162fea4afb
feat: settings page, sidebar and drawer destination "Settings" (icon settings, after Integration), route /settings (verified), showing only the running build's Version
fsylvain2026-09-30 00:19:29 +02:00
b146dfead7
fix: desktop account menu icons, labels and check mark are now centred in their 32 px rows
fsylvain2026-09-29 23:36:42 +02:00
27dadbbfa6
fix: account menu matches the redesigned board: System, Light, Dark stay in the menu and the sheet, and the visual-check exception on profile "Account menu" in web/visual/states.ts is removed
fsylvain2026-09-29 23:31:04 +02:00
6dc47789ef
chore: groundwork for new design and features related to users and settings
fsylvain2026-09-29 23:19:41 +02:00
65ced64568
fix: "save X min ago" only min to min/hours/days
fsylvain2026-09-29 22:56:05 +02:00
c40522a09f
fix: scrollable toolbar in mobile editor
fsylvain2026-09-29 22:53:49 +02:00
12faab7f92
feat: typed API client (useApi) and session store (useSession) with the global 401, unverified-403, 429 and offline handling from states.md
fsylvain2026-09-25 17:33:40 +02:00
eed661bb24
feat: PrimeVue replaced by Nuxt UI using token files from web/src/theme, with AuthShell, DashboardShell, AppBoot and the route guards from routes.md
fsylvain2026-09-25 17:07:40 +02:00
24f95a8fd7
chore: Vitest + Vue Test Utils test runner exposed as task test:web
fsylvain2026-09-25 16:12:50 +02:00
0e050c36ff
fix: rate limiting X-Real-IP from the real peer
fsylvain2026-09-25 06:49:55 +02:00
9b47685002
refac: split the auth handler into registration and login, account verification, and password reset handlers, each with its own dependencies
fsylvain2026-09-25 06:14:53 +02:00
3282b0580c
fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id
fsylvain2026-09-25 05:58:37 +02:00
cbb403011a
fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)
fsylvain2026-09-25 05:33:02 +02:00
f3ec3d2fa2
fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused
fsylvain2026-09-25 05:03:34 +02:00
81c4b62175
fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404
fsylvain2026-09-24 16:32:40 +02:00
2ee28203ab
fix: API responses never include a user's password, verification code or reset code hashes, or their expiry dates; verifying an account returns only the public user fields
fsylvain2026-09-24 15:39:50 +02:00
6d510d2805
refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h
fsylvain2026-09-24 03:36:37 +02:00
6e9e108033
refac: several unverified users can exist at once: an empty reset or verification code is stored as no value so it doesn't break the unique constraint, and deleting a user removes the row so the same username and email can register again
fsylvain2026-09-24 01:59:24 +02:00
0b4e614ec9
refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables
fsylvain2026-09-24 01:30:00 +02:00
e474f03d91
refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400
fsylvain2026-09-24 00:33:26 +02:00
5992c8598b
refac: allowed image types and the size limit are a domain rule checked by the use case, not by the persistence layer
fsylvain2026-09-24 00:03:29 +02:00
8a8a24434a
refac: deleting an article also deletes its images, and deleting a missing article returns 404
fsylvain2026-09-23 23:42:18 +02:00
c16fdbd26d
refac: authenticated user can edit an article's body; an unknown id returns 404
fsylvain2026-09-23 23:24:03 +02:00
8822bdddd0
refac: authenticated user can publish and unpublish an article; an unknown id returns 404
fsylvain2026-09-23 22:54:44 +02:00
790d4e6da6
refac: authenticated user can list all articles, including offline ones, while the public list only shows online ones
fsylvain2026-09-23 22:36:41 +02:00
6a2ca07b66
refac: repository updates, image attachment and deletes report the domain not-found error for an unknown id, the same for articles, users and images, and the test fakes stop returning GORM errors
fsylvain2026-09-23 22:09:06 +02:00
4278d96882
refac: article title rules are the same in the API request and the domain; an invalid title returns 400 instead of 500
fsylvain2026-09-23 20:04:09 +02:00
ff8cd5f0ec
refac: password and code hashing & checking go through a domain hasher interface used by the use cases instead of bcrypt in the user repository and the auth handler
fsylvain2026-09-23 19:29:20 +02:00
8460a078e3
refac: missing user or article is reported with a domain not-found error instead of a raw GORM error, and the API answers 404 for it
fsylvain2026-09-23 18:55:05 +02:00
7c57173497
feat: characterized the existing use cases as a baseline; every repo fake behaves like the real ones and can be told to fail, every use case is covered; gremlins runs clean on useCases
fsylvain2026-09-23 18:21:46 +02:00
09bd5afa4a
refac: rethought the complete workflow and deployement flow ; docs etc.
fsylvain2026-09-23 17:36:36 +02:00
fsylvain
Floriansylvain