docs: release notes for v3.5.3-beta

.env.example

@@ -14,6 +14,7 @@ CORS_ALLOWED_ORIGINS=
 AUTH_RATE_LIMIT_MAX_ATTEMPTS=5
 AUTH_RATE_LIMIT_WINDOW_SECONDS=60
 TRUSTED_PROXIES=
+SMTP_ALLOW_INSECURE=false
 UPDATE_FEED_URL=https://git.floriansylvain.fr
 RENEWCMS_CONTAINER=false
 IMAGE_VARIANT_MAX_SOURCE_BYTES=10485760

.gitignore

@@ -29,3 +29,7 @@ CLAUDE.md
 AGENTS.md
 codex-workflow.md
 CODING_STANDARDS.md
+
+# Generated LLM docs
+internal/infrastructure/llmdocs/generated/*
+!internal/infrastructure/llmdocs/generated/.gitkeep

Dockerfile

@@ -4,6 +4,10 @@ COPY web/package.json web/bun.lock ./
 RUN bun install --frozen-lockfile
 COPY web/ ./
 RUN bun run build-only
+WORKDIR /src
+COPY docs/ ./docs/
+COPY scripts/generate-llms.ts ./scripts/generate-llms.ts
+RUN bun scripts/generate-llms.ts
 
 FROM golang:1.27.3-alpine AS server
 ARG VERSION=dev
@@ -13,6 +17,7 @@ COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 COPY --from=web /src/internal/infrastructure/assets/dist ./internal/infrastructure/assets/dist
+COPY --from=web /src/internal/infrastructure/llmdocs/generated ./internal/infrastructure/llmdocs/generated
 RUN go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/renewcms ./cmd/server
 
 FROM alpine:3.22

README.md

@@ -47,6 +47,7 @@ task dev                # API with hot reload + Vite HMR → http://localhost:51
 | [docs/deployment.md](docs/deployment.md) | Building release binaries, running as a service, HTTPS, backups, upgrades |
 | [docs/docker.md](docs/docker.md) | Running RenewCMS in Docker: image, Compose, data volume, backups, reverse proxy, tags, upgrades, publishing |
 | [docs/configuration.md](docs/configuration.md) | Every environment variable |
+| [docs/privacy.md](docs/privacy.md) | Personal data stored, retention, cookies, outbound connections and GDPR requests |
 | [docs/architecture.md](docs/architecture.md) | Backend layering and how the SPA is embedded |
 | [docs/performance.md](docs/performance.md) | Measured costs, such as the `?seo=` article filter |
 | [docs/api.md](docs/api.md) | API reference: authentication, API keys, routes and the activity log |

Taskfile.yml

@@ -3,6 +3,7 @@ version: '3'
 vars:
   BINARY: renewcms
   DIST_DIR: internal/infrastructure/assets/dist
+  LLMS_DIR: internal/infrastructure/llmdocs/generated
   VERSION:
     sh: git describe --tags --always --dirty
   LDFLAGS: -s -w -X main.version={{.VERSION}}
@@ -32,6 +33,7 @@ tasks:
 
   dev:api:
     desc: Run the API with hot reload on :8080 (SPA not embedded)
+    deps: [build:llms]
     cmds:
       - air
 
@@ -231,22 +233,36 @@ tasks:
     desc: Type-check and build the SPA into {{.DIST_DIR}}
     dir: web
     deps: [web:install]
-    sources: [src/**/*, public/**/*, index.html, vite.config.ts, tsconfig*.json, package.json, bun.lock]
+    sources: [src/**/*, public/**/*, vite/**/*, index.html, vite.config.ts, tsconfig*.json, package.json, bun.lock]
     generates: ['../{{.DIST_DIR}}/index.html']
     cmds:
       - bun run build
 
+  build:llms:
+    desc: Generate llms.txt, llms-full.txt and openapi.json from the route catalogue and docs/ → {{.LLMS_DIR}}
+    deps: [web:install]
+    sources: [scripts/generate-llms.ts, web/src/data/apiCatalogue.ts, docs/api.md, docs/api/*.md, docs/llm/*.md, docs/configuration.md]
+    generates: ['{{.LLMS_DIR}}/llms-full.txt']
+    cmds:
+      - bun scripts/generate-llms.ts
+
   build:
     desc: Production binary for this machine → bin/{{.BINARY}}
-    deps: [build:web]
+    deps: [build:web, build:llms]
     cmds:
       - go build -trimpath -ldflags "{{.LDFLAGS}}" -o bin/{{.BINARY}}{{exeExt}} ./cmd/server
 
+  build:mcp:
+    desc: MCP server (stdio) for this machine → bin/{{.BINARY}}-mcp
+    cmds:
+      - go build -trimpath -ldflags "{{.LDFLAGS}}" -o bin/{{.BINARY}}-mcp{{exeExt}} ./cmd/mcp
+
   release:
     desc: Cross-compile and sign production binaries for all release targets → bin/ (needs RELEASE_SIGNING_KEY)
     cmds:
       - task: release:check
       - task: build:web
+      - task: build:llms
       - for: { var: RELEASE_TARGETS }
         task: build:target
         vars:

api/dependecyInjection.go

@@ -12,6 +12,7 @@ import (
 	domainInvite "RenewCMS/internal/domain/invite"
 	domainMail "RenewCMS/internal/domain/mail"
 	domainPurge "RenewCMS/internal/domain/purge"
+	domainSession "RenewCMS/internal/domain/session"
 	domainSite "RenewCMS/internal/domain/site"
 	domainTransaction "RenewCMS/internal/domain/transaction"
 	domainUpdate "RenewCMS/internal/domain/update"
@@ -46,6 +47,7 @@ type UseCases struct {
 	Token                           *authtoken.Auth
 	PurgeScheduler                  *scheduler.Runner
 	ActivityCleanupScheduler        *scheduler.Runner
+	RetentionScheduler              *scheduler.Runner
 	CreateArticleUseCase            *useCases.CreateArticleUseCase
 	GetArticleUseCase               *useCases.GetArticleUseCase
 	ListArticlesUseCase             *useCases.ListArticlesUseCase
@@ -139,7 +141,7 @@ type UseCases struct {
 
 func (c *UseCases) RunSchedulers(ctx context.Context) {
 	var running sync.WaitGroup
-	for _, runner := range []*scheduler.Runner{c.PurgeScheduler, c.ActivityCleanupScheduler} {
+	for _, runner := range []*scheduler.Runner{c.PurgeScheduler, c.ActivityCleanupScheduler, c.RetentionScheduler} {
 		if runner == nil {
 			continue
 		}
@@ -168,6 +170,7 @@ type Repositories struct {
 	VariantRenderer   domainImage.VariantRenderer
 	InviteRepo        domainInvite.Repository
 	APIKeyRepo        domainAPIKey.Repository
+	SessionRepo       domainSession.Repository
 	PurgeSettingsRepo domainPurge.Repository
 	AuditRepo         domainAudit.Repository
 	AuditSettingsRepo domainAudit.SettingsRepository
@@ -311,6 +314,7 @@ func getRepositories(connection *database.Connection, settings config.Settings)
 		VariantRenderer:   imaging.NewVariantRenderer(),
 		InviteRepo:        persistence.NewInviteRepository(db),
 		APIKeyRepo:        persistence.NewAPIKeyRepository(db),
+		SessionRepo:       persistence.NewRevokedSessionRepository(db),
 		PurgeSettingsRepo: persistence.NewPurgeSettingsRepository(db),
 		AuditRepo:         persistence.NewAuditEventRepository(db),
 		AuditSettingsRepo: persistence.NewAuditSettingsRepository(db),
@@ -346,7 +350,8 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 	return &UseCases{
 		PurgeScheduler:                  scheduler.NewSystemRunner(purgeScheduler, log.Default()),
 		ActivityCleanupScheduler:        scheduler.NewSystemCleanupRunner(activityCleanup, log.Default()),
-		Token:                           authtoken.New([]byte(settings.JWTSecret)),
+		RetentionScheduler:              scheduler.NewSystemRetentionRunner(useCases.NewEnforceRetentionUseCase(repos.UserRepo, repos.InviteRepo, repos.SessionRepo), log.Default()),
+		Token:                           authtoken.New([]byte(settings.JWTSecret), authtoken.WithRevocationStore(useCases.NewSessionRevocationUseCase(repos.SessionRepo, time.Now))),
 		CreateArticleUseCase:            useCases.NewCreateArticleUseCase(repos.ArticleRepo, renderer, recorder, repos.SiteRepo, repos.AuthorRepo),
 		GetArticleUseCase:               useCases.NewGetArticleUseCase(repos.ArticleRepo, renderer),
 		ListArticlesUseCase:             useCases.NewListArticlesUseCase(repos.ArticleRepo, renderer, repos.SiteRepo),
@@ -395,7 +400,7 @@ func getUseCases(repos *Repositories, imageStorage domainImage.Storage, settings
 		GetInviteUseCase:                useCases.NewGetInviteUseCase(repos.InviteRepo, hasher),
 		AcceptInviteUseCase:             useCases.NewAcceptInviteUseCase(repos.UserRepo, repos.InviteRepo, hasher, recorder),
 		SendMailUseCase:                 useCases.NewSendMailUseCase(repos.MailRepo),
-		CreateImageUseCase:              useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage, recorder),
+		CreateImageUseCase:              useCases.NewCreateImageUseCase(repos.ImageRepo, imageStorage, recorder, imaging.NewMetadataStripper()),
 		OpenMediaUseCase:                useCases.NewOpenMediaUseCase(imageStorage),
 		ListMediaUseCase:                useCases.NewListMediaUseCase(repos.ImageRepo, repos.ArticleRepo, repos.UserRepo, repos.VariantFileRepo, repos.SiteRepo, repos.AuthorRepo, repos.ContentTypeRepo, repos.EntryRepo),
 		RenameMediaUseCase:              useCases.NewRenameMediaUseCase(repos.ImageRepo, recorder),

api/handlers/article/articleHandler.go

@@ -506,6 +506,11 @@ func isVerifiedCaller(r *http.Request, getUser *useCases.GetUserUseCase) bool {
 		return false
 	}
 
+	tokenVersion, ok := claims.TokenVersion(r)
+	if !ok || tokenVersion != currentUser.TokenVersion {
+		return false
+	}
+
 	return currentUser.IsVerified
 }
 

api/handlers/auth/acceptInviteHandler.go

@@ -95,6 +95,8 @@ func writeAcceptInviteError(w http.ResponseWriter, err error) {
 		http.Error(w, apperr.UsernameTakenErrorMessage, http.StatusConflict)
 	case errors.Is(err, invite.ErrEmailHasAccount):
 		http.Error(w, apperr.EmailHasAccountErrorMessage, http.StatusConflict)
+	case errors.Is(err, user.ErrPasswordTooLong):
+		http.Error(w, apperr.PasswordTooLongErrorMessage, http.StatusBadRequest)
 	default:
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 	}

api/handlers/auth/loginHandler.go

@@ -41,12 +41,13 @@ func NewLoginHandler(token *authtoken.Auth, create *useCases.CreateUserUseCase,
 
 func removeJwtCookie(w http.ResponseWriter, isProduction bool) {
 	http.SetCookie(w, &http.Cookie{
-		Name:     "jwt",
+		Name:     authtoken.CookieName,
 		Value:    "",
 		Expires:  time.Now(),
 		MaxAge:   -1,
 		Secure:   isProduction,
 		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
 		Path:     "/",
 	})
 }
@@ -57,11 +58,12 @@ func setJwtCookie(w http.ResponseWriter, token *authtoken.Auth, isProduction boo
 		return err
 	}
 	http.SetCookie(w, &http.Cookie{
-		Name:     "jwt",
+		Name:     authtoken.CookieName,
 		Value:    tokenString,
 		Expires:  time.Now().Add(authtoken.SessionLifetime),
 		Secure:   isProduction,
 		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
 		Path:     "/",
 	})
 	return nil
@@ -122,6 +124,10 @@ func (h *LoginHandler) Register(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, apperr.RegistrationClosedErrorMessage, http.StatusForbidden)
 			return
 		}
+		if errors.Is(err, user.ErrPasswordTooLong) {
+			http.Error(w, apperr.PasswordTooLongErrorMessage, http.StatusBadRequest)
+			return
+		}
 		http.Error(w, apperr.RegistrationFailedErrorMessage, http.StatusInternalServerError)
 		return
 	}
@@ -139,8 +145,14 @@ func (h *LoginHandler) RegistrationStatus(w http.ResponseWriter, _ *http.Request
 }
 
 func (h *LoginHandler) Logout(w http.ResponseWriter, r *http.Request) {
-	h.AuthenticateUseCase.Logout(r.Context())
 	removeJwtCookie(w, h.IsProduction)
+	if claims, err := authtoken.FromContext(r.Context()); err == nil {
+		if err := h.Token.Revoke(claims); err != nil {
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+			return
+		}
+	}
+	h.AuthenticateUseCase.Logout(r.Context())
 	message, _ := json.Marshal(map[string]any{"message": "User logged out! HTTPonly jwt cookie deleted"})
 	_, _ = w.Write(message)
 }

api/handlers/auth/passwordResetHandler.go

@@ -72,6 +72,10 @@ func (h *PasswordResetHandler) ResetPassword(w http.ResponseWriter, r *http.Requ
 			http.Error(w, apperr.PasswordResetFailedErrorMessage, http.StatusForbidden)
 			return
 		}
+		if errors.Is(err, user.ErrPasswordTooLong) {
+			http.Error(w, apperr.PasswordTooLongErrorMessage, http.StatusBadRequest)
+			return
+		}
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}

api/handlers/contenttype/contentTypeHandler.go

@@ -92,6 +92,8 @@ func writeContentTypeError(w http.ResponseWriter, err error) {
 		http.Error(w, apperr.ContentTypeKeyTakenErrorMessage, http.StatusConflict)
 	case errors.Is(err, domain.ErrHasEntries):
 		http.Error(w, apperr.ContentTypeHasEntriesErrorMessage, http.StatusConflict)
+	case errors.Is(err, domain.ErrReferenced):
+		http.Error(w, apperr.ContentTypeReferencedErrorMessage, http.StatusConflict)
 	case errors.Is(err, domain.ErrSchemaIncompatible):
 		http.Error(w, apperr.SchemaIncompatibleErrorMessage, http.StatusConflict)
 	case errors.Is(err, domain.ErrInvalidName):

api/handlers/entry/entryHandler.go

@@ -43,6 +43,49 @@ type entryResponse struct {
 	CreatedAt   time.Time      `json:"created_at"`
 	UpdatedAt   time.Time      `json:"updated_at"`
 	Media       map[string]any `json:"media"`
+	Relations   map[string]any `json:"relations"`
+}
+
+type firstFieldBody struct {
+	Key   string                `json:"key"`
+	Type  contenttype.FieldType `json:"type"`
+	Value any                   `json:"value"`
+}
+
+type relationBody struct {
+	ID          uint32         `json:"id"`
+	ContentType string         `json:"content_type"`
+	FirstField  firstFieldBody `json:"first_field"`
+}
+
+type missingRelationBody struct {
+	ID      uint32 `json:"id"`
+	Missing bool   `json:"missing"`
+}
+
+func toRelationItem(item useCases.EntryRelation) any {
+	if item.Missing {
+		return missingRelationBody{ID: item.ID, Missing: true}
+	}
+	return relationBody{ID: item.ID, ContentType: item.ContentType, FirstField: firstFieldBody{Key: item.FirstField.Key, Type: item.FirstField.Type, Value: item.FirstField.Value}}
+}
+
+func toRelationsResponse(relations map[string]useCases.EntryRelations) map[string]any {
+	body := make(map[string]any, len(relations))
+	for key, held := range relations {
+		if !held.Many {
+			if len(held.Items) > 0 {
+				body[key] = toRelationItem(held.Items[0])
+			}
+			continue
+		}
+		items := make([]any, 0, len(held.Items))
+		for _, item := range held.Items {
+			items = append(items, toRelationItem(item))
+		}
+		body[key] = items
+	}
+	return body
 }
 
 type mediaBody struct {
@@ -81,6 +124,7 @@ func toResponse(typed useCases.TypedEntry) entryResponse {
 		CreatedAt:   typed.CreatedAt,
 		UpdatedAt:   typed.UpdatedAt,
 		Media:       toMediaResponse(typed.Media),
+		Relations:   toRelationsResponse(typed.Relations),
 	}
 }
 
@@ -181,7 +225,7 @@ func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, apperr.BodyErrorMessage, http.StatusBadRequest)
 		return
 	}
-	page, err := h.ListUseCase.ListPage(useCases.ListEntriesCommand{ContentTypeKey: chi.URLParam(r, "key"), Page: query.Page, Size: query.Size, Sort: query.Sort})
+	page, err := h.ListUseCase.ListPage(useCases.ListEntriesCommand{ContentTypeKey: chi.URLParam(r, "key"), Page: query.Page, Size: query.Size, Sort: query.Sort, Query: r.URL.Query().Get("q")})
 	if err != nil {
 		writeEntryError(w, err)
 		return

api/handlers/llms/llmsHandler.go

@@ -0,0 +1,76 @@
+package llms
+
+import (
+	"io/fs"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+)
+
+const (
+	versionPlaceholder = "{{VERSION}}"
+	baseURLPlaceholder = "{{BASE_URL}}"
+	pageSuffix         = ".md"
+	cacheControl       = "public, max-age=300"
+	notBuiltNotice     = "The LLM documentation was not generated for this build. Run `task build:llms`."
+)
+
+type Handler struct {
+	docs    fs.FS
+	version string
+	baseURL string
+}
+
+func NewHandler(docs fs.FS, version string, publicURL string) *Handler {
+	return &Handler{
+		docs:    docs,
+		version: version,
+		baseURL: strings.TrimRight(publicURL, "/"),
+	}
+}
+
+func (h *Handler) Register(r chi.Router) {
+	r.Get("/llms.txt", h.serve("llms.txt", "text/plain; charset=utf-8"))
+	r.Get("/llms-full.txt", h.serve("llms-full.txt", "text/plain; charset=utf-8"))
+	r.Get("/openapi.json", h.serve("openapi.json", "application/json"))
+	r.Get("/llms/{page}", h.page)
+}
+
+func (h *Handler) page(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "page")
+	if !strings.HasSuffix(name, pageSuffix) || strings.ContainsAny(name, "/\\") {
+		h.notFound(w)
+		return
+	}
+	h.write(w, path.Join("llms", name), "text/markdown; charset=utf-8")
+}
+
+func (h *Handler) serve(name string, contentType string) http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		h.write(w, name, contentType)
+	}
+}
+
+func (h *Handler) write(w http.ResponseWriter, name string, contentType string) {
+	if h.docs == nil {
+		h.notFound(w)
+		return
+	}
+	raw, err := fs.ReadFile(h.docs, name)
+	if err != nil {
+		h.notFound(w)
+		return
+	}
+	text := strings.NewReplacer(versionPlaceholder, h.version, baseURLPlaceholder, h.baseURL).Replace(string(raw))
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Cache-Control", cacheControl)
+	_, _ = w.Write([]byte(text))
+}
+
+func (h *Handler) notFound(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(http.StatusNotFound)
+	_, _ = w.Write([]byte(notBuiltNotice))
+}

api/middleware/crossOrigin.go

@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"RenewCMS/api/pkg/apperr"
+	"net/http"
+	"net/url"
+)
+
+func CrossOriginProtection(publicURL string) func(http.Handler) http.Handler {
+	protection := http.NewCrossOriginProtection()
+	if origin, ok := originOf(publicURL); ok {
+		_ = protection.AddTrustedOrigin(origin)
+	}
+	protection.SetDenyHandler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, apperr.CrossOriginErrorMessage, http.StatusForbidden)
+	}))
+
+	return func(next http.Handler) http.Handler {
+		protected := protection.Handler(next)
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Header.Get("Authorization") != "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+			protected.ServeHTTP(w, r)
+		})
+	}
+}
+
+func originOf(rawURL string) (string, bool) {
+	parsed, err := url.Parse(rawURL)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return "", false
+	}
+	return parsed.Scheme + "://" + parsed.Host, true
+}

api/middleware/rateLimit.go

@@ -14,8 +14,19 @@ type rateLimitWindow struct {
 	count int
 }
 
+type rateLimitCounters struct {
+	mu        sync.Mutex
+	window    time.Duration
+	windows   map[string]*rateLimitWindow
+	lastSweep time.Time
+}
+
 func NewRateLimiter(maxAttempts int, window time.Duration) func(http.Handler) http.Handler {
-	return newKeyedRateLimiter(maxAttempts, window, func(r *http.Request) string { return r.RemoteAddr })
+	return newKeyedRateLimiter(maxAttempts, window, connectionHostKey)
+}
+
+func connectionHostKey(r *http.Request) string {
+	return hostOf(r.RemoteAddr)
 }
 
 func NewUserRateLimiter(maxAttempts int, window time.Duration) func(http.Handler) http.Handler {
@@ -28,12 +39,11 @@ func userRateLimitKey(r *http.Request) string {
 }
 
 func newKeyedRateLimiter(maxAttempts int, window time.Duration, keyOf func(*http.Request) string) func(http.Handler) http.Handler {
-	var mu sync.Mutex
+	counters := &rateLimitCounters{window: window, windows: make(map[string]*rateLimitWindow)}
-	windows := make(map[string]*rateLimitWindow)
 
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			retryAfter, allowed := recordAttempt(&mu, windows, keyOf(r), maxAttempts, window)
+			retryAfter, allowed := counters.recordAttempt(keyOf(r), maxAttempts, time.Now())
 			if !allowed {
 				w.Header().Set("Retry-After", strconv.Itoa(retryAfter))
 				http.Error(w, apperr.TooManyRequestsErrorMessage, http.StatusTooManyRequests)
@@ -44,24 +54,36 @@ func newKeyedRateLimiter(maxAttempts int, window time.Duration, keyOf func(*http
 	}
 }
 
-func recordAttempt(mu *sync.Mutex, windows map[string]*rateLimitWindow, key string, maxAttempts int, window time.Duration) (int, bool) {
+func (c *rateLimitCounters) recordAttempt(key string, maxAttempts int, now time.Time) (int, bool) {
-	mu.Lock()
+	c.mu.Lock()
-	defer mu.Unlock()
+	defer c.mu.Unlock()
 
-	now := time.Now()
+	c.sweepExpired(now)
-	current, exists := windows[key]
+	current, exists := c.windows[key]
-	if !exists || now.Sub(current.start) >= window {
+	if !exists || now.Sub(current.start) >= c.window {
 		current = &rateLimitWindow{start: now}
-		windows[key] = current
+		c.windows[key] = current
 	}
 
 	current.count++
 	if current.count > maxAttempts {
-		return retryAfterSeconds(window - now.Sub(current.start)), false
+		return retryAfterSeconds(c.window - now.Sub(current.start)), false
 	}
 	return 0, true
 }
 
+func (c *rateLimitCounters) sweepExpired(now time.Time) {
+	if now.Sub(c.lastSweep) < c.window {
+		return
+	}
+	c.lastSweep = now
+	for key, current := range c.windows {
+		if now.Sub(current.start) >= c.window {
+			delete(c.windows, key)
+		}
+	}
+}
+
 func retryAfterSeconds(remaining time.Duration) int {
 	seconds := int(remaining / time.Second)
 	if remaining%time.Second > 0 {

api/middleware/securityHeaders.go

@@ -4,8 +4,8 @@ import "net/http"
 
 const contentSecurityPolicy = "default-src 'self'; " +
 	"script-src 'self' 'wasm-unsafe-eval'; " +
-	"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +
+	"style-src 'self' 'unsafe-inline'; " +
-	"font-src 'self' https://fonts.gstatic.com; " +
+	"font-src 'self'; " +
 	"img-src 'self' data: blob: https:; " +
 	"connect-src 'self'; " +
 	"object-src 'none'; " +

api/pkg/apperr/messages.go

@@ -16,6 +16,7 @@ const VerificationRequiredErrorMessage = "You must verify your account to access
 const PasswordResetRequestedMessage = "If an account exists for that email, a password reset link has been sent."
 const PasswordResetFailedErrorMessage = "The password reset code is invalid or has expired."
 const TooManyRequestsErrorMessage = "Too many requests. Please try again later."
+const CrossOriginErrorMessage = "Cross-origin requests are not allowed."
 const EmailHasAccountErrorMessage = "This address already has an account."
 const PendingInviteErrorMessage = "There's already a pending invite for this address."
 const InviteNotSentErrorMessage = "Couldn't send the invite. Try again in a moment."
@@ -25,6 +26,7 @@ const InviteInvalidErrorMessage = "This invite link doesn't work."
 const InviteExpiredErrorMessage = "This invite has expired."
 const OwnerRequiredErrorMessage = "Only the owner can do this."
 const UsernameTakenErrorMessage = "That username is taken. Try another."
+const PasswordTooLongErrorMessage = "The password must be 72 bytes or fewer."
 const MediaQueryErrorMessage = "The media query is invalid."
 const MediaFilenameErrorMessage = "Enter a filename."
 const MediaMergeConflictErrorMessage = "Some of the images to merge changed. Refresh and try again."
@@ -90,6 +92,7 @@ const SlugSuggestionHeader = "X-Slug-Suggestion"
 const ContentTypeNotFoundErrorMessage = "content_type_not_found"
 const ContentTypeKeyTakenErrorMessage = "content_type_key_taken"
 const ContentTypeHasEntriesErrorMessage = "content_type_has_entries"
+const ContentTypeReferencedErrorMessage = "content_type_referenced"
 const InvalidContentTypeKeyErrorMessage = "invalid_content_type_key"
 const InvalidIconErrorMessage = "invalid_icon"
 const BuiltinTypeNotFoundErrorMessage = "builtin_type_not_found"

api/pkg/authtoken/authtoken.go

@@ -2,6 +2,7 @@ package authtoken
 
 import (
 	"crypto/hmac"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
@@ -26,8 +27,14 @@ var (
 	ErrInvalid     = errors.New("token is invalid")
 	ErrExpired     = errors.New("token is expired")
 	ErrNotYetValid = errors.New("token is not yet valid")
+	ErrRevoked     = errors.New("token is revoked")
 )
 
+type RevocationStore interface {
+	Revoke(id string, expiresAt time.Time) error
+	IsRevoked(id string) (bool, error)
+}
+
 type Claims map[string]any
 
 type header struct {
@@ -36,8 +43,9 @@ type header struct {
 }
 
 type Auth struct {
-	secret []byte
+	secret      []byte
-	clock  func() time.Time
+	clock       func() time.Time
+	revocations RevocationStore
 }
 
 type Option func(*Auth)
@@ -46,6 +54,10 @@ func WithClock(clock func() time.Time) Option {
 	return func(a *Auth) { a.clock = clock }
 }
 
+func WithRevocationStore(store RevocationStore) Option {
+	return func(a *Auth) { a.revocations = store }
+}
+
 func New(secret []byte, options ...Option) *Auth {
 	auth := &Auth{secret: secret, clock: time.Now}
 	for _, option := range options {
@@ -66,6 +78,9 @@ func (a *Auth) Encode(claims map[string]any) (string, error) {
 	if _, ok := payload["exp"]; !ok {
 		payload["exp"] = now.Add(SessionLifetime).Unix()
 	}
+	if _, ok := payload["jti"]; !ok {
+		payload["jti"] = rand.Text()
+	}
 
 	headerSegment, err := encodeSegment(header{Algorithm: algorithmHS256, Type: tokenType})
 	if err != nil {
@@ -111,9 +126,46 @@ func (a *Auth) Decode(token string) (Claims, error) {
 	if err := a.validateTimes(claims); err != nil {
 		return nil, err
 	}
+	if err := a.checkRevocation(claims); err != nil {
+		return nil, err
+	}
 	return claims, nil
 }
 
+func (a *Auth) Revoke(claims Claims) error {
+	id, ok := claims["jti"].(string)
+	if !ok || a.revocations == nil {
+		return nil
+	}
+	expiry, present, err := numericDate(claims, "exp")
+	if err != nil || !present {
+		return ErrInvalid
+	}
+	return a.revocations.Revoke(id, expiry)
+}
+
+func (a *Auth) checkRevocation(claims Claims) error {
+	raw, present := claims["jti"]
+	if !present {
+		return nil
+	}
+	id, ok := raw.(string)
+	if !ok {
+		return ErrInvalid
+	}
+	if a.revocations == nil {
+		return nil
+	}
+	revoked, err := a.revocations.IsRevoked(id)
+	if err != nil {
+		return errors.Join(ErrInvalid, err)
+	}
+	if revoked {
+		return ErrRevoked
+	}
+	return nil
+}
+
 func (a *Auth) validateTimes(claims Claims) error {
 	now := a.clock()
 
@@ -121,7 +173,10 @@ func (a *Auth) validateTimes(claims Claims) error {
 	if err != nil {
 		return err
 	}
-	if present && !now.Before(expiry) {
+	if !present {
+		return ErrInvalid
+	}
+	if !now.Before(expiry) {
 		return ErrExpired
 	}
 

api/pkg/authtoken/middleware.go

@@ -8,7 +8,7 @@ import (
 )
 
 const (
-	cookieName   = "jwt"
+	CookieName   = "jwt"
 	bearerPrefix = "bearer "
 )
 
@@ -71,7 +71,7 @@ func tokenFromHeader(r *http.Request) string {
 }
 
 func tokenFromCookie(r *http.Request) string {
-	cookie, err := r.Cookie(cookieName)
+	cookie, err := r.Cookie(CookieName)
 	if err != nil {
 		return ""
 	}

api/router.go

@@ -11,6 +11,7 @@ import (
 	"RenewCMS/api/handlers/entry"
 	"RenewCMS/api/handlers/frontend"
 	"RenewCMS/api/handlers/imagevariant"
+	"RenewCMS/api/handlers/llms"
 	"RenewCMS/api/handlers/media"
 	"RenewCMS/api/handlers/settings"
 	"RenewCMS/api/handlers/site"
@@ -20,6 +21,7 @@ import (
 	"RenewCMS/api/middleware"
 	"RenewCMS/api/pkg/authtoken"
 	"RenewCMS/internal/infrastructure/config"
+	"RenewCMS/internal/infrastructure/llmdocs"
 	"encoding/json"
 	"log"
 	"net/http"
@@ -490,8 +492,10 @@ func InitRoutes(container *UseCases, settings config.Settings) *chi.Mux {
 	apiRouter := chi.NewRouter()
 	apiRouter.Use(middleware.SecurityHeaders(settings.IsProduction()))
 	enableCorsIfConfigured(apiRouter, settings.CorsAllowedOrigins)
+	apiRouter.Use(middleware.CrossOriginProtection(settings.PublicURL))
 	apiRouter.Use(chimiddleware.GetHead)
 	apiRouter.Get("/healthz", GetHealth)
+	llms.NewHandler(llmdocs.Docs, settings.Version, settings.PublicURL).Register(apiRouter)
 	apiRouter.Mount("/v1", backend)
 	apiRouter.Mount("/static/uploadedImages", staticimages.NewHandler(container.OpenMediaUseCase, container.ServeVariantUseCase))
 	apiRouter.Mount("/", frontend)

cmd/mcp/main.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"RenewCMS/internal/infrastructure/mcpserver"
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+var version = "dev"
+
+func main() {
+	allowDestructive := flag.Bool("allow-destructive", false, "also expose delete_article and delete_media")
+	showVersion := flag.Bool("version", false, "print the version and exit")
+	flag.Parse()
+	if *showVersion {
+		fmt.Println(version)
+		return
+	}
+
+	baseURL := os.Getenv("RENEWCMS_URL")
+	apiKey := os.Getenv("RENEWCMS_API_KEY")
+	if baseURL == "" || apiKey == "" {
+		log.Fatal("RENEWCMS_URL and RENEWCMS_API_KEY must be set")
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	server := mcpserver.New(mcpserver.NewClient(baseURL, apiKey, nil), mcpserver.Options{
+		Version:          version,
+		AllowDestructive: *allowDestructive,
+	})
+	if err := server.Run(ctx, &mcp.StdioTransport{}); err != nil {
+		log.Fatal(err)
+	}
+}

cmd/server/main.go

@@ -41,27 +41,28 @@ var requiredEnvVars = []string{
 }
 
 var envDefaults = map[string]string{
-	"ENVIRONMENT":                         "production",
+	"ENVIRONMENT":                              "production",
-	"PORT":                                "8080",
+	"PORT":                                     "8080",
-	"DB_FILE":                             "./data/renewcms.db",
+	"DB_FILE":                                  "./data/renewcms.db",
-	config.EnvDatabaseDriver:              config.DefaultDatabaseDriver,
+	config.EnvDatabaseDriver:                   config.DefaultDatabaseDriver,
-	"DB_TLS":                              config.DefaultDatabaseTLS,
+	"DB_TLS":                                   config.DefaultDatabaseTLS,
-	"DB_SSLMODE":                          config.DefaultDatabaseSSLMode,
+	"DB_SSLMODE":                               config.DefaultDatabaseSSLMode,
-	"DB_MAX_OPEN_CONNS":                   config.DefaultMaxOpenConns,
+	"DB_MAX_OPEN_CONNS":                        config.DefaultMaxOpenConns,
-	"DB_MAX_IDLE_CONNS":                   config.DefaultMaxIdleConns,
+	"DB_MAX_IDLE_CONNS":                        config.DefaultMaxIdleConns,
-	"DB_CONN_MAX_LIFETIME_SECONDS":        config.DefaultConnMaxLifetimeSeconds,
+	"DB_CONN_MAX_LIFETIME_SECONDS":             config.DefaultConnMaxLifetimeSeconds,
-	"UPLOAD_DIR":                          "./data/uploads",
+	"UPLOAD_DIR":                               "./data/uploads",
-	config.EnvStorageDriver:               config.DefaultStorageDriver,
+	config.EnvStorageDriver:                    config.DefaultStorageDriver,
-	"S3_REGION":                           config.DefaultS3Region,
+	"S3_REGION":                                config.DefaultS3Region,
-	"S3_PATH_STYLE":                       config.DefaultS3PathStyle,
+	"S3_PATH_STYLE":                            config.DefaultS3PathStyle,
-	"S3_TLS":                              config.DefaultS3TLS,
+	"S3_TLS":                                   config.DefaultS3TLS,
-	"AUTH_RATE_LIMIT_MAX_ATTEMPTS":        "5",
+	"AUTH_RATE_LIMIT_MAX_ATTEMPTS":             "5",
-	"AUTH_RATE_LIMIT_WINDOW_SECONDS":      "60",
+	"AUTH_RATE_LIMIT_WINDOW_SECONDS":           "60",
-	"TRUSTED_PROXIES":                     "",
+	"TRUSTED_PROXIES":                          "",
-	"UPDATE_FEED_URL":                     "https://git.floriansylvain.fr",
+	config.EnvSmtpAllowInsecure:                config.DefaultSmtpAllowInsecure,
-	"RENEWCMS_CONTAINER":                  "false",
+	"UPDATE_FEED_URL":                          "https://git.floriansylvain.fr",
-	config.EnvImageVariantMaxSourceBytes:  config.DefaultImageVariantMaxSourceBytes,
+	"RENEWCMS_CONTAINER":                       "false",
-	config.EnvImageVariantMaxSourcePixels: config.DefaultImageVariantMaxSourcePixels,
+	config.EnvImageVariantMaxSourceBytes:       config.DefaultImageVariantMaxSourceBytes,
+	config.EnvImageVariantMaxSourcePixels:      config.DefaultImageVariantMaxSourcePixels,
 	config.EnvImageVariantMaxConcurrentRenders: config.DefaultImageVariantMaxConcurrentRenders,
 }
 

docs/api.md

@@ -21,6 +21,12 @@ for example `https://cms.example/v1/article/`.
   or revoked key answers 401, even on public routes. The site writes (`POST`, `PATCH` and `DELETE`
   under `/v1/site`) and the author writes (`POST`, `PATCH` and `DELETE` under `/v1/author`, `POST /v1/author/me` included) are session only too.
 - Each key can make 120 requests per minute. Beyond that: 429 with a `Retry-After` header.
+- A session lasts 24 hours. `POST /v1/auth/logout` revokes it on the server, so a copied cookie
+  stops working at once; other sessions of the same user stay valid. A password reset ends every
+  session and revokes every key of that user.
+- A browser `POST`, `PUT`, `PATCH` or `DELETE` sent from another origin without an
+  `Authorization` header answers 403 "Cross-origin requests are not allowed." This blocks
+  cross-site request forgery with the cookie; scripts on other origins must send their key.
 
 ## Routes a key can call (30)
 | Group | Routes |

docs/architecture.md

@@ -55,6 +55,14 @@ The use cases `GetPurgeSettings`, `UpdatePurgeSettings`, `PreviewPurge` and `Run
 | `GET /v1/media/purge-preview` | Groups, copies, distinct articles, the first 5 groups, `more` and the fingerprint. |
 | `POST /v1/media/purge` | Runs the purge. Optional `fingerprint`; 409 when stale or when a run is in progress. |
 
+### Sessions and personal data retention
+
+A session is an HS256 token from `api/pkg/authtoken`. `Encode` adds a random `jti` and an `exp` 24 hours ahead; `Decode` refuses a token without `exp`. `authtoken.WithRevocationStore` plugs in `useCases.SessionRevocationUseCase`, which stores a `session.Revocation` (`jti`, `exp`) through the `internal/domain/session` `Repository` (`persistence.RevokedSessionRepository`, table `revoked_sessions`). `LoginHandler.Logout` revokes the presented token; from then on `Decode` answers `ErrRevoked` for it, and a store that cannot be read makes every token invalid rather than valid. Revoking every session of a user stays the job of `token_version`, bumped by a password reset.
+
+`useCases.EnforceRetentionUseCase.Tick(now)` deletes revocations past their expiry, unverified accounts 7 days after their code expired (`user.UnverifiedRetention`) and invites 30 days after they expired or were accepted (`invite.Retention`), and returns a `retention.Result`. `scheduler.NewSystemRetentionRunner` calls it one minute after startup and then hourly, logs one line only when something was removed, and stops with the other runners on shutdown.
+
+Uploads go through the `image.MetadataStripper` port before they are measured for size, hashed and stored. `imaging.MetadataStripper` walks the JPEG segments, PNG chunks and WebP RIFF chunks without re-encoding pixels, drops metadata, keeps colour profiles and re-adds an orientation-only EXIF block when the photo was rotated. A container it cannot walk fails the upload with `image.ErrImageUnreadable`.
+
 ### Activity log
 
 `internal/domain/audit` holds the append-only `Event` (actor, target and failure-reason snapshots, outcome, security flag, source, ip, user agent, `params` and `changes`), the closed vocabularies (actor type, category, outcome, source, change kind), the `Filter`, `Summary` and `Settings` types, the `Repository` interface (`Append`, `List`, `Summary`, `DeleteOlderThan`: no way to edit or delete one event), the `SettingsRepository` (`Get`, `SaveRetention`, `SaveLastCleanup`; no row means 90 days) and the sentinels `ErrInvalidFilter`, `ErrInvalidRetention`, `ErrInvalidEvent` and `ErrActorNotAllowed`. The `Recorder` port is `Record(ctx, event)`; it returns nothing, so a caller can never fail on it.

docs/configuration.md

@@ -11,7 +11,7 @@ Copy [`.env.example`](../.env.example) to `.env` to get started. When a required
 | Name            | Description                                                                                                         | Example                    |
 |-----------------|---------------------------------------------------------------------------------------------------------------------|----------------------------|
 | `PUBLIC_URL`    | Public base URL of the site, including scheme and no trailing slash. Used for links in emails and in the startup log. It is also the CMS's own address: at the first migration, when the sites table is empty, it seeds the default site (name "Default", key "default") with its scheme and host (path dropped, non-loopback `http` upgraded to `https`); an unparseable value stops the migration. It is never read for sites afterwards. | `https://cms.example.com`  |
-| `JWT_SECRET`    | Secret used to sign the auth JWT. Use a long random value; changing it logs everyone out.                            | `openssl rand -hex 32`     |
+| `JWT_SECRET`    | Secret used to sign the auth JWT. It must be at least 32 bytes, and the example values from `.env.example` and `docker.env.example` are refused: the server stops at startup with `JWT_SECRET is too weak` and how to generate one. Changing it logs everyone out. | `openssl rand -hex 32`     |
 | `SMTP_LOGIN`    | SMTP username used to authenticate with the server. Some providers (e.g. Brevo) issue a login distinct from the sender address. | `noreply@example.com` |
 | `SMTP_SENDER`   | Sender address used in the `From` header. Must be an address/domain the SMTP provider allows that login to send as.  | `noreply@example.com`      |
 | `SMTP_PASSWORD` | SMTP password.                                                                                                      |                            |
@@ -32,6 +32,7 @@ Copy [`.env.example`](../.env.example) to `.env` to get started. When a required
 | `CORS_ALLOWED_ORIGINS` | *(empty)*            | Semicolon-separated list of origins allowed to call the API. Matching is case-insensitive. An entry may contain one `*` (`https://*.preview.example.com`), and a lone `*` allows every origin. Credentials are never allowed cross-origin. When empty, no CORS headers are sent. That is the right setting whenever the SPA is served by RenewCMS itself (production) or through the Vite proxy (development). |
 | `AUTH_RATE_LIMIT_MAX_ATTEMPTS` | `5`           | Maximum number of requests a single client IP may send to `POST /v1/auth/login`, `POST /v1/auth/password-reset` or the invite-accept pair (`GET /v1/auth/invite` and `POST /v1/auth/invite/accept`, sharing one counter) within the window, tracked independently per route.                                                          |
 | `AUTH_RATE_LIMIT_WINDOW_SECONDS` | `60`        | Length, in seconds, of the fixed rate-limit window for the routes above.                                                                                                                                                    |
+| `SMTP_ALLOW_INSECURE`  | `false`              | `true` lets RenewCMS deliver mail without encryption to a server on another host that does not offer STARTTLS (a relay on a private network, a local Mailpit container). By default such delivery fails with an error naming this variable; port `465` always uses implicit TLS and `localhost`, `127.0.0.1` and `::1` are always allowed in clear text. Credentials (`SMTP_LOGIN`/`SMTP_PASSWORD`) are never sent unencrypted to another host, whatever this says. Any value other than `true` or `false` (case-insensitive) stops the server at boot. |
 | `TRUSTED_PROXIES`      | *(empty)*            | Semicolon-separated list of exact IP addresses (no CIDR) of reverse proxies allowed to supply the client IP via `X-Real-IP` for the rate limiting of the routes above. When a request's connection address is not in this list, any `X-Real-IP` or `X-Forwarded-For` header it sends is ignored and the connection address is used instead. See [deployment.md](deployment.md).      |
 | `RENEWCMS_CONTAINER` | `false` | Set to `true` (case-insensitive; any other value means `false`) when the app runs in a container. Settings then tells the owner to update by pulling a new image instead of offering browser updates, and `can_apply` is always `false`. The Dockerfile and `docker-compose.yml` set it to `true`. Update checks still work. |
 | `IMAGE_VARIANT_MAX_SOURCE_BYTES` | `10485760` | Largest stored image, in bytes, that an [image variant](image-variants.md) may be generated from. A request for a bigger source answers 413 with a plain-text body. The original is never affected, and SVG and animated GIF are always served as they are. A value that is not a whole number greater than zero stops the server at boot with an error naming the variable. |

docs/deployment.md

@@ -274,7 +274,7 @@ Either way, set `TRUSTED_PROXIES` (see [configuration.md](configuration.md)) to
 
 RenewCMS sends `Content-Security-Policy` (including `frame-ancestors 'none'`), `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy` and `Cross-Origin-Opener-Policy` itself, so the proxy doesn't need to add them. With `ENVIRONMENT=production` it also sends `Strict-Transport-Security: max-age=31536000` (browsers ignore it over plain HTTP, so serve the site over HTTPS only). Don't add the same headers in the proxy, or they will be duplicated.
 
-The CSP allows Google Fonts (`fonts.googleapis.com`, `fonts.gstatic.com`) and `https:` images, because the SPA loads its fonts from Google and articles may embed remote images. `style-src` keeps `'unsafe-inline'` for the article editor; `script-src` is `'self'` only.
+The CSP serves fonts from `'self'` only (the SPA bundles its fonts, so no visitor IP address is sent to a font CDN) and allows `https:` images, because articles may embed remote images. `style-src` keeps `'unsafe-inline'` for the article editor; `script-src` is `'self'` only.
 
 ## Using MySQL or MariaDB
 

docs/llm/gotchas.md

@@ -0,0 +1,67 @@
+# Gotchas
+
+> What trips up API clients: session-only routes, error texts, rate limits and draft visibility.
+
+## Session-only routes
+
+An API key cannot call these routes. They answer `403` with a plain-text body and no JSON:
+
+```
+HTTP/1.1 403 Forbidden
+
+This action needs a real session.
+```
+
+- `/v1/api-key/*`, `/v1/system/*`, `POST /v1/auth/verify`, `DELETE /v1/auth/register`.
+- Every activity route under `/v1/activity`.
+- Writes on sites (`POST`, `PATCH`, `DELETE` under `/v1/site`, so a key cannot create a site) and on authors (`POST`, `PATCH`, `DELETE` under `/v1/author`).
+- `PATCH /v1/settings`.
+
+Variant routes under `/v1/media/{id}/variants` answer `401` to a key instead. The sign-in routes (login, logout, register, password reset) ignore a key and give no `403`.
+
+When a task needs one of these routes, stop and tell the user to do it in the app. Do not try to log in with a password.
+
+## Error texts are plain text
+
+Errors are not JSON. The body is one sentence; branch on the status code, and show the sentence to the user.
+
+| Status | Typical text |
+| --- | --- |
+| `400` | `The request cannot be processed due to a mismatch in the format of the body.` |
+| `401` | `You must be logged in to access this resource.` |
+| `403` | `This action needs a real session.`, `Only the owner can do this.`, `Only owners and admins can do this.`, `You must verify your account to access this resource.` |
+| `404` | `Article not found`, `Image not found` |
+| `429` | `Too many requests. Please try again later.` |
+
+An invalid, unknown, expired or revoked key answers `401`, even on public routes. It is never treated as anonymous.
+
+## Rate limit: 429
+
+Each key may make 120 requests per minute. The `429` response carries a `Retry-After` header holding the seconds to wait:
+
+```
+HTTP/1.1 429 Too Many Requests
+Retry-After: 46
+
+Too many requests. Please try again later.
+```
+
+Sleep for `Retry-After` seconds, then retry once. Do not retry in a tight loop. Prefer one list call with `size=100` over many single reads.
+
+## Draft versus online
+
+- Anonymous callers and unverified users only see online articles. A draft answers `404` with `Article not found`, the same as an id that does not exist.
+- A verified session or a key sees drafts as well. In lists, `counts.draft` is `0` for anonymous callers and `status=draft` answers an empty page.
+- `POST /v1/article/` always creates a draft. Publishing is a separate call, `PATCH /v1/article/{id}/publish`.
+- Sitemaps list online articles only.
+
+## Writes
+
+- A title cannot be changed after creation. Create a new article instead.
+- `PATCH /v1/article/{id}` accepts `body`, `site_id`, `author_ids` and the SEO fields only. `{}` and `null` values answer `400`, except `cover_image_id` and `social_image_id`, where `null` removes the image.
+- Request bodies are HTML even though responses default to markdown. Send `<p>` and `<h2>`, not markdown syntax, or it is stored literally.
+- Ids in paths are unsigned integers. Anything else answers `400`.
+
+## Permissions follow the key's creator
+
+A key acts as the user who made it. A key made by a user who is neither owner nor admin cannot do what only owners and admins can, and it answers `403 Only owners and admins can do this.` Check `GET /v1/auth/me` to read the role of the key.

docs/llm/recipe-articles.md

@@ -0,0 +1,81 @@
+# Recipe: create, edit and publish an article
+
+> Create a draft, replace its body, check its SEO, publish it and read it back, with an API key.
+
+Set the key once. Every request below is real output from a running instance; ids and timestamps differ on yours.
+
+```sh
+export RENEWCMS_API_KEY=rcms_...
+```
+
+## 1. Create a draft
+
+Titles are 3 to 200 characters and cannot be changed later. The request body is HTML; the response body is markdown unless you pass `?format=html` or `?format=json`.
+
+```sh
+curl -X POST "{{BASE_URL}}/v1/article/" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"title":"How we price a bathroom renovation","body":"<p>A bathroom renovation is priced by room size, plumbing changes and finish level.</p>"}'
+```
+
+Status `201`:
+
+```json
+{"id":1,"title":"How we price a bathroom renovation","body":"A bathroom renovation is priced by room size, plumbing changes and finish level.","body_format":"markdown","is_online":false,"site_id":1,"authors":[],"created_at":"2026-10-23T01:11:16.767761797+02:00","updated_at":"2026-10-23T01:11:16.767761797+02:00","slug":"how-we-price-a-bathroom-renovation","excerpt":"","seo_title":"","seo_description":"","cover_image_id":null,"cover_image_alt":"","social_title":"","social_description":"","social_image_id":null,"canonical_url":"","noindex":false,"seo_dismissed":[]}
+```
+
+The article starts offline (`is_online: false`) on the default site.
+
+## 2. Replace the body, move it to a site, set the excerpt
+
+`PATCH` takes only `body`, `site_id`, `author_ids` and the SEO fields. At least one is required; `{}` answers `400`. Send `{"body": ""}` to empty a body.
+
+```sh
+curl -X PATCH "{{BASE_URL}}/v1/article/1" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"body":"<h2>What drives the price</h2><p>Room size, plumbing changes and finish level.</p>","site_id":2,"excerpt":"What drives the price of a bathroom renovation."}'
+```
+
+Status `200`:
+
+```json
+{"id":1,"title":"How we price a bathroom renovation","body":"## What drives the price\n\nRoom size, plumbing changes and finish level.","body_format":"markdown","is_online":false,"site_id":2,"authors":[],"created_at":"2026-10-23T01:11:16.767761797+02:00","updated_at":"2026-10-23T01:11:16.771008847+02:00","slug":"how-we-price-a-bathroom-renovation","excerpt":"What drives the price of a bathroom renovation.","seo_title":"","seo_description":"","cover_image_id":null,"cover_image_alt":"","social_title":"","social_description":"","social_image_id":null,"canonical_url":"","noindex":false,"seo_dismissed":[]}
+```
+
+## 3. Check the SEO before publishing
+
+An empty JSON object checks the saved article. Pass any SEO field to check a change without saving it.
+
+```sh
+curl -X POST "{{BASE_URL}}/v1/article/1/seo/check" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+Status `200`:
+
+```json
+{"status":"suggestions","suggestions":[{"code":"desc_short","field":"seo_description","params":{"length":47,"min":70}},{"code":"cover_none","field":"cover_image_id","params":{}},{"code":"no_au","field":"author_ids","params":{}},{"code":"short","field":"body","params":{"length":66,"min":300}}],"slug":{"available":true,"suggestion":null}}
+```
+
+Suggestions never block publishing.
+
+## 4. Publish
+
+```sh
+curl -X PATCH "{{BASE_URL}}/v1/article/1/publish" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+Status `200`, same article object with `"is_online":true`. `PATCH /v1/article/{id}/unpublish` reverses it.
+
+## 5. Read it back without credentials
+
+```sh
+curl "{{BASE_URL}}/v1/article/1?format=markdown"
+```
+
+Before step 4 this answers `404` with the text `Article not found`, because anonymous callers only see online articles.

docs/llm/recipe-media.md

@@ -0,0 +1,62 @@
+# Recipe: upload an image and attach it to an article
+
+> Upload a file with multipart form data, find it in the library and use it as an article cover.
+
+## 1. Upload
+
+Send the file in a form field named `file`. PNG, JPEG, WEBP and SVG are accepted.
+
+```sh
+curl -X POST "{{BASE_URL}}/v1/media/" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -F "file=@north-wall.png"
+```
+
+Status `201`:
+
+```json
+{"id":1,"filename":"north-wall.png","url":"/static/uploadedImages/8d9be79c-5db6-4d1d-9f06-b5d1b15cb4f0.png","size":100,"content_type":"image/png","width":32,"height":32,"sha256":"7654144c6e1ee8939fa061fa8129763869fa3c2de55954053a53a965848ef09c","uploaded_by":"florian","created_at":"2026-10-23T01:11:24.228947139+02:00","used_in":0,"duplicate":false,"variant_count":0,"variant_size":0}
+```
+
+`url` is relative to the instance: the public address is `{{BASE_URL}}` followed by `url`. `duplicate: true` means the same bytes were already in the library.
+
+## 2. Find an image
+
+```sh
+curl "{{BASE_URL}}/v1/media/?size=5" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+Status `200`:
+
+```json
+{"items":[{"id":1,"filename":"north-wall.png","url":"/static/uploadedImages/8d9be79c-5db6-4d1d-9f06-b5d1b15cb4f0.png","size":100,"content_type":"image/png","width":32,"height":32,"sha256":"7654144c6e1ee8939fa061fa8129763869fa3c2de55954053a53a965848ef09c","uploaded_by":"florian","created_at":"2026-10-23T01:11:24.228947139+02:00","used_in":0,"duplicate":false,"variant_count":0,"variant_size":0}],"total":1,"page":1,"size":5,"counts":{"all":1,"unused":1,"duplicates":0}}
+```
+
+Filter with `q`, `hash`, `filter` (`all`, `unused`, `duplicates`), `sort` and `variants`.
+
+## 3. Attach it as the cover
+
+An image is attached by id. `cover_image_alt` is the alternative text.
+
+```sh
+curl -X PATCH "{{BASE_URL}}/v1/article/1" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"cover_image_id":1,"cover_image_alt":"A tiled bathroom wall"}'
+```
+
+Status `200`, the article object with `"cover_image_id":1` and `"cover_image_alt":"A tiled bathroom wall"`. Use `social_image_id` for the sharing image, and `null` to remove either image.
+
+## 4. See where an image is used
+
+```sh
+curl "{{BASE_URL}}/v1/media/1/usage" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+```json
+[{"type":"article","id":1,"title":"How we price a bathroom renovation","published":true,"fields":["cover"]}]
+```
+
+Deleting or merging an image that is in use changes those articles, so read this first.

docs/llm/recipe-pagination.md

@@ -0,0 +1,67 @@
+# Recipe: paginate, filter and choose a body format
+
+> List articles page by page, search and sort them, and read bodies as markdown, HTML or JSON blocks.
+
+`GET /v1/article/` always answers an envelope, never a bare array:
+
+```sh
+curl "{{BASE_URL}}/v1/article/?format=html&size=5&page=1" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+```json
+{"items":[{"id":1,"title":"How we price a bathroom renovation","body":"<h2>What drives the price</h2><p>Room size, plumbing changes and finish level.</p>","body_format":"html","is_online":true,"site_id":2,"authors":[],"created_at":"2026-10-23T01:11:16.767761797+02:00","updated_at":"2026-10-23T01:11:24.236138156+02:00","excerpt":"What drives the price of a bathroom renovation.","slug":"how-we-price-a-bathroom-renovation","seo_status":"suggestions","seo_suggestions":3}],"total":1,"page":1,"size":5,"counts":{"all":1,"online":1,"draft":0,"suggestions":1}}
+```
+
+In JSON, `<` and `>` are escaped as `<` and `>`; a JSON parser returns the plain characters.
+
+## Walking every page
+
+1. Request `page=1` with the `size` you want (`5`, `25`, `50` or `100`).
+2. Read `total` and `size`. The number of pages is `ceil(total / size)`.
+3. Request the next pages until `page * size >= total`. A page past the end answers `200` with `items: []`, so an empty `items` also ends the loop.
+
+Ordering is applied to the whole list before slicing and ends with the id, so pages never overlap or skip.
+
+## Filters
+
+Combine them freely.
+
+| Parameter | Example | Effect |
+| --- | --- | --- |
+| `q` | `q=grout` | Title contains the text, ignoring case and accents. Up to 200 characters. |
+| `status` | `status=draft` | `online` or `draft`. |
+| `site` | `site=renew-blog` | Only that site's articles. |
+| `seo` | `seo=suggestions` | `ready`, `suggestions` or `hidden`. |
+| `sort` | `sort=title:asc` | `title`, `status`, `created_at` or `updated_at`, then `:asc` or `:desc`. Default `updated_at:desc`. |
+
+`counts` ignores every filter, so tab totals do not move while searching. `total` follows the filters.
+
+```sh
+curl "{{BASE_URL}}/v1/article/?site=renew-blog&status=draft&sort=title:asc&q=grout" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+```json
+{"items":[{"id":2,"title":"Draft about grout","body":"x","body_format":"markdown","is_online":false,"site_id":2,"authors":[],"created_at":"2026-10-23T01:12:24.922895943+02:00","updated_at":"2026-10-23T01:12:24.926728869+02:00","excerpt":"","slug":"draft-about-grout","seo_status":"suggestions","seo_suggestions":4}],"total":1,"page":1,"size":25,"counts":{"all":2,"online":1,"draft":1,"suggestions":2}}
+```
+
+## The `format` parameter
+
+| Value | `body` | `body_format` |
+| --- | --- | --- |
+| absent or `markdown` | markdown string | `markdown` |
+| `html` | the stored HTML | `html` |
+| `json` | array of blocks | `json` |
+
+It applies to every article route, including the writes. Request bodies of `POST` and `PATCH` stay HTML whatever the format. An invalid `format` is reported before any other error.
+
+## Invalid values
+
+A bad `page`, `size`, `status`, `sort` or `seo` answers `400` with a plain-text body:
+
+```
+The request cannot be processed due to a mismatch in the format of the body.
+```
+
+Media lists paginate the same way (`GET /v1/media/?page=2&size=50`) with their own `counts`.

docs/llm/recipe-sites.md

@@ -0,0 +1,66 @@
+# Recipe: sites and sitemaps
+
+> Create a site (session only), move an article onto it and read its public sitemap.
+
+An article belongs to one site. A site has a `key` (a slug used in URLs) and a `base_url` (the public address its pages are served from).
+
+## 1. List the sites
+
+```sh
+curl "{{BASE_URL}}/v1/site/" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY"
+```
+
+```json
+[{"id":1,"name":"Default","key":"default","base_url":"http://localhost:18080","default_social_image_id":null,"default_robots":"index","locale":null,"is_default":true,"article_count":0,"site_name":"","title_template":"%title% | %site%","default_description":""}]
+```
+
+## 2. Create a site: not with a key
+
+Creating, editing, defaulting and deleting a site need a browser session from the owner. A key answers `403`:
+
+```sh
+curl -X POST "{{BASE_URL}}/v1/site/" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"x","key":"x","base_url":"https://x.example"}'
+```
+
+```
+HTTP/1.1 403 Forbidden
+
+This action needs a real session.
+```
+
+Ask the owner to create the site in the app, or send the request with the owner's `jwt` cookie. With a session the same request answers `201`:
+
+```json
+{"id":2,"name":"Renew blog","key":"renew-blog","base_url":"https://blog.renew.example","default_social_image_id":null,"default_robots":"index","locale":null,"is_default":false,"article_count":0,"site_name":"","title_template":"%title% | %site%","default_description":""}
+```
+
+## 3. Put an article on the site
+
+Use the site `id` as `site_id`:
+
+```sh
+curl -X PATCH "{{BASE_URL}}/v1/article/1" \
+  -H "Authorization: Bearer $RENEWCMS_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"site_id":2}'
+```
+
+## 4. Read the sitemap
+
+The sitemap is public and lists the online articles of one site, by its `key`:
+
+```sh
+curl "{{BASE_URL}}/v1/site/renew-blog/sitemap"
+```
+
+```json
+[{"url":"https://blog.renew.example/how-we-price-a-bathroom-renovation","modified_at":"2026-10-22T23:11:24Z","noindex":false}]
+```
+
+`url` is the site's `base_url` plus the article slug. Drafts are not listed. The response header `X-Total-Count` holds the number of entries. Page with `page` and `size` (`25`, `50`, `100` or `500`, default `100`); any other `size` answers `400`. An unknown key answers `404` with `site_not_found`.
+
+List only one site's articles with `GET /v1/article/?site=renew-blog`.

docs/llms.md

@@ -0,0 +1,22 @@
+# LLM documentation
+
+A running instance serves its own documentation for language models, versioned with the binary:
+
+| URL | Content |
+| --- | --- |
+| `/llms.txt` | Short index with links, following llmstxt.org. |
+| `/llms-full.txt` | Every page below in one file. |
+| `/llms/<page>.md` | One page: `api-reference`, `api`, `articles`, `api-keys`, `gotchas`, `recipe-articles`, `recipe-media`, `recipe-sites`, `recipe-pagination`, `configuration`. |
+| `/openapi.json` | OpenAPI 3.1 description of the routes in the catalogue. |
+
+All of them are public. `{{VERSION}}` and `{{BASE_URL}}` in the sources are replaced by the binary's version and `PUBLIC_URL` when served.
+
+## How it is built
+
+`task build:llms` runs `scripts/generate-llms.ts` (bun) and writes into `internal/infrastructure/llmdocs/generated/`, which is gitignored and embedded in the binary. `task build`, `task release`, `task dev:api` and the Docker image run it first. Without it the routes answer 404 with a notice.
+
+- The API reference and `openapi.json` come from `web/src/data/apiCatalogue.ts`, the same file the Integration page renders. Edit the catalogue, not the output.
+- `docs/api.md`, `docs/api/*.md`, the variables table of `docs/configuration.md` and every `docs/llm/*.md` are included as written. A page in `docs/llm/` starts with `# Title`, then a `> one-line summary` used by `llms.txt`.
+- Recipes in `docs/llm/` hold real responses. Re-capture them when a response shape changes.
+
+`TestRouterRoutesAreInTheCatalogue` fails when a route of `api/router.go` is missing from the catalogue. Routes still undocumented are listed in `routesNotYetInTheCatalogue` in `test/api_catalogue_drift_test.go`; remove an entry once the route is documented.

docs/mcp.md

@@ -0,0 +1,37 @@
+# MCP server
+
+`cmd/mcp` builds `renewcms-mcp`, a stdio [MCP](https://modelcontextprotocol.io) server for Claude Desktop, Claude Code, Cursor and similar clients. It is an HTTP client of the public API: it holds no database access and sends the API key as `Authorization: Bearer`, so what the key's user may do is the limit of what the model may do.
+
+Build it with `task build:mcp` (`bin/renewcms-mcp`).
+
+## Configuration
+
+| Name | Description |
+| --- | --- |
+| `RENEWCMS_URL` | Address of the instance, for example `https://cms.example`. |
+| `RENEWCMS_API_KEY` | An API key created at `/integration/api-keys`. |
+
+They belong to the MCP binary only and are not server variables.
+
+```json
+{
+  "mcpServers": {
+    "renewcms": {
+      "command": "/path/to/renewcms-mcp",
+      "env": { "RENEWCMS_URL": "https://cms.example", "RENEWCMS_API_KEY": "rcms_..." }
+    }
+  }
+}
+```
+
+## Tools
+
+`list_articles`, `get_article`, `create_article` (always a draft), `update_article_body`, `publish_article`, `check_seo`, `list_media`, `upload_media` (local `path`, or `base64` with `filename`), `list_sites`, `get_sitemap`.
+
+`--allow-destructive` adds `delete_article` and `delete_media`.
+
+Routes that need a browser session, such as creating a site, are not exposed. API errors come back as tool errors with the status and the plain-text message.
+
+## Resources and prompts
+
+The resource `renewcms://docs/llms-full.txt` is the instance's own [`/llms-full.txt`](llms.md), so the model reads the documentation of the exact version it talks to. The prompt `write_and_publish_article` drafts, checks the SEO and asks before publishing.

docs/privacy.md

@@ -0,0 +1,77 @@
+# Privacy and personal data
+
+This page is for operators: whoever runs a RenewCMS instance is the data controller for it under the GDPR. It lists what the software stores about people, where, for how long, and what it sends elsewhere, so you can fill in your record of processing (art. 30), write your privacy notice (art. 13) and answer requests from the people concerned. It describes the software, not your obligations; it is not legal advice.
+
+## Who is concerned
+
+- **Back-office users**: the owner and the admins they invite.
+- **Invitees** who have not accepted yet.
+- **People named in content**: authors, and anyone your editors write about or photograph.
+- **Anyone who performs an audited action** (logging in, failing to log in, changing anything) has their IP address and browser recorded in the activity log.
+
+Readers of your public site are not tracked by RenewCMS: the public routes set no cookie and log nothing in production.
+
+## What is stored, and for how long
+
+| Data | Where | Kept |
+|---|---|---|
+| Username, email, display name, role, bcrypt password hash | `users` table | Until the account is deleted (see [Gaps](#gaps)). |
+| Verification and password-reset codes | `users` table, bcrypt-hashed | Verification: until the account is verified. Reset: one hour, then useless; cleared when used. |
+| Unverified sign-ups | `users` table | Deleted automatically 7 days after their verification code expired. |
+| Invites: invitee email, hashed code, inviter | `invites` table | Deleted automatically 30 days after they expired or were accepted. |
+| Sessions | The `jwt` cookie in the user's browser, valid 24 hours | Logging out revokes the session on the server; the revocation (a random id and an expiry, nothing else) is deleted once the session would have expired anyway. |
+| API keys: name, prefix, SHA-256 hash, creator, last use | `api_keys` table | Until revoked. A revoked key stays listed. |
+| Activity log: who (user id and name, API key name, or the username typed at a failed login), what, when, IP address, browser (user agent, truncated to 255 characters) | `audit_events` table | Settings → Activity: 30, 90 (default), 365 days or forever, and an optional size cap. Cleaned up once a night, at 03:00 server time. |
+| Authors: name, slug, bio, avatar, website, social links; the linked user's email is shown to admins | `authors` table | Until deleted. |
+| Articles and custom entries | `articles`, `entries` tables | Deleted articles are soft-deleted: the row and its content stay in the database (see [Gaps](#gaps)). |
+| Uploaded images | `UPLOAD_DIR` or the S3 bucket, plus the `images` table (file name, size, uploader) | Until deleted from the media library. Deleted images are soft-deleted in the table; the file itself is removed. |
+
+### Photo metadata
+
+Since this version, uploads are cleaned before they are stored. JPEG, PNG and WebP files lose their EXIF (GPS position, camera serial number, date), XMP, IPTC, comments and text chunks; only the orientation is kept, so rotated photos still display correctly. The pixels are not re-encoded. SVG files are stored as uploaded. **Images uploaded with an earlier version are not cleaned retroactively**: if they may carry GPS positions, download, clean and re-upload them, or merge them into a cleaned copy from the media library.
+
+### Activity log retention
+
+For security logs, the CNIL generally recommends keeping access logs between six months and a year. The default of 90 days is shorter; choose 365 days in Settings if that suits your purpose. Avoid "Forever": it keeps IP addresses indefinitely, which the storage-limitation principle rarely justifies.
+
+## Cookies and browser storage
+
+- `jwt`: the session cookie. HttpOnly, `SameSite=Lax`, `Secure` in production, 24 hours. Strictly necessary for the back office, so it needs no consent (ePrivacy art. 5(3); in France, Loi Informatique et Libertés art. 82).
+- `localStorage` on the user's device holds interface choices only: language (`renewcms-language`), page sizes, open or collapsed panels, dismissed hints and columns. `sessionStorage` holds unsaved article drafts until the tab closes. None of it is sent to the server or to anyone else, and it needs no consent either.
+
+RenewCMS sets no analytics, advertising or third-party cookie, so no consent banner is needed for the back office. Your public site may need one if *it* adds trackers.
+
+## What leaves the server
+
+| Destination | When | What |
+|---|---|---|
+| Your SMTP provider (`SMTP_HOST`) | Sign-up, invite, password reset | Recipient address, the message (with a one-time link). STARTTLS or implicit TLS is required for any non-loopback host unless you set `SMTP_ALLOW_INSECURE=true`. |
+| Your S3 provider, if `STORAGE_DRIVER=s3` | Every upload and image read | The image files. |
+| `UPDATE_FEED_URL` (default `https://git.floriansylvain.fr`) | Only when the owner clicks "Check for updates" or downloads one | The server's IP address and a standard HTTP request. No account or content data. |
+
+The back office loads nothing from third parties: fonts, icons and scripts are served by RenewCMS itself, and the Content-Security-Policy forbids any other source. Pick EU-based SMTP and storage providers, or make sure transfer safeguards (art. 44 and following) cover them, and list them as processors.
+
+## Security measures you can cite (art. 32)
+
+- Passwords are hashed with bcrypt (cost 12). One-time codes are random UUIDs, stored hashed, single-use and short-lived. API keys are 256-bit random values stored as SHA-256 hashes.
+- Login, password-reset and invite routes are rate-limited per client IP; failed logins are recorded as security events.
+- Sessions are revocable: logout ends one session, a password reset ends all of them and revokes the user's API keys.
+- Cross-site writes are refused, cookies are `SameSite=Lax`, and a strict Content-Security-Policy, `X-Frame-Options: DENY` and HSTS (in production) are sent.
+- The server refuses to start with a short or example `JWT_SECRET`.
+- Release binaries are signed (ed25519) and checked before a browser update is installed.
+
+## Answering requests from the people concerned
+
+- **Access and portability (art. 15 and 20)**: there is no self-service export yet. The data of a user is their row in `users`, their author profile, their API keys and the activity events where they are the actor; an owner can export the activity log as CSV from the Activity page and filter it by person.
+- **Rectification (art. 16)**: users can change their display name and author profile themselves. Changing an email address currently needs a database edit.
+- **Erasure (art. 17)**: an unverified account can cancel its own registration. Deleting a verified user has no button yet; see [Gaps](#gaps).
+
+## Gaps
+
+These are known and tracked; until they are fixed, handle them by hand.
+
+- No way to delete a verified user or remove an admin from the interface.
+- No self-service export or email change.
+- Soft-deleted articles and images keep their rows indefinitely.
+- The username typed at a failed login is stored as typed, so a password typed in the wrong field can end up in the activity log; clean such events by hand if it happens.
+- Images uploaded before metadata stripping keep their metadata.

docs/release-notes.md

@@ -42,3 +42,8 @@ Each body lives in `docs/releases/<tag>.md`. Publish with `tea releases create -
 | `v3.3.0-beta` | Sites, authors and search and sharing |
 | `v3.4.0-beta` | Custom content types |
 | `v3.4.1-beta` | Media field and security updates |
+| `v3.4.2-beta` | Security and privacy hardening |
+| `v3.5.0-beta` | Relation field |
+| `v3.5.1-beta` | Relation picker fix |
+| `v3.5.2-beta` | LLM documentation and MCP server |
+| `v3.5.3-beta` | OpenAPI response schemas |

docs/releases/v3.4.2-beta.md

@@ -0,0 +1,39 @@
+This release hardens sign-in, sessions and mail against common attacks, and reduces the personal data RenewCMS keeps or shares, following a security, GDPR and CNIL review.
+
+## Improvements and fixes
+
+- Signing out now ends the session on the server. A copied session cookie stops working at once, while the same user's other sessions keep working.
+- The limit on login, password reset and invitation attempts now applies per client address. Before, opening a new connection reset the count, so the limit could be bypassed.
+- Requests that change data and come from another website are refused, and the session cookie is now `SameSite=Lax`. A malicious page can no longer act on behalf of a signed-in user.
+- A session made stale by a password reset can no longer read draft articles.
+- Signing in with an unknown username now takes as long as signing in with a wrong password, so response times no longer reveal which usernames exist.
+- A password longer than 72 bytes is refused with a clear message, where it used to cause a server error.
+- Uploaded JPEG, PNG and WebP images lose their hidden metadata (GPS position, camera serial number, dates, comments) before they are stored. Pixels and colour profiles are untouched, and rotated photos keep their orientation.
+- The back office no longer loads its fonts from Google. The fonts ship with RenewCMS, so no visitor IP address is sent to a third party.
+- Unverified sign-ups are deleted 7 days after their verification code expired, and invitations 30 days after they expired or were accepted.
+- Exported activity CSV files also neutralise cells starting with a tab or a carriage return, which spreadsheets could otherwise treat as formulas.
+
+## API
+
+- Changed: `POST`, `PUT`, `PATCH` and `DELETE` requests sent by a browser from another origin without an `Authorization` header answer `403` "Cross-origin requests are not allowed." Scripts on other origins must send their API key.
+- Changed: `POST /v1/auth/logout` revokes the presented session. It answers `500` only when the revocation cannot be stored, and clears the cookie either way.
+- `POST /v1/auth/register`, `POST /v1/auth/password-reset/confirm` and `POST /v1/auth/invite/accept` answer `400` "The password must be 72 bytes or fewer." for longer passwords.
+
+## Under the hood
+
+- A new `docs/privacy.md` lists the personal data RenewCMS stores, how long it is kept, the cookies, what leaves the server and how to answer access or erasure requests. It is meant to help operators with their record of processing and privacy notice.
+- Cross-origin protection uses the Go standard library, so no dependency was added.
+- New feature specs and tests cover the hardening, in `features/security_privacy_hardening.feature`.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. Back up the database first as usual.
+- A new `revoked_sessions` table is created automatically at startup.
+- The server now refuses to start when `JWT_SECRET` is shorter than 32 bytes or is still an example value. Generate one with `openssl rand -hex 32`. Changing it signs everyone out.
+- Mail to an SMTP server on another host now requires encryption (STARTTLS, or port 465). If your relay offers neither, set the new `SMTP_ALLOW_INSECURE=true`. Credentials are still never sent unencrypted.
+- Sessions created before v3.4.1-beta, which carry no expiry, are refused. Those users sign in once more.
+
+## Known limitations
+
+- Images uploaded before this release keep their metadata. Re-upload them if they may contain GPS positions.
+- Verified users still cannot be deleted from the interface, and there is no self-service data export yet.

docs/releases/v3.5.0-beta.md

@@ -0,0 +1,40 @@
+This release adds a Relation field to custom content types, so an entry can point at entries of another type.
+
+## New
+
+**Relation field**
+- A content type can now have a Relation field that links to another content type. Three kinds are available: one to one (a target can be used by only one entry), one to many (one target per entry) and many to many (up to 50 targets per entry).
+- Entries are linked through a searchable picker in the entry form. Chosen targets appear as chips labelled with the first field of the target entry, or "Entry N" when that field is empty.
+- Entry lists and cards show the linked entries of each relation column.
+- When a linked entry is deleted afterwards, the relation is shown as missing instead of breaking the page. A required relation with a missing target must be fixed before the entry can be saved.
+- The schema builder previews the inverse side of a relation, and the schema review dialog explains the impact of adding or removing one.
+
+## Improvements and fixes
+
+- Deleting a content type that another type points at is refused, and the delete dialog tells you which types depend on it.
+- Adding a required relation to a type that already has entries is refused with the usual schema incompatibility message.
+- The right side panel of the article editor no longer overflows vertically on short screens.
+- The web app is split into smaller chunks, so the first page load transfers less code.
+
+## API
+
+- Changed: every entry answer (`POST`, `PUT` and `GET` of one entry, and each item of a list) carries a top-level `relations` object keyed by relation field key. Each value holds `id`, `content_type` and `first_field` for an existing target, or `id` and `missing: true` for a deleted one. Many to many fields return an array.
+- `GET /v1/content-type/{key}/entry` accepts `q`, a text search over the entries of the type, applied before pagination. `total` reflects the filtered count.
+- `POST /v1/content-type` and `PUT /v1/content-type/{key}` accept `type: "relation"` fields with `relation: {"content_type", "kind"}`. A bad definition answers `422` `invalid_field`.
+- Entry writes answer `422` `invalid_entry: <key>: required` or `invalid_entry: <key>: type`, and `409` `invalid_entry: <key>: unique` for a one to one target already taken.
+- `DELETE /v1/content-type/{key}` answers `409` `content_type_referenced` while another type has a relation to it.
+
+## Under the hood
+
+- New feature specs and tests cover the backend and the web app, in `features/relation_field_type.feature` and `features/relation_field_spa.feature`.
+- Vendor chunk splitting is configured in `web/vite/vendorChunks.ts` and covered by a spec.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. Back up the database first as usual.
+- No schema migration and no new environment variable. Existing content types and entries are unchanged.
+
+## Known limitations
+
+- Relation search filters entries in memory, so it is meant for types with a moderate number of entries.
+- The inverse side of a relation is only shown in the builder preview. The target type's form, list and API do not list the entries pointing at it.

docs/releases/v3.5.1-beta.md

@@ -0,0 +1,9 @@
+This release fixes the Relation field picker, which could not load any entries.
+
+## Improvements and fixes
+
+- Choosing a target for a Relation field no longer fails with "Couldn't load" and a `400` error. The picker asked for pages of 10 entries, a size the entry list refuses, and now asks for 25.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema migration and no new environment variable.

docs/releases/v3.5.2-beta.md

@@ -0,0 +1,28 @@
+This release lets language models read and use a RenewCMS instance: the server publishes its own documentation, an OpenAPI description, and a separate MCP server drives the API with a key.
+
+## New
+
+**Documentation for language models**
+- Every instance serves `/llms.txt` (a short index), `/llms-full.txt` (all the documentation in one file), `/llms/<page>.md` (one page each) and `/openapi.json`. They are public, and carry the version and address of the instance that serves them.
+- The pages include the API reference, the API key and article guides, ready-to-run recipes with real responses (publish an article, upload and attach an image, sites and sitemaps, pagination and formats), and a gotchas page on session-only routes, error texts, rate limits and draft visibility.
+
+**MCP server**
+- The new `renewcms-mcp` binary is a stdio MCP server for Claude Desktop, Claude Code, Cursor and similar clients. It calls the public API with an API key, so the key's rights limit what the model can do.
+- Tools: list, get, create, update the body of and publish articles, check SEO, list and upload media, list sites and read a sitemap. Deletion tools are only offered with `--allow-destructive`.
+- It exposes the instance's `llms-full.txt` as a resource and a prompt that drafts, checks and asks before publishing. Setup is in `docs/mcp.md`.
+
+## API
+
+- `GET /llms.txt`, `GET /llms-full.txt`, `GET /llms/{page}` and `GET /openapi.json` are public routes outside `/v1`. They answer `404` with a notice when the build did not generate them.
+
+## Under the hood
+
+- The API reference and `openapi.json` are generated from `web/src/data/apiCatalogue.ts` by `task build:llms`, which `task build`, `task release` and the Docker image run first.
+- A new test fails when a route of the router is missing from the catalogue. Twenty-five existing routes (content types, entries, builtin types, image variants, media variants and the user lookup) are still undocumented and listed as exceptions in that test.
+- The catalogue now records the success status of each endpoint.
+- `task build:mcp` builds the MCP server. `task release` does not include it yet.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema migration and no new environment variable.
+- The MCP server reads `RENEWCMS_URL` and `RENEWCMS_API_KEY` in its own process; the server does not need them.

docs/releases/v3.5.3-beta.md

@@ -0,0 +1,13 @@
+This release fixes the OpenAPI description served at `/openapi.json`, whose response schemas were empty.
+
+## Improvements and fixes
+
+- Every successful response in `/openapi.json` now has a schema (object properties, required keys, array items and scalar types) instead of an empty one, so client generators produce typed models. The schemas are inferred from the sample responses of the API reference.
+
+## Upgrading
+
+- Replace the binary, or pull the new image. No schema migration and no new environment variable.
+
+## Known limitations
+
+- Because the schemas come from sample responses, a field that is `null` in a sample is typed `null`, a field missing from a sample is missing from its schema, and timestamps are plain strings.

features/activity-log-backend.feature

@@ -358,6 +358,8 @@ Feature: The back-office keeps an append-only activity log that owners can read
         | target | +1+1             | '+1+1             |
         | target | -2               | '-2               |
         | actor  | @SUM(A1)         | '@SUM(A1)         |
+        | target | \t=cmd           | '\t=cmd           |
+        | target | \r=cmd           | '\r=cmd           |
         | target | Spring release   | Spring release    |
         | target | a=b              | a=b               |
 

features/hasher_domain_interface.feature

@@ -53,12 +53,14 @@ Feature: Password and code hashing go through a domain Hasher interface
     Then the result is the error user.ErrInvalidCredentials
     And errors.Is(err, user.ErrInvalidCredentials) is true
 
-  Scenario: Authenticating an unknown username never calls the hasher
+  Scenario: Authenticating an unknown username spends the same hashing work as a wrong password
     Given a user repository with no user "bob"
-    When AuthenticateUserUseCase.Authenticate is called with username "bob" and password
+    When AuthenticateUserUseCase.Authenticate is called twice with username "bob" and password
       "hunter2example"
-    Then the result is the error user.ErrUserNotFound
+    Then each result is the error user.ErrUserNotFound
-    And the hasher's Compare is never called
+    And the hasher's Compare is called once per attempt, against a decoy hash of a random value
+      that no password can match, so response time does not reveal whether a username exists
+    And the decoy is hashed once and reused for every later unknown username
 
   Scenario Outline: Login over HTTP still can't distinguish a bad password from an unknown username
     Given a user repository containing a user "alice" with stored password "hashed:hunter2example"

features/hasher_domain_interface.qa.md

@@ -29,9 +29,10 @@ Package: `test` (black-box, alongside the existing `article_test.go` / `user_tes
      assert the returned user matches and `err` is `nil`.
    - `Authenticate("alice", "wrongpassword12")` with `fakeHasher.Compare` returning an error
      → assert `errors.Is(err, user.ErrInvalidCredentials)` is `true`.
-   - `Authenticate("bob", "hunter2example")` with no "bob" in the repo → assert
+   - `Authenticate("bob", "hunter2example")` twice with no "bob" in the repo → assert
-     `errors.Is(err, user.ErrUserNotFound)` is `true` and `fakeHasher`'s `Compare` was never
+     `errors.Is(err, user.ErrUserNotFound)` is `true` each time, that `fakeHasher`'s `Compare`
-     invoked (record a `compareCalled` flag).
+     ran once per attempt (against the decoy hash), and that `Hash` ran exactly once overall
+     (the decoy is computed lazily and reused).
 
 ## HTTP checks (real BcryptHasher, in-memory fake repo, mirroring api/router.go)
 8. Call `validator.InitValidator()`.

features/login_and_password_reset_rate_limiting.feature

@@ -16,7 +16,8 @@ Feature: Login and password-reset requests are rate-limited per client IP
       (github.com/go-chi/chi/v5/middleware) runs first and rewrites r.RemoteAddr from
       X-Forwarded-For/X-Real-IP when present (matching the nginx reverse proxy setup in
       docs/deployment.md that already sets X-Forwarded-For), falling back to the raw RemoteAddr
-      otherwise; RateLimiter keys its counters on r.RemoteAddr
+      otherwise; RateLimiter keys its counters on the host portion of r.RemoteAddr (the source
+      port is ignored, so opening a new connection never yields a fresh counter)
     And RateLimiter(maxAttempts int, window time.Duration) func(http.Handler) http.Handler keeps
       an in-memory, mutex-guarded fixed-window counter per (route, client IP) pair: the first
       request from a client opens a window starting now; each subsequent request from the same

features/pending_screen.feature

@@ -26,8 +26,9 @@ Feature: Pending registration screen
       you'll log in there first. Can't find it? Check your spam folder. If the link has expired,
       cancel your registration and start again.") is rendered through ResultPanel's default slot
       as a second paragraph below the description, per components.md's "Slot default for extras"
-    And "Log out" calls POST /v1/auth/logout, which per loginHandler.Logout always responds 200 and
+    And "Log out" calls POST /v1/auth/logout, which per loginHandler.Logout clears the jwt cookie
-      clears the jwt cookie; on its response, PendingPage calls session.clear() and navigates to
+      and responds 200 (500 only when the session cannot be revoked server-side; the cookie is
+      cleared either way); on its response, PendingPage calls session.clear() and navigates to
       /login, disabling both actions while the call is in flight
     And "Cancel registration" opens ConfirmDialog (built by this slice; components.md documents it
       but no file exists yet) via useOverlay().create(ConfirmDialog).open(), with title "Cancel

features/relation_field_spa.feature

@@ -0,0 +1,380 @@
+Feature: Relation field in the SPA
+  As an owner or admin building a content type, and as a verified user filling an entry
+  I want a Relation field that links an entry to entries of another content type
+  So that structured content can point at other structured content
+
+  Background:
+    Given the SPA calls the API with relative URLs under /v1 and the "jwt" HttpOnly cookie
+    And API errors are plain text
+    And this slice changes only web/ (and web/visual); the backend of features/relation_field_type.feature is done
+    And the design is docs/design/screens/schema-later.md section 7 (3 states) and the board group "7 Relations" of "RenewCMS Screens Schema.dc.html" with SchemaFrame.dc.html; the frame markup wins over prose for layout
+    And the registry is lib/fieldTypes with lib/entryEditors, the single source for the builder, the list cells and the entry form; no screen branches on the type name "relation" where a registry property can say it
+    And the tags "Later" and "Relation columns: later" / "Relation field: later" drawn on the board are not rendered; the feature ships
+    And a relation value is an id (uint32 of at least 1) or null for one_to_one and one_to_many, and an array of ids ([] when empty, at most 50) for many_to_many
+    And a field loaded from the API has "relation": {"content_type","kind"} with kind "one_to_one", "one_to_many" or "many_to_many"
+    And every entry answer (POST 201, PUT 200, GET one, each list item) carries a top-level "relations" object keyed by relation field key: {"id","content_type","first_field":{"key","type","value"}} for an existing target, or {"id","missing":true}; an array of these for many_to_many; the label of a target is its first_field formatted by the same rule as the entry list, and "Entry N" when null
+    And the API refuses with 422 "invalid_entry: <key>: required", "invalid_entry: <key>: type", 409 "invalid_entry: <key>: unique", 409 "schema_incompatible" for a new required relation on a type with entries, 422 "invalid_field" for a bad definition, and 409 "content_type_referenced" when deleting a target type
+    And the picker searches GET /v1/content-type/{target}/entry?q=&page=&size= and reads total from the answer
+    And the inverse side is shown in the builder preview only; the target type's form, list and API are unchanged
+    And sentence case, buttons are verbs, every string goes through t() and has a French entry in i18n/messages.ts
+    And a copy tagged "(proposed copy)" is not in the design and is the coder's single point of change
+    And the sample data is the board's: Event with Venue (one_to_many) and Speakers (many_to_many); venues "Rue Verte hall" (Lyon · 120 seats), "Rue Verte yard" (Lyon · outdoor), "Rue du Port studio" (Nantes · 24 seats); speakers "Ines Duarte" and "Jonas Pereira"; entries 42 "Lime plaster workshop", 41 "Heat pumps: what the numbers say", 40 "Open day at the Rue Verte site"
+
+  Scenario Outline: Relation in the registry
+    Given the registry entry for "relation"
+    Then <property> is <value>
+
+    Examples:
+      | property                  | value                                                                                       |
+      | type name in the API      | relation (the eighth entry, after media)                                                    |
+      | label                     | Relation                                                                                    |
+      | description               | Links to another type's entries (proposed copy)                                    |
+      | icon                      | lucide:link                                                                                 |
+      | control                   | RelationField                                                                               |
+      | pairs with a neighbour    | no, full width                                                                              |
+      | empty value               | null for one_to_one and one_to_many, [] for many_to_many                                    |
+      | initial on create         | the empty value; a relation has no default, so no "Default" tag ever shows                  |
+      | initial on edit           | the stored id or ids                                                                        |
+      | supports unique           | no                                                                                          |
+      | supports limits           | no                                                                                          |
+      | supports default          | no                                                                                          |
+      | supports choices          | no                                                                                          |
+      | counter                   | none                                                                                        |
+      | list cell                 | chips: one chip, two chips and "+N", or "–"; not sortable                                   |
+      | sample in the API preview | null for a single kind, [] for many_to_many                                                 |
+
+  Scenario: A loaded relation field is not shown as Text
+    Given GET /v1/content-type/events returns a field {"key":"venue","label":"Venue","type":"relation","required":false,"unique":false,"default":null,"min":null,"max":null,"options":[],"relation":{"content_type":"venues","kind":"one_to_many"}}
+    Then the builder, the entry form and the list resolve it to the relation entry of the registry, never to the fallback type "text"
+
+  Scenario Outline: Client validation of a relation value
+    Given a <kind> relation "Venue" that is <required>
+    When the value is <value>
+    Then the rule is <rule>
+
+    Examples:
+      | kind         | required | value     | rule     |
+      | single       | required | null      | required |
+      | single       | optional | null      | none     |
+      | single       | required | 3         | none     |
+      | single       | optional | 0         | type     |
+      | single       | optional | "3"       | type     |
+      | single       | optional | [3]       | type     |
+      | many_to_many | required | []        | required |
+      | many_to_many | optional | []        | none     |
+      | many_to_many | optional | [11, 12]  | none     |
+      | many_to_many | optional | [11, 11]  | type     |
+      | many_to_many | optional | 11        | type     |
+      | many_to_many | optional | 51 ids    | type     |
+
+  Scenario Outline: Messages of a relation field
+    Given a relation field labelled "Venue" whose related type is named "Venues"
+    Then the message of the rule <rule> reads <message>
+
+    Examples:
+      | rule     | message                                                            |
+      | required | Choose a Venue. (proposed copy)                                    |
+      | type     | Venue must point to an existing entry. (proposed copy)             |
+      | unique   | That Venue is already used by another entry. (proposed copy)       |
+      | min      | not produced for relation                                          |
+      | max      | not produced for relation                                          |
+      | options  | not produced for relation                                          |
+
+
+  Scenario: The type gallery gains Relation
+    Given the inspector of a field that can still change type
+    Then the tile "Relation" with the link icon is the last tile, selectable like the others
+    And on a saved field the other tiles are dimmed to 40 % and not selectable, as for any locked type
+
+  Scenario: Adding a relation field
+    Given Events and a second content type Venues exist
+    When the user activates "Add field", types the label "Venue" and chooses the tile "Relation"
+    Then the new row shows the badge "New", the key "venue" (Auto, editable) and the chip reads "Unsaved changes"
+    And the inspector reads "Field: Venue" and shows, after the Type tiles and in this order, the select "Related content type" with the help "Choose the content type this field points to." and the group "How are they connected?"
+    And no related type is chosen yet and "Save" cannot send a relation without one (proposed copy for the message: "Choose a related content type.")
+
+  Scenario: The related content type select
+    Given the user is editing Events
+    Then the select lists the other content types by name, and Events itself, each with its key as a hint (proposed)
+    And choosing Venues sets the sentences of the preview to "Venue" and "Events"
+
+  Scenario: Three shape cards (design "Relation in the builder")
+    Given the related type is Venues, the owner Events
+    Then three cards are shown in a row (one column on mobile), each with a diagram of squares and a line, a title and a sentence
+      | card         | sentence                                                       |
+      | One to one   | Each Event has one Venue, and each Venue has one Event.        |
+      | One to many  | Each Event has one Venue. A Venue has many Events.             |
+      | Many to many | Each Event has many Venues, and each Venue has many Events.    |
+    And the selected card has the primary border and the sand fill with --rc-on-sand text, the others the accented border
+    And the cards are a radio group, one is selected at a time, and a new relation starts with "One to many" selected (proposed default)
+
+  Scenario: The preview of both sides
+    Given "One to many" is selected with Event and Venue
+    Then a block with the elevated background reads "Each Event has [one] Venue" and "Each Venue has [many] Events" followed by the muted text `· shown on Venue as the field "Events"`
+    And the bracketed words are drawn as selects showing the chosen kind and follow the selected card
+    And below it two cards "Event" (Venue: chip "Rue Verte hall") and "Venue" (Events: chips "Open day", "Lime plaster workshop" and "+1") illustrate both sides, side by side on desktop and stacked on mobile
+    And the inverse field is not stored anywhere and nothing about it is sent
+
+  Scenario Outline: The preview follows the kind
+    Given the owner Event and the related type Venue
+    When the user selects <card>
+    Then the sentences read <owner side> and <inverse side>
+
+    Examples:
+      | card         | owner side             | inverse side            |
+      | One to one   | Each Event has one Venue  | Each Venue has one Event   |
+      | One to many  | Each Event has one Venue  | Each Venue has many Events |
+      | Many to many | Each Event has many Venues| Each Venue has many Events |
+
+  Scenario: Plural and names come from the types
+    Given the owner "Events" and the related type "Venues"
+    Then "Event"/"Events" and "Venue"/"Venues" in the sentences are the singular and plural forms drawn from the type names (proposed rule: singular is the name without a final "s"; the field label is used for the singular of the related side)
+
+  Scenario: The PUT and POST body of a relation field
+    Given a relation "Venue" to "venues", kind "One to many", Required off
+    When the type is saved
+    Then the field is sent as {"key":"venue","label":"Venue","type":"relation","required":false,"unique":false,"default":null,"min":null,"max":null,"options":[],"relation":{"content_type":"venues","kind":"one_to_many"}}
+    And every other field is sent with "relation": null
+    And a round trip of the loaded field to the payload produces no change
+
+  Scenario: The inspector of a saved relation (locked) (state not drawn; proposed copy)
+    Given Events with a saved relation "Venue" as its field
+    When the user selects its row
+    Then the Label input and the Required switch are editable
+    And the Key is locked with "Used in the API, so it can't change."
+    And the legend of the tiles reads "Type" with a lock and "Can't change after saving", Relation is selected and the other tiles are dimmed to 40 %
+    And "Related content type" and the three cards are shown disabled with the selected card kept, under the note "The related type and the connection can't change after saving. (proposed copy)"
+
+  Scenario: A required relation added to a type with entries is refused first
+    Given Events with 12 entries and a new relation "Venue" that is required
+    When the user activates Save
+    Then no PUT is sent and the dialog "Review changes to Events" opens
+    And the row "Add Venue" has the warning badge "Can't be applied" and the text "Relation, required. A relation can't have a default, so the 12 existing entries would have no Venue. Make Venue optional to add it. (proposed copy)"
+    And "Back to editing" is enabled and "Apply changes" is disabled, so pressing it sends nothing
+    And an optional relation shows the clean row "Relation, optional. 12 entries are unaffected. (proposed copy)" with "Apply changes" enabled
+
+  Scenario: The server answers on the builder
+    Given the user applies a type with a relation
+    When the server answers <status> "<body>"
+    Then <result>
+
+    Examples:
+      | status | body                | result                                                                     |
+      | 409    | schema_incompatible | the existing "Nothing was changed" refusal flow runs unchanged             |
+      | 422    | invalid_field       | the existing invalid-field failure of the builder is shown, the edits stay |
+
+  Scenario: Deleting a type that another type points at (proposed copy)
+    Given Venues is the target of the relation on Events and Venues has no entries
+    When the user confirms the delete of Venues
+    Then the API answers 409 "content_type_referenced"
+    And the existing delete failure surface shows the title "You can't delete Venues yet" and the text "Events has a field that points to Venues. Remove that field first. (proposed copy)"
+    And the type is still listed
+
+  Scenario: The builder is for owners and admins
+    Given a verified user who is neither owner nor admin
+    Then the builder keeps its existing "You don't have access to Schema" state and no relation control is rendered
+
+
+  Scenario: Where the controls sit
+    Given Events with the fields Title, Venue and Speakers
+    Then the controls follow the schema order, full width in the 760 px column, each with its label ("Venue", "Speakers") in weight 500
+
+  Scenario: Single relation, empty, focused search (design "Venue")
+    Given /content/events/42 whose venue is null
+    When the user focuses the "Venue" control and types "rue"
+    Then the input shows the search icon, the typed text and "Search to add"
+    And a popover list under the input shows rows of at least 40 px (48 on mobile) with the title in weight 500 and a second muted 12/18 line, each row a button
+      | title              | second line      |
+      | Rue Verte hall     | Lyon · 120 seats |
+      | Rue Verte yard     | Lyon · outdoor   |
+      | Rue du Port studio | Nantes · 24 seats|
+    And the first row has the elevated background
+    And the title is the first field of the related type and the second line is the next fields formatted as the entry list does, joined by " · " (up to 2 fields, proposed rule)
+
+  Scenario: Picking a single target
+    When the user activates the row "Rue Verte hall"
+    Then the list closes, the control shows one chip "Rue Verte hall" with an x, the value becomes 3, and the chip of the page reads "Unsaved changes"
+    And the live region says "Venue set to Rue Verte hall. (proposed copy)" and the focus stays in the control
+    And the chip's x removes it, sets the value to null, and says "Venue cleared. (proposed copy)"
+
+  Scenario: Many relation (design "Speakers")
+    Given Events with speakers [11, 12]
+    Then the control is a bordered box (1 px accented, min height 40, 44 on mobile) holding the chips "Ines Duarte" and "Jonas Pereira", each 24 px high (32 on mobile) with an x, then the muted text "Search to add"
+    And the help line under it reads "An event can have many speakers."
+    And a chip is a sand chip with --rc-on-sand text, weight 500
+
+  Scenario: Adding and removing in a many relation
+    When the user types "ines" in the control and activates the row "Ines Duarte"
+    Then the chip is added at the end in the chosen order and the row no longer appears in later results
+    When the user activates the x of a chip, or presses Backspace in the empty input
+    Then that chip is removed and the live region says "Ines Duarte removed from Speakers. (proposed copy)"
+    And a 51st target cannot be added: the search shows "You can add up to 50. (proposed copy)" and no row is selectable
+
+  Scenario: One to one targets already used (proposed copy)
+    Given a one_to_one relation
+    When the server answers 409 "invalid_entry: room: unique"
+    Then "That Venue is already used by another entry." shows under the control with a circle-alert icon, the error border applies, the chip reads "Not saved" and the focus moves to the control
+
+  Scenario: The search request
+    When the user types "rue"
+    Then the input is trimmed and debounced, and only GET /v1/content-type/venues/entry?q=rue&page=1&size=<page size> is sent
+    And the response replaces the list and a stale answer never overwrites a newer one
+    And with an empty input the first page of the type is listed without q (proposed)
+
+  Scenario: Picker loading (not drawn; proposed copy)
+    Given the search has not answered
+    Then after 150 ms the list shows three skeleton rows of the same height, with "Searching… (proposed copy)" announced politely, and no row is selectable
+
+  Scenario: No match (not drawn; proposed copy)
+    Given the search answers total 0 for "zzz"
+    Then the list shows `No Venues match "zzz"` (proposed copy) and the action "Clear search" that empties the input
+    And when the related type has no entries at all the list reads "No Venues yet. Add one in Content, then come back. (proposed copy)"
+
+  Scenario Outline: Search failures (not drawn; proposed copy)
+    Given the search answers <outcome>
+    Then <result>
+
+    Examples:
+      | outcome         | result                                                                                                       |
+      | 500             | the list shows "Couldn't load Venues" / "Check your connection and try again." with "Try again" (proposed copy) |
+      | a network error | the same                                                                                                     |
+      | 429             | the existing rate-limit countdown alert                                                                      |
+      | 401             | the global redirect, no local copy                                                                           |
+      | 404             | "Couldn't load Venues" as for 500, since the related type may have been deleted (proposed copy)              |
+
+  Scenario: Load more in the list
+    Given the search has more results than one page
+    When the user scrolls to the end of the list or activates "Load more" (proposed copy)
+    Then the next page is appended and the focus stays on the active row
+
+  Scenario: Keyboard
+    Given the control is focused and the list is open
+    Then ArrowDown and ArrowUp move the active row, Enter picks it, Esc closes the list and keeps the typed text, Tab leaves the control
+    And in a many relation Backspace on an empty input removes the last chip and chips are reachable with ArrowLeft
+
+  Scenario: A missing target (not drawn; proposed copy)
+    Given relations.venue is {"id":3,"missing":true}
+    Then the control shows a dashed chip "Entry no longer exists (proposed copy)" with an x and the help "You can still save. The entry keeps the link until you change it. (proposed copy)" when the field is optional
+    And when the field is required the help reads "Venue is required. Choose another to save. (proposed copy)", and saving with the missing target sends no request, shows the required message and focuses the control
+    And saving an optional field with the missing target sends the same id
+
+  Scenario: Required and empty
+    Given a required relation with no target
+    When the user activates "Save"
+    Then no request is sent, the error "Choose a Venue." replaces the help line, the border is --ui-error, the chip reads "Not saved" and the focus goes to the control
+    And only the first field in schema order with an error takes the focus
+    When the user picks a target
+    Then the error goes and the chip reads "Unsaved changes"
+
+  Scenario: Saving
+    Given the PUT has not answered
+    Then the form is dimmed to 70 %, the chips and the input are not operable and the list cannot open
+    And Save reads "Saving…"
+
+  Scenario Outline: What the control shows and sends
+    Given the loaded value <loaded> with relations <relations>
+    When the user <action> and activates "Save"
+    Then the control shows <shown>
+    And the data holds <sent>
+
+    Examples:
+      | loaded  | relations           | action                            | shown                    | sent             |
+      | null    | none                | saves with nothing changed        | no chip                  | "venue": null    |
+      | 3       | existing venue 3    | saves with nothing changed        | the chip "Rue Verte hall"| "venue": 3       |
+      | 3       | missing venue 3     | saves with nothing changed        | the missing chip         | "venue": 3       |
+      | 3       | existing venue 3    | picks "Rue Verte yard"            | the chip "Rue Verte yard"| "venue": 4       |
+      | 3       | existing venue 3    | activates the x                   | no chip                  | "venue": null    |
+      | [11]    | speaker 11          | adds Jonas Pereira                | two chips                | "speakers": [11, 12] |
+      | [11,12] | speakers 11, 12     | removes both                      | no chip                  | "speakers": []   |
+
+  Scenario: Create payload with relations
+    Given /content/events/new with Title "Open day", Venue left empty and Speakers left empty
+    When the user activates "Save"
+    Then POST /v1/content-type/events/entry is sent once with "venue": null and "speakers": [] among the other keys, never absent
+    And with Rue Verte hall picked it holds "venue": 3, a JSON number
+
+  Scenario: Right after a pick the control uses the picked row
+    Given the user picks "Rue Verte yard" from the results
+    Then before any save the chip shows its title from the result and no extra request is made
+    When the PUT answers 200 with relations.venue
+    Then the control is rebuilt from the answered relations object
+
+  Scenario: Dirty tracking of a relation value
+    Given an entry whose venue is 3
+    When the user picks 4 then picks 3 again
+    Then the chip reads "Saved", "Save" is disabled and the leave guard does not prompt
+    And for a many relation the same ids in another order count as changed
+
+  Scenario Outline: Server answers for a relation field
+    Given the client found no error and the PUT or POST is sent
+    When the server answers <status> "<body>"
+    Then <result>
+
+    Examples:
+      | status | body                           | result                                                                                      |
+      | 422    | invalid_entry: venue: required | "Choose a Venue." under the control, error border, chip "Not saved", focus on the control   |
+      | 422    | invalid_entry: venue: type     | "Venue must point to an existing entry." (proposed copy) under the control, chip "Not saved" |
+      | 409    | invalid_entry: venue: unique   | the one to one copy above                                                                   |
+      | 422    | invalid_entry: venue: unknown_field | the read-only reload alert of features/content_entry_editor.feature, same as for media |
+
+  Scenario: Layout of the generated form with a relation
+    Given a boolean, a number or a date field before the relation
+    Then the relation never pairs and is full width at every viewport
+
+  Scenario: Mobile form
+    Given a 390 px viewport
+    Then chips are 32 px high, rows are 48 px high, the input is 44 px high, and the list opens as a bottom sheet (proposed) or under the input as drawn
+
+
+  Scenario Outline: The relation cell (design "Relation in the list")
+    Given the entry list of Events with the columns Title, Starts on, Venue and Speakers
+    And the item's relations <relations>
+    Then the cell shows <cell>
+
+    Examples:
+      | relations                                          | cell                                                       |
+      | venue 3 "Rue Verte hall"                           | one chip "Rue Verte hall" (20 px high, 6 px padding)       |
+      | speakers 11, 12                                    | two chips "Ines Duarte" and "Jonas Pereira"                |
+      | speakers 11, 12 and two more                       | two chips and the muted 12 px text "+2"                    |
+      | no venue                                           | the muted "–"                                              |
+      | an empty speakers list                             | the muted "–"                                              |
+      | a missing venue                                    | a dashed chip "Entry no longer exists" (proposed copy)     |
+
+  Scenario: Columns of the board (desktop)
+    Given the items 42, 41 and 40
+    Then the grid reads ID, Title, Starts on, Venue, Speakers with the columns 48 px, 1.4fr, 110 px, 200 px, 200 px
+    And row 42 shows "Rue Verte hall" and "Ines Duarte", "Jonas Pereira", "+2"; row 41 shows "–" and "Jonas Pereira"; row 40 shows "Rue Verte yard" and "–"
+    And rows stay 48 px high and the header is 36 px high on the elevated background
+    And the note "One chip for a single relation. Up to two chips and a "+N" for many. Empty shows a dash." is a design annotation and is not rendered
+
+  Scenario: The mobile card
+    Given a 390 px viewport and Venue and Speakers among the columns
+    Then each card lists the title, then a line "Venue" (12 px muted) followed by its chips, then a line "Speakers" followed by its chips (wrapping), and "–" for none
+    And the card keeps its minimum height
+
+  Scenario: Columns menu
+    When the user opens "Columns"
+    Then "Venue" and "Speakers" are listed with the link icon, their keys, and a checkbox like other fields
+    And the cap of 6, Reset and the stored choice work as for any field
+    And a relation column is not sortable and has no sort icon and no aria-sort
+
+  Scenario: Cell data comes from the item
+    Then the chips are read from each item's own "relations" object with no extra request
+    And the plain text of a relation cell (card title, page title) reads the labels joined by ", " or "–", never the numeric id
+
+  Scenario: Relation as the first column
+    Given a type whose first field is a relation
+    Then the first column still links to the editor and the chips are the link content
+    And the page title and breadcrumb of such an entry read "Entry 42"
+
+
+  Scenario: Accessibility of the control
+    Then the control is a combobox with role="combobox", aria-expanded, aria-controls and aria-activedescendant on the input, labelled by the field label
+    And the list is role="listbox" with role="option" rows
+    And chips are a group labelled by the field label, each x is a button named "Remove Ines Duarte from Speakers"
+    And required adds aria-required, the error text has an id and aria-invalid and aria-describedby point at it then at the help
+    And one polite live region announces added, removed and cleared values and the result count ("3 results" / "No results", proposed copy)
+    And mobile targets are 44 px
+
+  Scenario: Accessibility of the builder
+    Then the shape cards are a radio group with a visible selected state that is not only a colour, the disabled locked controls are announced as disabled, and "Can't be applied" is a text badge

features/relation_field_spa.qa.md

@@ -0,0 +1,59 @@
+# QA procedure: relation field in the SPA
+
+Two parts. Part 1 is automated (Vitest component tests, `task test:web`). Part 2 is the visual gate (`task visual:check`). Part 3 is manual. The Go side is in `relation_field_type.qa.md`. Until `task test:web` exists, SPA tests are reported NOT RUN, never passing.
+
+## Part 1: automated (Vitest + Vue Test Utils)
+Mock `/v1` per test with the shapes below; no live server. A field is `{"key","label","type":"relation","required","unique":false,"default":null,"min":null,"max":null,"options":[],"relation":{"content_type","kind"}}` and every other field carries `"relation": null`.
+
+Registry
+1. `lib/fieldTypes`: the relation entry has the properties of the registry outline (label, icon `lucide:link`, control `RelationField`, no unique/limits/default/choices, empty value per kind, sample null or []). An unknown type still falls back to text; a relation never does.
+2. Client validation table (single and many, required/optional, 0, "3", [3], duplicates, 51 ids) and the message map including the "not produced" rules.
+
+Builder (one test per state)
+3. Type gallery: Relation is the last tile; locked on a saved field with the other tiles dimmed.
+4. New relation: the related-type select lists the other types (mock `GET /v1/content-type`), the help text, the three cards with the exact sentences, default "One to many" (proposed); choosing a type updates the sentences.
+5. Preview outline: the kind change updates both sentences and the line `· shown on Venue as the field "Events"`; the example cards "Event" and "Venue" show the board's chips (Rue Verte hall, Open day, Lime plaster workshop, +1). Nothing about the inverse is in any request.
+6. Save body: relation sent as `{"content_type","kind"}`, others `"relation": null`; a loaded field round-trips unchanged; no related type chosen blocks Save with the proposed message.
+7. Saved relation: key, tiles, related type and cards are disabled; Label and Required editable; the proposed lock note shows.
+8. Review: required relation + entries > 0 shows the flagged row and disabled "Apply changes" with no PUT; optional shows the clean row; required with 0 entries sends at once; making an optional relation required shows "Entries may not fit" with Apply enabled.
+9. Server answers: 409 `schema_incompatible` and 422 `invalid_field` map to the existing flows.
+10. Delete refused: 409 `content_type_referenced` shows the proposed copy and the type stays listed.
+11. A non-owner/admin sees no builder.
+
+Entry form (one test per state)
+12. Single control: type "rue" -> only `GET /v1/content-type/venues/entry?q=rue&page=1&size=...` is sent (debounced, trimmed, stale answers ignored); rows show title and second line; pick sets the value to 3, one chip, "Unsaved changes", live message.
+13. Many control: chips for [11, 12], "Search to add", the help line; add keeps order; x and Backspace remove; picked ids are not offered again; the 51st is blocked with the proposed message.
+14. States: loading (skeleton after 150 ms), no match with "Clear search", empty type, 500, network error, 429 countdown, 401 redirect, 404 (all with the proposed copy where tagged), "Try again" re-sends only the search.
+15. Missing target (optional and required), saving, keyboard (arrows, Enter, Esc, Tab, Backspace), required-empty error and focus order (first invalid field only).
+16. Outline "What the control shows and sends" (all 7 rows) and the create payload with `venue: null`, `speakers: []` and with a picked number.
+17. Dirty tracking: back to the original value gives "Saved"; reordered many ids count as changed.
+18. Server answers table: `required`, `type`, `unique`, `unknown_field` (reload alert), each with the right copy, chip and focus.
+19. Layout: a relation after boolean/number/date never pairs.
+
+List
+20. Cell outline (one chip, two chips, two chips + "+2", dash for null, dash for [], missing chip) from each item's `relations` with no extra request; relation columns are not sortable (no sort icon, no `aria-sort`).
+21. Desktop grid for items 42/41/40 matches the board texts; the mobile card shows the labelled lines; the Columns menu lists Venue and Speakers with the link icon and the cap of 6.
+22. Plain text of a relation cell never shows the numeric id; a first-field relation keeps the link and the "Entry N" title.
+
+Accessibility
+23. Combobox/listbox roles and attributes, chip group label, "Remove X from Y" button names, required/invalid/describedby wiring, the live region texts.
+
+## Part 2: visual (`task visual:check -- <screen>`)
+Hard gate: each capture within 10 % at 1440x900 and 390x844, light and dark. Add setups in `web/visual/states.ts` with the board's own sample data; no clock-sensitive state exists in this group.
+
+| Screen | State | Board sample data the mock must reuse |
+| --- | --- | --- |
+| schema | Relation in the builder | Events with Venue (label), key `venue`, related type Venue, "One to many" selected, preview sentences, example cards with chips "Rue Verte hall", "Open day", "Lime plaster workshop", "+1" |
+| entry (content/events/42) | Relation in the entry form | Title "Lime plaster workshop" (21 / 80); Venue search "rue" with rows "Rue Verte hall / Lyon · 120 seats", "Rue Verte yard / Lyon · outdoor", "Rue du Port studio / Nantes · 24 seats"; Speakers chips "Ines Duarte", "Jonas Pereira"; help "An event can have many speakers." |
+| content (events) | Relation in the list | Items 42 "Lime plaster workshop" 21 Nov 2026 (Rue Verte hall; Ines Duarte, Jonas Pereira, +2), 41 "Heat pumps: what the numbers say" 3 Nov 2026 (–; Jonas Pereira), 40 "Open day at the Rue Verte site" 12 Nov 2026 (Rue Verte yard; –) |
+
+Notes:
+- The board's states are drawn with a "Later" badge; the SPA does not render it. Expect a pixel difference at the badge. If the 10 % gate fails because of it, the user decides on a documented `exception` (`approvedBy`); the QA never adds one.
+- The board's builder shows a four-tile gallery plus Relation; the SPA shows the full gallery. The mismatch is reported to the user, not worked around.
+- States tagged "(proposed copy)" (loading, no match, error, missing chip, locked inspector, review refusal, delete refusal) are not on the board and get Vitest tests only, no visual capture.
+
+## Part 3: manual (screenshots can't cover)
+- Keyboard and focus order across the combobox, chips and list; screen reader announcements of the live region.
+- Hover and motion of the popover and of the chips' x; the mobile bottom-sheet versus under-input choice.
+- Real SQLite end to end with the built binary: build the type pair, pick, save, reload, delete a target and see the missing chip.
+- `bunx playwright install chromium` the first time on a machine.

features/relation_field_type.feature

@@ -0,0 +1,235 @@
+Feature: Relation field type for custom content types
+
+  As a site owner or admin
+  I want a content type field that links an entry to entries of another content type
+  So that structured content can refer to other structured content
+
+  Background:
+    Given internal/domain/contenttype adds the field type "relation" next to text, richtext, number, boolean, date, select and media
+    And a relation field carries "relation": {"content_type": <key of an existing type>, "kind": "one_to_one" | "one_to_many" | "many_to_many"}
+    And "one_to_many" reads from the owner: each owner entry has one target, a target has many owner entries
+    And every field response gains the key "relation", null for the other types, so a field has exactly ten keys
+    And a relation field accepts only label, key, required and relation; unique, default, min, max and options are refused with ErrInvalidField
+    And the target type must exist, else ErrInvalidField; a self relation is allowed for one_to_many and many_to_many and refused for one_to_one
+    And the connection is stored once, on the owner field; the inverse side is derived, never stored, never added to the target schema, and the target type's schema, entry responses, list and routes are unchanged
+    And the owner value is an id (uint32, at least 1) or null for one_to_one and one_to_many, and an array of ids ([] when empty, at most 50, no duplicates, order kept) for many_to_many
+    And entry.Validate stays pure; the existence of target entries is checked by CreateEntry and UpdateEntry through entry.Repository
+    And a changed value means an id not equal to the one in the stored document for that key; on POST every id is changed; on PUT an unchanged id is not checked for existence unless the field is required
+    And a changed id must be an existing entry of the target type, else 422 "invalid_entry: <key>: type"
+    And a required relation is never saved empty: null, absent or [] give 422 "invalid_entry: <key>: required", and so does an unchanged id whose entry is gone
+    And a one_to_one id already held by another entry of the owner type is refused with 409 "invalid_entry: <key>: unique" (entry.ErrUniqueViolation)
+    And rules are checked in field order for Validate, then target existence in field order, then unique, and the body names one field per answer
+    And an entry response keeps its eight keys and adds "relations", always present ({} when no relation is set)
+    And "relations"[key] is {"id","content_type","first_field":{"key","type","value"}} for an existing target, or {"id","missing":true} when it is gone; for many_to_many it is an array of these in stored order
+    And first_field is the first field of the target type in schema order with its raw stored value, never formatted by the server
+    And the same "relations" object is on POST 201, PUT 200, GET one and every item of the list
+    And GET /v1/content-type/{key}/entry accepts ?q=, a trimmed case-insensitive substring of the display text of the first field, filtered in Go on the unpaged list before pagination, so total counts the matches; an empty q means no filter
+    And deleting an entry that other entries reference is allowed and leaves them untouched
+    And DELETE /v1/content-type/{key} on a type that is the target of a relation field is refused with 409 "content_type_referenced" (contenttype.ErrReferenced, new apperr string), even with no entries
+    And a saved relation field's type, target and kind never change: a change is refused with 422 "invalid_field"
+    And a new required relation on a type with entries gives 409 "schema_incompatible"
+    And no repository method is added; the code works on SQLite, MySQL/MariaDB and PostgreSQL with no JSON operators
+    And the key-set assertions of the earlier custom content type, entry and media features and tests are amended (field 9 to 10 keys, entry 8 to 9 keys)
+    And types: "venue" has title (text, required) and city (text); "event" has title (text, required) then venue (relation to venue, one_to_many, label "Venue") then speakers (relation to speaker, many_to_many); "speaker" has name (text, required)
+    And entries: venue 3 "Rue Verte hall", venue 4 "Rue Verte yard"; speaker 11 "Ines Duarte", speaker 12 "Jonas Pereira"
+    And users: admin id 2 (verified) can write types; any verified user can write entries
+
+  Scenario: Creating a content type with a relation field
+    Given a valid jwt cookie for admin 2 and the type "venue"
+    When the client sends POST /v1/content-type with fields title (text, required) and
+      {"key":"venue","label":"Venue","type":"relation","required":false,"unique":false,"default":null,"min":null,"max":null,"options":[],"relation":{"content_type":"venue","kind":"one_to_many"}}
+    Then the response status is 201
+    And the venue field comes back with that relation object and the other fields have "relation": null
+
+  Scenario Outline: A relation field with a bad definition is refused
+    Given a valid jwt cookie for admin 2
+    When the client sends POST /v1/content-type with a relation field that has <defect>
+    Then the response status is 422
+    And the response body is "invalid_field"
+    And no content type is stored
+
+    Examples:
+      | defect                                 |
+      | relation null                          |
+      | content_type "nope" (unknown type)     |
+      | content_type "" or missing             |
+      | kind "many_to_one"                     |
+      | kind missing                           |
+      | a relation object on a text field      |
+      | unique true                            |
+      | default 3                              |
+      | min 1                                  |
+      | max 5                                  |
+      | options ["a"]                          |
+      | a one_to_one self relation             |
+
+  Scenario: The shape of a saved relation never changes
+    Given the type "event" has a saved relation "venue" (one_to_many to venue) and at least one entry
+    When admin 2 sends PUT /v1/content-type/event changing its kind to many_to_many
+    Then the response is 422 invalid_field and the schema is unchanged
+    When admin 2 sends PUT changing its target to speaker
+    Then the response is 422 invalid_field and the schema is unchanged
+    When admin 2 sends PUT turning it into a text field
+    Then the response is 422 invalid_field and the schema is unchanged
+
+  Scenario Outline: Adding a relation field to a type that has entries
+    Given the type "event" has 12 entries
+    When admin 2 sends PUT adding a relation field "venue" that is <required>
+    Then the response status is <status> and the body is <message>
+
+    Examples:
+      | required | status | message             |
+      | required | 409    | schema_incompatible |
+      | optional | 200    |                     |
+
+  Scenario: Deleting a type that another type points at
+    Given the type "venue" has no entries and "event" has a relation to it
+    When admin 2 sends DELETE /v1/content-type/venue
+    Then the response status is 409 with "content_type_referenced" and venue still exists
+    When the relation field is removed from "event" and DELETE is sent again
+    Then the response status is 204
+
+  Scenario: Creating an entry with a single target
+    When a verified user sends POST /v1/content-type/event/entry with {"data":{"title":"Lime plaster workshop","venue":3}}
+    Then the response status is 201 and data.venue is 3
+    And relations is {"venue":{"id":3,"content_type":"venue","first_field":{"key":"title","type":"text","value":"Rue Verte hall"}}}
+
+  Scenario: Creating an entry with many targets
+    When the client sends POST with {"data":{"title":"A","speakers":[12,11]}}
+    Then data.speakers is [12,11] and relations.speakers lists speaker 12 then speaker 11
+
+  Scenario Outline: Empty optional relations
+    When the client sends POST with <data>
+    Then the response status is 201, <stored>, and relations is {}
+
+    Examples:
+      | data                                 | stored               |
+      | {"data":{"title":"A","venue":null}}  | data.venue is null   |
+      | {"data":{"title":"A"}}               | data.venue is absent |
+      | {"data":{"title":"A","speakers":[]}} | data.speakers is []  |
+
+  Scenario Outline: Values that break a relation are refused and store nothing
+    Given "venue" is <required> and "speakers" is many_to_many
+    When the client sends POST with the data <data>
+    Then the response status is <status> and the body is <message>
+    And no entry exists
+
+    Examples:
+      | required | data                             | status | message                        |
+      | required | {"title":"A"}                    | 422    | invalid_entry: venue: required |
+      | required | {"title":"A","venue":null}       | 422    | invalid_entry: venue: required |
+      | optional | {"title":"A","venue":999}        | 422    | invalid_entry: venue: type     |
+      | optional | {"title":"A","venue":"3"}        | 422    | invalid_entry: venue: type     |
+      | optional | {"title":"A","venue":0}          | 422    | invalid_entry: venue: type     |
+      | optional | {"title":"A","venue":3.5}        | 422    | invalid_entry: venue: type     |
+      | optional | {"title":"A","venue":[3]}        | 422    | invalid_entry: venue: type     |
+      | optional | {"title":"A","speakers":11}      | 422    | invalid_entry: speakers: type  |
+      | optional | {"title":"A","speakers":[11,11]} | 422    | invalid_entry: speakers: type  |
+      | optional | {"title":"A","speakers":[11,999]}| 422    | invalid_entry: speakers: type  |
+      | optional | {"title":"A","speakers":[3]}     | 422    | invalid_entry: speakers: type  |
+      | optional | speakers with 51 ids             | 422    | invalid_entry: speakers: type  |
+
+  Scenario: A required many relation is never empty
+    Given "speakers" is required
+    When the client sends POST with speakers [] or with the key absent
+    Then the response is 422 invalid_entry: speakers: required
+
+  Scenario: One to one keeps targets exclusive
+    Given the type "talk" has a one_to_one relation "room" to "venue" and a talk already holds venue 3
+    When the client sends POST with room 3
+    Then the response is 409 "invalid_entry: room: unique" and nothing is stored
+    When the holder is updated with room 3 unchanged
+    Then the response is 200
+    When the holder is deleted and the POST is sent again
+    Then the response is 201
+
+  Scenario: Replacing and clearing targets
+    Given the entry 5 holds venue 3 and speakers [11]
+    When a verified user sends PUT with venue 4 and speakers [11,12]
+    Then data and relations reflect venue 4 and speakers 11, 12
+    When the user sends PUT with venue null and speakers []
+    Then relations is {}
+
+  Scenario: A target deleted after the entry was saved
+    Given the entry 5 holds venue 3 and speakers [11,12]
+    When entry 3 of venue and entry 12 of speaker are deleted (both answer 204)
+    And the client sends GET /v1/content-type/event/entry/5
+    Then data is unchanged
+    And relations.venue is {"id":3,"missing":true}
+    And relations.speakers is [{"id":11,"content_type":"speaker","first_field":{"key":"name","type":"text","value":"Ines Duarte"}},{"id":12,"missing":true}]
+    And the entry 5 was not modified (updated_at and updated_by unchanged)
+
+  Scenario Outline: Unchanged and changed ids when the target is gone
+    Given the entry 5 holds venue 3 and venue 3 was deleted
+    When the user sends PUT with venue <value>
+    Then the response status is <status> and the body is <message>
+
+    Examples:
+      | value | status | message                    |
+      | 3     | 200    |                            |
+      | 999   | 422    | invalid_entry: venue: type |
+      | 4     | 200    |                            |
+      | null  | 200    |                            |
+
+  Scenario Outline: A required relation with a missing target can't be saved as is
+    Given venue is required, entry 5 holds venue 3 and venue 3 was deleted
+    When the user sends PUT with venue <value>
+    Then the status is <status>, the body is <message> and the stored entry is <outcome>
+
+    Examples:
+      | value | status | message                        | outcome   |
+      | 3     | 422    | invalid_entry: venue: required | unchanged |
+      | null  | 422    | invalid_entry: venue: required | unchanged |
+      | 4     | 200    |                                | updated   |
+
+  Scenario: A create always treats the id as changed
+    Given venue 3 was deleted
+    When the client sends POST with venue 3
+    Then the response is 422 invalid_entry: venue: type
+
+  Scenario: Two broken fields name only one
+    Given a body with a required text left empty and a relation to a missing target
+    Then the answer names one field: Validate rules first in field order, then existence, then unique
+
+  Scenario: Entry list responses carry relations per item
+    Given 3 events: one with a venue and two speakers, one with a deleted venue, one with nothing
+    When the client sends GET /v1/content-type/event/entry
+    Then each item keeps its eight keys and adds "relations"
+    And items, total, page and size are unchanged
+    And a type without a relation field returns "relations": {} and makes no target repository call
+
+  Scenario Outline: Searching the entries of a type
+    Given the type "venue" has entries titled "Rue Verte hall", "Rue Verte yard", "Rue du Port studio"
+    When the client sends GET /v1/content-type/venue/entry?q=<q>
+    Then total is <total>
+
+    Examples:
+      | q         | total |
+      | rue       | 3     |
+      | RUE VERTE | 2     |
+      | yard      | 1     |
+      | nothing   | 0     |
+      |           | 3     |
+
+  Scenario: Search is paginated after filtering
+    Given 30 venues match "rue"
+    When the client sends GET /v1/content-type/venue/entry?q=rue&page=2&size=10
+    Then total is 30, page is 2, size is 10 and items holds the second ten matches in the requested sort
+
+  Scenario: Deleting an entry that is referenced
+    Given 4 events hold venue 3
+    When a verified user sends DELETE /v1/content-type/venue/entry/3
+    Then the response status is 204 and the 4 events are not modified
+
+  Scenario: The target type, entries and API are unchanged
+    Given "event" has a one_to_many relation to "venue"
+    When the client sends GET /v1/content-type/venue and GET /v1/content-type/venue/entry/3
+    Then neither response carries the inverse field "Events" and the venue field list is the one saved
+
+  Scenario: Use case level
+    Given fake contenttype and entry repositories
+    Then contenttype.ValidateFields returns ErrInvalidField for each refused definition
+    And entry.Validate returns errors.Is(err, entry.ErrInvalidEntry) with Key and Rule "required" or "type" for the shapes above
+    And CreateEntry and UpdateEntry return the same for a missing target and perform no Create or Update
+    And UpdateContentType returns contenttype.ErrSchemaIncompatible for a new required relation and ErrInvalidField for a changed shape
+    And DeleteContentType returns contenttype.ErrReferenced for a target type

features/relation_field_type.qa.md

@@ -0,0 +1,48 @@
+# QA procedure: relation field type (API only)
+
+Package: `test` (black-box). No live server, no real SQLite file, no real SMTP, no SPA.
+
+## Setup shared by every case
+1. Call `validator.InitValidator()` once per test.
+2. Reuse `mockContentTypeRepo` and `mockEntryRepo` of the custom content type and media pairs. Fake names stay unique across the package. The entry fake needs `createCalls`, `updateCalls`, a `getCalls` counter per content type and a `deleteEntry(contentTypeID, id)` helper. No repository method is added.
+3. Build `NewHandler(...)` for the content type and entry handlers over use cases wired to the fakes. Mount them on a fresh `chi.NewRouter()` mirroring api/router.go under `/v1/content-type`, with `jwtauth.Verifier`, `jwtauth.Authenticator` and a test `jwtauth.New("HS256", []byte("test-secret"), nil)`, and `RequireOwnerOrAdmin` on the type write routes. Prefer `api.InitBackendRoutes` with a partial `*api.UseCases` if it works.
+4. Seed admin 2 and a plain verified user. Seed the types venue, speaker, event and talk, and the entries venue 3, 4 and speaker 11, 12 from the feature.
+5. Inject a fake clock so `updated_at` > `created_at`. Decode bodies into `map[string]any` and compare numbers as `float64`.
+
+## Schema
+6. POST a valid relation field -> 201; `relation` is the object sent; every other field has `"relation": null`; every field has exactly ten keys.
+7. Refusal table (null relation, unknown target, empty target, bad kind, missing kind, relation on a text field, unique/default/min/max/options, one_to_one self) -> 422 `invalid_field`, repo empty.
+8. Locking: kind, target and type changes on a saved relation -> 422 `invalid_field`, schema byte-identical. A type with no entries keeps today's free type change for non-saved shapes.
+9. Type with 12 entries: add required relation -> 409 `schema_incompatible`, unchanged; add optional -> 200 and the old entries read with `relations` `{}`.
+10. DELETE a target type with no entries -> 409 `content_type_referenced` (plain text); after removing the relation field -> 204. A type with entries is still 409 `content_type_has_entries`.
+
+## Entry writes
+11. Single and many targets -> 201, `data` as sent (array order kept), `relations` as in the feature. The target object has exactly `id`, `content_type`, `first_field`; `first_field` has exactly `key`, `type`, `value`, with the raw stored value.
+12. Empty optional (null, absent, []) -> 201, `relations` is `{}` (assert JSON `{}`, not null). A required many field with [] or absent -> 422 required.
+13. Refusal table -> exact status and body, `createCalls == 0`. The 51-id case is built in the test.
+14. A venue id in a speaker field -> 422 type.
+15. One-to-one exclusivity: 409 `invalid_entry: room: unique`, nothing stored; PUT of the holder unchanged -> 200; after deleting the holder, POST -> 201.
+16. PUT replace/clear -> 200 with updated `relations`.
+17. Dangling targets: `deleteEntry` venue 3 and speaker 12 -> GET entry 5 shows `{"id":3,"missing":true}` and the mixed array; `updated_at`/`updated_by` unchanged. PUT unchanged id -> 200; 999 -> 422 type; other id or null -> 200.
+18. Required relation with a gone target: PUT same id -> 422 required; null -> 422 required; other id -> 200. POST with a deleted id -> 422 type.
+19. Ordering: two bad fields name one only (Validate in field order, then existence, then unique).
+
+## Reads
+20. List with 3 events (full, dangling, empty) -> every item has the 8 old keys plus `relations`; `total`, `page`, `size` unchanged; `items` is `[]` for an empty type.
+21. A type without a relation field -> `relations` `{}` and zero Get calls on target types. 100 entries pointing at one target call Get at most once for that id.
+22. `?q=` table (case-insensitive, trimmed, empty = all, none = 0); `total` counts matches; page 2 size 10 of 30 matches returns the second ten; invalid `page`/`size`/`sort` keep their existing errors.
+23. GET venue and GET a venue entry after the relation exists on event -> no inverse field, same keys as before.
+
+## Delete
+24. DELETE a referenced venue entry -> 204; the referencing events are byte-identical and no Update is recorded.
+
+## Use case level (no HTTP)
+25. `ValidateFields`, `entry.Validate`, `CreateEntry`/`UpdateEntry`, `UpdateContentType`, `DeleteContentType` as in the last scenario (`errors.Is`).
+
+## Existing tests to amend
+26. Key-set assertions in the custom content type, entry and media specs and tests: field 9 -> 10 keys, entry 8 -> 9 keys. The coder owns this.
+
+## Manual verification (not exercised by the Go tests)
+- Real SQLite, then MySQL/MariaDB and PostgreSQL via the driver tasks: create venue and event with a relation, save entries, delete the venue entry, reload the event and confirm the dangling id and `missing`.
+- Time `GET .../entry?q=` against a type with 1,000 entries (the filter loads the whole type).
+- The SPA is the second pair and is not checked here.

features/security_privacy_hardening.feature

@@ -0,0 +1,190 @@
+Feature: Sessions, uploads and stored personal data are hardened against forgery, replay and over-retention
+
+  As the operator of a RenewCMS instance
+  I want cross-site writes refused, logged-out sessions dead, weak secrets rejected, mail encrypted,
+    photo metadata removed and stale personal data deleted on a schedule
+  So that the instance meets the security-of-processing and storage-limitation duties of the GDPR
+    (art. 5(1)(c), 5(1)(e), 25 and 32) without the operator having to configure anything
+
+  Background:
+    Given api.InitRoutes wraps every route in middleware.CrossOriginProtection(settings.PublicURL),
+      built on the standard library's http.CrossOriginProtection, after CORS and before any router
+    And the jwt cookie is set and cleared with HttpOnly, SameSite=Lax, Path "/" and, in
+      production, Secure
+
+  Rule: Cross-site writes are refused
+
+    Scenario Outline: An unsafe cross-origin browser request is refused before any handler runs
+      Given a request <method> /v1/user/invite carrying the jwt cookie and the headers <headers>
+      Then the response is 403 with the body "Cross-origin requests are not allowed."
+      And the handler never runs
+
+      Examples:
+        | method | headers                                                         |
+        | POST   | Sec-Fetch-Site: cross-site, Origin: https://evil.example        |
+        | POST   | Sec-Fetch-Site: same-site, Origin: https://blog.example.com     |
+        | DELETE | Sec-Fetch-Site: cross-site, Origin: https://evil.example        |
+        | POST   | Origin: https://evil.example (an older browser, no Sec-Fetch-Site) |
+
+    Scenario Outline: Requests that cannot be forged are let through
+      Given a request <request>
+      Then the handler runs
+
+      Examples:
+        | request                                                                              |
+        | POST with Sec-Fetch-Site: same-origin                                                |
+        | POST with Sec-Fetch-Site: none                                                       |
+        | POST with neither Sec-Fetch-Site nor Origin (a non-browser client)                   |
+        | GET, HEAD or OPTIONS from any origin                                                 |
+        | POST from another origin carrying an Authorization header (an API key or bearer jwt) |
+        | POST whose Origin is the origin of PUBLIC_URL while a proxy rewrote Host             |
+
+    Scenario: A PUBLIC_URL that cannot be parsed still leaves the protection on
+      Given PUBLIC_URL is not a URL
+      When a cross-site POST arrives
+      Then it is refused with 403
+
+  Rule: Logging out kills the session server-side
+
+    Scenario: Every session token carries a unique id and an expiry
+      When authtoken.Encode issues a token without "jti" or "exp"
+      Then it adds a random "jti" (crypto/rand.Text) and "exp" 24 hours after "iat"
+      And authtoken.Decode refuses a token without "exp" and a token whose "jti" is not a string
+        with ErrInvalid
+
+    Scenario: The token presented at logout is refused afterwards, other sessions are not
+      Given alice logged in twice, getting tokens A and B
+      When she sends POST /v1/auth/logout with token A
+      Then the response is 200 and clears the cookie
+      And a session.Revocation for A's jti, expiring at A's exp, is stored in revoked_sessions
+      And GET /v1/auth/me with token A answers 401 and with token B answers 200
+
+    Scenario: Logout without a valid session stores nothing
+      When POST /v1/auth/logout arrives without a cookie, or with an expired or revoked one
+      Then the response is 200, the cookie is cleared and nothing is stored
+
+    Scenario: A revocation that cannot be stored is reported
+      Given the revoked_sessions store refuses writes
+      When alice logs out
+      Then the response is 500 and the cookie is still cleared
+
+    Scenario: A token whose revocation cannot be checked is refused
+      Given the revoked_sessions store cannot be read
+      Then any request authenticated by a jwt is treated as unauthenticated
+
+  Rule: Only a current session sees drafts
+
+    Scenario: A verified user's stale token reads like an anonymous visitor
+      Given alice is verified and her token_version is 1
+      When GET /v1/article/ arrives with a token carrying token_version 0
+      Then only online articles are listed
+
+  Rule: Passwords fit bcrypt
+
+    Scenario Outline: A password over 72 bytes is refused with 400
+      When <request> carries a password of 73 bytes, or of 37 two-byte characters
+      Then the response is 400 with the body "The password must be 72 bytes or fewer."
+      And nothing is created or changed
+
+      Examples:
+        | request                                            |
+        | POST /v1/auth/register                             |
+        | POST /v1/auth/password-reset/confirm (valid code)  |
+        | POST /v1/auth/invite/accept (valid code)           |
+
+    Scenario: A wrong reset code still wins over a long password
+      When POST /v1/auth/password-reset/confirm carries a wrong code and a 73-byte password
+      Then the response is 403 as for any wrong code
+
+  Rule: The server refuses to start with a guessable signing secret
+
+    Scenario Outline: A weak JWT_SECRET stops startup
+      Given JWT_SECRET is <value>
+      Then config.NewSettingsFromEnv fails with config.ErrWeakJWTSecret
+      And the message says to generate one with `openssl rand -hex 32`
+
+      Examples:
+        | value                                          |
+        | empty                                          |
+        | shorter than 32 bytes                          |
+        | "change-me-to-a-long-random-string"            |
+        | "replace-with-output-of-openssl-rand-hex-32"   |
+
+  Rule: Mail is never sent in clear text over the network by default
+
+    Scenario: A non-loopback SMTP server without STARTTLS is refused
+      Given SMTP_PORT is not 465, SMTP_HOST is not localhost, 127.0.0.1 or ::1, and the server does
+        not offer STARTTLS
+      When a mail is sent
+      Then delivery fails before MAIL FROM with an error naming SMTP_ALLOW_INSECURE
+
+    Scenario: The operator can opt out for a trusted relay
+      Given SMTP_ALLOW_INSECURE is "true"
+      When a mail is sent to such a server without credentials
+      Then it is delivered in clear text
+      And credentials are still never sent in clear text
+
+  Rule: Uploaded photos lose their metadata
+
+    Scenario Outline: Metadata is removed before the bytes are stored, hashed or measured for size
+      When a <format> image is uploaded
+      Then the stored bytes no longer contain <removed>
+      And they still contain <kept>
+      And the image's size and sha256 describe the stored bytes, and its pixels are unchanged
+
+      Examples:
+        | format | removed                                                                     | kept                     |
+        | JPEG   | EXIF, XMP, IPTC (APP13), comments, MPF and other APPn segments, trailing images | JFIF, ICC profile, Adobe |
+        | PNG    | eXIf, tEXt, zTXt, iTXt, tIME and data after IEND                            | every other chunk        |
+        | WebP   | EXIF and XMP chunks (their VP8X flags cleared) and data after the RIFF size  | every other chunk        |
+
+    Scenario: A rotated photo keeps only its orientation
+      Given an uploaded JPEG, PNG or WebP whose EXIF orientation is 2 to 8
+      Then the stored file carries a minimal EXIF block holding only that orientation (after SOI or
+        JFIF for JPEG, after IHDR for PNG, at the end with the EXIF flag set for WebP)
+
+    Scenario: An image whose container cannot be walked is refused
+      When a JPEG, PNG or WebP with a truncated header, a chunk longer than the file or no IEND
+        (PNG) is uploaded
+      Then the upload fails with image.ErrImageUnreadable and nothing is stored
+      And a JPEG cut off inside its scan data is kept as it is
+
+    Scenario: SVG is stored as uploaded
+      When an SVG is uploaded
+      Then its bytes are stored unchanged
+
+  Rule: Stale personal data is deleted on a schedule
+
+    Scenario: The retention job runs hourly and logs only when it removed something
+      Given scheduler.NewSystemRetentionRunner runs useCases.EnforceRetentionUseCase a minute after
+        startup and then every hour
+      When a run removes something
+      Then the log reads "scheduler: personal data retention completed: revoked_sessions=<n>
+        unverified_users=<n> invites=<n>"
+      And a run that removes nothing logs nothing, and a failed run logs "... failed: <error>"
+
+    Scenario Outline: What is removed
+      Given <record>
+      Then the retention job <outcome>
+
+      Examples:
+        | record                                                                       | outcome  |
+        | a revoked session whose exp has passed                                       | deletes it |
+        | an unverified account whose verification code expired more than 7 days ago  | deletes it |
+        | an unverified account without a code expiry created more than 7 days ago     | deletes it |
+        | an invite that expired more than 30 days ago                                 | deletes it |
+        | an invite accepted more than 30 days ago                                     | deletes it |
+        | a verified account, a pending invite or an account still inside its 7 days   | keeps it |
+
+    Scenario: A failure stops the run and keeps the counts of what was done
+      Given deleting a user fails
+      Then the run returns the error with the sessions already purged counted and touches no invite
+
+  Rule: The back office loads nothing from third parties
+
+    Scenario: Fonts are bundled
+      Given the SPA's fonts (IBM Plex Sans, IBM Plex Mono, Source Serif 4) live in
+        web/src/assets/fonts with their OFL licences
+      Then the Content-Security-Policy allows "font-src 'self'" and "style-src 'self'
+        'unsafe-inline'" with no Google Fonts host
+      And loading the back office sends no request to fonts.googleapis.com or fonts.gstatic.com

features/security_privacy_hardening.qa.md

@@ -0,0 +1,84 @@
+# QA: security and privacy hardening
+
+Everything below runs in `task test` (package `test`, `-tags nofrontend`) unless marked manual.
+
+## Cross-origin protection and cookie flags
+
+1. `test/cross_origin_protection_http_test.go`: wrap a counting handler in
+   `middleware.CrossOriginProtection("https://cms.example.com")`.
+   - Refused with 403 and `apperr.CrossOriginErrorMessage`, handler not reached: a cross-site POST, a
+     same-site POST from `https://blog.example.com`, a cross-site DELETE, and a POST with only
+     `Origin: https://evil.example`.
+   - Allowed: same-origin POST, `Sec-Fetch-Site: none`, no headers, cross-site GET and OPTIONS, a
+     cross-site POST with `Authorization: Bearer rcms_key`, and a POST whose `Origin` is the public
+     URL while `Host` is `127.0.0.1:8080`.
+   - With `PUBLIC_URL` `::not a url`, a cross-site POST is still 403.
+2. `test/session_revocation_http_test.go` drives `api.InitRoutes`: the login cookie is HttpOnly,
+   Secure and `SameSite=Lax`, and a cross-site `POST /v1/auth/logout` is 403 and revokes nothing.
+
+## Session revocation
+
+3. `test/authtoken_test.go` (`TestAuthTokenRevocation`, `TestAuthTokenDecodeRejections`): distinct
+   `jti` per token; explicit `jti` kept; a revoked token gives `ErrRevoked` and is stored until its
+   `exp`; other tokens stay valid; store read failure gives `ErrInvalid`; store write failure is
+   returned by `Revoke`; no `jti` is a no-op; no `exp` refuses; tokens without `exp` or with a
+   non-string `jti` are refused by `Decode`.
+4. `TestSessionRevocationUseCase`: an already-expired session is not stored; an empty or 65-byte id
+   is `session.ErrInvalidSessionID`; 64 bytes is accepted.
+5. `TestRevokedSessionRepository` on a migrated SQLite file: revoking twice is harmless,
+   `DeleteExpired(now)` removes rows whose `expires_at <= now` and reports the count.
+6. `TestLogoutRevokesTheSession` through `api.InitRoutes`: two logins, logout with the first, `/me`
+   with it is 401 and with the second is 200; logout without a cookie is 200 and stores nothing;
+   a failing write gives 500 with the cookie cleared; a failing read makes `/me` 401.
+7. `test/verified_account_required_http_test.go`: a verified user whose `token_version` moved on
+   only sees online articles.
+
+## Passwords
+
+8. `test/password_length_limit_test.go`: 72 bytes accepted, 73 bytes and 37 × "é" refused by
+   `user.ValidatePassword`; register, reset (valid code) and invite accept answer 400 with
+   `apperr.PasswordTooLongErrorMessage` and change nothing; a wrong reset code still answers 403.
+9. `test/hasher_test.go`: an unknown username compares against a decoy hash once per attempt and
+   hashes the decoy once.
+
+## Configuration and mail
+
+10. `test/runtime_settings_from_env_test.go`: empty, short, 31-byte and both example
+    `JWT_SECRET` values fail with `config.ErrWeakJWTSecret` and mention `openssl rand -hex 32`;
+    32 bytes passes. `SMTP_ALLOW_INSECURE` reads `""`/`false` as false, `true`/`TRUE` as true, and
+    `maybe` fails naming the variable.
+11. `test/smtp_mailer_test.go` against the fake server on `127.0.0.2`: no STARTTLS and no opt-out
+    fails before `MAIL FROM` naming `SMTP_ALLOW_INSECURE`; with the opt-out the message is
+    delivered in clear text; with the opt-out and credentials, nothing is sent.
+
+## Upload metadata
+
+12. `test/image_metadata_stripping_test.go` builds JPEG, PNG and WebP files carrying a GPS-like
+    marker in EXIF, XMP, IPTC, comments, text chunks, MPF and trailing data. Assert the marker is
+    gone, ICC is kept, pixels decode identically, the orientation-only EXIF appears only when the
+    orientation is not 1 and sits in the documented place, WebP flags and RIFF size are correct,
+    a plain WebP and an SVG come back unchanged, and each malformed container is
+    `ErrImageUnreadable`.
+13. `TestUploadStoresTheStrippedImage`: the stored bytes carry no marker and `Size`/`SHA256` match
+    them. `TestUploadRefusesAnImageWhoseContainerIsBroken`: nothing is stored.
+
+## Retention
+
+14. `test/personal_data_retention_test.go`: the user and invite rules at their boundaries; one run
+    over a seeded world removes exactly one expired revocation, one abandoned account and two
+    invites; a second run removes nothing; a session store failure touches nothing else; a user
+    or invite deletion failure returns the partial counts; the runner logs counts only when
+    something was removed and logs failures.
+
+## Fonts
+
+15. `test/security_headers_test.go`: the CSP contains `font-src 'self';` and no Google host.
+16. Manual: `task build:web`, open the back office with the network panel; no request leaves for
+    `fonts.googleapis.com` or `fonts.gstatic.com`, and `task visual:check -- log-in` passes.
+
+## Manual verification
+
+- Behind the real reverse proxy, log in, copy the `jwt` cookie, log out, then replay the cookie
+  with `curl`: `/v1/auth/me` answers 401.
+- With an SMTP relay that lacks STARTTLS on a non-loopback host, sending fails until
+  `SMTP_ALLOW_INSECURE=true` is set.

features/trusted_proxy_client_ip_for_rate_limiting.feature

@@ -10,7 +10,7 @@ Feature: The rate limiter keys on the real connection address, trusting a forwar
   Background:
     Given POST /v1/auth/login and POST /v1/auth/password-reset are each wrapped, inside
       NewAuthRouter, by a middleware that runs before RateLimiter (api/middleware/rateLimit.go),
-      which keys its counters on r.RemoteAddr
+      which keys its counters on the host portion of r.RemoteAddr, never on its source port
     And this slice replaces chimiddleware.RealIP on those two route groups with
       TrustedProxyRealIP(trustedProxies []string) func(http.Handler) http.Handler
       (api/middleware/trustedProxyRealIP.go)
@@ -96,3 +96,23 @@ Feature: The rate limiter keys on the real connection address, trusting a forwar
       X-Real-IP header
     Then the first response is not rejected by rate limiting and the second is 429 — both are
       counted against "10.0.0.1" itself
+
+  Scenario: New connections from the same address share one counter
+    Given TRUSTED_PROXIES is "" and AUTH_RATE_LIMIT_MAX_ATTEMPTS is 1
+    When a request arrives with connection address "203.0.113.7:40000"
+    And a second request arrives with connection address "203.0.113.7:40001"
+    Then the first response is not rejected by rate limiting and the second is 429, because the
+      counter is keyed on "203.0.113.7" and the source port is ignored
+
+  Scenario: A forwarded client keeps one counter across the proxy's connections
+    Given TRUSTED_PROXIES is "10.0.0.1" and AUTH_RATE_LIMIT_MAX_ATTEMPTS is 1
+    When a request arrives with connection address "10.0.0.1:51000" and header
+      X-Real-IP: "198.51.100.9"
+    And a second request arrives with connection address "10.0.0.1:51001" and the same header
+    Then the first response is not rejected by rate limiting and the second is 429
+
+  Scenario: Expired counters do not accumulate
+    Given requests from many distinct addresses
+    When a full window has passed since a counter started
+    Then the next request evicts every counter whose window has ended, so memory stays bounded by
+      the addresses seen within one window

features/trusted_proxy_client_ip_for_rate_limiting.qa.md

@@ -56,6 +56,14 @@ setup (`mockUserRepo`, `stubHasher`, `mockMailRepo`, the full `useCases` set, `a
     no forwarding header at all. Assert not `429`. Send a second, identical request. Assert `429` —
     a trusted proxy with nothing to forward falls back to its own address as the key.
 
+14. `trustedProxies = nil`, limit 5. Send 100 requests from `203.0.113.7` on ports `40000`–`40099`.
+    Assert exactly 95 are `429` — the source port never yields a fresh counter
+    (`test/rate_limit_connection_key_http_test.go`).
+15. Same for IPv6: `[2001:db8::1]:50000` then `[2001:db8::1]:50001` with limit 1 → `200` then `429`.
+16. `trustedProxies = ["10.0.0.1"]`, limit 1. `10.0.0.1:51000` and `10.0.0.1:51001`, both with
+    `X-Real-IP: 198.51.100.9` → `200` then `429`.
+17. Limit 1, window 20 ms: `200`, `429`, wait 30 ms, `200` — an expired counter starts over.
+
 ## Manual verification (not exercised by the Go test)
 
 - Real behaviour behind the documented nginx and Caddy reverse proxies (`docs/deployment.md`) —

go.mod

@@ -14,6 +14,7 @@ require (
 	github.com/go-sql-driver/mysql v1.10.1
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.11.0
+	github.com/modelcontextprotocol/go-sdk v1.8.0
 	golang.org/x/crypto v0.58.0
 	golang.org/x/image v0.47.0
 	golang.org/x/net v0.61.0
@@ -45,6 +46,7 @@ require (
 	github.com/glebarez/go-sqlite v1.23.0 // indirect
 	github.com/go-playground/locales v0.14.2 // indirect
 	github.com/go-playground/universal-translator v0.18.2 // indirect
+	github.com/google/jsonschema-go v0.4.3 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.3 // indirect
@@ -54,9 +56,14 @@ require (
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.1.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/segmentio/encoding v0.5.4 // indirect
 	github.com/stretchr/testify v1.12.1 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	modernc.org/libc v1.79.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect

go.sum

@@ -61,6 +61,12 @@ github.com/go-playground/validator/v10 v10.30.5 h1:YyCXvVShZbs2Sm3Mb53eNOlhRXctS
 github.com/go-playground/validator/v10 v10.30.5/go.mod h1:wEqiaov48pXX1kjhc3Da8y0M0Dtg/BK7gurFBLgwFrQ=
 github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME=
 github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=
+github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/pprof v0.0.0-20261016150608-1facf8f91b50 h1:PlNWJRxu5APSV0pWqfIsZ0qt9OOGHSWfZQ4zvx+WgWs=
 github.com/google/pprof v0.0.0-20261016150608-1facf8f91b50/go.mod h1:yUo1AMMpsPIDFGuwDK8nLcf8+vvAd5l2O6JDZ6hpwrM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -85,16 +91,24 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/modelcontextprotocol/go-sdk v1.8.0 h1:KIvahhYqwtbeniWVPs3TcXEA7b8jEtwfBpOTAI+Urx4=
+github.com/modelcontextprotocol/go-sdk v1.8.0/go.mod h1:dL7u98E/zjJTGzEq+j30jQ8K2k1mb6LeAH4inEcSGts=
 github.com/ncruces/go-strftime v1.1.0 h1:vtPmPWMkb539RGV9WpWT9EwJGvrOCKvMNI4obWL47Hk=
 github.com/ncruces/go-strftime v1.1.0/go.mod h1:yVaq7iwCN09vHRrKBrrflXT0M9tTMG2KmZ9Fj7xeG/g=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/segmentio/asm v1.1.3 h1:WM03sfUOENvvKexOLp+pCqgb/WDjsi7EK8gIsICtzhc=
+github.com/segmentio/asm v1.1.3/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
+github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfvNt0=
+github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
@@ -105,12 +119,16 @@ golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
 golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
 golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
 golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
 golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/domain/contenttype/contentTypeDomain.go

@@ -13,6 +13,7 @@ var (
 	ErrInvalidIcon         = errors.New("invalid content type icon")
 	ErrInvalidField        = errors.New("invalid field")
 	ErrHasEntries          = errors.New("the content type still has entries")
+	ErrReferenced          = errors.New("the content type is the target of a relation field")
 	ErrSchemaIncompatible  = errors.New("the schema is incompatible with the stored entries")
 )
 
@@ -26,6 +27,7 @@ const (
 	TypeDate     FieldType = "date"
 	TypeSelect   FieldType = "select"
 	TypeMedia    FieldType = "media"
+	TypeRelation FieldType = "relation"
 )
 
 const (
@@ -54,6 +56,7 @@ type Field struct {
 	Min      any       `json:"min"`
 	Max      any       `json:"max"`
 	Options  []string  `json:"options"`
+	Relation *Relation `json:"relation"`
 }
 
 type ContentType struct {

internal/domain/contenttype/fieldKinds.go

@@ -21,6 +21,7 @@ var kinds = map[FieldType]kind{
 	TypeDate:     {accepts: isDate, measure: dateDays, bound: dateDays, unique: true},
 	TypeSelect:   {accepts: isString, unique: true},
 	TypeMedia:    {accepts: isMediaID},
+	TypeRelation: {},
 }
 
 func MediaID(value any) (uint32, bool) {

internal/domain/contenttype/fieldSchema.go

@@ -63,7 +63,7 @@ func (f Field) validSchema() bool {
 	if f.Unique && !fieldKind.unique {
 		return false
 	}
-	return f.validOptions() && f.validBounds(fieldKind) && f.validDefault()
+	return f.validRelation() && f.validOptions() && f.validBounds(fieldKind) && f.validDefault()
 }
 
 func (f Field) validOptions() bool {
@@ -109,7 +109,7 @@ func (f Field) validDefault() bool {
 	if f.Default == nil {
 		return true
 	}
-	if f.Type == TypeMedia {
+	if f.Type == TypeMedia || f.Type == TypeRelation {
 		return false
 	}
 	return !f.Unique && f.Violation(f.Default) == ""

internal/domain/contenttype/fieldValue.go

@@ -3,6 +3,9 @@ package contenttype
 import "slices"
 
 func (f Field) Violation(value any) string {
+	if f.Type == TypeRelation {
+		return f.relationViolation(value)
+	}
 	fieldKind, known := kinds[f.Type]
 	if !known || !fieldKind.accepts(value) {
 		return RuleType

internal/domain/contenttype/relationField.go

@@ -0,0 +1,134 @@
+package contenttype
+
+const MaxRelationIDs = 50
+
+type RelationKind string
+
+const (
+	RelationOneToOne   RelationKind = "one_to_one"
+	RelationOneToMany  RelationKind = "one_to_many"
+	RelationManyToMany RelationKind = "many_to_many"
+)
+
+type Relation struct {
+	ContentType string       `json:"content_type"`
+	Kind        RelationKind `json:"kind"`
+}
+
+func (r Relation) validKind() bool {
+	return r.Kind == RelationOneToOne || r.Kind == RelationOneToMany || r.Kind == RelationManyToMany
+}
+
+func (f Field) validRelation() bool {
+	if f.Type != TypeRelation {
+		return f.Relation == nil
+	}
+	return f.Relation != nil && f.Relation.ContentType != "" && f.Relation.validKind()
+}
+
+func (f Field) IsRelation() bool {
+	return f.Type == TypeRelation && f.Relation != nil
+}
+
+func (f Field) HoldsManyRelations() bool {
+	return f.IsRelation() && f.Relation.Kind == RelationManyToMany
+}
+
+func (f Field) IsExclusiveRelation() bool {
+	return f.IsRelation() && f.Relation.Kind == RelationOneToOne
+}
+
+func (f Field) RelationIDs(value any) ([]uint32, bool) {
+	if value == nil {
+		return []uint32{}, true
+	}
+	if !f.HoldsManyRelations() {
+		id, ok := MediaID(value)
+		if !ok {
+			return nil, false
+		}
+		return []uint32{id}, true
+	}
+	return manyRelationIDs(value)
+}
+
+func manyRelationIDs(value any) ([]uint32, bool) {
+	var items []any
+	switch typed := value.(type) {
+	case []any:
+		items = typed
+	case []uint32:
+		for _, id := range typed {
+			items = append(items, id)
+		}
+	default:
+		return nil, false
+	}
+	if len(items) > MaxRelationIDs {
+		return nil, false
+	}
+	ids := make([]uint32, 0, len(items))
+	seen := make(map[uint32]bool, len(items))
+	for _, item := range items {
+		id, ok := MediaID(item)
+		if !ok || seen[id] {
+			return nil, false
+		}
+		seen[id] = true
+		ids = append(ids, id)
+	}
+	return ids, true
+}
+
+func (f Field) relationViolation(value any) string {
+	if _, ok := f.RelationIDs(value); !ok {
+		return RuleType
+	}
+	return ""
+}
+
+func EmptyRelation(field Field, value any) bool {
+	if !field.HoldsManyRelations() {
+		return false
+	}
+	ids, ok := field.RelationIDs(value)
+	return ok && len(ids) == 0
+}
+
+type RelationRef struct {
+	Field Field
+	IDs   []uint32
+}
+
+func RelationRefs(fields []Field, data map[string]any) []RelationRef {
+	var refs []RelationRef
+	for _, field := range RelationFields(fields) {
+		if ids, ok := field.RelationIDs(data[field.Key]); ok && len(ids) > 0 {
+			refs = append(refs, RelationRef{Field: field, IDs: ids})
+		}
+	}
+	return refs
+}
+
+func RelationFields(fields []Field) []Field {
+	var relations []Field
+	for _, field := range fields {
+		if field.IsRelation() {
+			relations = append(relations, field)
+		}
+	}
+	return relations
+}
+
+func ReferencesType(fields []Field, key string) bool {
+	for _, field := range RelationFields(fields) {
+		if field.Relation.ContentType == key {
+			return true
+		}
+	}
+	return false
+}
+
+func SameRelation(left Field, right Field) bool {
+	return left.IsRelation() && right.IsRelation() && *left.Relation == *right.Relation
+}

internal/domain/entry/entryData.go

@@ -2,8 +2,11 @@ package entry
 
 import (
 	"RenewCMS/internal/domain/contenttype"
+	"fmt"
 	"reflect"
 	"sort"
+	"strconv"
+	"strings"
 )
 
 func SameValue(left any, right any) bool {
@@ -49,7 +52,7 @@ func Validate(fields []contenttype.Field, data map[string]any) error {
 
 func validateField(field contenttype.Field, data map[string]any) error {
 	value := data[field.Key]
-	if value == nil {
+	if value == nil || contenttype.EmptyRelation(field, value) {
 		if field.Required {
 			return InvalidField(field.Key, RuleRequired)
 		}
@@ -82,7 +85,7 @@ func firstUnknownField(fields []contenttype.Field, data map[string]any) error {
 func UniqueValues(fields []contenttype.Field, data map[string]any) []UniqueValue {
 	var values []UniqueValue
 	for _, field := range fields {
-		if value := data[field.Key]; field.Unique && value != nil {
+		if value := data[field.Key]; (field.Unique || field.IsExclusiveRelation()) && value != nil {
 			values = append(values, UniqueValue{Key: field.Key, Value: value})
 		}
 	}
@@ -103,3 +106,38 @@ func MissingMedia(field contenttype.Field, unchanged bool) error {
 	}
 	return InvalidField(field.Key, contenttype.RuleType)
 }
+
+func RelationIDs(fields []contenttype.Field, data map[string]any) map[string]map[uint32]bool {
+	ids := map[string]map[uint32]bool{}
+	for _, ref := range contenttype.RelationRefs(fields, data) {
+		held := make(map[uint32]bool, len(ref.IDs))
+		for _, id := range ref.IDs {
+			held[id] = true
+		}
+		ids[ref.Field.Key] = held
+	}
+	return ids
+}
+
+func MissingRelation(field contenttype.Field, unchanged bool) error {
+	return MissingMedia(field, unchanged)
+}
+
+func MatchesQuery(fields []contenttype.Field, data map[string]any, query string) bool {
+	if len(fields) == 0 {
+		return false
+	}
+	return strings.Contains(strings.ToLower(displayText(data[fields[0].Key])), strings.ToLower(query))
+}
+
+func displayText(value any) string {
+	switch typed := value.(type) {
+	case nil:
+		return ""
+	case string:
+		return typed
+	case float64:
+		return strconv.FormatFloat(typed, 'f', -1, 64)
+	}
+	return fmt.Sprint(value)
+}

internal/domain/image/metadataStripper.go

@@ -0,0 +1,5 @@
+package image
+
+type MetadataStripper interface {
+	Strip(contentType string, data []byte) ([]byte, error)
+}

internal/domain/invite/inviteDomain.go

@@ -15,6 +15,8 @@ var ErrInviteAlreadyAccepted = errors.New("invite already accepted")
 
 const Lifetime = 3 * 24 * time.Hour
 
+const Retention = 30 * 24 * time.Hour
+
 type Status string
 
 const (
@@ -42,3 +44,13 @@ func (i Invite) StatusAt(now time.Time) Status {
 	}
 	return StatusExpired
 }
+
+func (i Invite) IsStaleAt(now time.Time) bool {
+	switch i.StatusAt(now) {
+	case StatusAccepted:
+		return now.After(i.AcceptedAt.Add(Retention))
+	case StatusExpired:
+		return now.After(i.ExpiresAt.Add(Retention))
+	}
+	return false
+}

internal/domain/retention/retentionDomain.go

@@ -0,0 +1,11 @@
+package retention
+
+type Result struct {
+	RevokedSessions int
+	UnverifiedUsers int
+	Invites         int
+}
+
+func (r Result) Total() int {
+	return r.RevokedSessions + r.UnverifiedUsers + r.Invites
+}

internal/domain/session/sessionDomain.go

@@ -0,0 +1,22 @@
+package session
+
+import (
+	"errors"
+	"time"
+)
+
+var ErrInvalidSessionID = errors.New("invalid session id")
+
+const MaxIDLength = 64
+
+type Revocation struct {
+	ID        string
+	ExpiresAt time.Time
+}
+
+func ValidateID(id string) error {
+	if id == "" || len(id) > MaxIDLength {
+		return ErrInvalidSessionID
+	}
+	return nil
+}

internal/domain/session/sessionRepositoryInterface.go

@@ -0,0 +1,9 @@
+package session
+
+import "time"
+
+type Repository interface {
+	Revoke(revocation Revocation) error
+	IsRevoked(id string) (bool, error)
+	DeleteExpired(now time.Time) (int, error)
+}

internal/domain/user/userDomain.go

@@ -18,9 +18,19 @@ var ErrInvalidDisplayName = errors.New("invalid display name")
 var ErrUsernameTaken = errors.New("username taken")
 var ErrInvalidLookup = errors.New("invalid user lookup")
 var ErrVerificationEmailNotSent = errors.New("verification email not sent")
+var ErrPasswordTooLong = errors.New("password too long")
 
 const MaxLookupIDs = 100
 
+const MaxPasswordBytes = 72
+
+func ValidatePassword(password string) error {
+	if len(password) > MaxPasswordBytes {
+		return ErrPasswordTooLong
+	}
+	return nil
+}
+
 type Role string
 
 const (
@@ -45,6 +55,22 @@ type User struct {
 	UpdatedAt               time.Time `json:"updated_at"`
 }
 
+const UnverifiedRetention = 7 * 24 * time.Hour
+
+func (u User) IsStaleUnverifiedAt(now time.Time) bool {
+	if u.IsVerified {
+		return false
+	}
+	deadline := u.VerificationExpiration
+	if deadline.IsZero() {
+		deadline = u.CreatedAt
+	}
+	if deadline.IsZero() {
+		return false
+	}
+	return now.After(deadline.Add(UnverifiedRetention))
+}
+
 func (u User) NameOrUsername() string {
 	if trimmed := strings.TrimSpace(u.DisplayName); trimmed != "" {
 		return trimmed

internal/infrastructure/config/securitySettings.go

@@ -0,0 +1,39 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+const (
+	EnvJWTSecret             = "JWT_SECRET"
+	MinJWTSecretBytes        = 32
+	EnvSmtpAllowInsecure     = "SMTP_ALLOW_INSECURE"
+	DefaultSmtpAllowInsecure = "false"
+)
+
+var ErrWeakJWTSecret = errors.New("JWT_SECRET is too weak")
+
+var placeholderJWTSecrets = map[string]bool{
+	"change-me-to-a-long-random-string":          true,
+	"replace-with-output-of-openssl-rand-hex-32": true,
+}
+
+func ValidateJWTSecret(secret string) error {
+	if placeholderJWTSecrets[secret] {
+		return fmt.Errorf("%w: it is still the example value; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret)
+	}
+	if len(secret) < MinJWTSecretBytes {
+		return fmt.Errorf("%w: it must be at least %d bytes long; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret, MinJWTSecretBytes)
+	}
+	return nil
+}
+
+func jwtSecretFromEnv() (string, error) {
+	secret := os.Getenv(EnvJWTSecret)
+	if err := ValidateJWTSecret(secret); err != nil {
+		return "", err
+	}
+	return secret, nil
+}

internal/infrastructure/config/settings.go

@@ -9,11 +9,12 @@ import (
 )
 
 type SmtpSettings struct {
-	Login    string
+	Login         string
-	Sender   string
+	Sender        string
-	Password string
+	Password      string
-	Host     string
+	Host          string
-	Port     int
+	Port          int
+	AllowInsecure bool
 }
 
 type AuthRateLimitSettings struct {
@@ -55,11 +56,21 @@ func (s Settings) IsProduction() bool {
 }
 
 func NewSettingsFromEnv() (Settings, error) {
+	jwtSecret, err := jwtSecretFromEnv()
+	if err != nil {
+		return Settings{}, err
+	}
+
 	smtpPort, err := intEnv("SMTP_PORT")
 	if err != nil {
 		return Settings{}, err
 	}
 
+	smtpAllowInsecure, err := boolEnv(EnvSmtpAllowInsecure, DefaultSmtpAllowInsecure)
+	if err != nil {
+		return Settings{}, err
+	}
+
 	authRateLimitMaxAttempts, err := intEnv("AUTH_RATE_LIMIT_MAX_ATTEMPTS")
 	if err != nil {
 		return Settings{}, err
@@ -100,18 +111,19 @@ func NewSettingsFromEnv() (Settings, error) {
 		CorsAllowedOrigins: parseSemicolonSeparatedList(os.Getenv("CORS_ALLOWED_ORIGINS")),
 		PublicURL:          os.Getenv("PUBLIC_URL"),
 		UploadDir:          os.Getenv("UPLOAD_DIR"),
-		JWTSecret:          os.Getenv("JWT_SECRET"),
+		JWTSecret:          jwtSecret,
 		DBFile:             os.Getenv("DB_FILE"),
 		Database:           database,
 		Storage:            storage,
 		DataDirPath:        os.Getenv("DATA_DIR"),
 		Port:               os.Getenv("PORT"),
 		Smtp: SmtpSettings{
-			Login:    os.Getenv("SMTP_LOGIN"),
+			Login:         os.Getenv("SMTP_LOGIN"),
-			Sender:   os.Getenv("SMTP_SENDER"),
+			Sender:        os.Getenv("SMTP_SENDER"),
-			Password: os.Getenv("SMTP_PASSWORD"),
+			Password:      os.Getenv("SMTP_PASSWORD"),
-			Host:     os.Getenv("SMTP_HOST"),
+			Host:          os.Getenv("SMTP_HOST"),
-			Port:     smtpPort,
+			Port:          smtpPort,
+			AllowInsecure: smtpAllowInsecure,
 		},
 		AuthRateLimit: AuthRateLimitSettings{
 			MaxAttempts: authRateLimitMaxAttempts,

internal/infrastructure/imaging/exifOrientation.go

@@ -0,0 +1,75 @@
+package imaging
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+const (
+	tiffOrientationTag = 0x0112
+	tiffTypeShort      = 3
+	tiffHeaderSize     = 8
+	tiffEntrySize      = 12
+	tiffMagic          = 42
+	uprightOrientation = 1
+	maxOrientation     = 8
+)
+
+var exifHeader = []byte("Exif\x00\x00")
+
+func exifOrientation(payload []byte) (uint16, bool) {
+	tiff := bytes.TrimPrefix(payload, exifHeader)
+	if len(tiff) < tiffHeaderSize {
+		return 0, false
+	}
+	var order binary.ByteOrder
+	switch string(tiff[:2]) {
+	case "II":
+		order = binary.LittleEndian
+	case "MM":
+		order = binary.BigEndian
+	default:
+		return 0, false
+	}
+	if order.Uint16(tiff[2:]) != tiffMagic {
+		return 0, false
+	}
+	ifd := int(order.Uint32(tiff[4:]))
+	if ifd < tiffHeaderSize || ifd+2 > len(tiff) {
+		return 0, false
+	}
+	count := int(order.Uint16(tiff[ifd:]))
+	for i := range count {
+		entry := ifd + 2 + i*tiffEntrySize
+		if entry+tiffEntrySize > len(tiff) {
+			return 0, false
+		}
+		if order.Uint16(tiff[entry:]) != tiffOrientationTag || order.Uint16(tiff[entry+2:]) != tiffTypeShort {
+			continue
+		}
+		value := order.Uint16(tiff[entry+8:])
+		if value < uprightOrientation || value > maxOrientation {
+			return 0, false
+		}
+		return value, true
+	}
+	return 0, false
+}
+
+func needsOrientation(orientation uint16) bool {
+	return orientation > uprightOrientation
+}
+
+func orientationOnlyTIFF(orientation uint16) []byte {
+	tiff := make([]byte, 0, tiffHeaderSize+2+tiffEntrySize+4)
+	tiff = append(tiff, 'M', 'M')
+	tiff = binary.BigEndian.AppendUint16(tiff, tiffMagic)
+	tiff = binary.BigEndian.AppendUint32(tiff, tiffHeaderSize)
+	tiff = binary.BigEndian.AppendUint16(tiff, 1)
+	tiff = binary.BigEndian.AppendUint16(tiff, tiffOrientationTag)
+	tiff = binary.BigEndian.AppendUint16(tiff, tiffTypeShort)
+	tiff = binary.BigEndian.AppendUint32(tiff, 1)
+	tiff = binary.BigEndian.AppendUint16(tiff, orientation)
+	tiff = binary.BigEndian.AppendUint16(tiff, 0)
+	return binary.BigEndian.AppendUint32(tiff, 0)
+}

internal/infrastructure/imaging/jpegMetadata.go

@@ -0,0 +1,168 @@
+package imaging
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+const (
+	jpegMarkerPrefix = 0xFF
+	jpegSOI          = 0xD8
+	jpegEOI          = 0xD9
+	jpegSOS          = 0xDA
+	jpegTEM          = 0x01
+	jpegRST0         = 0xD0
+	jpegRST7         = 0xD7
+	jpegAPP0         = 0xE0
+	jpegAPP1         = 0xE1
+	jpegAPP2         = 0xE2
+	jpegAPP14        = 0xEE
+	jpegAPP15        = 0xEF
+	jpegCOM          = 0xFE
+	jpegStuffedZero  = 0x00
+)
+
+var iccProfileSignature = []byte("ICC_PROFILE\x00")
+
+type jpegSegment struct {
+	marker  byte
+	payload []byte
+}
+
+func stripJPEG(data []byte) ([]byte, error) {
+	if len(data) < 4 || data[0] != jpegMarkerPrefix || data[1] != jpegSOI {
+		return nil, errMalformedContainer
+	}
+
+	out := []byte{jpegMarkerPrefix, jpegSOI}
+	insertAt := len(out)
+	orientation := uint16(uprightOrientation)
+	first := true
+
+	for pos := 2; ; {
+		marker, next, err := readJPEGMarker(data, pos)
+		if err != nil {
+			return nil, err
+		}
+		pos = next
+
+		if marker == jpegEOI {
+			out = append(out, jpegMarkerPrefix, jpegEOI)
+			return withOrientationSegment(out, insertAt, orientation), nil
+		}
+		if isStandaloneJPEGMarker(marker) {
+			out = append(out, jpegMarkerPrefix, marker)
+			continue
+		}
+
+		segment, next, err := readJPEGSegment(data, pos, marker)
+		if err != nil {
+			return nil, err
+		}
+		pos = next
+
+		if isJPEGMetadata(segment) {
+			if found, ok := jpegExifOrientation(segment); ok {
+				orientation = found
+			}
+		} else {
+			out = appendJPEGSegment(out, segment)
+			if first && segment.marker == jpegAPP0 {
+				insertAt = len(out)
+			}
+		}
+		first = false
+
+		if marker == jpegSOS {
+			end := jpegScanEnd(data, pos)
+			out = append(out, data[pos:end]...)
+			if end == len(data) {
+				return withOrientationSegment(out, insertAt, orientation), nil
+			}
+			pos = end
+		}
+	}
+}
+
+func readJPEGMarker(data []byte, pos int) (byte, int, error) {
+	if pos >= len(data) || data[pos] != jpegMarkerPrefix {
+		return 0, 0, errMalformedContainer
+	}
+	for pos < len(data) && data[pos] == jpegMarkerPrefix {
+		pos++
+	}
+	if pos >= len(data) {
+		return 0, 0, errMalformedContainer
+	}
+	return data[pos], pos + 1, nil
+}
+
+func readJPEGSegment(data []byte, pos int, marker byte) (jpegSegment, int, error) {
+	if pos+2 > len(data) {
+		return jpegSegment{}, 0, errMalformedContainer
+	}
+	length := int(binary.BigEndian.Uint16(data[pos:]))
+	if length < 2 || pos+length > len(data) {
+		return jpegSegment{}, 0, errMalformedContainer
+	}
+	return jpegSegment{marker: marker, payload: data[pos+2 : pos+length]}, pos + length, nil
+}
+
+func jpegScanEnd(data []byte, pos int) int {
+	for pos < len(data) {
+		if data[pos] != jpegMarkerPrefix || pos+1 >= len(data) {
+			pos++
+			continue
+		}
+		next := data[pos+1]
+		if next == jpegStuffedZero || isRestartMarker(next) {
+			pos += 2
+			continue
+		}
+		return pos
+	}
+	return len(data)
+}
+
+func isStandaloneJPEGMarker(marker byte) bool {
+	return marker == jpegTEM || isRestartMarker(marker)
+}
+
+func isRestartMarker(marker byte) bool {
+	return marker >= jpegRST0 && marker <= jpegRST7
+}
+
+func isJPEGMetadata(segment jpegSegment) bool {
+	if segment.marker == jpegCOM {
+		return true
+	}
+	if segment.marker == jpegAPP2 {
+		return !bytes.HasPrefix(segment.payload, iccProfileSignature)
+	}
+	if segment.marker == jpegAPP0 || segment.marker == jpegAPP14 {
+		return false
+	}
+	return segment.marker >= jpegAPP1 && segment.marker <= jpegAPP15
+}
+
+func jpegExifOrientation(segment jpegSegment) (uint16, bool) {
+	if segment.marker != jpegAPP1 || !bytes.HasPrefix(segment.payload, exifHeader) {
+		return 0, false
+	}
+	return exifOrientation(segment.payload)
+}
+
+func appendJPEGSegment(out []byte, segment jpegSegment) []byte {
+	out = append(out, jpegMarkerPrefix, segment.marker)
+	out = binary.BigEndian.AppendUint16(out, uint16(len(segment.payload)+2))
+	return append(out, segment.payload...)
+}
+
+func withOrientationSegment(out []byte, insertAt int, orientation uint16) []byte {
+	if !needsOrientation(orientation) {
+		return out
+	}
+	payload := append(bytes.Clone(exifHeader), orientationOnlyTIFF(orientation)...)
+	segment := appendJPEGSegment(nil, jpegSegment{marker: jpegAPP1, payload: payload})
+	return append(out[:insertAt:insertAt], append(segment, out[insertAt:]...)...)
+}

internal/infrastructure/imaging/metadataStripper.go

@@ -0,0 +1,35 @@
+package imaging
+
+import (
+	domain "RenewCMS/internal/domain/image"
+	"errors"
+)
+
+var errMalformedContainer = errors.New("malformed image container")
+
+type MetadataStripper struct{}
+
+var _ domain.MetadataStripper = &MetadataStripper{}
+
+func NewMetadataStripper() *MetadataStripper {
+	return &MetadataStripper{}
+}
+
+func (s *MetadataStripper) Strip(contentType string, data []byte) ([]byte, error) {
+	var stripped []byte
+	var err error
+	switch contentType {
+	case "image/jpeg":
+		stripped, err = stripJPEG(data)
+	case "image/png":
+		stripped, err = stripPNG(data)
+	case "image/webp":
+		stripped, err = stripWebP(data)
+	default:
+		return data, nil
+	}
+	if err != nil {
+		return nil, errors.Join(domain.ErrImageUnreadable, err)
+	}
+	return stripped, nil
+}

internal/infrastructure/imaging/pngMetadata.go

@@ -0,0 +1,86 @@
+package imaging
+
+import (
+	"bytes"
+	"encoding/binary"
+	"hash/crc32"
+)
+
+const (
+	pngChunkHeaderSize = 8
+	pngChunkCRCSize    = 4
+	pngIHDR            = "IHDR"
+	pngIEND            = "IEND"
+	pngEXIF            = "eXIf"
+)
+
+var pngSignature = []byte("\x89PNG\r\n\x1a\n")
+
+var pngMetadataChunks = map[string]bool{
+	pngEXIF: true,
+	"tEXt":  true,
+	"zTXt":  true,
+	"iTXt":  true,
+	"tIME":  true,
+}
+
+func stripPNG(data []byte) ([]byte, error) {
+	if !bytes.HasPrefix(data, pngSignature) {
+		return nil, errMalformedContainer
+	}
+
+	out := bytes.Clone(pngSignature)
+	orientation := uint16(uprightOrientation)
+	insertAt := 0
+
+	for pos := len(pngSignature); pos < len(data); {
+		available := len(data) - pos - pngChunkHeaderSize - pngChunkCRCSize
+		if available < 0 {
+			return nil, errMalformedContainer
+		}
+		size := binary.BigEndian.Uint32(data[pos:])
+		if uint64(size) > uint64(available) {
+			return nil, errMalformedContainer
+		}
+		kind := string(data[pos+4 : pos+pngChunkHeaderSize])
+		payload := data[pos+pngChunkHeaderSize : pos+pngChunkHeaderSize+int(size)]
+		end := pos + pngChunkHeaderSize + len(payload) + pngChunkCRCSize
+
+		if pngMetadataChunks[kind] {
+			if kind == pngEXIF {
+				if found, ok := exifOrientation(payload); ok {
+					orientation = found
+				}
+			}
+		} else {
+			out = append(out, data[pos:end]...)
+			if kind == pngIHDR {
+				insertAt = len(out)
+			}
+		}
+		pos = end
+
+		if kind == pngIEND {
+			return withPNGOrientation(out, insertAt, orientation)
+		}
+	}
+	return nil, errMalformedContainer
+}
+
+func withPNGOrientation(out []byte, insertAt int, orientation uint16) ([]byte, error) {
+	if !needsOrientation(orientation) {
+		return out, nil
+	}
+	if insertAt == 0 {
+		return nil, errMalformedContainer
+	}
+	chunk := pngChunk(pngEXIF, orientationOnlyTIFF(orientation))
+	return append(out[:insertAt:insertAt], append(chunk, out[insertAt:]...)...), nil
+}
+
+func pngChunk(kind string, payload []byte) []byte {
+	chunk := binary.BigEndian.AppendUint32(nil, uint32(len(payload)))
+	chunk = append(chunk, kind...)
+	chunk = append(chunk, payload...)
+	return binary.BigEndian.AppendUint32(chunk, crc32.ChecksumIEEE(chunk[4:]))
+}

internal/infrastructure/imaging/webpMetadata.go

@@ -0,0 +1,88 @@
+package imaging
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+const (
+	riffHeaderSize      = 12
+	riffChunkHeaderSize = 8
+	webpVP8X            = "VP8X"
+	webpEXIF            = "EXIF"
+	webpXMP             = "XMP "
+	webpEXIFFlag        = 0x08
+	webpXMPFlag         = 0x04
+)
+
+func stripWebP(data []byte) ([]byte, error) {
+	if len(data) < riffHeaderSize || string(data[:4]) != "RIFF" || string(data[8:12]) != "WEBP" {
+		return nil, errMalformedContainer
+	}
+	declared := int(binary.LittleEndian.Uint32(data[4:])) + riffChunkHeaderSize
+	if declared > len(data) || declared < riffHeaderSize {
+		return nil, errMalformedContainer
+	}
+	data = data[:declared]
+
+	var chunks [][]byte
+	orientation := uint16(uprightOrientation)
+	for pos := riffHeaderSize; pos < len(data); {
+		available := len(data) - pos - riffChunkHeaderSize
+		if available < 0 {
+			return nil, errMalformedContainer
+		}
+		size := binary.LittleEndian.Uint32(data[pos+4:])
+		padded := uint64(size) + uint64(size%2)
+		if padded > uint64(available) {
+			return nil, errMalformedContainer
+		}
+		kind := string(data[pos : pos+4])
+		payload := data[pos+riffChunkHeaderSize : pos+riffChunkHeaderSize+int(size)]
+		end := pos + riffChunkHeaderSize + int(padded)
+		switch kind {
+		case webpEXIF:
+			if found, ok := exifOrientation(payload); ok {
+				orientation = found
+			}
+		case webpXMP:
+		default:
+			chunks = append(chunks, bytes.Clone(data[pos:end]))
+		}
+		pos = end
+	}
+
+	if len(chunks) == 0 {
+		return nil, errMalformedContainer
+	}
+	if string(chunks[0][:4]) == webpVP8X {
+		if len(chunks[0]) <= riffChunkHeaderSize {
+			return nil, errMalformedContainer
+		}
+		flags := &chunks[0][riffChunkHeaderSize]
+		*flags &^= webpEXIFFlag | webpXMPFlag
+		if needsOrientation(orientation) {
+			*flags |= webpEXIFFlag
+			chunks = append(chunks, riffChunk(webpEXIF, orientationOnlyTIFF(orientation)))
+		}
+	}
+	return riffContainer(chunks), nil
+}
+
+func riffChunk(kind string, payload []byte) []byte {
+	chunk := append([]byte(kind), binary.LittleEndian.AppendUint32(nil, uint32(len(payload)))...)
+	chunk = append(chunk, payload...)
+	if len(payload)%2 == 1 {
+		chunk = append(chunk, 0)
+	}
+	return chunk
+}
+
+func riffContainer(chunks [][]byte) []byte {
+	body := []byte("WEBP")
+	for _, chunk := range chunks {
+		body = append(body, chunk...)
+	}
+	out := append([]byte("RIFF"), binary.LittleEndian.AppendUint32(nil, uint32(len(body)))...)
+	return append(out, body...)
+}

internal/infrastructure/llmdocs/llmdocs.go

@@ -0,0 +1,19 @@
+package llmdocs
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed all:generated
+var generatedEmbed embed.FS
+
+var Docs = mustSub(generatedEmbed, "generated")
+
+func mustSub(fsys fs.FS, dir string) fs.FS {
+	sub, err := fs.Sub(fsys, dir)
+	if err != nil {
+		panic("llmdocs: " + err.Error())
+	}
+	return sub
+}

internal/infrastructure/mailer/transport.go

@@ -81,17 +81,27 @@ func (t transport) connect() (*smtp.Client, error) {
 	return client, nil
 }
 
+var errTLSUnavailable = errors.New("smtp server does not offer STARTTLS; set SMTP_ALLOW_INSECURE=true to send without encryption")
+
 func (t transport) negotiate(client *smtp.Client) error {
 	if t.settings.Port != implicitTLSPort {
-		if supported, _ := client.Extension("STARTTLS"); supported {
+		if err := t.startTLS(client); err != nil {
-			if err := client.StartTLS(t.tlsConfig); err != nil {
+			return err
-				return err
-			}
 		}
 	}
 	return t.authenticate(client)
 }
 
+func (t transport) startTLS(client *smtp.Client) error {
+	if supported, _ := client.Extension("STARTTLS"); supported {
+		return client.StartTLS(t.tlsConfig)
+	}
+	if t.settings.AllowInsecure || isLoopback(t.settings.Host) {
+		return nil
+	}
+	return errTLSUnavailable
+}
+
 func (t transport) authenticate(client *smtp.Client) error {
 	if t.settings.Login == "" {
 		return nil

internal/infrastructure/mcpserver/client.go

@@ -0,0 +1,77 @@
+package mcpserver
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	requestTimeout  = 60 * time.Second
+	maxResponseSize = 8 << 20
+)
+
+type Client struct {
+	baseURL string
+	apiKey  string
+	http    *http.Client
+}
+
+type Response struct {
+	Status int
+	Body   string
+}
+
+func NewClient(baseURL string, apiKey string, httpClient *http.Client) *Client {
+	if httpClient == nil {
+		httpClient = &http.Client{Timeout: requestTimeout}
+	}
+	return &Client{baseURL: strings.TrimRight(baseURL, "/"), apiKey: apiKey, http: httpClient}
+}
+
+func (c *Client) Do(ctx context.Context, method string, path string, query url.Values, body []byte, contentType string) (Response, error) {
+	target := c.baseURL + path
+	if len(query) > 0 {
+		target += "?" + query.Encode()
+	}
+	req, err := http.NewRequestWithContext(ctx, method, target, bytes.NewReader(body))
+	if err != nil {
+		return Response{}, err
+	}
+	if c.apiKey != "" {
+		req.Header.Set("Authorization", "Bearer "+c.apiKey)
+	}
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	res, err := c.http.Do(req)
+	if err != nil {
+		return Response{}, err
+	}
+	defer res.Body.Close()
+	raw, err := io.ReadAll(io.LimitReader(res.Body, maxResponseSize))
+	if err != nil {
+		return Response{}, err
+	}
+	return Response{Status: res.StatusCode, Body: string(raw)}, nil
+}
+
+func (r Response) Failed() bool {
+	return r.Status < 200 || r.Status > 299
+}
+
+func (r Response) Describe() string {
+	text := strings.TrimSpace(r.Body)
+	if r.Status == http.StatusNoContent || text == "" {
+		return fmt.Sprintf("HTTP %d", r.Status)
+	}
+	if r.Failed() {
+		return fmt.Sprintf("HTTP %d: %s", r.Status, text)
+	}
+	return text
+}

internal/infrastructure/mcpserver/server.go

@@ -0,0 +1,305 @@
+package mcpserver
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+const (
+	docsResourceURI = "renewcms://docs/llms-full.txt"
+	jsonType        = "application/json"
+)
+
+type Options struct {
+	Version          string
+	AllowDestructive bool
+}
+
+type server struct {
+	client *Client
+}
+
+type listArticlesInput struct {
+	Page   int    `json:"page,omitempty" jsonschema:"page number from 1"`
+	Size   int    `json:"size,omitempty" jsonschema:"page size: 5, 25, 50 or 100"`
+	Query  string `json:"q,omitempty" jsonschema:"text matched in the title"`
+	Status string `json:"status,omitempty" jsonschema:"online or draft"`
+	Sort   string `json:"sort,omitempty" jsonschema:"field:direction, e.g. title:asc or updated_at:desc"`
+	Site   string `json:"site,omitempty" jsonschema:"site key"`
+	SEO    string `json:"seo,omitempty" jsonschema:"ready, suggestions or hidden"`
+	Format string `json:"format,omitempty" jsonschema:"body format: markdown, html or json"`
+}
+
+type getArticleInput struct {
+	ID     int    `json:"id" jsonschema:"article id"`
+	Format string `json:"format,omitempty" jsonschema:"body format: markdown, html or json"`
+}
+
+type createArticleInput struct {
+	Title string `json:"title" jsonschema:"3 to 200 characters, cannot be changed later"`
+	Body  string `json:"body" jsonschema:"HTML body"`
+}
+
+type updateArticleBodyInput struct {
+	ID   int    `json:"id" jsonschema:"article id"`
+	Body string `json:"body" jsonschema:"new HTML body, replaces the old one"`
+}
+
+type articleIDInput struct {
+	ID int `json:"id" jsonschema:"article id"`
+}
+
+type listMediaInput struct {
+	Query  string `json:"q,omitempty" jsonschema:"search text"`
+	Filter string `json:"filter,omitempty" jsonschema:"all, unused or duplicates"`
+	Sort   string `json:"sort,omitempty" jsonschema:"newest, oldest, name, largest or total_size"`
+	Page   int    `json:"page,omitempty" jsonschema:"page number from 1"`
+	Size   int    `json:"size,omitempty" jsonschema:"page size: 5, 25, 50 or 100"`
+}
+
+type uploadMediaInput struct {
+	Path     string `json:"path,omitempty" jsonschema:"path of a local PNG, JPEG, WEBP or SVG file"`
+	Base64   string `json:"base64,omitempty" jsonschema:"base64 file content, instead of path"`
+	Filename string `json:"filename,omitempty" jsonschema:"file name, required with base64"`
+}
+
+type emptyInput struct{}
+
+type sitemapInput struct {
+	Key  string `json:"key" jsonschema:"site key"`
+	Page int    `json:"page,omitempty" jsonschema:"page number from 1"`
+	Size int    `json:"size,omitempty" jsonschema:"25, 50, 100 or 500"`
+}
+
+type mediaIDInput struct {
+	ID int `json:"id" jsonschema:"image id"`
+}
+
+func New(client *Client, opts Options) *mcp.Server {
+	s := &server{client: client}
+	srv := mcp.NewServer(&mcp.Implementation{Name: "renewcms", Version: opts.Version}, &mcp.ServerOptions{
+		Instructions: "Tools for a RenewCMS instance. Read the renewcms://docs/llms-full.txt resource for the API rules. Articles are created as drafts; ask before publishing.",
+	})
+
+	readOnly := &mcp.ToolAnnotations{ReadOnlyHint: true}
+	additive := &mcp.ToolAnnotations{DestructiveHint: boolPtr(false)}
+
+	mcp.AddTool(srv, &mcp.Tool{Name: "list_articles", Description: "List one page of articles with total and counts.", Annotations: readOnly}, s.listArticles)
+	mcp.AddTool(srv, &mcp.Tool{Name: "get_article", Description: "Get one article.", Annotations: readOnly}, s.getArticle)
+	mcp.AddTool(srv, &mcp.Tool{Name: "create_article", Description: "Create a draft article.", Annotations: additive}, s.createArticle)
+	mcp.AddTool(srv, &mcp.Tool{Name: "update_article_body", Description: "Replace the body of an article. The previous body is overwritten.", Annotations: &mcp.ToolAnnotations{IdempotentHint: true}}, s.updateArticleBody)
+	mcp.AddTool(srv, &mcp.Tool{Name: "publish_article", Description: "Make an article visible to everyone.", Annotations: &mcp.ToolAnnotations{IdempotentHint: true, DestructiveHint: boolPtr(false)}}, s.publishArticle)
+	mcp.AddTool(srv, &mcp.Tool{Name: "check_seo", Description: "Check the SEO of the saved article and list suggestions.", Annotations: readOnly}, s.checkSEO)
+	mcp.AddTool(srv, &mcp.Tool{Name: "list_media", Description: "List one page of the image library.", Annotations: readOnly}, s.listMedia)
+	mcp.AddTool(srv, &mcp.Tool{Name: "upload_media", Description: "Upload an image from a local path or base64 content.", Annotations: additive}, s.uploadMedia)
+	mcp.AddTool(srv, &mcp.Tool{Name: "list_sites", Description: "List the sites.", Annotations: readOnly}, s.listSites)
+	mcp.AddTool(srv, &mcp.Tool{Name: "get_sitemap", Description: "Read the public sitemap of a site.", Annotations: readOnly}, s.getSitemap)
+
+	if opts.AllowDestructive {
+		mcp.AddTool(srv, &mcp.Tool{Name: "delete_article", Description: "Permanently delete an article."}, s.deleteArticle)
+		mcp.AddTool(srv, &mcp.Tool{Name: "delete_media", Description: "Permanently delete an image."}, s.deleteMedia)
+	}
+
+	srv.AddResource(&mcp.Resource{
+		URI:         docsResourceURI,
+		Name:        "llms-full.txt",
+		Description: "The full RenewCMS documentation served by the instance.",
+		MIMEType:    "text/plain",
+	}, s.readDocs)
+
+	srv.AddPrompt(&mcp.Prompt{
+		Name:        "write_and_publish_article",
+		Description: "Draft an article, check its SEO and publish it after confirmation.",
+		Arguments:   []*mcp.PromptArgument{{Name: "topic", Description: "what the article is about", Required: true}},
+	}, writePrompt)
+
+	return srv
+}
+
+func boolPtr(value bool) *bool { return &value }
+
+func intQuery(query url.Values, name string, value int) {
+	if value > 0 {
+		query.Set(name, strconv.Itoa(value))
+	}
+}
+
+func textQuery(query url.Values, name string, value string) {
+	if value != "" {
+		query.Set(name, value)
+	}
+}
+
+func result(res Response, err error) (*mcp.CallToolResult, any, error) {
+	if err != nil {
+		return nil, nil, err
+	}
+	return &mcp.CallToolResult{
+		IsError: res.Failed(),
+		Content: []mcp.Content{&mcp.TextContent{Text: res.Describe()}},
+	}, nil, nil
+}
+
+func (s *server) call(ctx context.Context, method string, path string, query url.Values, body any) (*mcp.CallToolResult, any, error) {
+	var raw []byte
+	contentType := ""
+	if body != nil {
+		encoded, err := json.Marshal(body)
+		if err != nil {
+			return nil, nil, err
+		}
+		raw, contentType = encoded, jsonType
+	}
+	return result(s.client.Do(ctx, method, path, query, raw, contentType))
+}
+
+func articlePath(id int, suffix string) string {
+	return "/v1/article/" + strconv.Itoa(id) + suffix
+}
+
+func (s *server) listArticles(ctx context.Context, _ *mcp.CallToolRequest, in listArticlesInput) (*mcp.CallToolResult, any, error) {
+	query := url.Values{}
+	intQuery(query, "page", in.Page)
+	intQuery(query, "size", in.Size)
+	textQuery(query, "q", in.Query)
+	textQuery(query, "status", in.Status)
+	textQuery(query, "sort", in.Sort)
+	textQuery(query, "site", in.Site)
+	textQuery(query, "seo", in.SEO)
+	textQuery(query, "format", in.Format)
+	return s.call(ctx, http.MethodGet, "/v1/article/", query, nil)
+}
+
+func (s *server) getArticle(ctx context.Context, _ *mcp.CallToolRequest, in getArticleInput) (*mcp.CallToolResult, any, error) {
+	query := url.Values{}
+	textQuery(query, "format", in.Format)
+	return s.call(ctx, http.MethodGet, articlePath(in.ID, ""), query, nil)
+}
+
+func (s *server) createArticle(ctx context.Context, _ *mcp.CallToolRequest, in createArticleInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodPost, "/v1/article/", nil, map[string]string{"title": in.Title, "body": in.Body})
+}
+
+func (s *server) updateArticleBody(ctx context.Context, _ *mcp.CallToolRequest, in updateArticleBodyInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodPatch, articlePath(in.ID, ""), nil, map[string]string{"body": in.Body})
+}
+
+func (s *server) publishArticle(ctx context.Context, _ *mcp.CallToolRequest, in articleIDInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodPatch, articlePath(in.ID, "/publish"), nil, nil)
+}
+
+func (s *server) checkSEO(ctx context.Context, _ *mcp.CallToolRequest, in articleIDInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodPost, articlePath(in.ID, "/seo/check"), nil, map[string]string{})
+}
+
+func (s *server) deleteArticle(ctx context.Context, _ *mcp.CallToolRequest, in articleIDInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodDelete, articlePath(in.ID, ""), nil, nil)
+}
+
+func (s *server) listMedia(ctx context.Context, _ *mcp.CallToolRequest, in listMediaInput) (*mcp.CallToolResult, any, error) {
+	query := url.Values{}
+	textQuery(query, "q", in.Query)
+	textQuery(query, "filter", in.Filter)
+	textQuery(query, "sort", in.Sort)
+	intQuery(query, "page", in.Page)
+	intQuery(query, "size", in.Size)
+	return s.call(ctx, http.MethodGet, "/v1/media/", query, nil)
+}
+
+func (s *server) deleteMedia(ctx context.Context, _ *mcp.CallToolRequest, in mediaIDInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodDelete, "/v1/media/"+strconv.Itoa(in.ID), nil, nil)
+}
+
+func (s *server) uploadMedia(ctx context.Context, _ *mcp.CallToolRequest, in uploadMediaInput) (*mcp.CallToolResult, any, error) {
+	name, content, err := uploadContent(in)
+	if err != nil {
+		return nil, nil, err
+	}
+	var form bytes.Buffer
+	writer := multipart.NewWriter(&form)
+	part, err := writer.CreateFormFile("file", name)
+	if err != nil {
+		return nil, nil, err
+	}
+	if _, err := part.Write(content); err != nil {
+		return nil, nil, err
+	}
+	if err := writer.Close(); err != nil {
+		return nil, nil, err
+	}
+	return result(s.client.Do(ctx, http.MethodPost, "/v1/media/", nil, form.Bytes(), writer.FormDataContentType()))
+}
+
+func uploadContent(in uploadMediaInput) (string, []byte, error) {
+	switch {
+	case in.Path != "" && in.Base64 != "":
+		return "", nil, fmt.Errorf("give either path or base64, not both")
+	case in.Path != "":
+		content, err := os.ReadFile(in.Path)
+		if err != nil {
+			return "", nil, err
+		}
+		name := in.Filename
+		if name == "" {
+			name = filepath.Base(in.Path)
+		}
+		return name, content, nil
+	case in.Base64 != "":
+		if in.Filename == "" {
+			return "", nil, fmt.Errorf("filename is required with base64")
+		}
+		content, err := base64.StdEncoding.DecodeString(in.Base64)
+		if err != nil {
+			return "", nil, fmt.Errorf("base64 content is not valid: %w", err)
+		}
+		return in.Filename, content, nil
+	}
+	return "", nil, fmt.Errorf("give a path or base64 content")
+}
+
+func (s *server) listSites(ctx context.Context, _ *mcp.CallToolRequest, _ emptyInput) (*mcp.CallToolResult, any, error) {
+	return s.call(ctx, http.MethodGet, "/v1/site/", nil, nil)
+}
+
+func (s *server) getSitemap(ctx context.Context, _ *mcp.CallToolRequest, in sitemapInput) (*mcp.CallToolResult, any, error) {
+	query := url.Values{}
+	intQuery(query, "page", in.Page)
+	intQuery(query, "size", in.Size)
+	return s.call(ctx, http.MethodGet, "/v1/site/"+url.PathEscape(in.Key)+"/sitemap", query, nil)
+}
+
+func (s *server) readDocs(ctx context.Context, req *mcp.ReadResourceRequest) (*mcp.ReadResourceResult, error) {
+	res, err := s.client.Do(ctx, http.MethodGet, "/llms-full.txt", nil, nil, "")
+	if err != nil {
+		return nil, err
+	}
+	if res.Failed() {
+		return nil, fmt.Errorf("the instance did not serve its documentation: %s", res.Describe())
+	}
+	return &mcp.ReadResourceResult{Contents: []*mcp.ResourceContents{{
+		URI:      req.Params.URI,
+		MIMEType: "text/plain",
+		Text:     res.Body,
+	}}}, nil
+}
+
+func writePrompt(_ context.Context, req *mcp.GetPromptRequest) (*mcp.GetPromptResult, error) {
+	text := "Write an article about " + req.Params.Arguments["topic"] + " for this RenewCMS instance. " +
+		"Create it as a draft with create_article, run check_seo and fix what is worth fixing with update_article_body, " +
+		"then show me the result and ask before calling publish_article."
+	return &mcp.GetPromptResult{
+		Description: "Draft, check and publish an article",
+		Messages:    []*mcp.PromptMessage{{Role: "user", Content: &mcp.TextContent{Text: text}}},
+	}, nil
+}

internal/infrastructure/persistence/database/migrate.go

@@ -7,7 +7,7 @@ import (
 )
 
 func Migrate(db *gorm.DB, publicURL string) error {
-	err := tableOptionsFor(db).AutoMigrate(&models.Article{}, &models.Image{}, &models.User{}, &models.Invite{}, &models.APIKey{}, &models.PurgeSettings{}, &models.AuditEvent{}, &models.AuditSettings{}, &models.ImageVariant{}, &models.ImageVariantFile{}, &models.ImageVariantRejectionDay{}, &models.Site{}, &models.Author{}, &models.ArticleAuthor{}, &models.ContentType{}, &models.Entry{})
+	err := tableOptionsFor(db).AutoMigrate(&models.Article{}, &models.Image{}, &models.User{}, &models.Invite{}, &models.APIKey{}, &models.PurgeSettings{}, &models.AuditEvent{}, &models.AuditSettings{}, &models.ImageVariant{}, &models.ImageVariantFile{}, &models.ImageVariantRejectionDay{}, &models.Site{}, &models.Author{}, &models.ArticleAuthor{}, &models.ContentType{}, &models.Entry{}, &models.RevokedSession{})
 	if err != nil {
 		return err
 	}

internal/infrastructure/persistence/mappers/sessionMapper.go

@@ -0,0 +1,10 @@
+package mappers
+
+import (
+	"RenewCMS/internal/domain/session"
+	"RenewCMS/internal/infrastructure/persistence/models"
+)
+
+func RevokedSessionToModel(r session.Revocation) models.RevokedSession {
+	return models.RevokedSession{ID: r.ID, ExpiresAt: r.ExpiresAt.UTC()}
+}

internal/infrastructure/persistence/models/revokedSessionModel.go

@@ -0,0 +1,8 @@
+package models
+
+import "time"
+
+type RevokedSession struct {
+	ID        string    `gorm:"primaryKey;size:64"`
+	ExpiresAt time.Time `gorm:"index;not null"`
+}

internal/infrastructure/persistence/repositories/revokedSessionRepository.go

@@ -0,0 +1,39 @@
+package persistence
+
+import (
+	domainSession "RenewCMS/internal/domain/session"
+	"RenewCMS/internal/infrastructure/persistence/mappers"
+	entity "RenewCMS/internal/infrastructure/persistence/models"
+	"time"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type RevokedSessionRepository struct {
+	db *gorm.DB
+}
+
+func NewRevokedSessionRepository(db *gorm.DB) *RevokedSessionRepository {
+	return &RevokedSessionRepository{db}
+}
+
+func (s *RevokedSessionRepository) Revoke(revocation domainSession.Revocation) error {
+	model := mappers.RevokedSessionToModel(revocation)
+	return s.db.Clauses(clause.OnConflict{DoNothing: true}).Create(&model).Error
+}
+
+func (s *RevokedSessionRepository) IsRevoked(id string) (bool, error) {
+	var count int64
+	if err := s.db.Model(&entity.RevokedSession{}).Where("id = ?", id).Count(&count).Error; err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
+func (s *RevokedSessionRepository) DeleteExpired(now time.Time) (int, error) {
+	result := s.db.Where("expires_at <= ?", now.UTC()).Delete(&entity.RevokedSession{})
+	return int(result.RowsAffected), result.Error
+}
+
+var _ domainSession.Repository = &RevokedSessionRepository{}

internal/infrastructure/scheduler/runner.go

@@ -3,6 +3,7 @@ package scheduler
 import (
 	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/purge"
+	"RenewCMS/internal/domain/retention"
 	"context"
 	"errors"
 	"fmt"
@@ -23,6 +24,10 @@ type CleanupJob interface {
 	Tick(now time.Time) (audit.CleanupResult, bool, error)
 }
 
+type RetentionJob interface {
+	Tick(now time.Time) (retention.Result, error)
+}
+
 type task interface {
 	tick(ctx context.Context, now time.Time) (summary string, ran bool, err error)
 }
@@ -49,6 +54,16 @@ func (c cleanupTask) tick(_ context.Context, now time.Time) (string, bool, error
 	return fmt.Sprintf("removed=%d", result.Removed), ran, err
 }
 
+type retentionTask struct {
+	job RetentionJob
+}
+
+func (r retentionTask) tick(_ context.Context, now time.Time) (string, bool, error) {
+	result, err := r.job.Tick(now)
+	summary := fmt.Sprintf("revoked_sessions=%d unverified_users=%d invites=%d", result.RevokedSessions, result.UnverifiedUsers, result.Invites)
+	return summary, result.Total() > 0, err
+}
+
 type Runner struct {
 	label   string
 	task    task
@@ -60,8 +75,9 @@ type Runner struct {
 }
 
 const (
-	purgeLabel   = "automatic purge"
+	purgeLabel     = "automatic purge"
-	cleanupLabel = "activity cleanup"
+	cleanupLabel   = "activity cleanup"
+	retentionLabel = "personal data retention"
 )
 
 func newRunner(label string, task task, now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time, logger *log.Logger) *Runner {
@@ -76,6 +92,16 @@ func NewCleanupRunner(job CleanupJob, now func() time.Time, ticks <-chan time.Ti
 	return newRunner(cleanupLabel, cleanupTask{job}, now, ticks, startup, logger)
 }
 
+func NewRetentionRunner(job RetentionJob, now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time, logger *log.Logger) *Runner {
+	return newRunner(retentionLabel, retentionTask{job}, now, ticks, startup, logger)
+}
+
+func NewSystemRetentionRunner(job RetentionJob, logger *log.Logger) *Runner {
+	return withSystemTimers(func(now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time) *Runner {
+		return NewRetentionRunner(job, now, ticks, startup, logger)
+	})
+}
+
 func NewSystemRunner(job Job, logger *log.Logger) *Runner {
 	return withSystemTimers(func(now func() time.Time, ticks <-chan time.Time, startup <-chan time.Time) *Runner {
 		return NewRunner(job, now, ticks, startup, logger)

internal/infrastructure/useCases/AcceptInvite.go

@@ -66,6 +66,10 @@ func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite
 		return user.User{}, err
 	}
 
+	if err := user.ValidatePassword(command.Password); err != nil {
+		return user.User{}, err
+	}
+
 	hashedPassword, err := a.hasher.Hash(command.Password)
 	if err != nil {
 		return user.User{}, err

internal/infrastructure/useCases/AuthenticateUser.go

@@ -5,17 +5,21 @@ import (
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/user"
 	"context"
+	"crypto/rand"
 	"errors"
+	"sync"
 )
 
 type AuthenticateUserUseCase struct {
 	userRepository user.Repository
 	hasher         hash.Hasher
 	recorder       audit.Recorder
+	decoyOnce      sync.Once
+	decoyHash      string
 }
 
 func NewAuthenticateUserUseCase(userRepository user.Repository, hasher hash.Hasher, recorder audit.Recorder) *AuthenticateUserUseCase {
-	return &AuthenticateUserUseCase{userRepository, hasher, recorder}
+	return &AuthenticateUserUseCase{userRepository: userRepository, hasher: hasher, recorder: recorder}
 }
 
 func (a *AuthenticateUserUseCase) Authenticate(ctx context.Context, username string, password string) (user.User, error) {
@@ -34,6 +38,9 @@ func (a *AuthenticateUserUseCase) Authenticate(ctx context.Context, username str
 func (a *AuthenticateUserUseCase) verifyCredentials(username string, password string) (user.User, error) {
 	dbUser, err := a.userRepository.GetByUsername(username)
 	if err != nil {
+		if errors.Is(err, user.ErrUserNotFound) {
+			a.compareWithDecoy(password)
+		}
 		return user.User{}, err
 	}
 
@@ -44,6 +51,15 @@ func (a *AuthenticateUserUseCase) verifyCredentials(username string, password st
 	return dbUser, nil
 }
 
+func (a *AuthenticateUserUseCase) compareWithDecoy(password string) {
+	a.decoyOnce.Do(func() {
+		a.decoyHash, _ = a.hasher.Hash(rand.Text())
+	})
+	if a.decoyHash != "" {
+		_ = a.hasher.Compare(a.decoyHash, password)
+	}
+}
+
 func (a *AuthenticateUserUseCase) recordRejectedLogin(ctx context.Context, username string, cause error) {
 	if !errors.Is(cause, user.ErrUserNotFound) && !errors.Is(cause, user.ErrInvalidCredentials) {
 		return

internal/infrastructure/useCases/CreateContentType.go

@@ -37,6 +37,9 @@ func (u *CreateContentTypeUseCase) Create(command CreateContentTypeCommand) (con
 	if err != nil {
 		return contenttype.ContentType{}, err
 	}
+	if err := ensureRelationTargets(u.contentTypes, command.Key, fields); err != nil {
+		return contenttype.ContentType{}, err
+	}
 	if err := u.ensureKeyFree(command.Key); err != nil {
 		return contenttype.ContentType{}, err
 	}

internal/infrastructure/useCases/CreateEntry.go

@@ -36,6 +36,10 @@ func (u *CreateEntryUseCase) Create(command CreateEntryCommand) (TypedEntry, err
 	if err := ensureMediaExists(u.images, owner, data, nil); err != nil {
 		return TypedEntry{}, err
 	}
+	resolvers := newEntryResolvers(u.images, u.contentTypes, u.entries)
+	if err := ensureRelationsExist(resolvers.relations, owner, data, nil); err != nil {
+		return TypedEntry{}, err
+	}
 	if err := ensureUnique(u.entries, owner, data, 0); err != nil {
 		return TypedEntry{}, err
 	}
@@ -51,5 +55,5 @@ func (u *CreateEntryUseCase) Create(command CreateEntryCommand) (TypedEntry, err
 	if err != nil {
 		return TypedEntry{}, err
 	}
-	return typedEntry(owner, stored, newMediaResolver(u.images))
+	return typedEntry(owner, stored, resolvers)
 }

internal/infrastructure/useCases/CreateImage.go

@@ -29,10 +29,11 @@ type CreateImageUseCase struct {
 	imageRepository image.Repository
 	storage         image.Storage
 	recorder        audit.Recorder
+	stripper        image.MetadataStripper
 }
 
-func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder) *CreateImageUseCase {
+func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder, stripper image.MetadataStripper) *CreateImageUseCase {
-	return &CreateImageUseCase{imageRepository, storage, recorder}
+	return &CreateImageUseCase{imageRepository, storage, recorder, stripper}
 }
 
 func (g *CreateImageUseCase) CreateImage(ctx context.Context, input image.ImageInput) (image.Image, error) {
@@ -74,6 +75,11 @@ func (g *CreateImageUseCase) create(input image.ImageInput) (image.Image, error)
 		return image.Image{}, err
 	}
 
+	data, err = g.stripper.Strip(input.ContentType, data)
+	if err != nil {
+		return image.Image{}, err
+	}
+
 	checksum := sha256.Sum256(data)
 	storedName, err := g.storage.Put(input.ContentType, bytes.NewReader(data))
 	if err != nil {

internal/infrastructure/useCases/CreateUser.go

@@ -55,6 +55,10 @@ func (g *CreateUserUseCase) create(createUser CreateUserCommand) (user.User, err
 		return user.User{}, user.ErrRegistrationClosed
 	}
 
+	if err := user.ValidatePassword(createUser.Password); err != nil {
+		return user.User{}, err
+	}
+
 	rawUuid := uuid.NewString()
 
 	hashedPassword, err := g.hasher.Hash(createUser.Password)

internal/infrastructure/useCases/DeleteContentType.go

@@ -19,6 +19,15 @@ func (u *DeleteContentTypeUseCase) Delete(key string) error {
 	if err != nil {
 		return err
 	}
+	types, err := u.contentTypes.List()
+	if err != nil {
+		return err
+	}
+	for _, other := range types {
+		if other.ID != target.ID && contenttype.ReferencesType(other.Fields, target.Key) {
+			return contenttype.ErrReferenced
+		}
+	}
 	count, err := u.entries.CountByContentType(target.ID)
 	if err != nil {
 		return err

internal/infrastructure/useCases/EnforceRetention.go

@@ -0,0 +1,61 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/retention"
+	"RenewCMS/internal/domain/session"
+	"RenewCMS/internal/domain/user"
+	"time"
+)
+
+type EnforceRetentionUseCase struct {
+	users    user.Repository
+	invites  invite.Repository
+	sessions session.Repository
+}
+
+func NewEnforceRetentionUseCase(users user.Repository, invites invite.Repository, sessions session.Repository) *EnforceRetentionUseCase {
+	return &EnforceRetentionUseCase{users, invites, sessions}
+}
+
+func (e *EnforceRetentionUseCase) Tick(now time.Time) (retention.Result, error) {
+	var result retention.Result
+	var err error
+
+	if result.RevokedSessions, err = e.sessions.DeleteExpired(now); err != nil {
+		return result, err
+	}
+	if result.UnverifiedUsers, err = e.deleteStaleUnverifiedUsers(now); err != nil {
+		return result, err
+	}
+	result.Invites, err = e.deleteStaleInvites(now)
+	return result, err
+}
+
+func (e *EnforceRetentionUseCase) deleteStaleUnverifiedUsers(now time.Time) (int, error) {
+	removed := 0
+	for _, candidate := range e.users.GetAll() {
+		if !candidate.IsStaleUnverifiedAt(now) {
+			continue
+		}
+		if err := e.users.Delete(candidate.ID); err != nil {
+			return removed, err
+		}
+		removed++
+	}
+	return removed, nil
+}
+
+func (e *EnforceRetentionUseCase) deleteStaleInvites(now time.Time) (int, error) {
+	removed := 0
+	for _, candidate := range e.invites.GetAll() {
+		if !candidate.IsStaleAt(now) {
+			continue
+		}
+		if err := e.invites.Delete(candidate.ID); err != nil {
+			return removed, err
+		}
+		removed++
+	}
+	return removed, nil
+}

internal/infrastructure/useCases/ExportActivity.go

@@ -11,7 +11,7 @@ import (
 const exportBatchSize = 500
 
 const formulaGuard = "'"
-const formulaStarts = "=+-@"
+const formulaStarts = "=+-@\t\r"
 
 var exportHeader = []string{"when", "actor", "action", "target", "outcome", "source", "ip"}
 

internal/infrastructure/useCases/GetEntry.go

@@ -25,5 +25,5 @@ func (u *GetEntryUseCase) Get(contentTypeKey string, id uint32) (TypedEntry, err
 	if err != nil {
 		return TypedEntry{}, err
 	}
-	return typedEntry(owner, found, newMediaResolver(u.images))
+	return typedEntry(owner, found, newEntryResolvers(u.images, u.contentTypes, u.entries))
 }

internal/infrastructure/useCases/ListEntries.go

@@ -4,6 +4,7 @@ import (
 	"RenewCMS/internal/domain/contenttype"
 	"RenewCMS/internal/domain/entry"
 	"RenewCMS/internal/domain/image"
+	"strings"
 )
 
 type ListEntriesUseCase struct {
@@ -17,6 +18,7 @@ type ListEntriesCommand struct {
 	Page           int
 	Size           int
 	Sort           entry.Sort
+	Query          string
 }
 
 type EntryPage struct {
@@ -41,12 +43,12 @@ func (u *ListEntriesUseCase) ListPage(command ListEntriesCommand) (EntryPage, er
 	if err != nil {
 		return EntryPage{}, err
 	}
-	found, err := u.entries.ListPage(entry.Filters{ContentTypeID: owner.ID, Page: command.Page, Size: command.Size, Sort: command.Sort})
+	found, err := u.page(owner, command)
 	if err != nil {
 		return EntryPage{}, err
 	}
 	items := make([]TypedEntry, 0, len(found.Items))
-	resolver := newMediaResolver(u.images)
+	resolver := newEntryResolvers(u.images, u.contentTypes, u.entries)
 	for _, record := range found.Items {
 		typed, err := typedEntry(owner, record, resolver)
 		if err != nil {
@@ -56,3 +58,25 @@ func (u *ListEntriesUseCase) ListPage(command ListEntriesCommand) (EntryPage, er
 	}
 	return EntryPage{Items: items, Total: found.Total, Page: command.Page, Size: command.Size}, nil
 }
+
+func (u *ListEntriesUseCase) page(owner contenttype.ContentType, command ListEntriesCommand) (entry.PageResult, error) {
+	query := strings.TrimSpace(command.Query)
+	if query == "" {
+		return u.entries.ListPage(entry.Filters{ContentTypeID: owner.ID, Page: command.Page, Size: command.Size, Sort: command.Sort})
+	}
+	all, err := u.entries.ListPage(entry.Filters{ContentTypeID: owner.ID, Unpaged: true, Sort: command.Sort})
+	if err != nil {
+		return entry.PageResult{}, err
+	}
+	matching := make([]entry.Entry, 0, len(all.Items))
+	for _, record := range all.Items {
+		if entry.MatchesQuery(owner.Fields, record.Data, query) {
+			matching = append(matching, record)
+		}
+	}
+	pageNumber := max(command.Page, 1)
+	size := max(command.Size, 0)
+	start := min((pageNumber-1)*size, len(matching))
+	end := min(start+size, len(matching))
+	return entry.PageResult{Items: matching[start:end], Total: len(matching)}, nil
+}

internal/infrastructure/useCases/ResetPassword.go

@@ -35,6 +35,10 @@ func (r *ResetPasswordUseCase) ResetPassword(ctx context.Context, email string,
 		return user.ErrPasswordResetCodeExpired
 	}
 
+	if err := user.ValidatePassword(newPassword); err != nil {
+		return err
+	}
+
 	hashedPassword, err := r.hasher.Hash(newPassword)
 	if err != nil {
 		return err

internal/infrastructure/useCases/RevokeSession.go

@@ -0,0 +1,32 @@
+package useCases
+
+import (
+	"RenewCMS/internal/domain/session"
+	"time"
+)
+
+type SessionRevocationUseCase struct {
+	sessions session.Repository
+	now      func() time.Time
+}
+
+func NewSessionRevocationUseCase(sessions session.Repository, now func() time.Time) *SessionRevocationUseCase {
+	return &SessionRevocationUseCase{sessions, now}
+}
+
+func (s *SessionRevocationUseCase) Revoke(id string, expiresAt time.Time) error {
+	if err := session.ValidateID(id); err != nil {
+		return err
+	}
+	if !expiresAt.After(s.now()) {
+		return nil
+	}
+	return s.sessions.Revoke(session.Revocation{ID: id, ExpiresAt: expiresAt})
+}
+
+func (s *SessionRevocationUseCase) IsRevoked(id string) (bool, error) {
+	if err := session.ValidateID(id); err != nil {
+		return false, err
+	}
+	return s.sessions.IsRevoked(id)
+}

internal/infrastructure/useCases/UpdateContentType.go

@@ -39,6 +39,12 @@ func (u *UpdateContentTypeUseCase) Update(command UpdateContentTypeCommand) (con
 	if err != nil {
 		return contenttype.ContentType{}, err
 	}
+	if relationShapeChanged(current.Fields, fields) {
+		return contenttype.ContentType{}, contenttype.ErrInvalidField
+	}
+	if err := ensureRelationTargets(u.contentTypes, current.Key, fields); err != nil {
+		return contenttype.ContentType{}, err
+	}
 	stored, err := u.storedEntries(current.ID)
 	if err != nil {
 		return contenttype.ContentType{}, err

internal/infrastructure/useCases/UpdateEntry.go

@@ -40,6 +40,10 @@ func (u *UpdateEntryUseCase) Update(command UpdateEntryCommand) (TypedEntry, err
 	if err := ensureMediaExists(u.images, owner, command.Data, current.Data); err != nil {
 		return TypedEntry{}, err
 	}
+	resolvers := newEntryResolvers(u.images, u.contentTypes, u.entries)
+	if err := ensureRelationsExist(resolvers.relations, owner, command.Data, current.Data); err != nil {
+		return TypedEntry{}, err
+	}
 	if err := ensureUnique(u.entries, owner, command.Data, current.ID); err != nil {
 		return TypedEntry{}, err
 	}
@@ -50,5 +54,5 @@ func (u *UpdateEntryUseCase) Update(command UpdateEntryCommand) (TypedEntry, err
 	if err != nil {
 		return TypedEntry{}, err
 	}
-	return typedEntry(owner, stored, newMediaResolver(u.images))
+	return typedEntry(owner, stored, resolvers)
 }

internal/infrastructure/useCases/auditFailures.go

@@ -44,6 +44,7 @@ var failureReasons = []failureReason{
 	{user.ErrVerificationCodeExpired, "The verification code has expired."},
 	{user.ErrInvalidDisplayName, "That display name is too long."},
 	{user.ErrUsernameTaken, "That username is already taken."},
+	{user.ErrPasswordTooLong, "The password is longer than 72 bytes."},
 	{invite.ErrEmailHasAccount, "That email already has an account."},
 	{invite.ErrPendingInvite, "An invitation is already pending for that email."},
 	{invite.ErrInviteEmailNotSent, "The invitation email could not be sent."},