing.T) {
+	tests := []struct {
+		name           string
+		ifNoneMatch    string
+		expectedStatus int
+		expectedBody   string
+	}{
+		{"matching strong etag", `"etag"`, http.StatusNotModified, ""},
+		{"matching weak etag", `W/"etag"`, http.StatusNotModified, ""},
+		{"multiple etags with match", `"other", W/"etag"`, http.StatusNotModified, ""},
+		{"wildcard", `*`, http.StatusNotModified, ""},
+		{"non-matching etag", `"different"`, http.StatusOK, "cached body"},
 	}
 
-	w := httptest.NewRecorder()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, err := http.NewRequest("GET", "/", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			r.Header.Set("If-None-Match", tt.ifNoneMatch)
 
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithCaching("etag", 1*time.Minute, func(b *Builder) {
-			b.WithBody("cached body")
-			b.Write()
+			w := httptest.NewRecorder()
+
+			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				NewBuilder(w, r).WithCaching("etag", 1*time.Minute, func(b *Builder) {
+					b.WithBodyAsString("cached body")
+					b.Write()
+				})
+			})
+
+			handler.ServeHTTP(w, r)
+			resp := w.Result()
+
+			if resp.StatusCode != tt.expectedStatus {
+				t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, tt.expectedStatus)
+			}
+
+			if actual := w.Body.String(); actual != tt.expectedBody {
+				t.Fatalf(`Unexpected body, got %q instead of %q`, actual, tt.expectedBody)
+			}
+
+			if resp.Header.Get("Cache-Control") != "public, immutable" {
+				t.Fatalf(`Unexpected Cache-Control header: %q`, resp.Header.Get("Cache-Control"))
+			}
+
+			if resp.Header.Get("Expires") == "" {
+				t.Fatalf(`Expires header should not be empty`)
+			}
 		})
-	})
+	}
+}
 
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusNotModified
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
+func TestNormalizeETag(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"abc", `"abc"`},
+		{`"already-quoted"`, `"already-quoted"`},
+		{`W/"weak"`, `W/"weak"`},
+		{"", ""},
+		{"  spaced  ", `"spaced"`},
 	}
 
-	expectedBody := ``
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			if actual := normalizeETag(tt.input); actual != tt.expected {
+				t.Fatalf(`normalizeETag(%q) = %q, want %q`, tt.input, actual, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIfNoneMatch(t *testing.T) {
+	tests := []struct {
+		name        string
+		headerValue string
+		etag        string
+		expected    bool
+	}{
+		{"empty header", "", `"etag"`, false},
+		{"empty etag", `"etag"`, "", false},
+		{"exact match", `"etag"`, `"etag"`, true},
+		{"weak vs strong match", `W/"etag"`, `"etag"`, true},
+		{"wildcard", `*`, `"etag"`, true},
+		{"no match", `"other"`, `"etag"`, false},
+		{"match in list", `"a", "etag", "b"`, `"etag"`, true},
+		{"no match in list", `"a", "b", "c"`, `"etag"`, false},
 	}
 
-	expectedHeader := "public"
-	actualHeader := resp.Header.Get("Cache-Control")
-	if actualHeader != expectedHeader {
-		t.Fatalf(`Unexpected cache control header, got %q instead of %q`, actualHeader, expectedHeader)
-	}
-
-	if resp.Header.Get("Expires") == "" {
-		t.Fatalf(`Expires header should not be empty`)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if actual := ifNoneMatch(tt.headerValue, tt.etag); actual != tt.expected {
+				t.Fatalf(`ifNoneMatch(%q, %q) = %v, want %v`, tt.headerValue, tt.etag, actual, tt.expected)
+			}
+		})
 	}
 }
 
@@ -239,7 +281,7 @@ func TestBuildResponseWithBrotliCompression(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).Write()
+		NewBuilder(w, r).WithBodyAsString(body).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -263,7 +305,7 @@ func TestBuildResponseWithGzipCompression(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).Write()
+		NewBuilder(w, r).WithBodyAsString(body).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -287,7 +329,7 @@ func TestBuildResponseWithDeflateCompression(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).Write()
+		NewBuilder(w, r).WithBodyAsString(body).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -298,6 +340,12 @@ func TestBuildResponseWithDeflateCompression(t *testing.T) {
 	if actual != expected {
 		t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
 	}
+
+	expectedVary := "Accept-Encoding"
+	actualVary := resp.Header.Get("Vary")
+	if actualVary != expectedVary {
+		t.Fatalf(`Unexpected vary header value, got %q instead of %q`, actualVary, expectedVary)
+	}
 }
 
 func TestBuildResponseWithCompressionDisabled(t *testing.T) {
@@ -311,7 +359,7 @@ func TestBuildResponseWithCompressionDisabled(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).WithoutCompression().Write()
+		NewBuilder(w, r).WithBodyAsString(body).WithoutCompression().Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -322,6 +370,12 @@ func TestBuildResponseWithCompressionDisabled(t *testing.T) {
 	if actual != expected {
 		t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
 	}
+
+	expectedVary := ""
+	actualVary := resp.Header.Get("Vary")
+	if actualVary != expectedVary {
+		t.Fatalf(`Unexpected vary header value, got %q instead of %q`, actualVary, expectedVary)
+	}
 }
 
 func TestBuildResponseWithDeflateCompressionAndSmallPayload(t *testing.T) {
@@ -335,7 +389,7 @@ func TestBuildResponseWithDeflateCompressionAndSmallPayload(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).Write()
+		NewBuilder(w, r).WithBodyAsString(body).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -346,6 +400,12 @@ func TestBuildResponseWithDeflateCompressionAndSmallPayload(t *testing.T) {
 	if actual != expected {
 		t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
 	}
+
+	expectedVary := ""
+	actualVary := resp.Header.Get("Vary")
+	if actualVary != expectedVary {
+		t.Fatalf(`Unexpected vary header value, got %q instead of %q`, actualVary, expectedVary)
+	}
 }
 
 func TestBuildResponseWithoutCompressionHeader(t *testing.T) {
@@ -358,7 +418,7 @@ func TestBuildResponseWithoutCompressionHeader(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		New(w, r).WithBody(body).Write()
+		NewBuilder(w, r).WithBodyAsString(body).Write()
 	})
 
 	handler.ServeHTTP(w, r)
@@ -369,4 +429,29 @@ func TestBuildResponseWithoutCompressionHeader(t *testing.T) {
 	if actual != expected {
 		t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
 	}
+
+	expectedVary := "Accept-Encoding"
+	actualVary := resp.Header.Get("Vary")
+	if actualVary != expectedVary {
+		t.Fatalf(`Unexpected vary header value, got %q instead of %q`, actualVary, expectedVary)
+	}
+}
+
+func TestBuildResponseWithReaderBody(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		NewBuilder(w, r).WithBodyAsReader(bytes.NewBufferString("body")).Write()
+	})
+
+	handler.ServeHTTP(w, r)
+
+	if actualBody := w.Body.String(); actualBody != "body" {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, "body")
+	}
 }

internal/http/response/html.go

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-package html // import "miniflux.app/v2/internal/http/response/html"
+package response // import "miniflux.app/v2/internal/http/response"
 
 import (
 	"html"
@@ -9,20 +9,24 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response"
 )
 
-// OK creates a new HTML response with a 200 status code.
-func OK(w http.ResponseWriter, r *http.Request, body interface{}) {
-	builder := response.New(w, r)
+// HTML creates a new HTML response with a 200 status code.
+func HTML[T []byte | string](w http.ResponseWriter, r *http.Request, body T) {
+	builder := NewBuilder(w, r)
 	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody(body)
+	switch v := any(body).(type) {
+	case []byte:
+		builder.WithBodyAsBytes(v)
+	case string:
+		builder.WithBodyAsString(v)
+	}
 	builder.Write()
 }
 
-// ServerError sends an internal error to the client.
-func ServerError(w http.ResponseWriter, r *http.Request, err error) {
+// HTMLServerError sends an internal error to the client.
+func HTMLServerError(w http.ResponseWriter, r *http.Request, err error) {
 	slog.Error(http.StatusText(http.StatusInternalServerError),
 		slog.Any("error", err),
 		slog.String("client_ip", request.ClientIP(r)),
@@ -36,17 +40,17 @@ func ServerError(w http.ResponseWriter, r *http.Request, err error) {
 		),
 	)
 
-	builder := response.New(w, r)
+	builder := NewBuilder(w, r)
 	builder.WithStatus(http.StatusInternalServerError)
-	builder.WithHeader("Content-Security-Policy", response.ContentSecurityPolicyForUntrustedContent)
+	builder.WithHeader("Content-Security-Policy", ContentSecurityPolicyForUntrustedContent)
 	builder.WithHeader("Content-Type", "text/plain; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody(html.EscapeString(err.Error()))
+	builder.WithBodyAsString(html.EscapeString(err.Error()))
 	builder.Write()
 }
 
-// BadRequest sends a bad request error to the client.
-func BadRequest(w http.ResponseWriter, r *http.Request, err error) {
+// HTMLBadRequest sends a bad request error to the client.
+func HTMLBadRequest(w http.ResponseWriter, r *http.Request, err error) {
 	slog.Warn(http.StatusText(http.StatusBadRequest),
 		slog.Any("error", err),
 		slog.String("client_ip", request.ClientIP(r)),
@@ -60,17 +64,17 @@ func BadRequest(w http.ResponseWriter, r *http.Request, err error) {
 		),
 	)
 
-	builder := response.New(w, r)
+	builder := NewBuilder(w, r)
 	builder.WithStatus(http.StatusBadRequest)
-	builder.WithHeader("Content-Security-Policy", response.ContentSecurityPolicyForUntrustedContent)
+	builder.WithHeader("Content-Security-Policy", ContentSecurityPolicyForUntrustedContent)
 	builder.WithHeader("Content-Type", "text/plain; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody(html.EscapeString(err.Error()))
+	builder.WithBodyAsString(html.EscapeString(err.Error()))
 	builder.Write()
 }
 
-// Forbidden sends a forbidden error to the client.
-func Forbidden(w http.ResponseWriter, r *http.Request) {
+// HTMLForbidden sends a forbidden error to the client.
+func HTMLForbidden(w http.ResponseWriter, r *http.Request) {
 	slog.Warn(http.StatusText(http.StatusForbidden),
 		slog.String("client_ip", request.ClientIP(r)),
 		slog.Group("request",
@@ -83,16 +87,16 @@ func Forbidden(w http.ResponseWriter, r *http.Request) {
 		),
 	)
 
-	builder := response.New(w, r)
+	builder := NewBuilder(w, r)
 	builder.WithStatus(http.StatusForbidden)
 	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody("Access Forbidden")
+	builder.WithBodyAsString("Access Forbidden")
 	builder.Write()
 }
 
-// NotFound sends a page not found error to the client.
-func NotFound(w http.ResponseWriter, r *http.Request) {
+// HTMLNotFound sends a page not found error to the client.
+func HTMLNotFound(w http.ResponseWriter, r *http.Request) {
 	slog.Warn(http.StatusText(http.StatusNotFound),
 		slog.String("client_ip", request.ClientIP(r)),
 		slog.Group("request",
@@ -105,21 +109,21 @@ func NotFound(w http.ResponseWriter, r *http.Request) {
 		),
 	)
 
-	builder := response.New(w, r)
+	builder := NewBuilder(w, r)
 	builder.WithStatus(http.StatusNotFound)
 	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
-	builder.WithBody("Page Not Found")
+	builder.WithBodyAsString("Page Not Found")
 	builder.Write()
 }
 
-// Redirect redirects the user to another location.
-func Redirect(w http.ResponseWriter, r *http.Request, uri string) {
+// HTMLRedirect redirects the user to another location.
+func HTMLRedirect(w http.ResponseWriter, r *http.Request, uri string) {
 	http.Redirect(w, r, uri, http.StatusFound)
 }
 
-// RequestedRangeNotSatisfiable sends a range not satisfiable error to the client.
-func RequestedRangeNotSatisfiable(w http.ResponseWriter, r *http.Request, contentRange string) {
+// HTMLRequestedRangeNotSatisfiable sends a range not satisfiable error to the client.
+func HTMLRequestedRangeNotSatisfiable(w http.ResponseWriter, r *http.Request, contentRange string) {
 	slog.Warn(http.StatusText(http.StatusRequestedRangeNotSatisfiable),
 		slog.String("client_ip", request.ClientIP(r)),
 		slog.Group("request",
@@ -132,11 +136,11 @@ func RequestedRangeNotSatisfiable(w http.ResponseWriter, r *http.Request, conten
 		),
 	)
 
-	builder := response.New(w, r)
+	builder := NewBuilder(w, r)
 	builder.WithStatus(http.StatusRequestedRangeNotSatisfiable)
 	builder.WithHeader("Content-Type", "text/html; charset=utf-8")
 	builder.WithHeader("Cache-Control", "no-cache, max-age=0, must-revalidate, no-store")
 	builder.WithHeader("Content-Range", contentRange)
-	builder.WithBody("Range Not Satisfiable")
+	builder.WithBodyAsString("Range Not Satisfiable")
 	builder.Write()
 }

internal/http/response/html/html_test.go

@@ -1,240 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package html // import "miniflux.app/v2/internal/http/response/html"
-
-import (
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestOKResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		OK(w, r, "Some HTML")
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusOK
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `Some HTML`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	headers := map[string]string{
-		"Content-Type":  "text/html; charset=utf-8",
-		"Cache-Control": "no-cache, max-age=0, must-revalidate, no-store",
-	}
-
-	for header, expected := range headers {
-		actual := resp.Header.Get(header)
-		if actual != expected {
-			t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
-		}
-	}
-}
-
-func TestServerErrorResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ServerError(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusInternalServerError
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := "text/plain; charset=utf-8"
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestBadRequestResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		BadRequest(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusBadRequest
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := "text/plain; charset=utf-8"
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestForbiddenResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		Forbidden(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusForbidden
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `Access Forbidden`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := "text/html; charset=utf-8"
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestNotFoundResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		NotFound(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusNotFound
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `Page Not Found`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := "text/html; charset=utf-8"
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestRedirectResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		Redirect(w, r, "/path")
-	})
-
-	handler.ServeHTTP(w, r)
-
-	resp := w.Result()
-	defer resp.Body.Close()
-
-	expectedStatusCode := http.StatusFound
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedResult := "/path"
-	actualResult := resp.Header.Get("Location")
-	if actualResult != expectedResult {
-		t.Fatalf(`Unexpected redirect location, got %q instead of %q`, actualResult, expectedResult)
-	}
-}
-
-func TestRequestedRangeNotSatisfiable(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		RequestedRangeNotSatisfiable(w, r, "bytes */12777")
-	})
-
-	handler.ServeHTTP(w, r)
-
-	resp := w.Result()
-	defer resp.Body.Close()
-
-	expectedStatusCode := http.StatusRequestedRangeNotSatisfiable
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedContentRangeHeader := "bytes */12777"
-	actualContentRangeHeader := resp.Header.Get("Content-Range")
-	if actualContentRangeHeader != expectedContentRangeHeader {
-		t.Fatalf(`Unexpected content range header, got %q instead of %q`, actualContentRangeHeader, expectedContentRangeHeader)
-	}
-}

internal/http/response/html_test.go

@@ -0,0 +1,210 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package response // import "miniflux.app/v2/internal/http/response"
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestHTMLResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTML(w, r, "Some HTML")
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusOK)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `Some HTML` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `Some HTML`)
+	}
+
+	headers := map[string]string{
+		"Content-Type":  "text/html; charset=utf-8",
+		"Cache-Control": "no-cache, max-age=0, must-revalidate, no-store",
+	}
+
+	for header, expected := range headers {
+		if actual := resp.Header.Get(header); actual != expected {
+			t.Fatalf(`Unexpected header value, got %q instead of %q`, actual, expected)
+		}
+	}
+}
+
+func TestHTMLServerErrorResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLServerError(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusInternalServerError)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != "text/plain; charset=utf-8" {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, "text/plain; charset=utf-8")
+	}
+}
+
+func TestHTMLBadRequestResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLBadRequest(w, r, errors.New("Some error with injected HTML <script>alert('XSS')</script>"))
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusBadRequest)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `Some error with injected HTML &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != "text/plain; charset=utf-8" {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, "text/plain; charset=utf-8")
+	}
+}
+
+func TestHTMLForbiddenResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLForbidden(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusForbidden)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `Access Forbidden` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `Access Forbidden`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != "text/html; charset=utf-8" {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, "text/html; charset=utf-8")
+	}
+}
+
+func TestHTMLNotFoundResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLNotFound(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusNotFound)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `Page Not Found` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `Page Not Found`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != "text/html; charset=utf-8" {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, "text/html; charset=utf-8")
+	}
+}
+
+func TestHTMLRedirectResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLRedirect(w, r, "/path")
+	})
+
+	handler.ServeHTTP(w, r)
+
+	resp := w.Result()
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusFound {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusFound)
+	}
+
+	if actualResult := resp.Header.Get("Location"); actualResult != "/path" {
+		t.Fatalf(`Unexpected redirect location, got %q instead of %q`, actualResult, "/path")
+	}
+}
+
+func TestHTMLRequestedRangeNotSatisfiable(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		HTMLRequestedRangeNotSatisfiable(w, r, "bytes */12777")
+	})
+
+	handler.ServeHTTP(w, r)
+
+	resp := w.Result()
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusRequestedRangeNotSatisfiable {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusRequestedRangeNotSatisfiable)
+	}
+
+	if actualContentRangeHeader := resp.Header.Get("Content-Range"); actualContentRangeHeader != "bytes */12777" {
+		t.Fatalf(`Unexpected content range header, got %q instead of %q`, actualContentRangeHeader, "bytes */12777")
+	}
+}

internal/http/response/json.go

@@ -0,0 +1,168 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package response // import "miniflux.app/v2/internal/http/response"
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+
+	"miniflux.app/v2/internal/http/request"
+)
+
+const jsonContentTypeHeader = `application/json`
+
+// JSON creates a new JSON response with a 200 status code.
+func JSON(w http.ResponseWriter, r *http.Request, body any) {
+	responseBody, err := json.Marshal(body)
+	if err != nil {
+		JSONServerError(w, r, err)
+		return
+	}
+
+	builder := NewBuilder(w, r)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(responseBody)
+	builder.Write()
+}
+
+// JSONCreated sends a created response to the client.
+func JSONCreated(w http.ResponseWriter, r *http.Request, body any) {
+	responseBody, err := json.Marshal(body)
+	if err != nil {
+		JSONServerError(w, r, err)
+		return
+	}
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusCreated)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(responseBody)
+	builder.Write()
+}
+
+// JSONAccepted sends an accepted response to the client.
+func JSONAccepted(w http.ResponseWriter, r *http.Request) {
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusAccepted)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.Write()
+}
+
+// JSONServerError sends an internal error to the client.
+func JSONServerError(w http.ResponseWriter, r *http.Request, err error) {
+	slog.Error(http.StatusText(http.StatusInternalServerError),
+		slog.Any("error", err),
+		slog.String("client_ip", request.ClientIP(r)),
+		slog.Group("request",
+			slog.String("method", r.Method),
+			slog.String("uri", r.RequestURI),
+			slog.String("user_agent", r.UserAgent()),
+		),
+		slog.Group("response",
+			slog.Int("status_code", http.StatusInternalServerError),
+		),
+	)
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusInternalServerError)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(generateJSONError(err))
+	builder.Write()
+}
+
+// JSONBadRequest sends a bad request error to the client.
+func JSONBadRequest(w http.ResponseWriter, r *http.Request, err error) {
+	slog.Warn(http.StatusText(http.StatusBadRequest),
+		slog.Any("error", err),
+		slog.String("client_ip", request.ClientIP(r)),
+		slog.Group("request",
+			slog.String("method", r.Method),
+			slog.String("uri", r.RequestURI),
+			slog.String("user_agent", r.UserAgent()),
+		),
+		slog.Group("response",
+			slog.Int("status_code", http.StatusBadRequest),
+		),
+	)
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusBadRequest)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(generateJSONError(err))
+	builder.Write()
+}
+
+// JSONUnauthorized sends a not authorized error to the client.
+func JSONUnauthorized(w http.ResponseWriter, r *http.Request) {
+	slog.Warn(http.StatusText(http.StatusUnauthorized),
+		slog.String("client_ip", request.ClientIP(r)),
+		slog.Group("request",
+			slog.String("method", r.Method),
+			slog.String("uri", r.RequestURI),
+			slog.String("user_agent", r.UserAgent()),
+		),
+		slog.Group("response",
+			slog.Int("status_code", http.StatusUnauthorized),
+		),
+	)
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusUnauthorized)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(generateJSONError(errors.New("access unauthorized")))
+	builder.Write()
+}
+
+// JSONForbidden sends a forbidden error to the client.
+func JSONForbidden(w http.ResponseWriter, r *http.Request) {
+	slog.Warn(http.StatusText(http.StatusForbidden),
+		slog.String("client_ip", request.ClientIP(r)),
+		slog.Group("request",
+			slog.String("method", r.Method),
+			slog.String("uri", r.RequestURI),
+			slog.String("user_agent", r.UserAgent()),
+		),
+		slog.Group("response",
+			slog.Int("status_code", http.StatusForbidden),
+		),
+	)
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusForbidden)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(generateJSONError(errors.New("access forbidden")))
+	builder.Write()
+}
+
+// JSONNotFound sends a page not found error to the client.
+func JSONNotFound(w http.ResponseWriter, r *http.Request) {
+	slog.Warn(http.StatusText(http.StatusNotFound),
+		slog.String("client_ip", request.ClientIP(r)),
+		slog.Group("request",
+			slog.String("method", r.Method),
+			slog.String("uri", r.RequestURI),
+			slog.String("user_agent", r.UserAgent()),
+		),
+		slog.Group("response",
+			slog.Int("status_code", http.StatusNotFound),
+		),
+	)
+
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusNotFound)
+	builder.WithHeader("Content-Type", jsonContentTypeHeader)
+	builder.WithBodyAsBytes(generateJSONError(errors.New("resource not found")))
+	builder.Write()
+}
+
+func generateJSONError(err error) []byte {
+	type errorMsg struct {
+		ErrorMessage string `json:"error_message"`
+	}
+
+	encodedBody, _ := json.Marshal(errorMsg{ErrorMessage: err.Error()})
+	return encodedBody
+}

internal/http/response/json/json.go

@@ -1,215 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package json // import "miniflux.app/v2/internal/http/response/json"
-
-import (
-	"encoding/json"
-	"errors"
-	"log/slog"
-	"net/http"
-
-	"miniflux.app/v2/internal/http/request"
-	"miniflux.app/v2/internal/http/response"
-)
-
-const contentTypeHeader = `application/json`
-
-// OK creates a new JSON response with a 200 status code.
-func OK(w http.ResponseWriter, r *http.Request, body any) {
-	responseBody, err := json.Marshal(body)
-	if err != nil {
-		ServerError(w, r, err)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// Created sends a created response to the client.
-func Created(w http.ResponseWriter, r *http.Request, body any) {
-	responseBody, err := json.Marshal(body)
-	if err != nil {
-		ServerError(w, r, err)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusCreated)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// NoContent sends a no content response to the client.
-func NoContent(w http.ResponseWriter, r *http.Request) {
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusNoContent)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.Write()
-}
-
-func Accepted(w http.ResponseWriter, r *http.Request) {
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusAccepted)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.Write()
-}
-
-// ServerError sends an internal error to the client.
-func ServerError(w http.ResponseWriter, r *http.Request, err error) {
-	slog.Error(http.StatusText(http.StatusInternalServerError),
-		slog.Any("error", err),
-		slog.String("client_ip", request.ClientIP(r)),
-		slog.Group("request",
-			slog.String("method", r.Method),
-			slog.String("uri", r.RequestURI),
-			slog.String("user_agent", r.UserAgent()),
-		),
-		slog.Group("response",
-			slog.Int("status_code", http.StatusInternalServerError),
-		),
-	)
-
-	responseBody, jsonErr := generateJSONError(err)
-	if jsonErr != nil {
-		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusInternalServerError)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// BadRequest sends a bad request error to the client.
-func BadRequest(w http.ResponseWriter, r *http.Request, err error) {
-	slog.Warn(http.StatusText(http.StatusBadRequest),
-		slog.Any("error", err),
-		slog.String("client_ip", request.ClientIP(r)),
-		slog.Group("request",
-			slog.String("method", r.Method),
-			slog.String("uri", r.RequestURI),
-			slog.String("user_agent", r.UserAgent()),
-		),
-		slog.Group("response",
-			slog.Int("status_code", http.StatusBadRequest),
-		),
-	)
-
-	responseBody, jsonErr := generateJSONError(err)
-	if jsonErr != nil {
-		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusBadRequest)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// Unauthorized sends a not authorized error to the client.
-func Unauthorized(w http.ResponseWriter, r *http.Request) {
-	slog.Warn(http.StatusText(http.StatusUnauthorized),
-		slog.String("client_ip", request.ClientIP(r)),
-		slog.Group("request",
-			slog.String("method", r.Method),
-			slog.String("uri", r.RequestURI),
-			slog.String("user_agent", r.UserAgent()),
-		),
-		slog.Group("response",
-			slog.Int("status_code", http.StatusUnauthorized),
-		),
-	)
-
-	responseBody, jsonErr := generateJSONError(errors.New("access unauthorized"))
-	if jsonErr != nil {
-		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusUnauthorized)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// Forbidden sends a forbidden error to the client.
-func Forbidden(w http.ResponseWriter, r *http.Request) {
-	slog.Warn(http.StatusText(http.StatusForbidden),
-		slog.String("client_ip", request.ClientIP(r)),
-		slog.Group("request",
-			slog.String("method", r.Method),
-			slog.String("uri", r.RequestURI),
-			slog.String("user_agent", r.UserAgent()),
-		),
-		slog.Group("response",
-			slog.Int("status_code", http.StatusForbidden),
-		),
-	)
-
-	responseBody, jsonErr := generateJSONError(errors.New("access forbidden"))
-	if jsonErr != nil {
-		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusForbidden)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-// NotFound sends a page not found error to the client.
-func NotFound(w http.ResponseWriter, r *http.Request) {
-	slog.Warn(http.StatusText(http.StatusNotFound),
-		slog.String("client_ip", request.ClientIP(r)),
-		slog.Group("request",
-			slog.String("method", r.Method),
-			slog.String("uri", r.RequestURI),
-			slog.String("user_agent", r.UserAgent()),
-		),
-		slog.Group("response",
-			slog.Int("status_code", http.StatusNotFound),
-		),
-	)
-
-	responseBody, jsonErr := generateJSONError(errors.New("resource not found"))
-	if jsonErr != nil {
-		slog.Error("Unable to generate JSON error", slog.Any("error", jsonErr))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-
-	builder := response.New(w, r)
-	builder.WithStatus(http.StatusNotFound)
-	builder.WithHeader("Content-Type", contentTypeHeader)
-	builder.WithBody(responseBody)
-	builder.Write()
-}
-
-func generateJSONError(err error) ([]byte, error) {
-	type errorMsg struct {
-		ErrorMessage string `json:"error_message"`
-	}
-
-	encodedBody, err := json.Marshal(errorMsg{ErrorMessage: err.Error()})
-	if err != nil {
-		return nil, err
-	}
-
-	return encodedBody, nil
-}

internal/http/response/json/json_test.go

@@ -1,312 +0,0 @@
-// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-package json // import "miniflux.app/v2/internal/http/response/json"
-
-import (
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestOKResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		OK(w, r, map[string]string{"key": "value"})
-	})
-
-	handler.ServeHTTP(w, r)
-
-	resp := w.Result()
-	defer resp.Body.Close()
-
-	expectedStatusCode := http.StatusOK
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"key":"value"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %q instead of %q`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestCreatedResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		Created(w, r, map[string]string{"key": "value"})
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusCreated
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"key":"value"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestNoContentResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		NoContent(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusNoContent
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := ``
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestServerErrorResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ServerError(w, r, errors.New("some error"))
-	})
-
-	handler.ServeHTTP(w, r)
-
-	resp := w.Result()
-	defer resp.Body.Close()
-
-	expectedStatusCode := http.StatusInternalServerError
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"some error"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %q instead of %q`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestBadRequestResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		BadRequest(w, r, errors.New("Some Error"))
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusBadRequest
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"Some Error"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestUnauthorizedResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		Unauthorized(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusUnauthorized
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"access unauthorized"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestForbiddenResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		Forbidden(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusForbidden
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"access forbidden"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestNotFoundResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		NotFound(w, r)
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusNotFound
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"resource not found"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}
-
-func TestBuildInvalidJSONResponse(t *testing.T) {
-	r, err := http.NewRequest("GET", "/", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	w := httptest.NewRecorder()
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		OK(w, r, make(chan int))
-	})
-
-	handler.ServeHTTP(w, r)
-	resp := w.Result()
-
-	expectedStatusCode := http.StatusInternalServerError
-	if resp.StatusCode != expectedStatusCode {
-		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, expectedStatusCode)
-	}
-
-	expectedBody := `{"error_message":"json: unsupported type: chan int"}`
-	actualBody := w.Body.String()
-	if actualBody != expectedBody {
-		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, expectedBody)
-	}
-
-	expectedContentType := contentTypeHeader
-	actualContentType := resp.Header.Get("Content-Type")
-	if actualContentType != expectedContentType {
-		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, expectedContentType)
-	}
-}

internal/http/response/json_test.go

@@ -0,0 +1,302 @@
+// SPDX-FileCopyrightText: Copyright The Miniflux Authors. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package response // import "miniflux.app/v2/internal/http/response"
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestJSONResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSON(w, r, map[string]string{"key": "value"})
+	})
+
+	handler.ServeHTTP(w, r)
+
+	resp := w.Result()
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusOK)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"key":"value"}` {
+		t.Fatalf(`Unexpected body, got %q instead of %q`, actualBody, `{"key":"value"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONCreatedResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONCreated(w, r, map[string]string{"key": "value"})
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusCreated)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"key":"value"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"key":"value"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONAcceptedResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONAccepted(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusAccepted {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusAccepted)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, ``)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONServerErrorResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONServerError(w, r, errors.New("some error"))
+	})
+
+	handler.ServeHTTP(w, r)
+
+	resp := w.Result()
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusInternalServerError)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"some error"}` {
+		t.Fatalf(`Unexpected body, got %q instead of %q`, actualBody, `{"error_message":"some error"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONBadRequestResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONBadRequest(w, r, errors.New("Some Error"))
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusBadRequest)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"Some Error"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"Some Error"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONUnauthorizedResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONUnauthorized(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusUnauthorized)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"access unauthorized"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"access unauthorized"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONForbiddenResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONForbidden(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusForbidden)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"access forbidden"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"access forbidden"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestJSONNotFoundResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONNotFound(w, r)
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusNotFound)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"resource not found"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"resource not found"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestBuildInvalidJSONResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSON(w, r, make(chan int))
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusInternalServerError)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"json: unsupported type: chan int"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"json: unsupported type: chan int"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestBuildInvalidJSONCreatedResponse(t *testing.T) {
+	r, err := http.NewRequest("GET", "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := httptest.NewRecorder()
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		JSONCreated(w, r, make(chan int))
+	})
+
+	handler.ServeHTTP(w, r)
+	resp := w.Result()
+
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf(`Unexpected status code, got %d instead of %d`, resp.StatusCode, http.StatusInternalServerError)
+	}
+
+	if actualBody := w.Body.String(); actualBody != `{"error_message":"json: unsupported type: chan int"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"json: unsupported type: chan int"}`)
+	}
+
+	if actualContentType := resp.Header.Get("Content-Type"); actualContentType != jsonContentTypeHeader {
+		t.Fatalf(`Unexpected content type, got %q instead of %q`, actualContentType, jsonContentTypeHeader)
+	}
+}
+
+func TestGenerateJSONError(t *testing.T) {
+	actualBody := string(generateJSONError(errors.New("some error")))
+	if actualBody != `{"error_message":"some error"}` {
+		t.Fatalf(`Unexpected body, got %s instead of %s`, actualBody, `{"error_message":"some error"}`)
+	}
+}

internal/http/response/response.go

@@ -3,6 +3,8 @@
 
 package response // import "miniflux.app/v2/internal/http/response"
 
+import "net/http"
+
 // ContentSecurityPolicyForUntrustedContent is the default CSP for untrusted content.
 // default-src 'none' disables all content sources
 // form-action 'none' disables all form submissions
@@ -12,3 +14,10 @@ package response // import "miniflux.app/v2/internal/http/response"
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
 const ContentSecurityPolicyForUntrustedContent = `default-src 'none'; form-action 'none'; sandbox;`
+
+// NoContent sends a no content response to the client.
+func NoContent(w http.ResponseWriter, r *http.Request) {
+	builder := NewBuilder(w, r)
+	builder.WithStatus(http.StatusNoContent)
+	builder.Write()
+}