Merge pull request #26 from StarFleetCPTN/development

Added Google Drive and Google Photos and More Tests

README.md

@@ -34,6 +34,8 @@ GoMFT is a web-based managed file transfer application built with Go, leveraging
 ## Features
 
 - **Multiple Storage Support**: Leverage rclone's extensive support for cloud storage providers:
+  - Google Drive
+  - Google Photos
   - Amazon S3
   - MinIO
   - NextCloud
@@ -150,6 +152,10 @@ services:
       - BACKUP_DIR=/app/backups
       - JWT_SECRET=change_this_to_a_secure_random_string
       - BASE_URL=http://localhost:8080
+      # Google OAuth configuration (optional)
+      - GOOGLE_CLIENT_ID=your_google_client_id
+      - GOOGLE_CLIENT_SECRET=your_google_client_secret
+      # Email configuration
       - EMAIL_ENABLED=true
       - EMAIL_HOST=smtp.example.com
       - EMAIL_PORT=587
@@ -206,6 +212,10 @@ BACKUP_DIR=/app/backups
 JWT_SECRET=change_this_to_a_secure_random_string
 BASE_URL=http://localhost:8080
 
+# Google OAuth configuration (optional, for built-in authentication)
+GOOGLE_CLIENT_ID=your_google_client_id
+GOOGLE_CLIENT_SECRET=your_google_client_secret
+
 # Email configuration
 EMAIL_ENABLED=true
 EMAIL_HOST=smtp.example.com
@@ -226,6 +236,9 @@ EMAIL_PASSWORD=smtp_password
 - `BACKUP_DIR`: Directory for storing database backups
 - `JWT_SECRET`: Secret key for JWT token generation
 - `BASE_URL`: Base URL for generating links in emails (e.g., password reset links)
+- Google OAuth configuration for built-in authentication:
+  - `GOOGLE_CLIENT_ID`: Your Google OAuth client ID
+  - `GOOGLE_CLIENT_SECRET`: Your Google OAuth client secret
 - Email configuration settings for system notifications and password resets:
   - `EMAIL_ENABLED`: Set to `true` to enable email functionality
   - `EMAIL_HOST`: SMTP server hostname
@@ -332,6 +345,8 @@ User management features:
 ### Transfer Configuration Options
 
 1. **Source/Destination Types**:
+   - Google Drive (with built-in or custom authentication)
+   - Google Photos (with built-in or custom authentication)
    - Local filesystem
    - Amazon S3
    - MinIO (S3-compatible storage)
@@ -343,32 +358,46 @@ User management features:
 2. **Connection Options**:
    - Host/server addresses
    - Authentication (username/password or key files)
+   - OAuth2 authentication for Google services
    - Port configurations
    - Cloud credentials (access keys, secret keys)
    - Bucket and region settings
    - Custom endpoints
    - Custom rclone flags
 
-3. **File Options**:
+3. **Google Photos Specific Options**:
+   - Read-only mode for safer operations
+   - Start year filter for historical photos
+   - Include/exclude archived media
+   - Album path configuration
+   - Built-in or custom OAuth authentication
+
+4. **Google Drive Specific Options**:
+   - Folder ID for specific directory access
+   - Team/Shared Drive ID support
+   - Built-in or custom OAuth authentication
+   - Path-based navigation
+
+5. **File Options**:
    - File patterns for filtering (e.g., `*.txt`, `data_*.csv`)
    - Output patterns for dynamic naming
    - Archive options for transferred files
    - Skip already processed files to avoid duplicates
    - Concurrent file transfers (configurable per job)
 
-4. **Performance Options**:
+6. **Performance Options**:
    - **Multi-threaded File Transfers**: Process multiple files simultaneously for higher throughput
    - Configurable concurrency level (1-32 concurrent transfers)
    - Per-job concurrency settings to optimize for different storage types
    - Automatic transfer queue management to prevent overloading systems
    - Adaptive processing based on source/destination capabilities
 
-5. **Schedule Options**:
+7. **Schedule Options**:
    - Cron expressions for flexible scheduling
    - Manual execution
    - Enable/disable schedules
 
-6. **Webhook Notifications**:
+8. **Webhook Notifications**:
    - **Webhook Integration**: Send notifications to external systems when jobs complete
    - **Secure Authentication**: HMAC-SHA256 signature for webhook verification
    - **Custom Headers**: Add custom HTTP headers to webhook requests

components/admin_tools.templ

@@ -85,7 +85,8 @@ script hideDialog(id string) {
 }
 
 script submitFormAndHideDialog(formId string, dialogId string) {
-	document.getElementById(formId).submit();
+	// Use HTMX's API to trigger the request instead of bypassing it
+	htmx.trigger(document.getElementById(formId), 'submit');
 	document.getElementById(dialogId).classList.add("hidden");
 }
 

components/config_form.templ

@@ -7,6 +7,7 @@ import (
 	"github.com/starfleetcptn/gomft/components/providers/source"
 	"github.com/starfleetcptn/gomft/components/providers/destination"
 	"github.com/starfleetcptn/gomft/components/providers/common"
+	"strconv"
 )
 
 type ConfigFormData struct {
@@ -44,6 +45,10 @@ func getInitialData(config *db.TransferConfig) string {
 	sourceClientSecret := ""
 	sourceDriveId := ""
 	sourceTeamDrive := ""
+	// Google Photos source fields
+	sourceReadOnly := false
+	sourceStartYear, _ := strconv.Atoi(getCurrentYear())
+	sourceIncludeArchived := false
 	
 	filePattern := ""
 	outputPattern := "${filename}"
@@ -68,6 +73,10 @@ func getInitialData(config *db.TransferConfig) string {
 	destClientSecret := ""
 	destDriveId := ""
 	destTeamDrive := ""
+	// Google Photos destination fields
+	destReadOnly := false
+	destStartYear, _ := strconv.Atoi(getCurrentYear()) // Default to current year int
+	destIncludeArchived := false
 	
 	archivePath := ""
 	archiveEnabled := false
@@ -75,6 +84,7 @@ func getInitialData(config *db.TransferConfig) string {
 	skipProcessedFiles := true
 	maxConcurrentTransfers := 4
 	rcloneFlags := ""
+	useBuiltinAuth := true
 
 	// If editing an existing config, populate with those values
 	if config != nil {
@@ -96,12 +106,21 @@ func getInitialData(config *db.TransferConfig) string {
 		sourceEndpoint = config.SourceEndpoint
 		sourceShare = config.SourceShare
 		sourceDomain = config.SourceDomain
-		sourcePassiveMode = config.SourcePassiveMode
+		sourcePassiveMode = config.GetSourcePassiveMode()
 		sourceClientId = config.SourceClientID
 		sourceClientSecret = config.SourceClientSecret
 		sourceDriveId = config.SourceDriveID
 		sourceTeamDrive = config.SourceTeamDrive
 		
+		// Google Photos source fields
+		if config.SourceReadOnly != nil {
+			sourceReadOnly = *config.SourceReadOnly
+		}
+		sourceStartYear = config.SourceStartYear
+		if config.SourceIncludeArchived != nil {
+			sourceIncludeArchived = *config.SourceIncludeArchived
+		}
+		
 		filePattern = config.FilePattern
 		outputPattern = config.OutputPattern
 		
@@ -122,18 +141,32 @@ func getInitialData(config *db.TransferConfig) string {
 		destEndpoint = config.DestEndpoint
 		destShare = config.DestShare
 		destDomain = config.DestDomain
-		destPassiveMode = config.DestPassiveMode
+		destPassiveMode = config.GetDestPassiveMode()
 		destClientId = config.DestClientID
 		destClientSecret = config.DestClientSecret
 		destDriveId = config.DestDriveID
 		destTeamDrive = config.DestTeamDrive
 		
+		// Google Photos destination fields
+		if config.DestReadOnly != nil {
+			destReadOnly = *config.DestReadOnly
+		}
+		destStartYear = config.DestStartYear
+		if config.DestIncludeArchived != nil {
+			destIncludeArchived = *config.DestIncludeArchived
+		}
+		
 		archivePath = config.ArchivePath
-		archiveEnabled = config.ArchiveEnabled
-		deleteAfterTransfer = config.DeleteAfterTransfer
+		archiveEnabled = config.GetArchiveEnabled()
+		deleteAfterTransfer = config.GetDeleteAfterTransfer()
 		skipProcessedFiles = config.GetSkipProcessedFiles()
 		maxConcurrentTransfers = config.MaxConcurrentTransfers
 		rcloneFlags = config.RcloneFlags
+		if config.UseBuiltinAuth != nil {
+			useBuiltinAuth = *config.UseBuiltinAuth
+		} else if destClientId != "" || destClientSecret != "" {
+			useBuiltinAuth = false
+		}
 	}
 
 	// Return the JSON-formatted string with all the data
@@ -159,6 +192,9 @@ func getInitialData(config *db.TransferConfig) string {
 		sourceClientSecret: '%s',
 		sourceDriveId: '%s',
 		sourceTeamDrive: '%s',
+		sourceReadOnly: %v,
+		sourceStartYear: %d,
+		sourceIncludeArchived: %v,
 		
 		filePattern: '%s',
 		outputPattern: '%s',
@@ -183,6 +219,11 @@ func getInitialData(config *db.TransferConfig) string {
 		destClientSecret: '%s',
 		destDriveId: '%s',
 		destTeamDrive: '%s',
+		destReadOnly: %v,
+		destStartYear: %d,
+		destIncludeArchived: %v,
+		
+		useBuiltinAuth: %v,
 		
 		archivePath: '%s',
 		archiveEnabled: %v,
@@ -194,10 +235,13 @@ func getInitialData(config *db.TransferConfig) string {
 	name, sourceType, sourcePath, sourceHost, sourcePort, sourceUser, sourcePassword, sourceKeyFile, sourceAuthType,
 	sourceBucket, sourceRegion, sourceAccessKey, sourceSecretKey, sourceEndpoint, sourceShare, sourceDomain, sourcePassiveMode,
 	sourceClientId, sourceClientSecret, sourceDriveId, sourceTeamDrive,
+	sourceReadOnly, sourceStartYear, sourceIncludeArchived,
 	filePattern, outputPattern,
 	destinationType, destinationPath, destHost, destPort, destUser, destPassword, destKeyFile, destAuthType,
 	destBucket, destRegion, destAccessKey, destSecretKey, destEndpoint, destShare, destDomain, destPassiveMode,
 	destClientId, destClientSecret, destDriveId, destTeamDrive,
+	destReadOnly, destStartYear, destIncludeArchived,
+	useBuiltinAuth,
 	archivePath, archiveEnabled, deleteAfterTransfer, skipProcessedFiles, maxConcurrentTransfers, rcloneFlags)
 }
 
@@ -277,6 +321,13 @@ templ ConfigForm(ctx context.Context, data ConfigFormData) {
 					@source.NextCloudSourceForm()
 				</template>
 
+				<template x-if="sourceType === 'google_drive'">
+					@source.GoogleDriveSourceForm()
+				</template>
+				
+				<template x-if="sourceType === 'gphotos'">
+					@source.GooglePhotosSourceForm()
+				</template>
 				
 				<!-- File pattern fields -->
 				@common.FilePatternFields()
@@ -316,7 +367,14 @@ templ ConfigForm(ctx context.Context, data ConfigFormData) {
 				<template x-if="destinationType === 'webdav'">
 					@destination.WebDAVDestinationForm()
 				</template>
+
+				<template x-if="destinationType === 'gdrive'">
+					@destination.GoogleDriveDestinationForm()
+				</template>
 				
+				<template x-if="destinationType === 'gphotos'">
+					@destination.GooglePhotosDestinationForm()
+				</template>
 				
 				<!-- Archive options -->
 				@common.ArchiveOptions()

components/configs.templ

@@ -68,6 +68,9 @@ script triggerConfigDelete(dialogId string, configID uint, configName string) {
 
 type ConfigsData struct {
 	Configs []db.TransferConfig
+	Error string
+	ErrorDetails string
+	Status string
 }
 
 templ Configs(ctx context.Context, data ConfigsData) {
@@ -106,6 +109,27 @@ templ Configs(ctx context.Context, data ConfigsData) {
 				console.log("Notyf initialized:", window.notyf);
 			}
 
+			// Show status messages based on URL parameters
+			document.addEventListener('DOMContentLoaded', function() {
+				// Check for error message
+				const urlParams = new URLSearchParams(window.location.search);
+				const errorMsg = urlParams.get('error');
+				const errorDetails = urlParams.get('details');
+				const status = urlParams.get('status');
+				
+				if (errorMsg) {
+					let message = errorMsg;
+					if (errorDetails) {
+						message += ": " + errorDetails;
+					}
+					window.notyf.error(message);
+				}
+				
+				if (status === 'gdrive_auth_success') {
+					window.notyf.success("Google Drive authentication completed successfully");
+				}
+			});
+
 			// Track all HTMX events for debugging
 			document.addEventListener('htmx:beforeRequest', function(event) {
 				
@@ -244,8 +268,32 @@ templ Configs(ctx context.Context, data ConfigsData) {
 														<p class="text-sm font-medium text-primary-600 dark:text-primary-400 truncate">
 															{ config.Name }
 														</p>
+
+														<!-- Google Drive Authentication Badge -->
+														if (config.DestinationType == "gdrive" || config.SourceType == "gdrive" || config.SourceType == "gphotos" || config.DestinationType == "gphotos") && !config.GetGoogleAuthenticated() {
+															<span class="ml-2 px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-yellow-100 text-yellow-800 dark:bg-yellow-800 dark:text-yellow-100">
+																<i class="fas fa-exclamation-triangle mr-1 flex items-center"></i>
+																Authentication Required
+															</span>
+														}
+														
+														<!-- Google Drive Authentication Status Indicator -->
+														if (config.DestinationType == "gdrive" || config.SourceType == "gdrive" || config.SourceType == "gphotos" || config.DestinationType == "gphotos") && config.GetGoogleAuthenticated() {
+															<span class="ml-2 px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-green-100 text-green-800 dark:bg-green-800 dark:text-green-100">
+																<i class="fas fa-check-circle mr-1 flex items-center"></i>
+																Authenticated
+															</span>
+														}
 													</div>
 													<div class="ml-2 flex-shrink-0 flex space-x-2">
+														<!-- Google Drive Authentication Button -->
+														if (config.DestinationType == "gdrive" || config.SourceType == "gdrive" || config.SourceType == "gphotos" || config.DestinationType == "gphotos") && !config.GetGoogleAuthenticated() {
+															<a href={ templ.SafeURL(fmt.Sprintf("/configs/%d/gdrive-auth", config.ID)) } class="btn-warning btn-sm">
+																<i class="fab fa-google-drive mr-1"></i>
+																Authenticate
+															</a>
+														}
+														
 														<a href={ templ.SafeURL(fmt.Sprintf("/configs/%d", config.ID)) } class="btn-secondary btn-sm">
 															<i class="fas fa-edit mr-1"></i>
 															Edit
@@ -304,6 +352,14 @@ templ Configs(ctx context.Context, data ConfigsData) {
 						Configurations define how files are transferred between systems
 					</p>
 				</div>
+				
+				<!-- Google Drive Auth Help -->
+				<div class="mt-4 text-center">
+					<p class="text-sm text-secondary-500 dark:text-secondary-400">
+						<i class="fab fa-google-drive mr-1 text-blue-500 inline-flex items-center"></i>
+						Google Drive configurations require authentication. Click the "Authenticate" button to complete setup.
+					</p>
+				</div>
 			</div>
 		</div>
 	}

components/job_form.templ

@@ -191,16 +191,17 @@ templ JobForm(ctx context.Context, data JobFormData) {
 										<div class="flex items-center">
 											<input 
 												type="checkbox" 
-												id="enabled" 
+												id="enabled"
 												name="enabled"
 												value="true"
-												checked
-												class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
+												if data.Job.GetEnabled() {
+													checked
+												}
+												class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded" />
 											<label for="enabled" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">Enable this job</label>
 										</div>
-										<p class="mt-2 text-sm text-secondary-500 dark:text-secondary-400">
-											<i class="fas fa-exclamation-triangle mr-1 text-amber-500"></i>
-											Disabled jobs will not run automatically.
+										<p class="mt-1 text-sm text-secondary-500 dark:text-secondary-400">
+											Jobs that are not enabled will not run automatically on schedule.
 										</p>
 									</div>
 									
@@ -215,12 +216,15 @@ templ JobForm(ctx context.Context, data JobFormData) {
 											<div class="flex items-center">
 												<input 
 													type="checkbox" 
-													id="webhook_enabled" 
+													id="webhook_enabled"
 													name="webhook_enabled"
 													value="true"
-													class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
+													if data.Job.GetWebhookEnabled() {
+														checked
+													}
+													class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded" />
 												<label for="webhook_enabled" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">
-													Enable webhook notifications
+													Send webhook notification on completion
 												</label>
 											</div>
 											
@@ -293,7 +297,9 @@ templ JobForm(ctx context.Context, data JobFormData) {
 															id="notify_on_success" 
 															name="notify_on_success"
 															value="true"
-															checked
+															if data.Job.GetNotifyOnSuccess() {
+																checked
+															}
 															class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
 														<label for="notify_on_success" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">
 															Notify on successful jobs
@@ -306,7 +312,9 @@ templ JobForm(ctx context.Context, data JobFormData) {
 															id="notify_on_failure" 
 															name="notify_on_failure"
 															value="true"
-															checked
+															if data.Job.GetNotifyOnFailure() {
+																checked
+															}
 															class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
 														<label for="notify_on_failure" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">
 															Notify on failed jobs
@@ -434,18 +442,17 @@ templ JobForm(ctx context.Context, data JobFormData) {
 										<div class="flex items-center">
 											<input 
 												type="checkbox" 
-												id="enabled" 
+												id="enabled"
 												name="enabled"
 												value="true"
-												if data.Job.Enabled {
+												if data.Job.GetEnabled() {
 													checked
 												}
-												class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
+												class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded" />
 											<label for="enabled" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">Enable this job</label>
 										</div>
-										<p class="mt-2 text-sm text-secondary-500 dark:text-secondary-400">
-											<i class="fas fa-exclamation-triangle mr-1 text-amber-500"></i>
-											Disabled jobs will not run automatically.
+										<p class="mt-1 text-sm text-secondary-500 dark:text-secondary-400">
+											Jobs that are not enabled will not run automatically on schedule.
 										</p>
 									</div>
 									
@@ -460,15 +467,15 @@ templ JobForm(ctx context.Context, data JobFormData) {
 											<div class="flex items-center">
 												<input 
 													type="checkbox" 
-													id="webhook_enabled" 
+													id="webhook_enabled"
 													name="webhook_enabled"
 													value="true"
-													if data.Job.WebhookEnabled {
+													if data.Job.GetWebhookEnabled() {
 														checked
 													}
-													class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
+													class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded" />
 												<label for="webhook_enabled" class="ml-2 block text-sm font-medium text-secondary-700 dark:text-secondary-300">
-													Enable webhook notifications
+													Send webhook notification on completion
 												</label>
 											</div>
 											
@@ -544,7 +551,7 @@ templ JobForm(ctx context.Context, data JobFormData) {
 															id="notify_on_success" 
 															name="notify_on_success"
 															value="true"
-															if data.Job.NotifyOnSuccess {
+															if data.Job.GetNotifyOnSuccess() {
 																checked
 															}
 															class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>
@@ -559,7 +566,7 @@ templ JobForm(ctx context.Context, data JobFormData) {
 															id="notify_on_failure" 
 															name="notify_on_failure"
 															value="true"
-															if data.Job.NotifyOnFailure {
+															if data.Job.GetNotifyOnFailure() {
 																checked
 															}
 															class="h-4 w-4 text-primary-600 focus:ring-primary-500 border-secondary-300 dark:border-secondary-700 rounded"/>

components/jobs.templ

@@ -287,7 +287,7 @@ templ Jobs(ctx context.Context, data JobsData) {
 																{ job.Config.Name }
 															}
 														</p>
-														if job.Enabled {
+														if job.GetEnabled() {
 															<span class="ml-2 px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-green-100 dark:bg-green-900 text-green-800 dark:text-green-300">
 																Active
 															</span>

components/profile.templ

@@ -34,7 +34,7 @@ templ Profile(ctx context.Context, user db.User) {
 							<div class="flex flex-col sm:flex-row">
 								<dt class="text-sm font-medium text-secondary-500 dark:text-secondary-400 sm:w-1/3 mb-1 sm:mb-0">Role</dt>
 								<dd class="text-sm text-secondary-900 dark:text-secondary-100 sm:w-2/3">
-									if user.IsAdmin {
+									if user.GetIsAdmin() {
 										<span class="badge badge-success">
 											<i class="fas fa-user-shield mr-1"></i> Administrator
 										</span>

components/providers/common/common.templ

@@ -194,6 +194,8 @@ templ SourceSelection() {
 			<option value="smb">SMB</option>
 			<option value="nextcloud">NextCloud</option>
 			<option value="webdav">WebDAV</option>
+			<option value="google_drive">Google Drive</option>
+			<option value="gphotos">Google Photos</option>
 		</select>
 	</div>
 </div>
@@ -217,6 +219,8 @@ templ DestinationSelection() {
 			<option value="smb">SMB</option>
 			<option value="nextcloud">NextCloud</option>
 			<option value="webdav">WebDAV</option>
+			<option value="gdrive">Google Drive</option>
+			<option value="gphotos">Google Photos</option>
 		</select>
 	</div>
 </div>

components/providers/destination/gdrive.templ

@@ -0,0 +1,178 @@
+package destination
+
+templ GoogleDriveDestinationForm() {
+<div class="space-y-6" x-init="$watch('useBuiltinAuth', value => {
+    if(value) {
+        destClientId = '';
+        destClientSecret = '';
+    }
+})">
+    <div class="mb-6">
+        <label for="use_builtin_auth" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="use_builtin_auth" name="use_builtin_auth" type="checkbox" 
+                    class="sr-only"
+                    x-model="useBuiltinAuth"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="useBuiltinAuth ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Use rclone's built-in Google authentication (recommended)
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Simple one-click authentication using rclone's shared credentials
+        </p>
+    </div>
+
+    <div x-bind:class="{ 'opacity-50': useBuiltinAuth }">
+        <div>
+            <label for="dest_client_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client ID
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-id-card text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="text" id="dest_client_id" name="dest_client_id" x-model="destClientId"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Drive OAuth Client ID" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client ID from Google Cloud Console
+            </p>
+        </div>
+
+        <div class="mt-4">
+            <label for="dest_client_secret" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client Secret
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-key text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="password" id="dest_client_secret" name="dest_client_secret" x-model="destClientSecret"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Drive OAuth Client Secret" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client Secret from Google Cloud Console
+            </p>
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <label for="dest_drive_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Folder ID (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-folder text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="dest_drive_id" name="dest_drive_id" x-model="destDriveId"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Google Drive Folder ID (optional)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Folder ID to use as the root (leave empty for "My Drive")
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="dest_team_drive" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Shared/Team Drive ID (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-users text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="dest_team_drive" name="dest_team_drive" x-model="destTeamDrive"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Shared/Team Drive ID (optional)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            ID of the Shared Drive / Team Drive to use
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="destination_path" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Path</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-folder-open text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="destination_path" name="destination_path" x-model="destinationPath"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Path within Google Drive (e.g., /backup)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Path within the Drive where files will be uploaded
+        </p>
+    </div>
+
+    <div class="p-4 bg-amber-50 rounded-lg border border-amber-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-triangle text-amber-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-amber-800">Important: Authentication Required</h3>
+                <div class="mt-2 text-sm text-amber-700">
+                    <p><strong>After saving this configuration</strong>, you will need to authenticate with Google Drive.</p>
+                    <p class="mt-1">The authentication process will require you to:</p>
+                    <ol class="list-decimal list-inside mt-1 space-y-1">
+                        <li>Visit a Google authorization URL</li>
+                        <li>Sign in to your Google account</li>
+                        <li>Grant permission to access your Google Drive</li>
+                        <li>Copy the authorization code back to this application</li>
+                    </ol>
+                    <p class="mt-2 text-xs">
+                        This is a one-time process for each configuration. The application will store your authorization token securely.
+                    </p>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="p-4 bg-blue-50 rounded-lg border border-blue-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-info-circle text-blue-400"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-blue-800">Authentication Information</h3>
+                <div class="mt-2 text-sm text-blue-700">
+                    <template x-if="useBuiltinAuth">
+                        <div>
+                            <p>You're using rclone's built-in authentication, which simplifies the setup process:</p>
+                            <ul class="list-disc list-inside mt-1 space-y-1">
+                                <li>No need to create your own Google API credentials</li>
+                                <li>Authentication happens through a browser window</li>
+                                <li>You will need to manually copy the authorization code back</li>
+                            </ul>
+                            <p class="mt-2 text-xs text-amber-600">
+                                <i class="fas fa-exclamation-triangle mr-1"></i> 
+                                Note: The built-in authentication uses shared credentials which have rate limits across all rclone users.
+                                If you plan to transfer large amounts of data or run many concurrent transfers, consider creating your own credentials.
+                            </p>
+                        </div>
+                    </template>
+                    <template x-if="!useBuiltinAuth">
+                        <div>
+                            <p>To use Google Drive with your own credentials:</p>
+                            <ol class="list-decimal list-inside mt-1 space-y-1">
+                                <li>Go to the <a href="https://console.cloud.google.com/" target="_blank" class="text-blue-600 underline">Google Cloud Console</a></li>
+                                <li>Create a project and enable the Google Drive API</li>
+                                <li>Create OAuth 2.0 credentials (Client ID & Secret)</li>
+                                <li>Set authorized redirect URI to <code class="bg-blue-100 px-1 py-0.5 rounded">http://localhost:53682/</code></li>
+                            </ol>
+                        </div>
+                    </template>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+} 

components/providers/destination/gphotos.templ

@@ -0,0 +1,220 @@
+package destination
+
+templ GooglePhotosDestinationForm() {
+<div class="space-y-6" x-init="$watch('useBuiltinAuth', value => {
+    if(value) {
+        destClientId = '';
+        destClientSecret = '';
+    }
+})">
+    <div class="mb-6">
+        <label for="use_builtin_auth" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="use_builtin_auth" name="use_builtin_auth" type="checkbox" 
+                    class="sr-only"
+                    x-model="useBuiltinAuth"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="useBuiltinAuth ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Use rclone's built-in Google authentication (recommended)
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Simple one-click authentication using rclone's shared credentials
+        </p>
+    </div>
+
+    <div x-bind:class="{ 'opacity-50': useBuiltinAuth }">
+        <div>
+            <label for="dest_client_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client ID
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-id-card text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="text" id="dest_client_id" name="dest_client_id" x-model="destClientId"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Photos OAuth Client ID" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client ID from Google Cloud Console
+            </p>
+        </div>
+
+        <div class="mt-4">
+            <label for="dest_client_secret" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client Secret
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-key text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="password" id="dest_client_secret" name="dest_client_secret" x-model="destClientSecret"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Photos OAuth Client Secret" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client Secret from Google Cloud Console
+            </p>
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <label for="dest_read_only" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="dest_read_only" name="dest_read_only" type="checkbox" 
+                    class="sr-only"
+                    x-model="destReadOnly"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="destReadOnly ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Read-only mode
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Only request read-only access to your photos
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="dest_start_year" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Start Year (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-calendar text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="number" id="dest_start_year" name="dest_start_year" x-model="destStartYear"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Only include photos after this year (default: 2000)" min="1900" max="2100" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Only include photos uploaded after this year
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="dest_include_archived" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="dest_include_archived" name="dest_include_archived" type="checkbox" 
+                    class="sr-only"
+                    x-model="destIncludeArchived"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="destIncludeArchived ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Include archived media
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Include archived photos and videos in media listings
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="destination_path" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Album Path</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-images text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="destination_path" name="destination_path" x-model="destinationPath"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Album path (e.g., /album/my-photos)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Path within Google Photos where files will be uploaded
+        </p>
+    </div>
+
+    <div class="p-4 bg-amber-50 rounded-lg border border-amber-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-triangle text-amber-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-amber-800">Important: Authentication Required</h3>
+                <div class="mt-2 text-sm text-amber-700">
+                    <p><strong>After saving this configuration</strong>, you will need to authenticate with Google Photos.</p>
+                    <p class="mt-1">The authentication process will require you to:</p>
+                    <ol class="list-decimal list-inside mt-1 space-y-1">
+                        <li>Visit a Google authorization URL</li>
+                        <li>Sign in to your Google account</li>
+                        <li>Grant permission to access your Google Photos</li>
+                        <li>Copy the authorization code back to this application</li>
+                    </ol>
+                    <p class="mt-2 text-xs">
+                        This is a one-time process for each configuration. The application will store your authorization token securely.
+                    </p>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="p-4 bg-blue-50 rounded-lg border border-blue-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-info-circle text-blue-400"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-blue-800">Authentication Information</h3>
+                <div class="mt-2 text-sm text-blue-700">
+                    <template x-if="useBuiltinAuth">
+                        <div>
+                            <p>You're using rclone's built-in authentication, which simplifies the setup process:</p>
+                            <ul class="list-disc list-inside mt-1 space-y-1">
+                                <li>No need to create your own Google API credentials</li>
+                                <li>Authentication happens through a browser window</li>
+                                <li>You will need to manually copy the authorization code back</li>
+                            </ul>
+                            <p class="mt-2 text-xs text-amber-600">
+                                <i class="fas fa-exclamation-triangle mr-1"></i> 
+                                Note: The built-in authentication uses shared credentials which have rate limits across all rclone users.
+                                If you plan to transfer large amounts of data or run many concurrent transfers, consider creating your own credentials.
+                            </p>
+                        </div>
+                    </template>
+                    <template x-if="!useBuiltinAuth">
+                        <div>
+                            <p>To use Google Photos with your own credentials:</p>
+                            <ol class="list-decimal list-inside mt-1 space-y-1">
+                                <li>Go to the <a href="https://console.cloud.google.com/" target="_blank" class="text-blue-600 underline">Google Cloud Console</a></li>
+                                <li>Create a project and enable the Google Photos API</li>
+                                <li>Create OAuth 2.0 credentials (Client ID & Secret)</li>
+                                <li>Set authorized redirect URI to <code class="bg-blue-100 px-1 py-0.5 rounded">http://localhost:53682/</code></li>
+                            </ol>
+                        </div>
+                    </template>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="p-4 bg-yellow-50 rounded-lg border border-yellow-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-circle text-yellow-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-yellow-800">Important Note About Google Photos</h3>
+                <div class="mt-2 text-sm text-yellow-700">
+                    <p>All media items uploaded to Google Photos with rclone are stored in full resolution at original quality. These uploads will count towards storage in your Google Account.</p>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+} 

components/providers/providers_test.go

@@ -86,6 +86,11 @@ func TestSourceProviders(t *testing.T) {
 			err := source.WebDAVSourceForm().Render(ctx, &buf)
 			return buf.String(), err
 		}},
+		{"GoogleDriveSourceForm", func() (string, error) {
+			var buf strings.Builder
+			err := source.GoogleDriveSourceForm().Render(ctx, &buf)
+			return buf.String(), err
+		}},
 	}
 
 	for _, provider := range providers {
@@ -138,6 +143,11 @@ func TestDestinationProviders(t *testing.T) {
 			err := destination.WebDAVDestinationForm().Render(ctx, &buf)
 			return buf.String(), err
 		}},
+		{"GoogleDriveDestinationForm", func() (string, error) {
+			var buf strings.Builder
+			err := destination.GoogleDriveDestinationForm().Render(ctx, &buf)
+			return buf.String(), err
+		}},
 	}
 
 	for _, provider := range providers {

components/providers/source/gdrive.templ

@@ -0,0 +1,129 @@
+package source
+
+templ GoogleDriveSourceForm() {
+<div class="space-y-6" x-init="$watch('useBuiltinAuth', value => {
+    if(value) {
+        sourceClientId = '';
+        sourceClientSecret = '';
+    }
+})">
+    <div class="mb-6">
+        <label for="use_builtin_auth_source" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="use_builtin_auth_source" name="use_builtin_auth_source" type="checkbox" 
+                    class="sr-only"
+                    x-model="useBuiltinAuth"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="useBuiltinAuth ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Use rclone's built-in Google authentication (recommended)
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Simple one-click authentication using rclone's shared credentials
+        </p>
+    </div>
+
+    <div x-bind:class="{ 'opacity-50': useBuiltinAuth }">
+        <div>
+            <label for="source_client_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client ID
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-id-card text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="text" id="source_client_id" name="source_client_id" x-model="sourceClientId"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Drive OAuth Client ID" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client ID from Google Cloud Console
+            </p>
+        </div>
+
+        <div class="mt-4">
+            <label for="source_client_secret" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client Secret
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-key text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="password" id="source_client_secret" name="source_client_secret" x-model="sourceClientSecret"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Drive OAuth Client Secret" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client Secret from Google Cloud Console
+            </p>
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_drive_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Folder ID (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-folder text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="source_drive_id" name="source_drive_id" x-model="sourceDriveId"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Google Drive Folder ID (optional)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Folder ID to use as the root (leave empty for "My Drive")
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_team_drive" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Shared/Team Drive ID (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-users text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="source_team_drive" name="source_team_drive" x-model="sourceTeamDrive"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Shared/Team Drive ID (optional)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            ID of the Shared Drive / Team Drive to use
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_path" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Path</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-folder-open text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="source_path" name="source_path" x-model="sourcePath"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Path within Google Drive (e.g., /backup)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Path within the Drive from which files will be transferred
+        </p>
+    </div>
+
+    <div class="p-4 bg-amber-50 rounded-lg border border-amber-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-triangle text-amber-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-amber-800">Authentication Required</h3>
+                <div class="mt-2 text-sm text-amber-700">
+                    <p>After saving this configuration, you'll need to authenticate with Google Drive on the configurations page.</p>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+} 

components/providers/source/gphotos.templ

@@ -0,0 +1,220 @@
+package source
+
+templ GooglePhotosSourceForm() {
+<div class="space-y-6" x-init="$watch('useBuiltinAuth', value => {
+    if(value) {
+        sourceClientId = '';
+        sourceClientSecret = '';
+    }
+})">
+    <div class="mb-6">
+        <label for="use_builtin_auth" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="use_builtin_auth" name="use_builtin_auth" type="checkbox" 
+                    class="sr-only"
+                    x-model="useBuiltinAuth"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="useBuiltinAuth ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Use rclone's built-in Google authentication (recommended)
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Simple one-click authentication using rclone's shared credentials
+        </p>
+    </div>
+
+    <div x-bind:class="{ 'opacity-50': useBuiltinAuth }">
+        <div>
+            <label for="source_client_id" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client ID
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-id-card text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="text" id="source_client_id" name="source_client_id" x-model="sourceClientId"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Photos OAuth Client ID" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client ID from Google Cloud Console
+            </p>
+        </div>
+
+        <div class="mt-4">
+            <label for="source_client_secret" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">
+                Google Client Secret
+                <span x-show="useBuiltinAuth" class="text-secondary-400 dark:text-secondary-600 text-xs font-normal">(Using rclone default)</span>
+            </label>
+            <div class="relative">
+                <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                    <i class="fas fa-key text-secondary-400 dark:text-secondary-600"></i>
+                </div>
+                <input type="password" id="source_client_secret" name="source_client_secret" x-model="sourceClientSecret"
+                    class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                    x-bind:disabled="useBuiltinAuth"
+                    placeholder="Google Photos OAuth Client Secret" />
+            </div>
+            <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+                Client Secret from Google Cloud Console
+            </p>
+        </div>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_read_only" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="source_read_only" name="source_read_only" type="checkbox" 
+                    class="sr-only"
+                    x-model="sourceReadOnly"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="sourceReadOnly ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Read-only mode
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Only request read-only access to your photos
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_start_year" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Start Year (Optional)</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-calendar text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="number" id="source_start_year" name="source_start_year" x-model="sourceStartYear"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Only include photos after this year (default: 2000)" min="1900" max="2100" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Only include photos uploaded after this year
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_include_archived" class="flex items-center cursor-pointer">
+            <div class="relative">
+                <input id="source_include_archived" name="source_include_archived" type="checkbox" 
+                    class="sr-only"
+                    x-model="sourceIncludeArchived"
+                    value="true"
+                />
+                <div class="block bg-gray-200 w-14 h-8 rounded-full"></div>
+                <div class="dot absolute left-1 top-1 bg-white w-6 h-6 rounded-full transition"
+                    :class="sourceIncludeArchived ? 'transform translate-x-6 bg-primary-500' : ''"></div>
+            </div>
+            <div class="ml-3 text-gray-700 font-medium">
+                Include archived media
+            </div>
+        </label>
+        <p class="mt-1 ml-14 text-xs text-secondary-500 dark:text-secondary-400">
+            Include archived photos and videos in media listings
+        </p>
+    </div>
+
+    <div class="mt-4">
+        <label for="source_path" class="block text-sm font-medium text-secondary-700 dark:text-secondary-300 mb-1">Album Path</label>
+        <div class="relative">
+            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+                <i class="fas fa-images text-secondary-400 dark:text-secondary-600"></i>
+            </div>
+            <input type="text" id="source_path" name="source_path" x-model="sourcePath"
+                class="form-input pl-10 w-full rounded-lg border-secondary-300 dark:border-secondary-700 dark:bg-secondary-800 dark:text-secondary-100 focus:ring-primary-500 focus:border-primary-500"
+                placeholder="Album path (e.g., /album/my-photos)" />
+        </div>
+        <p class="mt-1 text-xs text-secondary-500 dark:text-secondary-400">
+            Path within Google Photos to download files from
+        </p>
+    </div>
+
+    <div class="p-4 bg-amber-50 rounded-lg border border-amber-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-triangle text-amber-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-amber-800">Important: Authentication Required</h3>
+                <div class="mt-2 text-sm text-amber-700">
+                    <p><strong>After saving this configuration</strong>, you will need to authenticate with Google Photos.</p>
+                    <p class="mt-1">The authentication process will require you to:</p>
+                    <ol class="list-decimal list-inside mt-1 space-y-1">
+                        <li>Visit a Google authorization URL</li>
+                        <li>Sign in to your Google account</li>
+                        <li>Grant permission to access your Google Photos</li>
+                        <li>Copy the authorization code back to this application</li>
+                    </ol>
+                    <p class="mt-2 text-xs">
+                        This is a one-time process for each configuration. The application will store your authorization token securely.
+                    </p>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="p-4 bg-blue-50 rounded-lg border border-blue-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-info-circle text-blue-400"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-blue-800">Authentication Information</h3>
+                <div class="mt-2 text-sm text-blue-700">
+                    <template x-if="useBuiltinAuth">
+                        <div>
+                            <p>You're using rclone's built-in authentication, which simplifies the setup process:</p>
+                            <ul class="list-disc list-inside mt-1 space-y-1">
+                                <li>No need to create your own Google API credentials</li>
+                                <li>Authentication happens through a browser window</li>
+                                <li>You will need to manually copy the authorization code back</li>
+                            </ul>
+                            <p class="mt-2 text-xs text-amber-600">
+                                <i class="fas fa-exclamation-triangle mr-1"></i> 
+                                Note: The built-in authentication uses shared credentials which have rate limits across all rclone users.
+                                If you plan to transfer large amounts of data or run many concurrent transfers, consider creating your own credentials.
+                            </p>
+                        </div>
+                    </template>
+                    <template x-if="!useBuiltinAuth">
+                        <div>
+                            <p>To use Google Photos with your own credentials:</p>
+                            <ol class="list-decimal list-inside mt-1 space-y-1">
+                                <li>Go to the <a href="https://console.cloud.google.com/" target="_blank" class="text-blue-600 underline">Google Cloud Console</a></li>
+                                <li>Create a project and enable the Google Photos API</li>
+                                <li>Create OAuth 2.0 credentials (Client ID & Secret)</li>
+                                <li>Set authorized redirect URI to <code class="bg-blue-100 px-1 py-0.5 rounded">http://localhost:53682/</code></li>
+                            </ol>
+                        </div>
+                    </template>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <div class="p-4 bg-yellow-50 rounded-lg border border-yellow-100">
+        <div class="flex">
+            <div class="flex-shrink-0">
+                <i class="fas fa-exclamation-circle text-yellow-500"></i>
+            </div>
+            <div class="ml-3">
+                <h3 class="text-sm font-medium text-yellow-800">Important Note About Google Photos</h3>
+                <div class="mt-2 text-sm text-yellow-700">
+                    <p>When downloading from Google Photos, be aware that some original metadata may not be preserved. Google Photos processes and may compress some images upon upload.</p>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+} 

components/users.templ

@@ -73,7 +73,7 @@ templ Users(ctx context.Context, data UsersData) {
 													<div class="text-sm font-medium text-secondary-900 dark:text-secondary-100">{ user.Email }</div>
 												</td>
 												<td class="px-6 py-4 whitespace-nowrap">
-													if user.IsAdmin {
+													if user.GetIsAdmin() {
 														<span class="px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-primary-100 dark:bg-primary-900 text-primary-800 dark:text-primary-300">
 															<i class="fas fa-user-shield mr-1"></i> Admin
 														</span>

go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gin-contrib/sessions v1.0.2 // indirect
 	github.com/gin-contrib/sse v1.0.0 // indirect
 	github.com/glebarez/go-sqlite v1.21.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -30,6 +31,9 @@ require (
 	github.com/go-playground/validator/v10 v10.25.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/google/uuid v1.3.0 // indirect
+	github.com/gorilla/context v1.1.2 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gorilla/sessions v1.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect

go.sum

@@ -15,6 +15,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/gin-contrib/sessions v1.0.2 h1:UaIjUvTH1cMeOdj3in6dl+Xb6It8RiKRF9Z1anbUyCA=
+github.com/gin-contrib/sessions v1.0.2/go.mod h1:KxKxWqWP5LJVDCInulOl4WbLzK2KSPlLesfZ66wRvMs=
 github.com/gin-contrib/sse v1.0.0 h1:y3bT1mUWUxDpW4JLQg/HnTqV4rozuW4tC9eFKTxYI9E=
 github.com/gin-contrib/sse v1.0.0/go.mod h1:zNuFdwarAygJBht0NTKiSi3jRf6RbqeILZ9Sp6Slhe0=
 github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
@@ -44,6 +46,12 @@ github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbu
 github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
+github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
+github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=

internal/api/api.go

@@ -14,22 +14,22 @@ import (
 )
 
 type RegisterRequest struct {
-	Email string `json:"email" binding:"required,min=3,max=50"`
+	Email    string `json:"email" binding:"required,min=3,max=50"`
 	Password string `json:"password" binding:"required,min=8"`
 }
 
 type LoginRequest struct {
-	Email string `json:"email" binding:"required"`
+	Email    string `json:"email" binding:"required"`
 	Password string `json:"password" binding:"required"`
 }
 
 type LoginResponse struct {
-	Token string `json:"token"`
+	Token string       `json:"token"`
 	User  UserResponse `json:"user"`
 }
 
 type UserResponse struct {
-	ID       uint   `json:"id"`
+	ID    uint   `json:"id"`
 	Email string `json:"email"`
 }
 
@@ -94,7 +94,7 @@ func handleRegister(database *db.DB) gin.HandlerFunc {
 
 		// Create user
 		user := &db.User{
-			Email:     req.Email,
+			Email:        req.Email,
 			PasswordHash: string(hashedPassword),
 		}
 
@@ -136,7 +136,7 @@ func handleLogin(database *db.DB, jwtSecret string) gin.HandlerFunc {
 		c.JSON(http.StatusOK, LoginResponse{
 			Token: token,
 			User: UserResponse{
-				ID:       user.ID,
+				ID:    user.ID,
 				Email: user.Email,
 			},
 		})
@@ -384,7 +384,7 @@ func handleCreateJob(database *db.DB, scheduler *scheduler.Scheduler) gin.Handle
 		}
 
 		// Schedule the job if enabled
-		if job.Enabled {
+		if job.GetEnabled() {
 			if err := scheduler.ScheduleJob(&job); err != nil {
 				c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to schedule job"})
 				return
@@ -484,7 +484,7 @@ func handleUpdateJob(database *db.DB, scheduler *scheduler.Scheduler) gin.Handle
 		}
 
 		// Check if schedule or enabled status changed
-		scheduleChanged := updatedJob.Schedule != existingJob.Schedule || updatedJob.Enabled != existingJob.Enabled
+		scheduleChanged := updatedJob.Schedule != existingJob.Schedule || updatedJob.GetEnabled() != existingJob.GetEnabled()
 
 		if err := database.UpdateJob(&updatedJob); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update job"})
@@ -493,7 +493,7 @@ func handleUpdateJob(database *db.DB, scheduler *scheduler.Scheduler) gin.Handle
 
 		// Update the scheduler if needed
 		if scheduleChanged {
-			if updatedJob.Enabled {
+			if updatedJob.GetEnabled() {
 				if err := scheduler.ScheduleJob(&updatedJob); err != nil {
 					c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update job schedule"})
 					return
@@ -610,12 +610,8 @@ func handleEnableJob(database *db.DB, scheduler *scheduler.Scheduler) gin.Handle
 			return
 		}
 
-		// Update job status
-		job.Enabled = true
-		if err := database.UpdateJob(job); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update job"})
-			return
-		}
+		// Enable the job
+		job.SetEnabled(true)
 
 		// Add to scheduler
 		if err := scheduler.ScheduleJob(job); err != nil {
@@ -654,12 +650,8 @@ func handleDisableJob(database *db.DB, scheduler *scheduler.Scheduler) gin.Handl
 			return
 		}
 
-		// Update job status
-		job.Enabled = false
-		if err := database.UpdateJob(job); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update job"})
-			return
-		}
+		// Disable the job
+		job.SetEnabled(false)
 
 		// Remove from scheduler
 		scheduler.UnscheduleJob(jobID)

internal/db/db.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -18,10 +19,10 @@ type User struct {
 	ID                  uint   `gorm:"primarykey"`
 	Email               string `gorm:"unique;not null"`
 	PasswordHash        string `gorm:"not null"`
-	IsAdmin             bool   `gorm:"default:false"`
+	IsAdmin             *bool  `gorm:"default:false"`
 	LastPasswordChange  time.Time
-	FailedLoginAttempts int  `gorm:"default:0"`
-	AccountLocked       bool `gorm:"default:false"`
+	FailedLoginAttempts int   `gorm:"default:0"`
+	AccountLocked       *bool `gorm:"default:false"`
 	LockoutUntil        *time.Time
 	Theme               string `gorm:"default:'light'"`
 	CreatedAt           time.Time
@@ -42,7 +43,7 @@ type PasswordResetToken struct {
 	User      User      `gorm:"foreignkey:UserID"`
 	Token     string    `gorm:"not null"`
 	ExpiresAt time.Time `gorm:"not null"`
-	Used      bool      `gorm:"default:false"`
+	Used      *bool     `gorm:"default:false"`
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -67,12 +68,16 @@ type TransferConfig struct {
 	SourceShare  string `form:"source_share"`
 	SourceDomain string `form:"source_domain"`
 	// FTP source fields
-	SourcePassiveMode bool `gorm:"default:true" form:"source_passive_mode"`
+	SourcePassiveMode *bool `gorm:"default:true" form:"source_passive_mode"`
 	// OneDrive and Google Drive source fields
 	SourceClientID     string `form:"source_client_id"`
 	SourceClientSecret string `form:"source_client_secret" gorm:"-"` // Not stored in DB, only used for form
 	SourceDriveID      string `form:"source_drive_id"`               // For OneDrive
 	SourceTeamDrive    string `form:"source_team_drive"`             // For Google Drive
+	// Google Photos source fields
+	SourceReadOnly        *bool `form:"source_read_only"`        // For Google Photos
+	SourceStartYear       int   `form:"source_start_year"`       // For Google Photos
+	SourceIncludeArchived *bool `form:"source_include_archived"` // For Google Photos
 	// General fields
 	FilePattern     string `gorm:"default:'*'" form:"file_pattern"`
 	OutputPattern   string `form:"output_pattern"` // Pattern for output filenames with date variables
@@ -93,17 +98,24 @@ type TransferConfig struct {
 	DestShare  string `form:"dest_share"`
 	DestDomain string `form:"dest_domain"`
 	// FTP destination fields
-	DestPassiveMode bool `gorm:"default:true" form:"dest_passive_mode"`
+	DestPassiveMode *bool `gorm:"default:true" form:"dest_passive_mode"`
 	// OneDrive and Google Drive destination fields
 	DestClientID     string `form:"dest_client_id"`
 	DestClientSecret string `form:"dest_client_secret" gorm:"-"` // Not stored in DB, only used for form
 	DestDriveID      string `form:"dest_drive_id"`               // For OneDrive
 	DestTeamDrive    string `form:"dest_team_drive"`             // For Google Drive
+	// Google Photos destination fields
+	DestReadOnly        *bool `form:"dest_read_only"`        // For Google Photos
+	DestStartYear       int   `form:"dest_start_year"`       // For Google Photos
+	DestIncludeArchived *bool `form:"dest_include_archived"` // For Google Photos
+	// Security fields
+	UseBuiltinAuth           *bool `form:"use_builtin_auth"` // For Google and other OAuth services
+	GoogleDriveAuthenticated *bool // Whether Google Drive auth is completed
 	// General fields
 	ArchivePath            string `form:"archive_path"`
-	ArchiveEnabled         bool   `gorm:"default:false" form:"archive_enabled"`
+	ArchiveEnabled         *bool  `gorm:"default:false" form:"archive_enabled"`
 	RcloneFlags            string `form:"rclone_flags"`
-	DeleteAfterTransfer    bool   `gorm:"default:false" form:"delete_after_transfer"`
+	DeleteAfterTransfer    *bool  `gorm:"default:false" form:"delete_after_transfer"`
 	SkipProcessedFiles     *bool  `gorm:"default:true" form:"skip_processed_files"`
 	MaxConcurrentTransfers int    `gorm:"default:4" form:"max_concurrent_transfers"` // Number of concurrent file transfers
 	CreatedBy              uint
@@ -119,16 +131,16 @@ type Job struct {
 	Config    TransferConfig `gorm:"foreignkey:ConfigID"`
 	ConfigIDs string         `gorm:"column:config_ids"` // Comma-separated list of config IDs
 	Schedule  string         `gorm:"not null" form:"schedule"`
-	Enabled   bool           `gorm:"default:true" form:"enabled"`
+	Enabled   *bool          `gorm:"default:true" form:"enabled"`
 	LastRun   *time.Time
 	NextRun   *time.Time
 	// Webhook notification fields
-	WebhookEnabled  bool   `gorm:"default:false" form:"webhook_enabled"`
+	WebhookEnabled  *bool  `gorm:"default:false" form:"webhook_enabled"`
 	WebhookURL      string `form:"webhook_url"`
 	WebhookSecret   string `form:"webhook_secret"`
 	WebhookHeaders  string `form:"webhook_headers"` // JSON-encoded headers
-	NotifyOnSuccess bool   `gorm:"default:true" form:"notify_on_success"`
-	NotifyOnFailure bool   `gorm:"default:true" form:"notify_on_failure"`
+	NotifyOnSuccess *bool  `gorm:"default:true" form:"notify_on_success"`
+	NotifyOnFailure *bool  `gorm:"default:true" form:"notify_on_failure"`
 	CreatedBy       uint
 	User            User `gorm:"foreignkey:CreatedBy"`
 	CreatedAt       time.Time
@@ -558,7 +570,7 @@ func (db *DB) GenerateRcloneConfig(config *TransferConfig) error {
 			"--log-level", "ERROR",
 		}
 
-		if config.SourcePassiveMode {
+		if config.SourcePassiveMode != nil && *config.SourcePassiveMode {
 			args = append(args, "passive", "true")
 		}
 
@@ -629,6 +641,40 @@ func (db *DB) GenerateRcloneConfig(config *TransferConfig) error {
 			args = append(args, "team_drive", config.SourceTeamDrive)
 		}
 
+		cmd := exec.Command(rclonePath, args...)
+		if output, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("failed to create source config: %v\nOutput: %s", err, output)
+		}
+	case "gphotos":
+		args := []string{
+			"config", "create", sourceName, "google photos",
+			"--non-interactive",
+			"--config", configPath,
+			"--log-level", "ERROR",
+		}
+
+		// Only add client_id and client_secret if they're provided (not empty)
+		// This allows using rclone's built-in authentication
+		if config.SourceClientID != "" && config.SourceClientSecret != "" {
+			args = append(args, "client_id", config.SourceClientID)
+			args = append(args, "client_secret", config.SourceClientSecret)
+		}
+
+		// Add read_only option if specified
+		if config.SourceReadOnly != nil && *config.SourceReadOnly {
+			args = append(args, "read_only", "true")
+		}
+
+		// Add start_year if specified
+		if config.SourceStartYear > 0 {
+			args = append(args, "start_year", strconv.Itoa(config.SourceStartYear))
+		}
+
+		// Add include_archived if specified
+		if config.SourceIncludeArchived != nil && *config.SourceIncludeArchived {
+			args = append(args, "include_archived", "true")
+		}
+
 		cmd := exec.Command(rclonePath, args...)
 		if output, err := cmd.CombinedOutput(); err != nil {
 			return fmt.Errorf("failed to create source config: %v\nOutput: %s", err, output)
@@ -746,7 +792,7 @@ func (db *DB) GenerateRcloneConfig(config *TransferConfig) error {
 			"--log-level", "ERROR",
 		}
 
-		if config.DestPassiveMode {
+		if config.DestPassiveMode != nil && *config.DestPassiveMode {
 			args = append(args, "passive", "true")
 		}
 
@@ -799,6 +845,67 @@ func (db *DB) GenerateRcloneConfig(config *TransferConfig) error {
 			args = append(args, "drive_id", config.DestDriveID)
 		}
 
+		cmd := exec.Command(rclonePath, args...)
+		if output, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("failed to create destination config: %v\nOutput: %s", err, output)
+		}
+	case "gdrive":
+		args := []string{
+			"config", "create", destName, "drive",
+			"--non-interactive",
+			"--config", configPath,
+			"--log-level", "ERROR",
+		}
+
+		// Only add client_id and client_secret if they're provided (not empty)
+		// This allows using rclone's built-in authentication
+		if config.DestClientID != "" && config.DestClientSecret != "" {
+			args = append(args, "client_id", config.DestClientID)
+			args = append(args, "client_secret", config.DestClientSecret)
+		}
+
+		if config.DestTeamDrive != "" {
+			args = append(args, "team_drive", config.DestTeamDrive)
+		}
+
+		if config.DestDriveID != "" {
+			args = append(args, "root_folder_id", config.DestDriveID)
+		}
+
+		cmd := exec.Command(rclonePath, args...)
+		if output, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("failed to create destination config: %v\nOutput: %s", err, output)
+		}
+	case "gphotos":
+		args := []string{
+			"config", "create", destName, "google photos",
+			"--non-interactive",
+			"--config", configPath,
+			"--log-level", "ERROR",
+		}
+
+		// Only add client_id and client_secret if they're provided (not empty)
+		// This allows using rclone's built-in authentication
+		if config.DestClientID != "" && config.DestClientSecret != "" {
+			args = append(args, "client_id", config.DestClientID)
+			args = append(args, "client_secret", config.DestClientSecret)
+		}
+
+		// Add read_only option if specified
+		if config.DestReadOnly != nil && *config.DestReadOnly {
+			args = append(args, "read_only", "true")
+		}
+
+		// Add start_year if specified
+		if config.DestStartYear > 0 {
+			args = append(args, "start_year", strconv.Itoa(config.DestStartYear))
+		}
+
+		// Add include_archived if specified
+		if config.DestIncludeArchived != nil && *config.DestIncludeArchived {
+			args = append(args, "include_archived", "true")
+		}
+
 		cmd := exec.Command(rclonePath, args...)
 		if output, err := cmd.CombinedOutput(); err != nil {
 			return fmt.Errorf("failed to create destination config: %v\nOutput: %s", err, output)
@@ -837,12 +944,14 @@ func (db *DB) GenerateRcloneConfig(config *TransferConfig) error {
 	return nil
 }
 
+// GetActiveJobs returns all active jobs
 func (db *DB) GetActiveJobs() ([]Job, error) {
 	if db.DB == nil {
 		return nil, fmt.Errorf("database connection is nil")
 	}
 	var jobs []Job
-	err := db.Preload("Config").Where("enabled = ?", true).Find(&jobs).Error
+	// For boolean pointer fields, need to check either NULL (for default) or true value
+	err := db.Preload("Config").Where("enabled IS NULL OR enabled = ?", true).Find(&jobs).Error
 	return jobs, err
 }
 
@@ -885,3 +994,470 @@ func (tc *TransferConfig) GetSkipProcessedFiles() bool {
 func (tc *TransferConfig) SetSkipProcessedFiles(value bool) {
 	tc.SkipProcessedFiles = &value
 }
+
+// StoreGoogleDriveToken stores the Google Drive auth token for a config
+func (db *DB) StoreGoogleDriveToken(configIDStr string, token string) error {
+	configID, err := strconv.ParseUint(configIDStr, 10, 64)
+	if err != nil {
+		return fmt.Errorf("invalid config ID: %v", err)
+	}
+
+	// Get the existing config
+	config, err := db.GetTransferConfig(uint(configID))
+	if err != nil {
+		return fmt.Errorf("failed to get config: %v", err)
+	}
+
+	// Mark as authenticated
+	authenticated := true
+	config.GoogleDriveAuthenticated = &authenticated
+
+	// Update the config in the database
+	if err := db.UpdateTransferConfig(config); err != nil {
+		return fmt.Errorf("failed to update config: %v", err)
+	}
+
+	// Get the rclone config path
+	configPath := db.GetConfigRclonePath(config)
+
+	// Read existing config if it exists
+	existingConfig := ""
+	if _, err := os.Stat(configPath); err == nil {
+		data, err := os.ReadFile(configPath)
+		if err != nil {
+			return fmt.Errorf("failed to read existing config: %v", err)
+		}
+		existingConfig = string(data)
+	}
+
+	// Ensure directory exists
+	configDir := filepath.Dir(configPath)
+	if err := os.MkdirAll(configDir, 0755); err != nil {
+		return fmt.Errorf("failed to create config directory: %v", err)
+	}
+
+	// Write the new config with the token
+	destName := fmt.Sprintf("dest_%d", config.ID)
+	newConfig := fmt.Sprintf("[%s]\ntype = drive\ntoken = %s\n", destName, token)
+
+	// If the config has client ID and secret, add them
+	if config.DestClientID != "" && config.DestClientSecret != "" {
+		newConfig += fmt.Sprintf("client_id = %s\nclient_secret = %s\n", config.DestClientID, config.DestClientSecret)
+	}
+
+	// Add root folder ID if specified
+	if config.DestDriveID != "" {
+		newConfig += fmt.Sprintf("root_folder_id = %s\n", config.DestDriveID)
+	}
+
+	// Add team drive if specified
+	if config.DestTeamDrive != "" {
+		newConfig += fmt.Sprintf("team_drive = %s\n", config.DestTeamDrive)
+	}
+
+	// If there's existing config, append to it; otherwise create new file
+	var content string
+	if existingConfig != "" {
+		// Replace/update existing dest section if it exists, otherwise append
+		if strings.Contains(existingConfig, fmt.Sprintf("[%s]", destName)) {
+			// This is a simplistic approach - in production you might want a more robust regex-based replacement
+			// Truncate at the beginning of the dest section
+			parts := strings.SplitN(existingConfig, fmt.Sprintf("[%s]", destName), 2)
+			// Check if there are more sections after this one
+			nextSectionIdx := strings.Index(parts[1], "[")
+			if nextSectionIdx != -1 {
+				content = parts[0] + newConfig + parts[1][nextSectionIdx:]
+			} else {
+				content = parts[0] + newConfig
+			}
+		} else {
+			content = existingConfig + "\n" + newConfig
+		}
+	} else {
+		content = newConfig
+	}
+
+	// Write the config file
+	if err := os.WriteFile(configPath, []byte(content), 0600); err != nil {
+		return fmt.Errorf("failed to write config: %v", err)
+	}
+
+	return nil
+}
+
+// GenerateRcloneConfigWithToken generates a rclone config file for a transfer config with a provided token
+func (db *DB) GenerateRcloneConfigWithToken(config *TransferConfig, token string) error {
+	// Get the config path
+	configPath := db.GetConfigRclonePath(config)
+	if configPath == "" {
+		return fmt.Errorf("failed to get config path")
+	}
+
+	// Clean up the token to ensure it's a single line JSON
+	token = strings.TrimSpace(token)
+	token = strings.ReplaceAll(token, "\n", "")
+	token = strings.ReplaceAll(token, "\r", "")
+
+	// Determine if this is a source or destination config
+	var configType, section, clientID, clientSecret string
+	var readOnly, includeArchived *bool
+	var startYear int
+
+	if config.DestinationType == "gdrive" || config.DestinationType == "gphotos" {
+		configType = config.DestinationType
+		section = "dest"
+		clientID = config.DestClientID
+		clientSecret = config.DestClientSecret
+		readOnly = config.DestReadOnly
+		startYear = config.DestStartYear
+		includeArchived = config.DestIncludeArchived
+	} else if config.SourceType == "gdrive" || config.SourceType == "gphotos" {
+		configType = config.SourceType
+		section = "source"
+		clientID = config.SourceClientID
+		clientSecret = config.SourceClientSecret
+		readOnly = config.SourceReadOnly
+		startYear = config.SourceStartYear
+		includeArchived = config.SourceIncludeArchived
+	} else {
+		return fmt.Errorf("config is not for Google Drive or Google Photos")
+	}
+
+	// Read the existing config
+	content, err := os.ReadFile(configPath)
+	if err != nil {
+		return fmt.Errorf("failed to read config file: %v", err)
+	}
+
+	// Prepare the section content
+	var sectionContent string
+	if configType == "gdrive" {
+		sectionContent = fmt.Sprintf("[%s_%d]\ntype = drive\n", section, config.ID)
+		if clientID != "" {
+			sectionContent += fmt.Sprintf("client_id = %s\n", clientID)
+		}
+		if clientSecret != "" {
+			sectionContent += fmt.Sprintf("client_secret = %s\n", clientSecret)
+		}
+		sectionContent += fmt.Sprintf("token = %s\n", token)
+
+		// Add team drive if specified
+		if section == "source" && config.SourceTeamDrive != "" {
+			sectionContent += fmt.Sprintf("team_drive = %s\n", config.SourceTeamDrive)
+		} else if section == "dest" && config.DestTeamDrive != "" {
+			sectionContent += fmt.Sprintf("team_drive = %s\n", config.DestTeamDrive)
+		}
+
+		// Add read-only flag if specified
+		if readOnly != nil && *readOnly {
+			sectionContent += "read_only = true\n"
+		}
+	} else if configType == "gphotos" {
+		sectionContent = fmt.Sprintf("[%s_%d]\ntype = google photos\n", section, config.ID)
+		if clientID != "" {
+			sectionContent += fmt.Sprintf("client_id = %s\n", clientID)
+		}
+		if clientSecret != "" {
+			sectionContent += fmt.Sprintf("client_secret = %s\n", clientSecret)
+		}
+		sectionContent += fmt.Sprintf("token = %s\n", token)
+
+		// Add read-only flag if specified
+		if readOnly != nil && *readOnly {
+			sectionContent += "read_only = true\n"
+		}
+
+		// Add start year if specified
+		if startYear > 0 {
+			sectionContent += fmt.Sprintf("start_year = %d\n", startYear)
+		}
+
+		// Add include_archived flag if specified and true
+		if includeArchived != nil && *includeArchived {
+			sectionContent += "include_archived = true\n"
+		}
+	}
+
+	// Find the section in the existing config
+	sectionPattern := regexp.MustCompile(fmt.Sprintf(`\[%s_%d\][^\[]*`, section, config.ID))
+	if sectionPattern.MatchString(string(content)) {
+		// Replace the existing section
+		newContent := sectionPattern.ReplaceAllString(string(content), sectionContent)
+		err = os.WriteFile(configPath, []byte(newContent), 0644)
+		if err != nil {
+			return fmt.Errorf("failed to write updated config file: %v", err)
+		}
+	} else {
+		// Append the section to the config
+		file, err := os.OpenFile(configPath, os.O_APPEND|os.O_WRONLY, 0644)
+		if err != nil {
+			return fmt.Errorf("failed to open config file for appending: %v", err)
+		}
+		defer file.Close()
+
+		_, err = file.WriteString("\n" + sectionContent)
+		if err != nil {
+			return fmt.Errorf("failed to append to config file: %v", err)
+		}
+	}
+
+	// Update the authentication status
+	authenticated := true
+	if config.DestinationType == "gdrive" || config.DestinationType == "gphotos" {
+		config.SetGoogleAuthenticated(authenticated)
+	} else if config.SourceType == "gdrive" || config.SourceType == "gphotos" {
+		config.SetGoogleAuthenticated(authenticated)
+	}
+
+	return nil
+}
+
+// GetIsAdmin returns the value of IsAdmin with a default if nil
+func (u *User) GetIsAdmin() bool {
+	if u.IsAdmin == nil {
+		return false // Default to false if not set
+	}
+	return *u.IsAdmin
+}
+
+// SetIsAdmin sets the IsAdmin field
+func (u *User) SetIsAdmin(value bool) {
+	u.IsAdmin = &value
+}
+
+// GetAccountLocked returns the value of AccountLocked with a default if nil
+func (u *User) GetAccountLocked() bool {
+	if u.AccountLocked == nil {
+		return false // Default to false if not set
+	}
+	return *u.AccountLocked
+}
+
+// SetAccountLocked sets the AccountLocked field
+func (u *User) SetAccountLocked(value bool) {
+	u.AccountLocked = &value
+}
+
+// GetUsed returns the value of Used with a default if nil
+func (t *PasswordResetToken) GetUsed() bool {
+	if t.Used == nil {
+		return false // Default to false if not set
+	}
+	return *t.Used
+}
+
+// SetUsed sets the Used field
+func (t *PasswordResetToken) SetUsed(value bool) {
+	t.Used = &value
+}
+
+// GetSourcePassiveMode returns the value of SourcePassiveMode with a default if nil
+func (tc *TransferConfig) GetSourcePassiveMode() bool {
+	if tc.SourcePassiveMode == nil {
+		return true // Default to true if not set
+	}
+	return *tc.SourcePassiveMode
+}
+
+// SetSourcePassiveMode sets the SourcePassiveMode field
+func (tc *TransferConfig) SetSourcePassiveMode(value bool) {
+	tc.SourcePassiveMode = &value
+}
+
+// GetDestPassiveMode returns the value of DestPassiveMode with a default if nil
+func (tc *TransferConfig) GetDestPassiveMode() bool {
+	if tc.DestPassiveMode == nil {
+		return true // Default to true if not set
+	}
+	return *tc.DestPassiveMode
+}
+
+// SetDestPassiveMode sets the DestPassiveMode field
+func (tc *TransferConfig) SetDestPassiveMode(value bool) {
+	tc.DestPassiveMode = &value
+}
+
+// GetGoogleDriveAuthenticated returns whether the transfer config has been authenticated with Google Drive
+func (tc *TransferConfig) GetGoogleDriveAuthenticated() bool {
+	return tc.GoogleDriveAuthenticated != nil && *tc.GoogleDriveAuthenticated
+}
+
+// SetGoogleDriveAuthenticated sets the Google Drive authentication status
+func (tc *TransferConfig) SetGoogleDriveAuthenticated(value bool) {
+	tc.GoogleDriveAuthenticated = &value
+}
+
+// GetGoogleAuthenticated is an alias for GetGoogleDriveAuthenticated for better semantics when working with Google Photos
+func (tc *TransferConfig) GetGoogleAuthenticated() bool {
+	return tc.GetGoogleDriveAuthenticated()
+}
+
+// SetGoogleAuthenticated is an alias for SetGoogleDriveAuthenticated for better semantics when working with Google Photos
+func (tc *TransferConfig) SetGoogleAuthenticated(value bool) {
+	tc.SetGoogleDriveAuthenticated(value)
+}
+
+// GetArchiveEnabled returns the value of ArchiveEnabled with a default if nil
+func (tc *TransferConfig) GetArchiveEnabled() bool {
+	if tc.ArchiveEnabled == nil {
+		return false // Default to false if not set
+	}
+	return *tc.ArchiveEnabled
+}
+
+// SetArchiveEnabled sets the ArchiveEnabled field
+func (tc *TransferConfig) SetArchiveEnabled(value bool) {
+	tc.ArchiveEnabled = &value
+}
+
+// GetDeleteAfterTransfer returns the value of DeleteAfterTransfer with a default if nil
+func (tc *TransferConfig) GetDeleteAfterTransfer() bool {
+	if tc.DeleteAfterTransfer == nil {
+		return false // Default to false if not set
+	}
+	return *tc.DeleteAfterTransfer
+}
+
+// SetDeleteAfterTransfer sets the DeleteAfterTransfer field
+func (tc *TransferConfig) SetDeleteAfterTransfer(value bool) {
+	tc.DeleteAfterTransfer = &value
+}
+
+// GetEnabled returns the value of Enabled with a default if nil
+func (j *Job) GetEnabled() bool {
+	if j.Enabled == nil {
+		return true // Default to true if not set
+	}
+	return *j.Enabled
+}
+
+// SetEnabled sets the Enabled field
+func (j *Job) SetEnabled(value bool) {
+	j.Enabled = &value
+}
+
+// GetWebhookEnabled returns the value of WebhookEnabled with a default if nil
+func (j *Job) GetWebhookEnabled() bool {
+	if j.WebhookEnabled == nil {
+		return false // Default to false if not set
+	}
+	return *j.WebhookEnabled
+}
+
+// SetWebhookEnabled sets the WebhookEnabled field
+func (j *Job) SetWebhookEnabled(value bool) {
+	j.WebhookEnabled = &value
+}
+
+// GetNotifyOnSuccess returns the value of NotifyOnSuccess with a default if nil
+func (j *Job) GetNotifyOnSuccess() bool {
+	if j.NotifyOnSuccess == nil {
+		return true // Default to true if not set
+	}
+	return *j.NotifyOnSuccess
+}
+
+// SetNotifyOnSuccess sets the NotifyOnSuccess field
+func (j *Job) SetNotifyOnSuccess(value bool) {
+	j.NotifyOnSuccess = &value
+}
+
+// GetNotifyOnFailure returns the value of NotifyOnFailure with a default if nil
+func (j *Job) GetNotifyOnFailure() bool {
+	if j.NotifyOnFailure == nil {
+		return true // Default to true if not set
+	}
+	return *j.NotifyOnFailure
+}
+
+// SetNotifyOnFailure sets the NotifyOnFailure field
+func (j *Job) SetNotifyOnFailure(value bool) {
+	j.NotifyOnFailure = &value
+}
+
+// GetGDriveCredentialsFromConfig extracts Google Drive client ID and secret from an existing rclone config file
+func (db *DB) GetGDriveCredentialsFromConfig(config *TransferConfig) (string, string) {
+	configPath := db.GetConfigRclonePath(config)
+	if configPath == "" {
+		return "", ""
+	}
+
+	// Check if the file exists
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		return "", ""
+	}
+
+	// Read the rclone config file
+	content, err := os.ReadFile(configPath)
+	if err != nil {
+		return "", ""
+	}
+
+	// Parse the content to extract client_id and client_secret from both source and destination sections
+	lines := strings.Split(string(content), "\n")
+
+	// Define section names based on config ID
+	sourceSectionName := fmt.Sprintf("[source_%d]", config.ID)
+	destSectionName := fmt.Sprintf("[dest_%d]", config.ID)
+
+	var inSourceSection, inDestSection bool
+	var sourceClientID, sourceClientSecret, destClientID, destClientSecret string
+
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+
+		// Check if we're entering a new section
+		if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") {
+			inSourceSection = line == sourceSectionName
+			inDestSection = line == destSectionName
+			continue
+		}
+
+		// Extract credentials from source section
+		if inSourceSection {
+			if strings.HasPrefix(line, "client_id") {
+				parts := strings.SplitN(line, "=", 2)
+				if len(parts) == 2 {
+					sourceClientID = strings.TrimSpace(parts[1])
+				}
+			} else if strings.HasPrefix(line, "client_secret") {
+				parts := strings.SplitN(line, "=", 2)
+				if len(parts) == 2 {
+					sourceClientSecret = strings.TrimSpace(parts[1])
+				}
+			}
+		}
+
+		// Extract credentials from destination section
+		if inDestSection {
+			if strings.HasPrefix(line, "client_id") {
+				parts := strings.SplitN(line, "=", 2)
+				if len(parts) == 2 {
+					destClientID = strings.TrimSpace(parts[1])
+				}
+			} else if strings.HasPrefix(line, "client_secret") {
+				parts := strings.SplitN(line, "=", 2)
+				if len(parts) == 2 {
+					destClientSecret = strings.TrimSpace(parts[1])
+				}
+			}
+		}
+
+		// If we found both values in both sections, we can stop processing
+		if sourceClientID != "" && sourceClientSecret != "" && destClientID != "" && destClientSecret != "" {
+			break
+		}
+	}
+
+	// Prefer destination credentials since we're authenticating for destination
+	if destClientID != "" && destClientSecret != "" {
+		return destClientID, destClientSecret
+	}
+
+	// Fall back to source credentials if available
+	if sourceClientID != "" && sourceClientSecret != "" {
+		return sourceClientID, sourceClientSecret
+	}
+
+	return "", ""
+}

internal/db/edge_cases_test.go

@@ -66,7 +66,7 @@ func TestDeleteTransferConfigEdgeCases(t *testing.T) {
 		Name:      "Job for Config",
 		ConfigID:  configWithJob.ID,
 		Schedule:  "0 * * * *",
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	err = db.CreateJob(job)
@@ -122,7 +122,7 @@ func TestDeleteJobEdgeCases(t *testing.T) {
 			Name:      fmt.Sprintf("Edge Job %d", i),
 			ConfigID:  config.ID,
 			Schedule:  "0 * * * *",
-			Enabled:   true,
+			Enabled:   BoolPtr(true),
 			CreatedBy: testUser.ID,
 		}
 		err = db.CreateJob(job)
@@ -145,7 +145,7 @@ func TestDeleteJobEdgeCases(t *testing.T) {
 		Name:      "Job with History",
 		ConfigID:  config.ID,
 		Schedule:  "0 * * * *",
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	err = db.CreateJob(jobWithHistory)

internal/db/error_handling_test.go

@@ -70,7 +70,7 @@ func TestGetPasswordResetTokenError(t *testing.T) {
 		UserID:    testUser.ID,
 		Token:     "used-token",
 		ExpiresAt: time.Now().Add(1 * time.Hour),
-		Used:      true,
+		Used:      BoolPtr(true),
 	}
 	err = db.CreatePasswordResetToken(usedToken)
 	assert.NoError(t, err)
@@ -131,7 +131,7 @@ func TestGenerateRcloneConfigErrors(t *testing.T) {
 	testUser := &User{
 		Email:              "config-error-test@example.com",
 		PasswordHash:       "hashed_password",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 

internal/db/initialization_test.go

@@ -66,7 +66,7 @@ func TestInitializeWithExistingDB(t *testing.T) {
 	user := &User{
 		Email:        "test@example.com",
 		PasswordHash: "hash",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err = db1.CreateUser(user)
 	assert.NoError(t, err)

internal/db/migrations/add_google_drive_authenticated.go

@@ -0,0 +1,21 @@
+package migrations
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+// AddGoogleDriveAuthenticated adds the GoogleDriveAuthenticated field to the transfer_configs table
+func AddGoogleDriveAuthenticated() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "20240315_add_google_drive_authenticated",
+		Migrate: func(tx *gorm.DB) error {
+			// Add the GoogleDriveAuthenticated column with a default value of false
+			return tx.Exec("ALTER TABLE transfer_configs ADD COLUMN google_drive_authenticated BOOLEAN DEFAULT false").Error
+		},
+		Rollback: func(tx *gorm.DB) error {
+			// Remove the GoogleDriveAuthenticated column
+			return tx.Exec("ALTER TABLE transfer_configs DROP COLUMN google_drive_authenticated").Error
+		},
+	}
+}

internal/db/migrations/add_google_photos_support.go

@@ -0,0 +1,61 @@
+package migrations
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+// AddGooglePhotosSupport adds Google Photos related fields to the transfer_configs table
+func AddGooglePhotosSupport() *gormigrate.Migration {
+	return &gormigrate.Migration{
+		ID: "20240518_add_google_photos_support",
+		Migrate: func(tx *gorm.DB) error {
+			// Add Google Photos source fields
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN source_read_only BOOLEAN DEFAULT false").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN source_start_year INTEGER DEFAULT 0").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN source_include_archived BOOLEAN DEFAULT false").Error; err != nil {
+				return err
+			}
+
+			// Add Google Photos destination fields
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN dest_read_only BOOLEAN DEFAULT false").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN dest_start_year INTEGER DEFAULT 0").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs ADD COLUMN dest_include_archived BOOLEAN DEFAULT false").Error; err != nil {
+				return err
+			}
+
+			// Add OAuth field
+			return tx.Exec("ALTER TABLE transfer_configs ADD COLUMN use_builtin_auth BOOLEAN DEFAULT true").Error
+		},
+		Rollback: func(tx *gorm.DB) error {
+			// Remove all added columns in reverse order
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN use_builtin_auth").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN dest_include_archived").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN dest_start_year").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN dest_read_only").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN source_include_archived").Error; err != nil {
+				return err
+			}
+			if err := tx.Exec("ALTER TABLE transfer_configs DROP COLUMN source_start_year").Error; err != nil {
+				return err
+			}
+			return tx.Exec("ALTER TABLE transfer_configs DROP COLUMN source_read_only").Error
+		},
+	}
+}

internal/db/migrations/migrations.go

@@ -16,6 +16,8 @@ func InitMigrations(db *gorm.DB) *gormigrate.Gormigrate {
 		AddMultiConfigSupport(),
 		UpdateSkipProcessedFilesToNullable(),
 		AddWebhookSupport(),
+		AddGoogleDriveAuthenticated(),
+		AddGooglePhotosSupport(),
 	}
 
 	return gormigrate.New(db, gormigrate.DefaultOptions, migrations)

internal/db/rclone_test.go

@@ -3,6 +3,7 @@ package db
 import (
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"testing"
 	"time"
@@ -135,3 +136,116 @@ func TestGenerateRcloneConfigWithoutRclone(t *testing.T) {
 		}
 	}
 }
+
+func TestGoogleDriveRcloneConfig(t *testing.T) {
+	// Skip if rclone not available
+	rclonePath := os.Getenv("RCLONE_PATH")
+	if rclonePath == "" {
+		rclonePath = "rclone" // default to PATH lookup
+	}
+	_, err := exec.Command(rclonePath, "--version").CombinedOutput()
+	if err != nil {
+		t.Skip("Skipping test as rclone is not available")
+	}
+
+	db := setupTestDB(t)
+
+	// Create a test user
+	testUser := &User{
+		Email:              fmt.Sprintf("google-rclone-test-%d@example.com", time.Now().UnixNano()),
+		PasswordHash:       "hashed_password",
+		LastPasswordChange: time.Now(),
+	}
+	err = db.CreateUser(testUser)
+	if err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	// Create Google Drive source config
+	googleSourceConfig := &TransferConfig{
+		Name:               "Google Drive Source Rclone Test",
+		SourceType:         "google_drive",
+		SourcePath:         "/path/in/google/drive",
+		SourceClientID:     "source_google_client_id",
+		SourceClientSecret: "source_google_client_secret",
+		SourceTeamDrive:    "source_team_drive_id",
+		DestinationType:    "local",
+		DestinationPath:    "/local/destination/path",
+		FilePattern:        "*.pdf",
+		CreatedBy:          testUser.ID,
+	}
+
+	// Set authenticated status
+	authenticated := true
+	googleSourceConfig.GoogleDriveAuthenticated = &authenticated
+
+	// Create the config
+	err = db.CreateTransferConfig(googleSourceConfig)
+	assert.NoError(t, err)
+
+	err = db.GenerateRcloneConfigWithToken(googleSourceConfig, "test_token")
+	assert.NoError(t, err)
+
+	// Generate rclone config for source
+	configPath := db.GetConfigRclonePath(googleSourceConfig)
+
+	// Check that the file exists
+	_, err = os.Stat(configPath)
+	assert.NoError(t, err, "Rclone config file should exist")
+
+	// Read the config file
+	configContent, err := os.ReadFile(configPath)
+	assert.NoError(t, err)
+	content := string(configContent)
+
+	// Verify it contains Google Drive specific content
+	assert.Contains(t, content, "type = drive")
+	assert.Contains(t, content, fmt.Sprintf("client_id = %s", googleSourceConfig.SourceClientID))
+	assert.Contains(t, content, "source")
+	assert.Contains(t, content, fmt.Sprintf("team_drive = %s", googleSourceConfig.SourceTeamDrive))
+
+	// Create Google Drive destination config
+	googleDestConfig := &TransferConfig{
+		Name:             "Google Drive Dest Rclone Test",
+		SourceType:       "local",
+		SourcePath:       "/local/source/path",
+		DestinationType:  "google_drive",
+		DestinationPath:  "/dest/path/in/google/drive",
+		DestClientID:     "dest_google_client_id",
+		DestClientSecret: "dest_google_client_secret",
+		DestTeamDrive:    "dest_team_drive_id",
+		FilePattern:      "*.pdf",
+		CreatedBy:        testUser.ID,
+	}
+
+	// Set authenticated status
+	googleDestConfig.GoogleDriveAuthenticated = &authenticated
+
+	// Create the config
+	err = db.CreateTransferConfig(googleDestConfig)
+	assert.NoError(t, err)
+
+	// Generate rclone config for destination
+	configPath = db.GetConfigRclonePath(googleDestConfig)
+
+	// Check that the file exists
+	_, err = os.Stat(configPath)
+	assert.NoError(t, err, "Rclone config file should exist")
+
+	// Read the config file
+	configContent, err = os.ReadFile(configPath)
+	assert.NoError(t, err)
+	content = string(configContent)
+
+	// Verify it contains Google Drive specific content
+	assert.Contains(t, content, "type = drive")
+	assert.Contains(t, content, fmt.Sprintf("client_id = %s", googleDestConfig.DestClientID))
+	assert.Contains(t, content, "dest")
+	assert.Contains(t, content, fmt.Sprintf("team_drive = %s", googleDestConfig.DestTeamDrive))
+
+	// Clean up
+	err = db.Delete(&googleSourceConfig).Error
+	assert.NoError(t, err)
+	err = db.Delete(&googleDestConfig).Error
+	assert.NoError(t, err)
+}

internal/db/transaction_test.go

@@ -117,7 +117,7 @@ func TestDeleteJobWithTransaction(t *testing.T) {
 		Name:      "Test Delete Job",
 		ConfigID:  testConfig.ID,
 		Schedule:  "0 * * * *", // Run hourly
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	err = db.CreateJob(testJob)
@@ -137,7 +137,7 @@ func TestDeleteJobWithTransaction(t *testing.T) {
 		Name:      "Test Delete Job 2",
 		ConfigID:  testConfig.ID,
 		Schedule:  "0 * * * *", // Run hourly
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	err = db.CreateJob(testJob2)

internal/scheduler/mock_scheduler.go

@@ -31,7 +31,7 @@ func (m *MockScheduler) ScheduleJob(job *db.Job) error {
 		return m.ScheduleJobErr
 	}
 
-	if job.Enabled {
+	if job.GetEnabled() {
 		m.ScheduledJobs[job.ID] = true
 		delete(m.UnscheduledJobs, job.ID)
 	} else {

internal/scheduler/mock_scheduler_test.go

@@ -17,8 +17,8 @@ func TestMockScheduler_MultiConfig(t *testing.T) {
 		Name:     "Multi-Config Test Job",
 		Schedule: "*/5 * * * *",
 		ConfigID: 1, // Primary config ID
-		Enabled:  true,
 	}
+	job.SetEnabled(true)
 
 	// Set multiple config IDs
 	job.SetConfigIDsList([]uint{1, 2, 3})
@@ -55,8 +55,8 @@ func TestMockScheduler_MultiConfig(t *testing.T) {
 		Name:     "Single Config Job",
 		Schedule: "0 0 * * *",
 		ConfigID: 4,
-		Enabled:  true,
 	}
+	singleConfigJob.SetEnabled(true)
 
 	// Set a single config ID
 	singleConfigJob.SetConfigIDsList([]uint{4})

internal/scheduler/scheduler.go

@@ -241,7 +241,7 @@ func (s *Scheduler) loadJobs() {
 
 	for _, job := range jobs {
 		// Skip disabled jobs
-		if !job.Enabled {
+		if !job.GetEnabled() {
 			s.log.LogInfo("Job %d (%s) is disabled, skipping scheduling", job.ID, job.Name)
 			continue
 		}
@@ -268,7 +268,7 @@ func (s *Scheduler) ScheduleJob(job *db.Job) error {
 	}
 
 	// Only schedule if job is enabled
-	if !job.Enabled {
+	if !job.GetEnabled() {
 		s.log.LogInfo("Job %d is disabled, skipping scheduling", job.ID)
 		return nil
 	}
@@ -535,6 +535,12 @@ func (s *Scheduler) executeConfigTransfer(job db.Job, config db.TransferConfig,
 	if maxConcurrent < 1 {
 		maxConcurrent = 1 // Default to 1 if not set
 	}
+
+	// Limit Google Photos to 1 concurrent transfers
+	if config.SourceType == "gphotos" || config.DestinationType == "gphotos" {
+		maxConcurrent = 1
+	}
+
 	s.log.LogInfo("Using %d concurrent transfers for job %d, config %d", maxConcurrent, job.ID, config.ID)
 
 	// Create wait group for concurrent processing
@@ -783,7 +789,7 @@ func (s *Scheduler) executeConfigTransfer(job db.Job, config db.TransferConfig,
 				}
 
 				// If archiving is enabled and transfer was successful, move files to archive
-				if config.ArchiveEnabled && config.ArchivePath != "" {
+				if config.GetArchiveEnabled() && config.ArchivePath != "" {
 					s.log.LogInfo("Archiving file %s for job %d, config %d", currentFileName, job.ID, config.ID)
 
 					// We don't need to move the file since we used moveto, but we can copy it to archive
@@ -828,7 +834,7 @@ func (s *Scheduler) executeConfigTransfer(job db.Job, config db.TransferConfig,
 					}
 				}
 
-				if config.DeleteAfterTransfer {
+				if config.GetDeleteAfterTransfer() {
 					s.log.LogInfo("Deleting file %s for job %d, config %d", currentFileName, job.ID, config.ID)
 					deleteArgs := []string{
 						"--config", configPath,
@@ -1026,15 +1032,15 @@ func (s *Scheduler) checkFileProcessingHistory(jobID uint, fileName string) (*db
 
 // sendWebhookNotification sends a notification to the configured webhook URL
 func (s *Scheduler) sendWebhookNotification(job *db.Job, history *db.JobHistory, config *db.TransferConfig) {
-	if !job.WebhookEnabled || job.WebhookURL == "" {
+	if !job.GetWebhookEnabled() || job.WebhookURL == "" {
 		return
 	}
 
 	// Skip notifications based on settings
-	if history.Status == "completed" && !job.NotifyOnSuccess {
+	if history.Status == "completed" && !job.GetNotifyOnSuccess() {
 		return
 	}
-	if history.Status == "failed" && !job.NotifyOnFailure {
+	if history.Status == "failed" && !job.GetNotifyOnFailure() {
 		return
 	}
 

internal/scheduler/scheduler_test.go

@@ -151,7 +151,7 @@ func TestScheduler_ScheduleJob(t *testing.T) {
 	user := &db.User{
 		Email:        "test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)
@@ -175,7 +175,7 @@ func TestScheduler_ScheduleJob(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job).Error; err != nil {
@@ -207,11 +207,8 @@ func TestScheduler_ScheduleJob(t *testing.T) {
 		t.Errorf("Expected NextRun to be set, got nil")
 	}
 
-	// Test scheduling a disabled job
-	job.Enabled = false
-	if err := scheduler.ScheduleJob(job); err != nil {
-		t.Fatalf("Failed to schedule disabled job: %v", err)
-	}
+	// Disable the job
+	job.SetEnabled(false)
 
 	// Check that the disabled job was not scheduled
 	scheduler.jobMutex.Lock()
@@ -222,8 +219,10 @@ func TestScheduler_ScheduleJob(t *testing.T) {
 		t.Errorf("Expected disabled job not to be scheduled, but it was")
 	}
 
+	// Re-enable the job
+	job.SetEnabled(true)
+
 	// Test with invalid cron expression
-	job.Enabled = true
 	job.Schedule = "invalid cron"
 	if err := scheduler.ScheduleJob(job); err == nil {
 		t.Errorf("Expected error for invalid cron expression, got nil")
@@ -399,7 +398,7 @@ func TestRunJobNow(t *testing.T) {
 	// Create a test user
 	user := &db.User{
 		Email:     "test_runjob@example.com",
-		IsAdmin:   false,
+		IsAdmin:   BoolPtr(false),
 		CreatedAt: time.Now(),
 		UpdatedAt: time.Now(),
 	}
@@ -423,7 +422,7 @@ func TestRunJobNow(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	err = database.Create(job).Error
@@ -481,7 +480,7 @@ func TestHasFileBeenProcessed(t *testing.T) {
 	// Create a test user
 	user := &db.User{
 		Email:     "test_fileprocessed@example.com",
-		IsAdmin:   false,
+		IsAdmin:   BoolPtr(false),
 		CreatedAt: time.Now(),
 		UpdatedAt: time.Now(),
 	}
@@ -505,7 +504,7 @@ func TestHasFileBeenProcessed(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	err = database.Create(job).Error
@@ -568,7 +567,7 @@ func TestCheckFileProcessingHistory(t *testing.T) {
 	// Create a test user
 	user := &db.User{
 		Email:     "test_filehistory@example.com",
-		IsAdmin:   false,
+		IsAdmin:   BoolPtr(false),
 		CreatedAt: time.Now(),
 		UpdatedAt: time.Now(),
 	}
@@ -592,7 +591,7 @@ func TestCheckFileProcessingHistory(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	err = database.Create(job).Error
@@ -654,7 +653,7 @@ func TestUnscheduleJob(t *testing.T) {
 	user := &db.User{
 		Email:        "unschedule-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)
@@ -678,7 +677,7 @@ func TestUnscheduleJob(t *testing.T) {
 		Name:      "Test Job 1",
 		Schedule:  "*/15 * * * *", // Every 15 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job1).Error; err != nil {
@@ -689,7 +688,7 @@ func TestUnscheduleJob(t *testing.T) {
 		Name:      "Test Job 2",
 		Schedule:  "0 */2 * * *", // Every 2 hours
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job2).Error; err != nil {
@@ -854,7 +853,7 @@ func TestStopScheduler(t *testing.T) {
 	user := &db.User{
 		Email:        "stop-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)
@@ -878,7 +877,7 @@ func TestStopScheduler(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/1 * * * *", // Every minute
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job).Error; err != nil {
@@ -941,7 +940,7 @@ func TestFileProcessingFullCycle(t *testing.T) {
 	user := &db.User{
 		Email:        "file-processing-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)
@@ -966,7 +965,7 @@ func TestFileProcessingFullCycle(t *testing.T) {
 		Name:      "File Processing Test Job",
 		Schedule:  "*/30 * * * *", // Every 30 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job).Error; err != nil {
@@ -1051,7 +1050,7 @@ func TestExecuteJobWithMultipleConfigs(t *testing.T) {
 	user := &db.User{
 		Email:        "multi-config-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)
@@ -1098,7 +1097,7 @@ func TestExecuteJobWithMultipleConfigs(t *testing.T) {
 	job := &db.Job{
 		Name:      "Multi-Config Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 
@@ -1195,7 +1194,7 @@ func TestScheduler_LoadMultiConfigJobs(t *testing.T) {
 	user := &db.User{
 		Email:              "multiconfig-test@example.com",
 		PasswordHash:       "hashed_password",
-		IsAdmin:            true,
+		IsAdmin:            BoolPtr(true),
 		LastPasswordChange: time.Now(),
 	}
 	if err := database.CreateUser(user); err != nil {
@@ -1212,7 +1211,7 @@ func TestScheduler_LoadMultiConfigJobs(t *testing.T) {
 	job1 := &db.Job{
 		Name:      "Multi-Config Job 1",
 		Schedule:  "*/5 * * * *",
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	job1.SetConfigIDsList([]uint{config1.ID, config2.ID})
@@ -1225,7 +1224,7 @@ func TestScheduler_LoadMultiConfigJobs(t *testing.T) {
 	job2 := &db.Job{
 		Name:      "Multi-Config Job 2",
 		Schedule:  "0 * * * *",
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	job2.SetConfigIDsList([]uint{config3.ID, config4.ID})
@@ -1239,7 +1238,7 @@ func TestScheduler_LoadMultiConfigJobs(t *testing.T) {
 		Name:      "Single-Config Job",
 		Schedule:  "0 0 * * *",
 		ConfigID:  config1.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	err = database.DB.Create(job3).Error
@@ -1312,3 +1311,7 @@ func TestScheduler_LoadMultiConfigJobs(t *testing.T) {
 func boolPtr(b bool) *bool {
 	return &b
 }
+
+func BoolPtr(b bool) *bool {
+	return &b
+}

internal/scheduler/webhook_integration_test.go

@@ -38,7 +38,7 @@ func TestJobExecutionWebhook(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-integration@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -96,11 +96,11 @@ func TestJobExecutionWebhook(t *testing.T) {
 		Name:            "Webhook Integration Job",
 		ConfigID:        config.ID,
 		Schedule:        "*/5 * * * *", // not actually used in this test
-		Enabled:         true,
-		WebhookEnabled:  true,
+		Enabled:         BoolPtr(true),
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      mockServer.URL,
-		NotifyOnSuccess: true,
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(true),
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 	}
 	err = database.DB.Create(job).Error
@@ -259,7 +259,7 @@ func TestFailedJobWebhook(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-failure@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -314,11 +314,11 @@ func TestFailedJobWebhook(t *testing.T) {
 		Name:            "Webhook Failure Job",
 		ConfigID:        config.ID,
 		Schedule:        "*/5 * * * *", // not actually used in this test
-		Enabled:         true,
-		WebhookEnabled:  true,
+		Enabled:         BoolPtr(true),
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      mockServer.URL,
-		NotifyOnSuccess: true,
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(true),
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 	}
 	err = database.DB.Create(job).Error
@@ -431,7 +431,7 @@ func TestWebhookDisabledForSuccessNotification(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-disabled@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -476,11 +476,11 @@ func TestWebhookDisabledForSuccessNotification(t *testing.T) {
 		Name:            "Webhook Disabled Job",
 		ConfigID:        config.ID,
 		Schedule:        "*/5 * * * *", // not actually used in this test
-		Enabled:         true,
-		WebhookEnabled:  true,
+		Enabled:         BoolPtr(true),
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      mockServer.URL,
-		NotifyOnSuccess: false, // This is the key setting we're testing
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(false), // This is the key setting we're testing
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 	}
 	err = database.DB.Create(job).Error

internal/scheduler/webhook_test.go

@@ -35,7 +35,7 @@ func TestWebhookNotification(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -110,10 +110,10 @@ func TestWebhookNotification(t *testing.T) {
 			job: &db.Job{
 				Name:            "Success Job",
 				ConfigID:        config.ID,
-				WebhookEnabled:  true,
+				WebhookEnabled:  BoolPtr(true),
 				WebhookURL:      mockServer.URL,
-				NotifyOnSuccess: true,
-				NotifyOnFailure: true,
+				NotifyOnSuccess: BoolPtr(true),
+				NotifyOnFailure: BoolPtr(true),
 				CreatedBy:       user.ID,
 			},
 			history: &db.JobHistory{
@@ -135,10 +135,10 @@ func TestWebhookNotification(t *testing.T) {
 			job: &db.Job{
 				Name:            "Failed Job",
 				ConfigID:        config.ID,
-				WebhookEnabled:  true,
+				WebhookEnabled:  BoolPtr(true),
 				WebhookURL:      mockServer.URL,
-				NotifyOnSuccess: true,
-				NotifyOnFailure: true,
+				NotifyOnSuccess: BoolPtr(true),
+				NotifyOnFailure: BoolPtr(true),
 				CreatedBy:       user.ID,
 			},
 			history: &db.JobHistory{
@@ -159,10 +159,10 @@ func TestWebhookNotification(t *testing.T) {
 			job: &db.Job{
 				Name:            "Success Job No Notify",
 				ConfigID:        config.ID,
-				WebhookEnabled:  true,
+				WebhookEnabled:  BoolPtr(true),
 				WebhookURL:      mockServer.URL,
-				NotifyOnSuccess: false,
-				NotifyOnFailure: true,
+				NotifyOnSuccess: BoolPtr(false),
+				NotifyOnFailure: BoolPtr(true),
 				CreatedBy:       user.ID,
 			},
 			history: &db.JobHistory{
@@ -182,10 +182,10 @@ func TestWebhookNotification(t *testing.T) {
 			job: &db.Job{
 				Name:            "Failed Job No Notify",
 				ConfigID:        config.ID,
-				WebhookEnabled:  true,
+				WebhookEnabled:  BoolPtr(true),
 				WebhookURL:      mockServer.URL,
-				NotifyOnSuccess: true,
-				NotifyOnFailure: false,
+				NotifyOnSuccess: BoolPtr(true),
+				NotifyOnFailure: BoolPtr(false),
 				CreatedBy:       user.ID,
 			},
 			history: &db.JobHistory{
@@ -206,10 +206,10 @@ func TestWebhookNotification(t *testing.T) {
 			job: &db.Job{
 				Name:            "Webhook Disabled",
 				ConfigID:        config.ID,
-				WebhookEnabled:  false,
+				WebhookEnabled:  BoolPtr(true),
 				WebhookURL:      mockServer.URL,
-				NotifyOnSuccess: true,
-				NotifyOnFailure: true,
+				NotifyOnSuccess: BoolPtr(true),
+				NotifyOnFailure: BoolPtr(true),
 				CreatedBy:       user.ID,
 			},
 			history: &db.JobHistory{
@@ -244,10 +244,10 @@ func TestWebhookNotification(t *testing.T) {
 			job := &db.Job{
 				Name:            tc.job.Name,
 				ConfigID:        tc.job.ConfigID,
-				WebhookEnabled:  tc.webhookEnabled,
+				WebhookEnabled:  BoolPtr(tc.webhookEnabled),
 				WebhookURL:      tc.webhookURL,
-				NotifyOnSuccess: tc.notifyOnSuccess,
-				NotifyOnFailure: tc.notifyOnFailure,
+				NotifyOnSuccess: BoolPtr(tc.notifyOnSuccess),
+				NotifyOnFailure: BoolPtr(tc.notifyOnFailure),
 				CreatedBy:       tc.job.CreatedBy,
 			}
 
@@ -366,7 +366,7 @@ func TestWebhookAuthentication(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-auth-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -413,11 +413,11 @@ func TestWebhookAuthentication(t *testing.T) {
 	job := &db.Job{
 		Name:            "Auth Test Job",
 		ConfigID:        config.ID,
-		WebhookEnabled:  true,
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      mockServer.URL,
 		WebhookSecret:   secret,
-		NotifyOnSuccess: true,
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(true),
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 	}
 	err = database.DB.Create(job).Error
@@ -492,7 +492,7 @@ func TestWebhookCustomHeaders(t *testing.T) {
 	user := &db.User{
 		Email:        "webhook-headers-test@example.com",
 		PasswordHash: "hashed_password",
-		IsAdmin:      true,
+		IsAdmin:      BoolPtr(true),
 	}
 	err := database.CreateUser(user)
 	require.NoError(t, err)
@@ -548,11 +548,11 @@ func TestWebhookCustomHeaders(t *testing.T) {
 	job := &db.Job{
 		Name:            "Custom Headers Test Job",
 		ConfigID:        config.ID,
-		WebhookEnabled:  true,
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      mockServer.URL,
 		WebhookHeaders:  string(customHeadersJSON),
-		NotifyOnSuccess: true,
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(true),
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 	}
 	err = database.DB.Create(job).Error

internal/testutils/testutils.go

@@ -66,9 +66,9 @@ func CreateTestUser(t *testing.T, database *db.DB, email string, isAdmin bool) *
 	user := &db.User{
 		Email:              email,
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            isAdmin,
 		LastPasswordChange: time.Now(),
 	}
+	user.SetIsAdmin(isAdmin)
 
 	if err := database.CreateUser(user); err != nil {
 		t.Fatalf("Failed to create test user: %v", err)

internal/web/handlers/admin_tools_handlers.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -331,7 +330,7 @@ func (h *Handlers) HandleImportConfigs(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -370,7 +369,7 @@ func (h *Handlers) HandleImportJobs(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -401,7 +400,7 @@ func (h *Handlers) HandleImportJobs(c *gin.Context) {
 		}
 
 		if enabled, ok := rawJob["enabled"].(bool); ok {
-			job.Enabled = enabled
+			job.SetEnabled(enabled)
 		}
 
 		// Handle config_id
@@ -443,7 +442,7 @@ func (h *Handlers) HandleListBackups(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -466,7 +465,7 @@ func (h *Handlers) HandleSystemInfo(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -494,7 +493,7 @@ func (h *Handlers) HandleImportJobsFromFile(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -547,7 +546,7 @@ func (h *Handlers) HandleImportJobsFromFile(c *gin.Context) {
 		}
 
 		if enabled, ok := rawJob["enabled"].(bool); ok {
-			job.Enabled = enabled
+			job.SetEnabled(enabled)
 		}
 
 		// Handle config_id
@@ -589,7 +588,7 @@ func (h *Handlers) HandleDeleteLogFile(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -641,7 +640,7 @@ func (h *Handlers) HandleSystemMaintenanceCheck(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -682,7 +681,7 @@ func (h *Handlers) HandleUpdateSystemSettings(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}
@@ -736,7 +735,12 @@ func (h *Handlers) checkDatabaseSize() map[string]interface{} {
 	// Parse size for comparison
 	var size float64
 	var unit string
-	fmt.Sscanf(sizeStr, "%f %s", &size, &unit)
+	if _, err := fmt.Sscanf(sizeStr, "%f %s", &size, &unit); err != nil {
+		return map[string]interface{}{
+			"status":  "unknown",
+			"message": "Unable to determine database size",
+		}
+	}
 
 	status := "healthy"
 	message := fmt.Sprintf("Database size is %s", sizeStr)
@@ -1139,7 +1143,7 @@ func (h *Handlers) getLogFiles() []components.LogFile {
 	}
 
 	// Try to read directory
-	files, err := ioutil.ReadDir(logsDir)
+	files, err := os.ReadDir(logsDir)
 	if err != nil {
 		return []components.LogFile{}
 	}
@@ -1156,11 +1160,16 @@ func (h *Handlers) getLogFiles() []components.LogFile {
 			continue
 		}
 
-		size := formatSize(float64(file.Size()))
+		fileInfo, err := file.Info()
+		if err != nil {
+			continue
+		}
+
+		size := formatSize(float64(fileInfo.Size()))
 		logFiles = append(logFiles, components.LogFile{
 			Name:    file.Name(),
 			Size:    size,
-			ModTime: file.ModTime(),
+			ModTime: fileInfo.ModTime(),
 			Path:    filepath.Join(logsDir, file.Name()),
 		})
 	}
@@ -1203,7 +1212,7 @@ func (h *Handlers) HandleViewLog(c *gin.Context) {
 	}
 
 	// Read file contents
-	content, err := ioutil.ReadFile(filePath)
+	content, err := os.ReadFile(filePath)
 	if err != nil {
 		c.String(http.StatusInternalServerError, "Error reading log file: "+err.Error())
 		return
@@ -1316,7 +1325,7 @@ func (h *Handlers) HandleImportConfigsFromFile(c *gin.Context) {
 	}
 
 	userObj, ok := user.(*db.User)
-	if !ok || !userObj.IsAdmin {
+	if !ok || !userObj.GetIsAdmin() {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
 		return
 	}

internal/web/handlers/admin_tools_handlers_test.go

@@ -36,7 +36,7 @@ func TestHandleAdminTools(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Create a test request
@@ -81,7 +81,7 @@ func TestHandleBackupDatabase(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user
@@ -131,7 +131,7 @@ func TestHandleVacuumDatabase(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user
@@ -186,7 +186,7 @@ func TestHandleClearJobHistory(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user
@@ -228,7 +228,7 @@ func TestHandleExportConfigs(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	config := &db.TransferConfig{
@@ -267,8 +267,7 @@ func TestHandleExportConfigs(t *testing.T) {
 
 	// Parse the response as JSON
 	var configs []map[string]interface{}
-	var err error
-	err = json.Unmarshal(w.Body.Bytes(), &configs)
+	var err = json.Unmarshal(w.Body.Bytes(), &configs)
 	assert.NoError(t, err)
 	assert.Greater(t, len(configs), 0)
 }
@@ -281,7 +280,7 @@ func TestHandleExportJobs(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Create a test config
@@ -301,7 +300,7 @@ func TestHandleExportJobs(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *", // Every 5 minutes
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	handlers.DB.DB.Create(job)
@@ -332,8 +331,7 @@ func TestHandleExportJobs(t *testing.T) {
 
 	// Parse the response as JSON
 	var jobs []map[string]interface{}
-	var err error
-	err = json.Unmarshal(w.Body.Bytes(), &jobs)
+	var err = json.Unmarshal(w.Body.Bytes(), &jobs)
 	assert.NoError(t, err)
 	assert.Greater(t, len(jobs), 0)
 }
@@ -346,7 +344,7 @@ func TestHandleImportConfigs(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the route
@@ -407,7 +405,7 @@ func TestHandleImportJobs(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -481,7 +479,7 @@ func TestHandleExportConfigsUnauthorized(t *testing.T) {
 	testUser := &db.User{
 		ID:      2,
 		Email:   "user@example.com",
-		IsAdmin: false,
+		IsAdmin: BoolPtr(false),
 	}
 
 	// Set up the context with the non-admin user
@@ -519,7 +517,7 @@ func TestHandleBackupDatabaseError(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user
@@ -589,7 +587,7 @@ func TestHandleListBackups(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -636,7 +634,7 @@ func TestHandleSystemInfo(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -705,7 +703,7 @@ func TestHandleImportConfigsFromFile(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the route
@@ -768,7 +766,7 @@ func TestHandleImportJobsFromFile(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -868,7 +866,7 @@ func TestHandleImportConfigsInvalidJSON(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -937,7 +935,7 @@ func TestHandleDeleteLogFile(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -982,7 +980,7 @@ func TestHandleSystemMaintenanceCheck(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - this must be done BEFORE registering the routes
@@ -1024,7 +1022,7 @@ func TestHandleUpdateSystemSettings(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1088,7 +1086,7 @@ func TestHandleViewLog(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1134,7 +1132,7 @@ func TestHandleViewLogNotFound(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1187,7 +1185,7 @@ func TestHandleDownloadLog(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1241,7 +1239,7 @@ func TestHandleDeleteBackup(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1301,7 +1299,7 @@ func TestHandleDownloadBackup(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1353,7 +1351,7 @@ func TestHandleRefreshLogs(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes
@@ -1414,7 +1412,7 @@ func TestHandleRefreshBackups(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up the context with the user - must be done BEFORE registering routes

internal/web/handlers/api_handlers.go

@@ -35,7 +35,7 @@ func (h *Handlers) HandleAPILogin(c *gin.Context) {
 	}
 
 	// Generate JWT token
-	token, err := h.GenerateJWT(user.ID, user.Email, user.IsAdmin)
+	token, err := h.GenerateJWT(user.ID, user.Email, user.GetIsAdmin())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate token"})
 		return

internal/web/handlers/api_handlers_test.go

@@ -26,7 +26,7 @@ func setupAPITest(t *testing.T) (*Handlers, *gin.Engine, *db.DB, *db.User) {
 	user := &db.User{
 		Email:              "test@example.com",
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(user)
@@ -52,10 +52,7 @@ func setupAuthenticatedAPITest(t *testing.T, isAdmin bool) (*Handlers, *gin.Engi
 	handlers, router, database, user := setupAPITest(t)
 
 	// Update user admin status if needed
-	if isAdmin != user.IsAdmin {
-		user.IsAdmin = isAdmin
-		database.Save(user)
-	}
+	user.SetIsAdmin(isAdmin)
 
 	// Set up authentication middleware
 	router.Use(func(c *gin.Context) {
@@ -162,7 +159,7 @@ func TestHandleAPIConfigs(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -242,7 +239,7 @@ func TestHandleAPIConfig(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -376,7 +373,7 @@ func TestHandleAPIUpdateConfig(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -483,7 +480,7 @@ func TestHandleAPIDeleteConfig(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -513,7 +510,7 @@ func TestHandleAPIDeleteConfig(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "* * * * *",
 		ConfigID:  configWithJob.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -591,7 +588,7 @@ func TestHandleAPIRunJob(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "* * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -600,7 +597,7 @@ func TestHandleAPIRunJob(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -609,7 +606,7 @@ func TestHandleAPIRunJob(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "* * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)

internal/web/handlers/auth_handlers.go

@@ -17,6 +17,15 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
+// Define a custom type for context keys to avoid string collisions
+type contextKey string
+
+// Context keys
+const (
+	themeKey contextKey = "theme"
+	emailKey contextKey = "email"
+)
+
 // AuthMiddleware is a middleware function that checks if the user is authenticated
 func (h *Handlers) AuthMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
@@ -152,16 +161,16 @@ func (h *Handlers) HandleLoginPage(c *gin.Context) {
 		c.Redirect(http.StatusFound, "/dashboard")
 		return
 	}
-	
+
 	// Create template context and set email if available
 	ctx := components.CreateTemplateContext(c)
 	if email, exists := c.Get("email"); exists {
-		ctx = context.WithValue(ctx, "email", email)
+		ctx = context.WithValue(ctx, emailKey, email)
 	}
-	
+
 	// Check for message query param (used for password expired, etc.)
 	message := c.Query("message")
-	
+
 	// User is not logged in, show login page
 	if message != "" {
 		components.Login(ctx, message).Render(c.Request.Context(), c.Writer)
@@ -183,10 +192,10 @@ func (h *Handlers) HandleLogin(c *gin.Context) {
 	}
 
 	// Check if account is locked
-	if user.AccountLocked {
+	if user.GetAccountLocked() {
 		if user.LockoutUntil != nil && time.Now().After(*user.LockoutUntil) {
 			// Lockout period has expired, reset the lockout
-			user.AccountLocked = false
+			user.SetAccountLocked(false)
 			user.FailedLoginAttempts = 0
 			user.LockoutUntil = nil
 			h.DB.Save(&user)
@@ -201,18 +210,18 @@ func (h *Handlers) HandleLogin(c *gin.Context) {
 	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
 		// Increment failed login attempts
 		user.FailedLoginAttempts++
-		
+
 		// Check if we need to lock the account
 		policy := auth.DefaultPasswordPolicy()
 		if user.FailedLoginAttempts >= policy.MaxLoginAttempts {
-			user.AccountLocked = true
+			user.SetAccountLocked(true)
 			lockoutTime := time.Now().Add(policy.LockoutDuration)
 			user.LockoutUntil = &lockoutTime
 			h.DB.Save(&user)
 			components.Login(components.CreateTemplateContext(c), "Account is locked due to too many failed login attempts. Please try again later.").Render(c, c.Writer)
 			return
 		}
-		
+
 		h.DB.Save(&user)
 		components.Login(components.CreateTemplateContext(c), "Invalid credentials").Render(c, c.Writer)
 		return
@@ -220,7 +229,7 @@ func (h *Handlers) HandleLogin(c *gin.Context) {
 
 	// Reset failed login attempts on successful login
 	user.FailedLoginAttempts = 0
-	user.AccountLocked = false
+	user.SetAccountLocked(false)
 	user.LockoutUntil = nil
 	h.DB.Save(&user)
 
@@ -276,7 +285,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		c.Redirect(http.StatusFound, "/login")
 		return
 	}
-	
+
 	claims, err := auth.ValidateToken(tokenCookie, h.JWTSecret)
 	if err != nil {
 		if c.GetHeader("HX-Request") == "true" {
@@ -290,12 +299,12 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		return
 	}
 	userID := claims.UserID
-	
+
 	// Get form values
 	currentPassword := c.PostForm("current_password")
 	newPassword := c.PostForm("new_password")
 	confirmPassword := c.PostForm("confirm_password")
-	
+
 	// Validate new password matches confirmation
 	if newPassword != confirmPassword {
 		c.Data(http.StatusOK, "text/html", []byte(`<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-4" role="alert">
@@ -303,7 +312,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Get user
 	var user db.User
 	if err := h.DB.First(&user, userID).Error; err != nil {
@@ -312,7 +321,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Verify current password
 	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)) != nil {
 		c.Data(http.StatusOK, "text/html", []byte(`<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-4" role="alert">
@@ -320,7 +329,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Validate password against policy
 	policy := auth.DefaultPasswordPolicy()
 	if err := auth.ValidatePassword(newPassword, policy); err != nil {
@@ -330,7 +339,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		c.Data(http.StatusOK, "text/html", []byte(errorMsg))
 		return
 	}
-	
+
 	// Check password history
 	if err := auth.CheckPasswordHistory(user.ID, newPassword, user.PasswordHash, h.DB.DB, policy); err != nil {
 		errorMsg := `<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-4" role="alert">
@@ -339,7 +348,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		c.Data(http.StatusOK, "text/html", []byte(errorMsg))
 		return
 	}
-	
+
 	// Hash the new password
 	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
 	if err != nil {
@@ -348,7 +357,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Update password history
 	if err := auth.UpdatePasswordHistory(user.ID, string(hashedPassword), h.DB.DB, policy); err != nil {
 		c.Data(http.StatusOK, "text/html", []byte(`<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded mb-4" role="alert">
@@ -356,7 +365,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Update user's password
 	user.PasswordHash = string(hashedPassword)
 	user.LastPasswordChange = time.Now()
@@ -366,7 +375,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 		</div>`))
 		return
 	}
-	
+
 	// Return success message
 	c.Data(http.StatusOK, "text/html", []byte(`<div class="bg-green-100 border border-green-400 text-green-700 px-4 py-3 rounded mb-4" role="alert">
 		<span class="block sm:inline">Password updated successfully!</span>
@@ -375,7 +384,7 @@ func (h *Handlers) HandleChangePassword(c *gin.Context) {
 
 // HandleForgotPasswordPage displays the forgot password form
 func (h *Handlers) HandleForgotPasswordPage(c *gin.Context) {
-	ctx := context.WithValue(c.Request.Context(), "theme", "light")
+	ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 	components.ForgotPassword(ctx, "", "").Render(c.Request.Context(), c.Writer)
 }
 
@@ -383,7 +392,7 @@ func (h *Handlers) HandleForgotPasswordPage(c *gin.Context) {
 func (h *Handlers) HandleForgotPassword(c *gin.Context) {
 	email := c.PostForm("email")
 	if email == "" {
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ForgotPassword(ctx, "Email is required", "").Render(c.Request.Context(), c.Writer)
 		return
 	}
@@ -394,7 +403,7 @@ func (h *Handlers) HandleForgotPassword(c *gin.Context) {
 		// Don't reveal that the email doesn't exist for security reasons
 		// But we'll log it for debugging
 		log.Printf("Password reset requested for non-existent email: %s", email)
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ForgotPassword(ctx, "", "If your email is registered, you will receive a password reset link.").Render(c.Request.Context(), c.Writer)
 		return
 	}
@@ -403,7 +412,7 @@ func (h *Handlers) HandleForgotPassword(c *gin.Context) {
 	token, err := generateResetToken(32)
 	if err != nil {
 		log.Printf("Error generating reset token: %v", err)
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ForgotPassword(ctx, "An error occurred. Please try again later.", "").Render(c.Request.Context(), c.Writer)
 		return
 	}
@@ -411,33 +420,33 @@ func (h *Handlers) HandleForgotPassword(c *gin.Context) {
 	// Save token in database with expiration time (15 minutes)
 	expiration := time.Now().Add(15 * time.Minute)
 	resetToken := &db.PasswordResetToken{
-		UserID:     user.ID,
-		Token:      token,
-		ExpiresAt:  expiration,
+		UserID:    user.ID,
+		Token:     token,
+		ExpiresAt: expiration,
 	}
-	
+
 	if err := h.DB.CreatePasswordResetToken(resetToken); err != nil {
 		log.Printf("Error saving reset token: %v", err)
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ForgotPassword(ctx, "An error occurred. Please try again later.", "").Render(c.Request.Context(), c.Writer)
 		return
 	}
-	
+
 	// Send password reset email
 	err = h.Email.SendPasswordResetEmail(user.Email, user.Email, token)
 	if err != nil {
 		// If email sending fails, log the error but don't expose this to the user
 		log.Printf("Error sending password reset email: %v", err)
-		
+
 		// If email is disabled, log the reset link
 		if strings.Contains(err.Error(), "email service is disabled") {
 			log.Printf("Email service is disabled, reset link: %v", err)
 		}
 	}
-	
+
 	// Show success message regardless of whether email was sent
 	// This prevents user enumeration attacks
-	ctx := context.WithValue(c.Request.Context(), "theme", "light")
+	ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 	components.ForgotPassword(ctx, "", "If your email is registered, you will receive a password reset link.").Render(c.Request.Context(), c.Writer)
 }
 
@@ -457,7 +466,7 @@ func (h *Handlers) HandleResetPasswordPage(c *gin.Context) {
 		return
 	}
 
-	ctx := context.WithValue(c.Request.Context(), "theme", "light")
+	ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 	components.ResetPassword(ctx, token, "").Render(c.Request.Context(), c.Writer)
 }
 
@@ -473,19 +482,19 @@ func (h *Handlers) HandleResetPassword(c *gin.Context) {
 	}
 
 	if password == "" || confirmPassword == "" {
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ResetPassword(ctx, token, "Both password fields are required.").Render(c.Request.Context(), c.Writer)
 		return
 	}
 
 	if password != confirmPassword {
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ResetPassword(ctx, token, "Passwords do not match.").Render(c.Request.Context(), c.Writer)
 		return
 	}
 
 	if len(password) < 8 {
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ResetPassword(ctx, token, "Password must be at least 8 characters long.").Render(c.Request.Context(), c.Writer)
 		return
 	}
@@ -510,7 +519,7 @@ func (h *Handlers) HandleResetPassword(c *gin.Context) {
 	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		log.Printf("Error hashing password: %v", err)
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ResetPassword(ctx, token, "An error occurred. Please try again later.").Render(c.Request.Context(), c.Writer)
 		return
 	}
@@ -520,7 +529,7 @@ func (h *Handlers) HandleResetPassword(c *gin.Context) {
 	user.LastPasswordChange = time.Now()
 	if err := h.DB.UpdateUser(user); err != nil {
 		log.Printf("Error updating user password: %v", err)
-		ctx := context.WithValue(c.Request.Context(), "theme", "light")
+		ctx := context.WithValue(c.Request.Context(), themeKey, "light")
 		components.ResetPassword(ctx, token, "An error occurred. Please try again later.").Render(c.Request.Context(), c.Writer)
 		return
 	}

internal/web/handlers/auth_handlers_test.go

@@ -318,9 +318,9 @@ func TestHandleLogin(t *testing.T) {
 	user := &db.User{
 		Email:               "test@example.com",
 		PasswordHash:        string(hashedPassword),
-		IsAdmin:             false,
+		IsAdmin:             BoolPtr(false),
 		FailedLoginAttempts: 0,
-		AccountLocked:       false,
+		AccountLocked:       BoolPtr(false),
 		LastPasswordChange:  time.Now(),
 	}
 	database.Create(user)
@@ -437,9 +437,9 @@ func TestHandleChangePassword(t *testing.T) {
 	user := &db.User{
 		Email:               "test@example.com",
 		PasswordHash:        string(hashedPassword),
-		IsAdmin:             false,
+		IsAdmin:             BoolPtr(false),
 		FailedLoginAttempts: 0,
-		AccountLocked:       false,
+		AccountLocked:       BoolPtr(false),
 		LastPasswordChange:  time.Now().Add(-24 * time.Hour), // 1 day ago
 	}
 	database.Create(user)
@@ -577,7 +577,7 @@ func TestHandleForgotPassword(t *testing.T) {
 	user := &db.User{
 		Email:              "test@example.com",
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(user)
@@ -612,7 +612,7 @@ func TestHandleForgotPassword(t *testing.T) {
 	result := database.Where("user_id = ?", user.ID).First(&resetToken)
 	assert.NoError(t, result.Error, "Reset token should be created")
 	assert.NotEmpty(t, resetToken.Token, "Token should not be empty")
-	assert.False(t, resetToken.Used, "Token should not be marked as used")
+	assert.False(t, resetToken.GetUsed(), "Token should not be marked as used")
 
 	// Verify email would have been sent (if not mocked)
 	// Note: We can't check SendPasswordResetEmailCalls with our current mock
@@ -654,7 +654,7 @@ func TestHandleResetPasswordPage(t *testing.T) {
 	user := &db.User{
 		Email:              "test@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(user)
@@ -665,7 +665,7 @@ func TestHandleResetPasswordPage(t *testing.T) {
 		UserID:    user.ID,
 		Token:     token,
 		ExpiresAt: time.Now().Add(15 * time.Minute),
-		Used:      false,
+		Used:      BoolPtr(false),
 	}
 	database.Create(resetToken)
 
@@ -719,7 +719,7 @@ func TestHandleResetPassword(t *testing.T) {
 	user := &db.User{
 		Email:              "test@example.com",
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now().Add(-24 * time.Hour), // 1 day ago
 	}
 	database.Create(user)
@@ -730,7 +730,7 @@ func TestHandleResetPassword(t *testing.T) {
 		UserID:    user.ID,
 		Token:     token,
 		ExpiresAt: time.Now().Add(15 * time.Minute),
-		Used:      false,
+		Used:      BoolPtr(false),
 	}
 	database.Create(resetToken)
 
@@ -767,7 +767,7 @@ func TestHandleResetPassword(t *testing.T) {
 	// Verify token is marked as used
 	var updatedToken db.PasswordResetToken
 	database.First(&updatedToken, resetToken.ID)
-	assert.True(t, updatedToken.Used, "Token should be marked as used")
+	assert.True(t, updatedToken.GetUsed(), "Token should be marked as used")
 
 	// Test case 2: Passwords don't match
 	// Create another token first
@@ -776,7 +776,7 @@ func TestHandleResetPassword(t *testing.T) {
 		UserID:    user.ID,
 		Token:     token2,
 		ExpiresAt: time.Now().Add(15 * time.Minute),
-		Used:      false,
+		Used:      BoolPtr(false),
 	}
 	database.Create(resetToken2)
 
@@ -800,7 +800,7 @@ func TestHandleResetPassword(t *testing.T) {
 		UserID:    user.ID,
 		Token:     token3,
 		ExpiresAt: time.Now().Add(15 * time.Minute),
-		Used:      false,
+		Used:      BoolPtr(false),
 	}
 	database.Create(resetToken3)
 

internal/web/handlers/config_handlers.go

@@ -17,8 +17,16 @@ func (h *Handlers) HandleConfigs(c *gin.Context) {
 	var configs []db.TransferConfig
 	h.DB.Where("created_by = ?", userID).Find(&configs)
 
+	// Check for error or status parameters in the URL
+	error := c.Query("error")
+	errorDetails := c.Query("details")
+	status := c.Query("status")
+
 	data := components.ConfigsData{
-		Configs: configs,
+		Configs:      configs,
+		Error:        error,
+		ErrorDetails: errorDetails,
+		Status:       status,
 	}
 	components.Configs(c.Request.Context(), data).Render(c, c.Writer)
 }
@@ -72,10 +80,48 @@ func (h *Handlers) HandleCreateConfig(c *gin.Context) {
 	userID := c.GetUint("userID")
 	config.CreatedBy = userID
 
-	// Process skipProcessedFiles value (now using pointer)
-	skipProcessedValue := c.Request.FormValue("skip_processed_files") == "true"
+	// Process Boolean fields
+	skipProcessedVal := c.Request.FormValue("skip_processed_files")
+	skipProcessedValue := skipProcessedVal == "on" || skipProcessedVal == "true"
 	config.SkipProcessedFiles = &skipProcessedValue
 
+	archiveEnabledVal := c.Request.FormValue("archive_enabled")
+	archiveEnabledValue := archiveEnabledVal == "on" || archiveEnabledVal == "true"
+	config.ArchiveEnabled = &archiveEnabledValue
+
+	deleteAfterTransferVal := c.Request.FormValue("delete_after_transfer")
+	deleteAfterTransferValue := deleteAfterTransferVal == "on" || deleteAfterTransferVal == "true"
+	config.DeleteAfterTransfer = &deleteAfterTransferValue
+
+	sourcePassiveModeVal := c.Request.FormValue("source_passive_mode")
+	sourcePassiveModeValue := sourcePassiveModeVal == "on" || sourcePassiveModeVal == "true"
+	config.SourcePassiveMode = &sourcePassiveModeValue
+
+	destPassiveModeVal := c.Request.FormValue("dest_passive_mode")
+	destPassiveModeValue := destPassiveModeVal == "on" || destPassiveModeVal == "true"
+	config.DestPassiveMode = &destPassiveModeValue
+
+	// Google Photos specific fields
+	destReadOnlyVal := c.Request.FormValue("dest_read_only")
+	destReadOnlyValue := destReadOnlyVal == "on" || destReadOnlyVal == "true"
+	config.DestReadOnly = &destReadOnlyValue
+
+	sourceReadOnlyVal := c.Request.FormValue("source_read_only")
+	sourceReadOnlyValue := sourceReadOnlyVal == "on" || sourceReadOnlyVal == "true"
+	config.SourceReadOnly = &sourceReadOnlyValue
+
+	destIncludeArchivedVal := c.Request.FormValue("dest_include_archived")
+	destIncludeArchivedValue := destIncludeArchivedVal == "on" || destIncludeArchivedVal == "true"
+	config.DestIncludeArchived = &destIncludeArchivedValue
+
+	sourceIncludeArchivedVal := c.Request.FormValue("source_include_archived")
+	sourceIncludeArchivedValue := sourceIncludeArchivedVal == "on" || sourceIncludeArchivedVal == "true"
+	config.SourceIncludeArchived = &sourceIncludeArchivedValue
+
+	useBuiltinAuthVal := c.Request.FormValue("use_builtin_auth")
+	useBuiltinAuthValue := useBuiltinAuthVal == "on" || useBuiltinAuthVal == "true"
+	config.UseBuiltinAuth = &useBuiltinAuthValue
+
 	if err := h.DB.Create(&config).Error; err != nil {
 		log.Printf("Error creating config: %v", err)
 		c.String(http.StatusInternalServerError, fmt.Sprintf("Failed to create config: %v", err))
@@ -125,10 +171,48 @@ func (h *Handlers) HandleUpdateConfig(c *gin.Context) {
 		return
 	}
 
-	// Process skipProcessedFiles value (now using pointer)
-	skipProcessedValue := c.Request.FormValue("skip_processed_files") == "true"
+	// Process Boolean fields
+	skipProcessedVal := c.Request.FormValue("skip_processed_files")
+	skipProcessedValue := skipProcessedVal == "on" || skipProcessedVal == "true"
 	config.SkipProcessedFiles = &skipProcessedValue
 
+	archiveEnabledVal := c.Request.FormValue("archive_enabled")
+	archiveEnabledValue := archiveEnabledVal == "on" || archiveEnabledVal == "true"
+	config.ArchiveEnabled = &archiveEnabledValue
+
+	deleteAfterTransferVal := c.Request.FormValue("delete_after_transfer")
+	deleteAfterTransferValue := deleteAfterTransferVal == "on" || deleteAfterTransferVal == "true"
+	config.DeleteAfterTransfer = &deleteAfterTransferValue
+
+	sourcePassiveModeVal := c.Request.FormValue("source_passive_mode")
+	sourcePassiveModeValue := sourcePassiveModeVal == "on" || sourcePassiveModeVal == "true"
+	config.SourcePassiveMode = &sourcePassiveModeValue
+
+	destPassiveModeVal := c.Request.FormValue("dest_passive_mode")
+	destPassiveModeValue := destPassiveModeVal == "on" || destPassiveModeVal == "true"
+	config.DestPassiveMode = &destPassiveModeValue
+
+	// Google Photos specific fields
+	destReadOnlyVal := c.Request.FormValue("dest_read_only")
+	destReadOnlyValue := destReadOnlyVal == "on" || destReadOnlyVal == "true"
+	config.DestReadOnly = &destReadOnlyValue
+
+	sourceReadOnlyVal := c.Request.FormValue("source_read_only")
+	sourceReadOnlyValue := sourceReadOnlyVal == "on" || sourceReadOnlyVal == "true"
+	config.SourceReadOnly = &sourceReadOnlyValue
+
+	destIncludeArchivedVal := c.Request.FormValue("dest_include_archived")
+	destIncludeArchivedValue := destIncludeArchivedVal == "on" || destIncludeArchivedVal == "true"
+	config.DestIncludeArchived = &destIncludeArchivedValue
+
+	sourceIncludeArchivedVal := c.Request.FormValue("source_include_archived")
+	sourceIncludeArchivedValue := sourceIncludeArchivedVal == "on" || sourceIncludeArchivedVal == "true"
+	config.SourceIncludeArchived = &sourceIncludeArchivedValue
+
+	useBuiltinAuthVal := c.Request.FormValue("use_builtin_auth")
+	useBuiltinAuthValue := useBuiltinAuthVal == "on" || useBuiltinAuthVal == "true"
+	config.UseBuiltinAuth = &useBuiltinAuthValue
+
 	// Preserve fields that shouldn't be updated
 	config.CreatedBy = oldConfig.CreatedBy
 

internal/web/handlers/config_handlers_test.go

@@ -341,7 +341,7 @@ func TestHandleDeleteConfig(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  configWithJob.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.Create(job).Error; err != nil {

internal/web/handlers/dashboard_handlers_test.go

@@ -37,7 +37,7 @@ func setupDashboardTest(t *testing.T) (*Handlers, *gin.Engine, *db.DB) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	if err := database.DB.Create(job).Error; err != nil {

internal/web/handlers/file_metadata_handlers.go

@@ -16,6 +16,10 @@ type FileMetadataHandler struct {
 	DB *db.DB
 }
 
+type UserIDKey string
+
+const userIDKey UserIDKey = "userID"
+
 // ListFileMetadata displays a list of file metadata with pagination and filtering options
 func (h *FileMetadataHandler) ListFileMetadata(c *gin.Context) {
 	userID := c.GetUint("userID")
@@ -322,9 +326,6 @@ func (h *FileMetadataHandler) SearchFileMetadata(c *gin.Context) {
 		return
 	}
 
-	// Create context for template
-	ctx := components.CreateTemplateContext(c)
-
 	// Render the file metadata search template
 	data := components.FileMetadataSearchData{
 		Files:      fileMetadata,
@@ -348,7 +349,7 @@ func (h *FileMetadataHandler) SearchFileMetadata(c *gin.Context) {
 	}
 
 	// Add HTMX request checking and conditional rendering
-	ctx = context.WithValue(c.Request.Context(), "userID", userID)
+	ctx := context.WithValue(c.Request.Context(), userIDKey, userID)
 
 	// Check if this is an HTMX request
 	isHtmxRequest := c.GetHeader("HX-Request") == "true" || c.Query("htmx") == "true"
@@ -626,7 +627,7 @@ func (h *FileMetadataHandler) HandleFileMetadataSearchPartial(c *gin.Context) {
 		data.TotalPages++
 	}
 
-	ctx := context.WithValue(c.Request.Context(), "userID", userID)
+	ctx := context.WithValue(c.Request.Context(), userIDKey, userID)
 	c.Header("Content-Type", "text/html")
 	components.FileMetadataSearchContent(data).Render(ctx, c.Writer)
 }

internal/web/handlers/file_metadata_handlers_test.go

@@ -43,7 +43,7 @@ func setupFileMetadataHandlers(t *testing.T) (*FileMetadataHandler, *gin.Engine,
 		Name:      "Test Job for File Metadata",
 		ConfigID:  testConfig.ID,
 		Schedule:  "0 * * * *", // Run hourly
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: testUser.ID,
 	}
 	err = handlers.DB.CreateJob(testJob)

internal/web/handlers/gdrive_handlers.go

@@ -0,0 +1,400 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// HandleGDriveAuth initiates the Google Drive authentication process
+func (h *Handlers) HandleGDriveAuth(c *gin.Context) {
+	// Get the config ID from the query parameter
+	configIDStr := c.Param("id")
+	if configIDStr == "" {
+		RenderErrorPage(c, "Missing configuration ID", "")
+		return
+	}
+
+	configID, err := strconv.ParseUint(configIDStr, 10, 64)
+	if err != nil {
+		RenderErrorPage(c, "Invalid configuration ID", err.Error())
+		return
+	}
+
+	// Get the configuration
+	config, err := h.DB.GetTransferConfig(uint(configID))
+	if err != nil {
+		RenderErrorPage(c, "Configuration not found", err.Error())
+		return
+	}
+
+	// Ensure it's a Google Drive or Google Photos configuration
+	if config.DestinationType != "gdrive" && config.DestinationType != "gphotos" {
+		RenderErrorPage(c, "Not a Google configuration", "The selected configuration is not set up for Google Drive or Google Photos")
+		return
+	}
+
+	// Prepare for OAuth
+	dataDir := os.Getenv("DATA_DIR")
+	if dataDir == "" {
+		dataDir = "./data"
+	}
+
+	// Get Rclone Config Path
+	rcloneConfigPath := h.DB.GetConfigRclonePath(config)
+	if rcloneConfigPath == "" {
+		RenderErrorPage(c, "Rclone config not found", "The selected configuration does not have a valid rclone config")
+		return
+	}
+
+	// Create a temporary config file for authentication
+	tempConfigDir := filepath.Join(dataDir, "temp")
+	if err := os.MkdirAll(tempConfigDir, 0755); err != nil {
+		RenderErrorPage(c, "Failed to create temporary directory", err.Error())
+		return
+	}
+
+	tempConfigPath := filepath.Join(tempConfigDir, fmt.Sprintf("gdrive_auth_%d.conf", config.ID))
+
+	// Store the temporary config path in a cookie
+	c.SetCookie("gdrive_temp_config", tempConfigPath, 3600, "/", "", false, true)
+
+	// Get base URL for redirect URI
+	baseURL := os.Getenv("BASE_URL")
+	if baseURL == "" {
+		// Try to detect the base URL from the request
+		scheme := "http"
+		if c.Request.TLS != nil {
+			scheme = "https"
+		}
+		baseURL = fmt.Sprintf("%s://%s", scheme, c.Request.Host)
+	}
+
+	// Define the redirect URI for our callback
+	redirectURI := fmt.Sprintf("%s/configs/gdrive-callback", baseURL)
+
+	// Attempt to get GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from ENV
+	clientID := os.Getenv("GOOGLE_CLIENT_ID")
+	clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")
+
+	if clientID == "" || clientSecret == "" {
+		// Check if we have client credentials in the existing config file
+		existingClientID, existingClientSecret := h.DB.GetGDriveCredentialsFromConfig(config)
+
+		if existingClientID != "" && existingClientSecret != "" {
+			// Use credentials from existing config
+			clientID = existingClientID
+			clientSecret = existingClientSecret
+		} else {
+			// fallback to rclone client ID and secret
+			clientID = "202264815644.apps.googleusercontent.com"
+			clientSecret = "X4Z3ca8xfWDb1Voo-F9a7ZxJ"
+		}
+	}
+
+	if config.DestClientID != "" && config.DestClientSecret == "" {
+		// If user provided just client ID but no secret, try to find the secret in the config
+		_, existingClientSecret := h.DB.GetGDriveCredentialsFromConfig(config)
+
+		if existingClientSecret != "" {
+			// Use the secret from the existing config with the provided client ID
+			clientSecret = existingClientSecret
+		} else {
+			// If we still can't find a matching secret, show an error
+			RenderErrorPage(c, "Missing client secret", "You provided a custom client ID but no client secret. Both are required for Google authentication.")
+			return
+		}
+	}
+
+	// Generate state parameter for security (to prevent CSRF)
+	state := fmt.Sprintf("gomft_%d_%d", config.ID, time.Now().Unix())
+
+	// Store state in cookie for validation during callback
+	c.SetCookie("gdrive_auth_state", state, 3600, "/", "", false, true)
+
+	// Store config ID in cookie for use during callback
+	c.SetCookie("gdrive_config_id", configIDStr, 3600, "/", "", false, true)
+
+	// Determine the appropriate scope based on destination type
+	var scope string
+	if config.DestinationType == "gphotos" {
+		// Read-only access is handled elsewhere in the config; here we need the full auth scope
+		scope = url.QueryEscape("https://www.googleapis.com/auth/photoslibrary")
+	} else {
+		// Default to Google Drive scope
+		scope = url.QueryEscape("https://www.googleapis.com/auth/drive")
+	}
+
+	// Create a config file with redirect URI-based auth
+	configType := "drive"
+	if config.DestinationType == "gphotos" {
+		configType = "google photos"
+	}
+
+	configContent := fmt.Sprintf(`[temp_%s]
+type = %s
+client_id = %s
+client_secret = %s
+redirect_url = %s
+`, config.DestinationType, configType, clientID, clientSecret, redirectURI)
+
+	// Write the config file
+	if err := os.WriteFile(tempConfigPath, []byte(configContent), 0644); err != nil {
+		RenderErrorPage(c, "Failed to create temporary config file", err.Error())
+		return
+	}
+
+	// Direct Google OAuth URL with our redirect
+	authURL := fmt.Sprintf("https://accounts.google.com/o/oauth2/auth?client_id=%s&redirect_uri=%s&scope=%s&response_type=code&access_type=offline&state=%s",
+		url.QueryEscape(clientID),
+		url.QueryEscape(redirectURI),
+		scope,
+		url.QueryEscape(state))
+
+	// Redirect the user to Google's auth page directly
+	c.Redirect(http.StatusFound, authURL)
+}
+
+// HandleGDriveAuthCallback handles the callback from Google OAuth
+func (h *Handlers) HandleGDriveAuthCallback(c *gin.Context) {
+	// Get auth code from query parameters
+	authCode := c.Query("code")
+	if authCode == "" {
+		RenderErrorPage(c, "Authentication failed", "No authorization code received from Google")
+		return
+	}
+
+	// Verify state parameter to prevent CSRF
+	state := c.Query("state")
+	storedState, err := c.Cookie("gdrive_auth_state")
+	if err != nil || state != storedState {
+		RenderErrorPage(c, "Authentication failed", "Invalid state parameter")
+		return
+	}
+
+	// Get config ID from cookie
+	configIDStr, err := c.Cookie("gdrive_config_id")
+	if err != nil {
+		RenderErrorPage(c, "Authentication failed", "Unable to retrieve configuration ID")
+		return
+	}
+
+	configID, err := strconv.ParseUint(configIDStr, 10, 64)
+	if err != nil {
+		RenderErrorPage(c, "Invalid configuration ID", err.Error())
+		return
+	}
+
+	// Get the temp config path from cookie
+	tempConfigPath, err := c.Cookie("gdrive_temp_config")
+	if err != nil || tempConfigPath == "" {
+		RenderErrorPage(c, "Session expired", "The authentication session has expired")
+		return
+	}
+
+	// Get base URL for redirect URI
+	baseURL := os.Getenv("BASE_URL")
+	if baseURL == "" {
+		// Try to detect the base URL from the request
+		scheme := "http"
+		if c.Request.TLS != nil {
+			scheme = "https"
+		}
+		baseURL = fmt.Sprintf("%s://%s", scheme, c.Request.Host)
+	}
+	redirectURI := fmt.Sprintf("%s/configs/gdrive-callback", baseURL)
+
+	// Get the configuration to retrieve client ID and secret
+	config, err := h.DB.GetTransferConfig(uint(configID))
+	if err != nil {
+		RenderErrorPage(c, "Failed to get configuration", err.Error())
+		return
+	}
+
+	// Attempt to get GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from ENV
+	clientID := os.Getenv("GOOGLE_CLIENT_ID")
+	clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")
+
+	if clientID == "" || clientSecret == "" {
+		// Check if we have client credentials in the existing config file
+		existingClientID, existingClientSecret := h.DB.GetGDriveCredentialsFromConfig(config)
+
+		if existingClientID != "" && existingClientSecret != "" {
+			// Use credentials from existing config
+			clientID = existingClientID
+			clientSecret = existingClientSecret
+		} else {
+			// fallback to rclone client ID and secret
+			clientID = "202264815644.apps.googleusercontent.com"
+			clientSecret = "X4Z3ca8xfWDb1Voo-F9a7ZxJ"
+		}
+	}
+
+	if config.DestClientID != "" && config.DestClientSecret == "" {
+		// If user provided just client ID but no secret, try to find the secret in the config
+		_, existingClientSecret := h.DB.GetGDriveCredentialsFromConfig(config)
+
+		if existingClientSecret != "" {
+			// Use the secret from the existing config with the provided client ID
+			clientSecret = existingClientSecret
+		} else {
+			// If we still can't find a matching secret, show an error
+			RenderErrorPage(c, "Missing client secret", "You provided a custom client ID but no client secret. Both are required for Google authentication.")
+			return
+		}
+	}
+
+	// Exchange auth code for token using HTTP request
+	tokenURL := "https://oauth2.googleapis.com/token"
+	formData := url.Values{
+		"code":          {authCode},
+		"client_id":     {clientID},
+		"client_secret": {clientSecret},
+		"redirect_uri":  {redirectURI},
+		"grant_type":    {"authorization_code"},
+	}
+
+	resp, err := http.PostForm(tokenURL, formData)
+	if err != nil {
+		RenderErrorPage(c, "Failed to exchange authorization code for token", err.Error())
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		RenderErrorPage(c, "Failed to read token response", err.Error())
+		return
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		RenderErrorPage(c, "Failed to exchange authorization code for token", string(body))
+		return
+	}
+
+	// Parse the token response
+	var tokenResp struct {
+		AccessToken  string `json:"access_token"`
+		TokenType    string `json:"token_type"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int    `json:"expires_in"`
+	}
+
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		RenderErrorPage(c, "Failed to parse token response", err.Error())
+		return
+	}
+
+	// Create a token JSON in the format rclone expects
+	tokenJSON := fmt.Sprintf(`{
+		"access_token": "%s",
+		"token_type": "%s",
+		"refresh_token": "%s",
+		"expiry": "%s"
+	}`,
+		tokenResp.AccessToken,
+		tokenResp.TokenType,
+		tokenResp.RefreshToken,
+		time.Now().Add(time.Duration(tokenResp.ExpiresIn)*time.Second).Format(time.RFC3339))
+
+	// Mark the configuration as authenticated in the database
+	config.SetGoogleDriveAuthenticated(true)
+	if err := h.DB.UpdateTransferConfig(config); err != nil {
+		RenderErrorPage(c, "Failed to update configuration", err.Error())
+		return
+	}
+
+	// Generate the rclone config file with the token
+	if err := h.DB.GenerateRcloneConfigWithToken(config, tokenJSON); err != nil {
+		RenderErrorPage(c, "Failed to generate rclone configuration", err.Error())
+		return
+	}
+
+	// Clean up the temporary file
+	os.Remove(tempConfigPath)
+
+	// Clear cookies
+	c.SetCookie("gdrive_temp_config", "", -1, "/", "", false, true)
+	c.SetCookie("gdrive_auth_state", "", -1, "/", "", false, true)
+	c.SetCookie("gdrive_config_id", "", -1, "/", "", false, true)
+
+	// Redirect to the config list with a success message
+	var successParam string
+	if config.DestinationType == "gphotos" {
+		successParam = "gphotos_auth_success"
+	} else {
+		successParam = "gdrive_auth_success"
+	}
+	c.Redirect(http.StatusFound, fmt.Sprintf("/configs?status=%s", successParam))
+}
+
+// HandleGDriveTokenProcess processes a Google Drive token directly from a URL parameter
+func (h *Handlers) HandleGDriveTokenProcess(c *gin.Context) {
+	// Get the parameters
+	configID := c.Query("config_id")
+	if configID == "" {
+		RenderErrorPage(c, "Missing configuration ID", "")
+		return
+	}
+
+	token := c.Query("token")
+	if token == "" {
+		RenderErrorPage(c, "Missing token", "")
+		return
+	}
+
+	// Parse config ID
+	configIDUint, err := strconv.ParseUint(configID, 10, 64)
+	if err != nil {
+		RenderErrorPage(c, "Invalid configuration ID", err.Error())
+		return
+	}
+
+	// Get the configuration
+	config, err := h.DB.GetTransferConfig(uint(configIDUint))
+	if err != nil {
+		RenderErrorPage(c, "Configuration not found", err.Error())
+		return
+	}
+
+	// Ensure it's a Google Drive configuration
+	if config.DestinationType != "gdrive" {
+		RenderErrorPage(c, "Not a Google Drive configuration", "")
+		return
+	}
+
+	// Mark the configuration as authenticated
+	config.SetGoogleDriveAuthenticated(true)
+	if err := h.DB.UpdateTransferConfig(config); err != nil {
+		RenderErrorPage(c, "Failed to update configuration", err.Error())
+		return
+	}
+
+	// Generate the rclone config with the token
+	if err := h.DB.GenerateRcloneConfigWithToken(config, token); err != nil {
+		RenderErrorPage(c, "Failed to generate rclone configuration", err.Error())
+		return
+	}
+
+	// Redirect to the config list with success
+	c.Redirect(http.StatusFound, "/configs?status=gdrive_auth_success")
+}
+
+// RenderErrorPage renders an error page with the given message
+func RenderErrorPage(c *gin.Context, title string, details string) {
+	// Here we'd typically use a component for error display
+	// For now, we'll just redirect to the configs page with an error in the query string
+	errorURL := "/configs?error=" + url.QueryEscape(title)
+	if details != "" {
+		errorURL += "&details=" + url.QueryEscape(details)
+	}
+	c.Redirect(http.StatusFound, errorURL)
+}

internal/web/handlers/gdrive_handlers_test.go

@@ -0,0 +1,429 @@
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/starfleetcptn/gomft/internal/db"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+// DBInterface defines the methods we need to mock for our tests
+type DBInterface interface {
+	GetTransferConfig(id uint) (*db.TransferConfig, error)
+	GetConfigRclonePath(config *db.TransferConfig) string
+	GenerateRcloneConfigWithToken(config *db.TransferConfig, token string) error
+	GetGDriveCredentialsFromConfig(config *db.TransferConfig) (string, string)
+}
+
+// MockDB is a mock implementation of the DB interface for testing
+type MockDB struct {
+	mock.Mock
+}
+
+// Implement the necessary methods from the DB interface for our tests
+func (m *MockDB) GetTransferConfig(id uint) (*db.TransferConfig, error) {
+	args := m.Called(id)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*db.TransferConfig), args.Error(1)
+}
+
+func (m *MockDB) GetConfigRclonePath(config *db.TransferConfig) string {
+	args := m.Called(config)
+	return args.String(0)
+}
+
+func (m *MockDB) GenerateRcloneConfigWithToken(config *db.TransferConfig, token string) error {
+	args := m.Called(config, token)
+	return args.Error(0)
+}
+
+func (m *MockDB) GetGDriveCredentialsFromConfig(config *db.TransferConfig) (string, string) {
+	args := m.Called(config)
+	return args.String(0), args.String(1)
+}
+
+// MockHandlers is a modified version of Handlers that accepts our mock DB
+type MockHandlers struct {
+	DB DBInterface
+}
+
+// HandleGDriveAuth is a copy of the original method but using our interface
+func (h *MockHandlers) HandleGDriveAuth(c *gin.Context) {
+	// Get the config ID from the query parameter
+	configIDStr := c.Param("id")
+	if configIDStr == "" {
+		RenderErrorPage(c, "Missing configuration ID", "")
+		return
+	}
+
+	configID, err := strconv.ParseUint(configIDStr, 10, 64)
+	if err != nil {
+		RenderErrorPage(c, "Invalid configuration ID", err.Error())
+		return
+	}
+
+	// Get the configuration
+	config, err := h.DB.GetTransferConfig(uint(configID))
+	if err != nil {
+		RenderErrorPage(c, "Configuration not found", err.Error())
+		return
+	}
+
+	// Ensure it's a Google Drive or Google Photos configuration
+	if config.DestinationType != "gdrive" && config.DestinationType != "gphotos" {
+		RenderErrorPage(c, "Not a Google configuration", "The selected configuration is not set up for Google Drive or Google Photos")
+		return
+	}
+
+	// Prepare for OAuth
+	dataDir := os.Getenv("DATA_DIR")
+	if dataDir == "" {
+		dataDir = "./data"
+	}
+
+	// Get Rclone Config Path
+	rcloneConfigPath := h.DB.GetConfigRclonePath(config)
+	if rcloneConfigPath == "" {
+		RenderErrorPage(c, "Rclone config not found", "The selected configuration does not have a valid rclone config")
+		return
+	}
+
+	// Create a temporary config file for authentication
+	tempConfigDir := filepath.Join(dataDir, "temp")
+	if err := os.MkdirAll(tempConfigDir, 0755); err != nil {
+		RenderErrorPage(c, "Failed to create temporary directory", err.Error())
+		return
+	}
+
+	tempConfigPath := filepath.Join(tempConfigDir, fmt.Sprintf("gdrive_auth_%d.conf", config.ID))
+
+	// Store the temporary config path in a cookie
+	c.SetCookie("gdrive_temp_config", tempConfigPath, 3600, "/", "", false, true)
+
+	// Get base URL for redirect URI
+	baseURL := os.Getenv("BASE_URL")
+	if baseURL == "" {
+		// Try to detect the base URL from the request
+		scheme := "http"
+		if c.Request.TLS != nil {
+			scheme = "https"
+		}
+		baseURL = fmt.Sprintf("%s://%s", scheme, c.Request.Host)
+	}
+
+	// Define the redirect URI for our callback
+	redirectURI := fmt.Sprintf("%s/configs/gdrive-callback", baseURL)
+
+	// Attempt to get GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from ENV
+	clientID := os.Getenv("GOOGLE_CLIENT_ID")
+	clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")
+
+	if clientID == "" || clientSecret == "" {
+		// Check if we have client credentials in the existing config file
+		existingClientID, existingClientSecret := h.DB.GetGDriveCredentialsFromConfig(config)
+
+		if existingClientID != "" && existingClientSecret != "" {
+			// Use credentials from existing config
+			clientID = existingClientID
+			clientSecret = existingClientSecret
+		} else {
+			// fallback to rclone client ID and secret
+			clientID = "202264815644.apps.googleusercontent.com"
+			clientSecret = "X4Z3ca8xfWDb1Voo-F9a7ZxJ"
+		}
+	}
+
+	// Generate state parameter for security (to prevent CSRF)
+	state := fmt.Sprintf("gomft_%d_%d", config.ID, time.Now().Unix())
+
+	// Store state in cookie for validation during callback
+	c.SetCookie("gdrive_auth_state", state, 3600, "/", "", false, true)
+
+	// Store config ID in cookie for use during callback
+	c.SetCookie("gdrive_config_id", configIDStr, 3600, "/", "", false, true)
+
+	// Determine the appropriate scope based on destination type
+	var scope string
+	if config.DestinationType == "gphotos" {
+		// Read-only access is handled elsewhere in the config; here we need the full auth scope
+		scope = url.QueryEscape("https://www.googleapis.com/auth/photoslibrary")
+	} else {
+		// Default to Google Drive scope
+		scope = url.QueryEscape("https://www.googleapis.com/auth/drive")
+	}
+
+	// Direct Google OAuth URL with our redirect
+	authURL := fmt.Sprintf("https://accounts.google.com/o/oauth2/auth?client_id=%s&redirect_uri=%s&scope=%s&response_type=code&access_type=offline&state=%s",
+		url.QueryEscape(clientID),
+		url.QueryEscape(redirectURI),
+		scope,
+		url.QueryEscape(state))
+
+	// Redirect the user to Google's auth page directly
+	c.Redirect(http.StatusFound, authURL)
+}
+
+// HandleGDriveAuthCallback handles the callback from Google OAuth
+func (h *MockHandlers) HandleGDriveAuthCallback(c *gin.Context) {
+	// Get auth code from query parameters
+	authCode := c.Query("code")
+	if authCode == "" {
+		RenderErrorPage(c, "Authentication failed", "No authorization code received from Google")
+		return
+	}
+
+	// Verify state parameter to prevent CSRF
+	state := c.Query("state")
+	storedState, err := c.Cookie("gdrive_auth_state")
+	if err != nil || state != storedState {
+		RenderErrorPage(c, "Authentication failed", "Invalid state parameter")
+		return
+	}
+
+	// Get config ID from cookie
+	configIDStr, err := c.Cookie("gdrive_config_id")
+	if err != nil {
+		RenderErrorPage(c, "Authentication failed", "Unable to retrieve configuration ID")
+		return
+	}
+
+	configID, err := strconv.ParseUint(configIDStr, 10, 64)
+	if err != nil {
+		RenderErrorPage(c, "Invalid configuration ID", err.Error())
+		return
+	}
+
+	// Get the configuration
+	config, err := h.DB.GetTransferConfig(uint(configID))
+	if err != nil {
+		RenderErrorPage(c, "Failed to get configuration", err.Error())
+		return
+	}
+
+	// For testing purposes, we'll simulate a successful token exchange
+	// In a real implementation, we would exchange the auth code for a token
+	mockToken := `{"access_token":"test_access_token","refresh_token":"test_refresh_token","expiry":"2023-12-31T23:59:59Z"}`
+
+	// Update the config with the token
+	err = h.DB.GenerateRcloneConfigWithToken(config, mockToken)
+	if err != nil {
+		RenderErrorPage(c, "Failed to update configuration", err.Error())
+		return
+	}
+
+	// Redirect to the config edit page
+	c.Redirect(http.StatusFound, fmt.Sprintf("/configs/edit/%d", config.ID))
+}
+
+func setupTestRouter() (*gin.Engine, *MockDB) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	mockDB := new(MockDB)
+	handlers := &MockHandlers{
+		DB: mockDB,
+	}
+
+	router.GET("/configs/gdrive/:id", handlers.HandleGDriveAuth)
+	router.GET("/configs/gdrive-callback", handlers.HandleGDriveAuthCallback)
+
+	return router, mockDB
+}
+
+func TestHandleGDriveAuth_GoogleDrive(t *testing.T) {
+	// Setup
+	router, mockDB := setupTestRouter()
+
+	// Create a test config
+	testConfig := &db.TransferConfig{
+		ID:              1,
+		DestinationType: "gdrive",
+	}
+
+	// Set up mock expectations
+	mockDB.On("GetTransferConfig", uint(1)).Return(testConfig, nil)
+	mockDB.On("GetConfigRclonePath", testConfig).Return("/path/to/rclone.conf")
+	mockDB.On("GetGDriveCredentialsFromConfig", testConfig).Return("test_client_id", "test_client_secret")
+
+	// Create test request
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/configs/gdrive/1", nil)
+	router.ServeHTTP(w, req)
+
+	// Assertions
+	assert.Equal(t, http.StatusFound, w.Code)
+
+	// Verify the redirect URL
+	location := w.Header().Get("Location")
+	assert.Contains(t, location, "accounts.google.com/o/oauth2/auth")
+	assert.Contains(t, location, "drive")
+	assert.Contains(t, location, "test_client_id")
+
+	// Verify cookies were set
+	cookies := w.Result().Cookies()
+	assert.GreaterOrEqual(t, len(cookies), 3)
+
+	// Check if state cookie exists
+	stateFound := false
+	for _, cookie := range cookies {
+		if cookie.Name == "gdrive_auth_state" {
+			stateFound = true
+			break
+		}
+	}
+	assert.True(t, stateFound)
+}
+
+func TestHandleGDriveAuth_GooglePhotos(t *testing.T) {
+	// Setup
+	router, mockDB := setupTestRouter()
+
+	// Create a test config
+	testConfig := &db.TransferConfig{
+		ID:              2,
+		DestinationType: "gphotos",
+	}
+
+	// Set up mock expectations
+	mockDB.On("GetTransferConfig", uint(2)).Return(testConfig, nil)
+	mockDB.On("GetConfigRclonePath", testConfig).Return("/path/to/rclone.conf")
+	mockDB.On("GetGDriveCredentialsFromConfig", testConfig).Return("test_client_id", "test_client_secret")
+
+	// Create test request
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/configs/gdrive/2", nil)
+	router.ServeHTTP(w, req)
+
+	// Assertions
+	assert.Equal(t, http.StatusFound, w.Code)
+
+	// Verify the redirect URL
+	location := w.Header().Get("Location")
+	assert.Contains(t, location, "accounts.google.com/o/oauth2/auth")
+	assert.Contains(t, location, "photoslibrary")
+	assert.Contains(t, location, "test_client_id")
+
+	// Verify cookies were set
+	cookies := w.Result().Cookies()
+	assert.GreaterOrEqual(t, len(cookies), 3)
+
+	// Check if state cookie exists
+	stateFound := false
+	for _, cookie := range cookies {
+		if cookie.Name == "gdrive_auth_state" {
+			stateFound = true
+			break
+		}
+	}
+	assert.True(t, stateFound)
+}
+
+func TestHandleGDriveAuthCallback(t *testing.T) {
+	// Setup test environment
+	router, mockDB := setupTestRouter()
+
+	// Create a temporary directory for testing
+	tempDir, err := os.MkdirTemp("", "gdrive-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	// Create a temporary config file
+	tempConfigPath := filepath.Join(tempDir, "temp_config.conf")
+	if err := os.WriteFile(tempConfigPath, []byte("test config"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Test state and config ID
+	testState := "gomft_1_12345"
+	testConfigID := "1"
+
+	// Create a test config
+	testConfig := &db.TransferConfig{
+		ID:              1,
+		DestinationType: "gphotos",
+	}
+
+	// Set up mock expectations
+	mockDB.On("GetTransferConfig", uint(1)).Return(testConfig, nil)
+	mockDB.On("GenerateRcloneConfigWithToken", testConfig, mock.Anything).Return(nil)
+
+	// Create test request with auth code and state
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/configs/gdrive-callback?code=test_auth_code&state="+testState, nil)
+
+	// Add required cookies to the request
+	req.AddCookie(&http.Cookie{Name: "gdrive_auth_state", Value: testState})
+	req.AddCookie(&http.Cookie{Name: "gdrive_config_id", Value: testConfigID})
+	req.AddCookie(&http.Cookie{Name: "gdrive_temp_config", Value: tempConfigPath})
+
+	// Send the request
+	router.ServeHTTP(w, req)
+
+	// We expect a redirect on successful auth
+	assert.Equal(t, http.StatusFound, w.Code)
+
+	// Should redirect to the config edit page
+	location := w.Header().Get("Location")
+	assert.Contains(t, location, "/configs/edit/1")
+}
+
+func TestHandleGDriveAuth_InvalidConfig(t *testing.T) {
+	// Setup
+	router, mockDB := setupTestRouter()
+
+	// Set up mock expectations for a non-existent config
+	mockDB.On("GetTransferConfig", uint(999)).Return(nil, fmt.Errorf("config not found"))
+
+	// Create test request
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/configs/gdrive/999", nil)
+	router.ServeHTTP(w, req)
+
+	// Assertions - should render error page
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Body.String(), "Configuration not found")
+}
+
+func TestHandleGDriveAuth_NonGoogleConfig(t *testing.T) {
+	// Setup
+	router, mockDB := setupTestRouter()
+
+	// Create a non-Google test config
+	testConfig := &db.TransferConfig{
+		ID:              3,
+		DestinationType: "s3", // Not Google Drive or Photos
+	}
+
+	// Set up mock expectations
+	mockDB.On("GetTransferConfig", uint(3)).Return(testConfig, nil)
+
+	// Create test request
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/configs/gdrive/3", nil)
+	router.ServeHTTP(w, req)
+
+	// Assertions - should render error page
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Body.String(), "Not a Google configuration")
+}
+
+// RenderErrorPage renders an error page with the given message
+func RenderErrorPage(c *gin.Context, title string, details string) {
+	// Here we'd typically use a component for error display
+	// For now, we'll just render a simple HTML error page for testing
+	errorHTML := fmt.Sprintf("<html><body><h1>Error: %s</h1><p>%s</p></body></html>", title, details)
+	c.Data(http.StatusOK, "text/html", []byte(errorHTML))
+}

internal/web/handlers/import_jobs_test.go

@@ -35,7 +35,7 @@ func TestHandleImportJobsFixed(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up middleware to add the user to the context
@@ -99,7 +99,7 @@ func TestHandleImportJobsFixed(t *testing.T) {
 		ConfigID:  testJobs[0].ConfigID,
 		ConfigIDs: testJobs[0].ConfigIDs,
 		Schedule:  testJobs[0].Schedule,
-		Enabled:   testJobs[0].Enabled,
+		Enabled:   BoolPtr(testJobs[0].Enabled),
 		CreatedBy: testJobs[0].CreatedBy,
 	}
 
@@ -138,7 +138,7 @@ func TestHandleImportJobsFromFileFixed(t *testing.T) {
 	testUser := &db.User{
 		ID:      1,
 		Email:   "admin@example.com",
-		IsAdmin: true,
+		IsAdmin: BoolPtr(true),
 	}
 
 	// Set up middleware to add the user to the context - must be done BEFORE registering routes
@@ -218,7 +218,7 @@ func TestHandleImportJobsFromFileFixed(t *testing.T) {
 		ConfigID:  testJobs[0].ConfigID,
 		ConfigIDs: testJobs[0].ConfigIDs,
 		Schedule:  testJobs[0].Schedule,
-		Enabled:   testJobs[0].Enabled,
+		Enabled:   BoolPtr(testJobs[0].Enabled),
 		CreatedBy: testJobs[0].CreatedBy,
 	}
 

internal/web/handlers/job_handlers.go

@@ -214,6 +214,23 @@ func (h *Handlers) HandleCreateJob(c *gin.Context) {
 	// Set the config IDs list
 	job.SetConfigIDsList(configIDsList)
 
+	// Set the boolean fields - handle both "on" and "true" values for checkboxes
+	enabledVal := c.Request.FormValue("enabled")
+	jobEnabledValue := enabledVal == "on" || enabledVal == "true"
+	job.SetEnabled(jobEnabledValue)
+
+	webhookEnabledVal := c.Request.FormValue("webhook_enabled")
+	webhookEnabledValue := webhookEnabledVal == "on" || webhookEnabledVal == "true"
+	job.SetWebhookEnabled(webhookEnabledValue)
+
+	notifySuccessVal := c.Request.FormValue("notify_on_success")
+	notifyOnSuccessValue := notifySuccessVal == "on" || notifySuccessVal == "true"
+	job.SetNotifyOnSuccess(notifyOnSuccessValue)
+
+	notifyFailureVal := c.Request.FormValue("notify_on_failure")
+	notifyOnFailureValue := notifyFailureVal == "on" || notifyFailureVal == "true"
+	job.SetNotifyOnFailure(notifyOnFailureValue)
+
 	// Set created by user
 	job.CreatedBy = userID
 
@@ -315,6 +332,23 @@ func (h *Handlers) HandleUpdateJob(c *gin.Context) {
 	// Set the config IDs list
 	job.SetConfigIDsList(configIDsList)
 
+	// Set the boolean fields - handle both "on" and "true" values for checkboxes
+	enabledVal := c.Request.FormValue("enabled")
+	jobEnabledValue := enabledVal == "on" || enabledVal == "true"
+	job.SetEnabled(jobEnabledValue)
+
+	webhookEnabledVal := c.Request.FormValue("webhook_enabled")
+	webhookEnabledValue := webhookEnabledVal == "on" || webhookEnabledVal == "true"
+	job.SetWebhookEnabled(webhookEnabledValue)
+
+	notifySuccessVal := c.Request.FormValue("notify_on_success")
+	notifyOnSuccessValue := notifySuccessVal == "on" || notifySuccessVal == "true"
+	job.SetNotifyOnSuccess(notifyOnSuccessValue)
+
+	notifyFailureVal := c.Request.FormValue("notify_on_failure")
+	notifyOnFailureValue := notifyFailureVal == "on" || notifyFailureVal == "true"
+	job.SetNotifyOnFailure(notifyOnFailureValue)
+
 	// Preserve fields that shouldn't be updated
 	job.CreatedBy = oldJob.CreatedBy
 	job.ID = oldJob.ID

internal/web/handlers/job_handlers_test.go

@@ -25,7 +25,7 @@ func setupJobsTest(t *testing.T) (*Handlers, *gin.Engine, *db.DB, *db.User, *db.
 	user := &db.User{
 		Email:              "jobtest@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(user)
@@ -34,7 +34,7 @@ func setupJobsTest(t *testing.T) (*Handlers, *gin.Engine, *db.DB, *db.User, *db.
 	adminUser := &db.User{
 		Email:              "jobadmin@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            true,
+		IsAdmin:            BoolPtr(true),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(adminUser)
@@ -99,7 +99,7 @@ func TestHandleJobs(t *testing.T) {
 		Name:      "Test Job 1",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  1,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job1)
@@ -108,7 +108,7 @@ func TestHandleJobs(t *testing.T) {
 		Name:      "Test Job 2",
 		Schedule:  "*/10 * * * *",
 		ConfigID:  1,
-		Enabled:   false,
+		Enabled:   BoolPtr(false),
 		CreatedBy: user.ID,
 	}
 	database.Create(job2)
@@ -117,7 +117,7 @@ func TestHandleJobs(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -126,7 +126,7 @@ func TestHandleJobs(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  1,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)
@@ -178,7 +178,7 @@ func TestHandleEditJob(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -187,7 +187,7 @@ func TestHandleEditJob(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -196,7 +196,7 @@ func TestHandleEditJob(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)
@@ -232,7 +232,7 @@ func TestHandleEditJob(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(adminOtherJob)
@@ -287,13 +287,13 @@ func TestHandleCreateJob(t *testing.T) {
 	assert.Equal(t, jobName, job.Name)
 	assert.Equal(t, "*/15 * * * *", job.Schedule)
 	assert.Equal(t, config.ID, job.ConfigID)
-	assert.True(t, job.Enabled)
+	assert.True(t, job.GetEnabled())
 
 	// Test case 2: Try to use another user's config
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -420,7 +420,7 @@ func TestHandleUpdateJob(t *testing.T) {
 		Name:      jobName,
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 
@@ -435,7 +435,7 @@ func TestHandleUpdateJob(t *testing.T) {
 	assert.NoError(t, err, "Should find the newly created job")
 	assert.Equal(t, jobName, createdJob.Name, "Created job should have the expected name")
 	assert.Equal(t, "*/5 * * * *", createdJob.Schedule, "Created job should have the expected schedule")
-	assert.True(t, createdJob.Enabled, "Created job should be enabled")
+	assert.True(t, createdJob.GetEnabled(), "Created job should be enabled")
 
 	// Add route
 	router.PUT("/jobs/:id", handlers.HandleUpdateJob)
@@ -482,7 +482,7 @@ func TestHandleUpdateJob(t *testing.T) {
 	// Verify individual fields one by one
 	assert.Equal(t, updatedName, updatedJob.Name, "Job name should be updated")
 	assert.Equal(t, "0 0 * * *", updatedJob.Schedule, "Job schedule should be updated")
-	assert.False(t, updatedJob.Enabled, "Enabled status should be false")
+	assert.False(t, updatedJob.GetEnabled(), "Enabled status should be false")
 
 	// Make sure the ConfigIDs are still correct
 	configIDs := updatedJob.GetConfigIDsList()
@@ -493,7 +493,7 @@ func TestHandleUpdateJob(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	result = database.Create(otherUser)
@@ -504,7 +504,7 @@ func TestHandleUpdateJob(t *testing.T) {
 		Name:      "Other User Job " + time.Now().Format("20060102150405"),
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	// Make sure the other job also has a config list set
@@ -557,7 +557,7 @@ func TestHandleUpdateJobWithMultipleConfigs(t *testing.T) {
 		Name:      "Test Job for Multi-config Update",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	// Set initial configs (just config1)
@@ -596,7 +596,7 @@ func TestHandleUpdateJobWithMultipleConfigs(t *testing.T) {
 
 	assert.Equal(t, "Updated Multi-Config Job", updatedJob.Name)
 	assert.Equal(t, "0 * * * *", updatedJob.Schedule)
-	assert.True(t, updatedJob.Enabled)
+	assert.True(t, updatedJob.GetEnabled())
 
 	// The primary ConfigID should be updated to the first config in the new list
 	assert.Equal(t, config2.ID, updatedJob.ConfigID)
@@ -623,7 +623,7 @@ func TestHandleDeleteJob(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -651,7 +651,7 @@ func TestHandleDeleteJob(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -660,7 +660,7 @@ func TestHandleDeleteJob(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)
@@ -683,7 +683,7 @@ func TestHandleRunJob(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -711,7 +711,7 @@ func TestHandleRunJob(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -720,7 +720,7 @@ func TestHandleRunJob(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)
@@ -744,7 +744,7 @@ func TestHandleJobRunDetails(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -791,7 +791,7 @@ func TestHandleJobsFilter(t *testing.T) {
 		Name:      "Test Job 1",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job1)
@@ -800,7 +800,7 @@ func TestHandleJobsFilter(t *testing.T) {
 		Name:      "Test Job 2",
 		Schedule:  "*/10 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   false,
+		Enabled:   BoolPtr(false),
 		CreatedBy: user.ID,
 	}
 	database.Create(job2)
@@ -809,7 +809,7 @@ func TestHandleJobsFilter(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -818,7 +818,7 @@ func TestHandleJobsFilter(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)
@@ -881,7 +881,7 @@ func TestHandleJobHistory(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -976,7 +976,7 @@ func TestHandleJobSchedule(t *testing.T) {
 		Name:      "Test Job",
 		Schedule:  "*/5 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: user.ID,
 	}
 	database.Create(job)
@@ -1060,7 +1060,7 @@ func TestHandleJobSchedule(t *testing.T) {
 	otherUser := &db.User{
 		Email:              "other@example.com",
 		PasswordHash:       "hashedpassword",
-		IsAdmin:            false,
+		IsAdmin:            BoolPtr(false),
 		LastPasswordChange: time.Now(),
 	}
 	database.Create(otherUser)
@@ -1069,7 +1069,7 @@ func TestHandleJobSchedule(t *testing.T) {
 		Name:      "Other User Job",
 		Schedule:  "*/15 * * * *",
 		ConfigID:  config.ID,
-		Enabled:   true,
+		Enabled:   BoolPtr(true),
 		CreatedBy: otherUser.ID,
 	}
 	database.Create(otherJob)

internal/web/handlers/oauth_handlers.go

@@ -0,0 +1,239 @@
+package handlers
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+)
+
+// GoogleDriveAuthHandler initiates the Google Drive OAuth flow
+func (h *Handlers) HandleGoogleDriveAuth(c *gin.Context) {
+	configID := c.Query("config_id")
+	if configID == "" {
+		RenderErrorPage(c, "Missing config_id parameter", "")
+		return
+	}
+
+	// Prepare for the OAuth flow
+	dataDir := os.Getenv("DATA_DIR")
+	if dataDir == "" {
+		dataDir = "./data"
+	}
+
+	// Ensure oauth directory exists
+	oauthDir := filepath.Join(dataDir, "oauth")
+	if err := os.MkdirAll(oauthDir, 0755); err != nil {
+		RenderErrorPage(c, "Failed to create oauth directory", err.Error())
+		return
+	}
+
+	// Get rclone path
+	rclonePath := os.Getenv("RCLONE_PATH")
+	if rclonePath == "" {
+		rclonePath = "rclone"
+	}
+
+	// Set up a temporary rclone config
+	tempConfigPath := filepath.Join(oauthDir, fmt.Sprintf("temp_gdrive_%s.conf", configID))
+
+	// Build rclone command to get auth URL
+	cmd := exec.Command(
+		rclonePath,
+		"config",
+		"create",
+		"temp_gdrive",
+		"drive",
+		"--config",
+		tempConfigPath,
+	)
+
+	// Set a timeout context
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 30*time.Second)
+	defer cancel()
+
+	// Run the command with proper context handling
+	// We can't use exec.CommandContext directly since we're creating the command differently
+	// So we'll use a goroutine with the context's Done() channel to handle cancellation
+	go func() {
+		<-ctx.Done() // Wait for context to be done (timeout or cancellation)
+		if cmd.Process != nil {
+			if err := cmd.Process.Kill(); err != nil {
+				RenderErrorPage(c, "Failed to kill rclone process", err.Error())
+			}
+		}
+	}()
+
+	// Run the command to get the browser URL (this will fail in a specific way)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		outputStr := string(output)
+
+		// Look for the URL in the output
+		authURL := extractAuthURL(outputStr)
+		if authURL == "" {
+			RenderErrorPage(c, "Failed to get Google Drive authentication URL", outputStr)
+			return
+		}
+
+		// Store the config ID in the session
+		session := sessions.Default(c)
+		session.Set("gdrive_config_id", configID)
+		session.Set("gdrive_temp_config", tempConfigPath)
+		if err := session.Save(); err != nil {
+			RenderErrorPage(c, "Failed to save session", err.Error())
+			return
+		}
+
+		// Use component rendering instead of HTML template
+		// This would typically use a component like:
+		// components.GDriveAuth(c.Request.Context(), components.GDriveAuthData{
+		//    AuthURL: authURL,
+		//    ConfigID: configID,
+		// }).Render(c.Request.Context(), c.Writer)
+		// For now, we'll redirect to the configs page with the auth URL and config ID
+		c.Redirect(http.StatusFound, fmt.Sprintf("/configs/%s/gdrive-auth?auth_url=%s",
+			configID, url.QueryEscape(authURL)))
+		return
+	}
+
+	// If we get here, something unexpected happened
+	RenderErrorPage(c, "Unexpected result from rclone", string(output))
+}
+
+// HandleGoogleDriveCallback handles the manual entry of the OAuth code
+func (h *Handlers) HandleGoogleDriveCallback(c *gin.Context) {
+	// Get the auth code from form submission
+	authCode := c.PostForm("auth_code")
+	if authCode == "" {
+		RenderErrorPage(c, "Missing authentication code", "")
+		return
+	}
+
+	// Get the config ID from the session
+	session := sessions.Default(c)
+	configID := session.Get("gdrive_config_id")
+	tempConfigPath := session.Get("gdrive_temp_config")
+
+	if configID == nil || tempConfigPath == nil {
+		RenderErrorPage(c, "Session expired or invalid. Please try again.", "")
+		return
+	}
+
+	// Get rclone path
+	rclonePath := os.Getenv("RCLONE_PATH")
+	if rclonePath == "" {
+		rclonePath = "rclone"
+	}
+
+	// Complete the OAuth flow with the provided code
+	cmd := exec.Command(
+		rclonePath,
+		"config",
+		"reconnect",
+		"temp_gdrive:",
+		"--config",
+		tempConfigPath.(string),
+	)
+
+	// Create a pipe for stdin
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		RenderErrorPage(c, "Failed to create stdin pipe", err.Error())
+		return
+	}
+
+	// Start the command
+	if err := cmd.Start(); err != nil {
+		RenderErrorPage(c, "Failed to start rclone command", err.Error())
+		return
+	}
+
+	// Write the auth code to stdin
+	fmt.Fprintln(stdin, authCode)
+	stdin.Close()
+
+	// Wait for the command to complete
+	if err := cmd.Wait(); err != nil {
+		RenderErrorPage(c, "Failed to complete Google Drive authentication", err.Error())
+		return
+	}
+
+	// Read the token from the config file
+	configData, err := ioutil.ReadFile(tempConfigPath.(string))
+	if err != nil {
+		RenderErrorPage(c, "Failed to read token from config file", err.Error())
+		return
+	}
+
+	// Extract token from config
+	token := extractToken(string(configData))
+	if token == "" {
+		RenderErrorPage(c, "Failed to extract token from config", "")
+		return
+	}
+
+	// Store the token in the database
+	configIDStr := configID.(string)
+	if err := h.DB.StoreGoogleDriveToken(configIDStr, token); err != nil {
+		RenderErrorPage(c, "Failed to save token", err.Error())
+		return
+	}
+
+	// Clean up temporary config
+	os.Remove(tempConfigPath.(string))
+
+	// Clear session data
+	session.Delete("gdrive_config_id")
+	session.Delete("gdrive_temp_config")
+	if err := session.Save(); err != nil {
+		RenderErrorPage(c, "Failed to save session", err.Error())
+		return
+	}
+
+	// Redirect to the configs page
+	c.Redirect(http.StatusFound, "/configs?status=gdrive_auth_success")
+}
+
+// Helper function to extract the authentication URL from rclone output
+func extractAuthURL(output string) string {
+	// This is a simplified version - you may need to improve the regex
+	// to handle different output formats from rclone
+	lines := strings.Split(output, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, "http") && strings.Contains(line, "accounts.google.com") {
+			// Extract the URL - this is a simplified approach
+			words := strings.Fields(line)
+			for _, word := range words {
+				if strings.HasPrefix(word, "http") {
+					return word
+				}
+			}
+		}
+	}
+	return ""
+}
+
+// Helper function to extract token from rclone config
+func extractToken(configData string) string {
+	// Look for the token JSON in the config
+	lines := strings.Split(configData, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, "token") {
+			parts := strings.SplitN(line, "=", 2)
+			if len(parts) == 2 {
+				return strings.TrimSpace(parts[1])
+			}
+		}
+	}
+	return ""
+}

internal/web/handlers/routes.go

@@ -31,6 +31,12 @@ func (h *Handlers) RegisterRoutes(router *gin.Engine) {
 		authorized.PUT("/configs/:id", h.HandleUpdateConfig)
 		authorized.POST("/configs/:id", h.HandleUpdateConfig)
 		authorized.DELETE("/configs/:id", h.HandleDeleteConfig)
+
+		// Google Drive authentication routes
+		authorized.GET("/configs/:id/gdrive-auth", h.HandleGDriveAuth)
+		authorized.GET("/configs/gdrive-callback", h.HandleGDriveAuthCallback)
+		authorized.GET("/configs/gdrive-token", h.HandleGDriveTokenProcess)
+
 		authorized.GET("/jobs", h.HandleJobs)
 		authorized.GET("/jobs/new", h.HandleNewJob)
 		authorized.GET("/jobs/:id", h.HandleEditJob)

internal/web/handlers/test_utils.go

@@ -81,8 +81,8 @@ func setupTestDB(t *testing.T) *db.DB {
 	admin := db.User{
 		Email:        testEmail,
 		PasswordHash: string(hashedPassword),
-		IsAdmin:      true,
 	}
+	admin.SetIsAdmin(true)
 
 	if err := gormDB.Create(&admin).Error; err != nil {
 		t.Fatalf("Failed to create test admin user: %v", err)

internal/web/handlers/user_handlers.go

@@ -57,9 +57,9 @@ func (h *Handlers) HandleCreateUser(c *gin.Context) {
 	user := db.User{
 		Email:              email,
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            isAdmin,
 		LastPasswordChange: time.Now(),
 	}
+	user.SetIsAdmin(isAdmin)
 
 	if err := h.DB.Create(&user).Error; err != nil {
 		c.String(http.StatusInternalServerError, "Failed to create user")
@@ -130,21 +130,22 @@ func (h *Handlers) HandleRegister(c *gin.Context) {
 		return
 	}
 
-	// Create the admin user
+	// Create the user
 	user := db.User{
 		Email:              email,
 		PasswordHash:       string(hashedPassword),
-		IsAdmin:            true,
 		LastPasswordChange: time.Now(),
 	}
+	// Set as regular user (not admin)
+	user.SetIsAdmin(false)
 
 	if err := h.DB.Create(&user).Error; err != nil {
 		c.String(http.StatusInternalServerError, "Failed to create user")
 		return
 	}
 
-	// Generate JWT
-	token, err := h.GenerateJWT(user.ID, user.Email, user.IsAdmin)
+	// Generate JWT token
+	token, err := h.GenerateJWT(user.ID, user.Email, user.GetIsAdmin())
 	if err != nil {
 		c.String(http.StatusInternalServerError, "Failed to generate token")
 		return

internal/web/handlers/user_handlers_test.go

@@ -299,7 +299,7 @@ func TestHandleRegister(t *testing.T) {
 	err := database.Where("email = ?", formData.Get("email")).First(&user).Error
 	assert.NoError(t, err)
 	assert.Equal(t, formData.Get("email"), user.Email)
-	assert.True(t, user.IsAdmin)
+	assert.True(t, user.GetIsAdmin())
 
 	// Verify JWT cookie was set
 	cookies := resp.Result().Cookies()

internal/web/handlers/webhook_test.go

@@ -57,12 +57,12 @@ func TestWebhookConfiguration(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify webhook settings were saved correctly
-	assert.True(t, job.WebhookEnabled)
+	assert.True(t, job.GetWebhookEnabled())
 	assert.Equal(t, "https://example.com/webhook", job.WebhookURL)
 	assert.Equal(t, "test-secret", job.WebhookSecret)
 	assert.Equal(t, `{"X-Test-Header": "test-value"}`, job.WebhookHeaders)
-	assert.True(t, job.NotifyOnSuccess)
-	assert.True(t, job.NotifyOnFailure)
+	assert.True(t, job.GetNotifyOnSuccess())
+	assert.True(t, job.GetNotifyOnFailure())
 }
 
 // TestWebhookEditConfiguration tests editing webhook configuration
@@ -75,8 +75,8 @@ func TestWebhookEditConfiguration(t *testing.T) {
 		Name:           "Initial Job",
 		ConfigID:       config.ID,
 		Schedule:       "*/30 * * * *",
-		Enabled:        true,
-		WebhookEnabled: false, // Initially disabled
+		Enabled:        BoolPtr(true),
+		WebhookEnabled: BoolPtr(false), // Initially disabled
 		CreatedBy:      user.ID,
 		CreatedAt:      time.Now(),
 		UpdatedAt:      time.Now(),
@@ -116,12 +116,12 @@ func TestWebhookEditConfiguration(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify webhook settings were updated correctly
-	assert.True(t, updatedJob.WebhookEnabled)
+	assert.True(t, updatedJob.GetWebhookEnabled())
 	assert.Equal(t, "https://example.com/webhook", updatedJob.WebhookURL)
 	assert.Equal(t, "new-secret", updatedJob.WebhookSecret)
 	assert.Equal(t, `{"X-Api-Key": "12345"}`, updatedJob.WebhookHeaders)
-	assert.True(t, updatedJob.NotifyOnSuccess)
-	assert.False(t, updatedJob.NotifyOnFailure)
+	assert.True(t, updatedJob.GetNotifyOnSuccess())
+	assert.False(t, updatedJob.GetNotifyOnFailure())
 }
 
 // TestDisablingWebhook tests disabling a previously enabled webhook
@@ -134,13 +134,13 @@ func TestDisablingWebhook(t *testing.T) {
 		Name:            "Webhook Enabled Job",
 		ConfigID:        config.ID,
 		Schedule:        "*/30 * * * *",
-		Enabled:         true,
-		WebhookEnabled:  true,
+		Enabled:         BoolPtr(true),
+		WebhookEnabled:  BoolPtr(true),
 		WebhookURL:      "https://example.com/webhook",
 		WebhookSecret:   "secret",
 		WebhookHeaders:  `{"X-Test": "test"}`,
-		NotifyOnSuccess: true,
-		NotifyOnFailure: true,
+		NotifyOnSuccess: BoolPtr(true),
+		NotifyOnFailure: BoolPtr(true),
 		CreatedBy:       user.ID,
 		CreatedAt:       time.Now(),
 		UpdatedAt:       time.Now(),
@@ -178,7 +178,7 @@ func TestDisablingWebhook(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify webhook was disabled
-	assert.False(t, updatedJob.WebhookEnabled)
+	assert.False(t, updatedJob.GetWebhookEnabled())
 
 	// Other fields should remain unchanged
 	assert.Equal(t, "https://example.com/webhook", updatedJob.WebhookURL)
@@ -241,3 +241,7 @@ func TestWebhookValidation(t *testing.T) {
 	assert.NotEqual(t, http.StatusFound, resp.Code)
 	assert.Contains(t, resp.Body.String(), "valid JSON")
 }
+
+func BoolPtr(b bool) *bool {
+	return &b
+}

main.go

@@ -71,11 +71,11 @@ func main() {
 
 		// Create admin user
 		adminUser := &db.User{
-			Email:           "admin@example.com",
+			Email:              "admin@example.com",
 			PasswordHash:       string(hashedPassword),
-			IsAdmin:            true,
 			LastPasswordChange: time.Now(),
 		}
+		adminUser.SetIsAdmin(true)
 
 		if err := database.CreateUser(adminUser); err != nil {
 			log.Fatalf("Failed to create admin user: %v", err)