Address production-readiness review: clearer errors, safer votes, and ops hardening.

Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
2026-08-22 12:16:59 -07:00
parent 5bdaa8977f
commit 29b0536215
26 changed files with 612 additions and 146 deletions
@@ -5,7 +5,7 @@
      hx-post="/questions/{{.Question.ID}}/vote"
      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
      <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      <input type="hidden" name="value" value="1">
+      {{if eq .Question.UserVote 1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="1">{{end}}
      <input type="hidden" name="view" value="{{.View}}">
      <input type="hidden" name="date" value="{{.Date}}">
      <button type="submit" class="vote-btn{{if eq .Question.UserVote 1}} is-up{{end}}" aria-label="Upvote" aria-pressed="{{if eq .Question.UserVote 1}}true{{else}}false{{end}}">
@@ -17,7 +17,7 @@
      hx-post="/questions/{{.Question.ID}}/vote"
      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
      <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      <input type="hidden" name="value" value="-1">
+      {{if eq .Question.UserVote -1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="-1">{{end}}
      <input type="hidden" name="view" value="{{.View}}">
      <input type="hidden" name="date" value="{{.Date}}">
      <button type="submit" class="vote-btn{{if eq .Question.UserVote -1}} is-down{{end}}" aria-label="Downvote" aria-pressed="{{if eq .Question.UserVote -1}}true{{else}}false{{end}}">