codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Address follow-up review: cheaper avatars, list limits, less chatter.

Browse Source 
Switch avatar resize to ApproxBiLinear, cap hunt/profile/admin list queries, drop redundant admin/profile lookups, dedupe CI on app PRs, and refresh stale todo.md notes.
This commit is contained in:
codegirl007
2026-08-22 09:55:32 -07:00
parent 1a8c4eda14
commit 96b0ce795a
13 changed files with 83 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
todo.md
+15 -16
View File
@@ -2,31 +2,30 @@
From the project review. Priority order within each section.
## Fix soon
## Done recently
- [x] **Persist sessions** — Sessions live in the app DB (`sessions` table) via `postgresstore`. Opaque cookie unchanged; unused `SESSION_SECRET` removed from config / `.env.example`.
- [x] **Drop Dockerfile** — Deploying on DigitalOcean App Platform (buildpack from `go.mod`); no container image needed.
- [x] **Rune-safe truncation** — `title[:120]`, `body[:8000]`, `city[:80]`, answer body, etc. can split multi-byte UTF-8. Truncate by runes (or safely).
- [x] **Admin bootstrap** — `ADMIN_USERNAME` seeds the first admin on register only when no admin exists. Promote/demote via `/admin/users` (admins only); roles stay in `users.role`.
- [x] **Persist sessions** — Custom sqlc-backed `SessionStore` (scs API kept; no `postgresstore`).
- [x] **Drop Dockerfile** — DigitalOcean App Platform buildpack from `go.mod`.
- [x] **Rune-safe truncation** — Form fields truncate by runes.
- [x] **Admin bootstrap** — `ADMIN_USERNAME` seeds first admin only when none exist; `/admin/users` for promote/demote.
- [x] **Graceful shutdown** — Signal-aware `http.Server.Shutdown` with timeouts.
- [x] **Handler tests** — Vote HTMX, answer/hide, CSRF, session rotation via in-memory `Store` (no Postgres for web suite).
- [x] **App Platform listen port** — Prefers `PORT`, then `LISTEN`, then `:8080`.
- [x] **Prod DB = PlanetScale Postgres** — Required `DATABASE_URL`; DSN cleanup for PlanetScale/libpq-only params.
## Docs & ops
- [ ] **README** — How to run locally, env vars (from `.env.example`), admin bootstrap, PlanetScale `DATABASE_URL`, App Platform notes (`PORT`, `SECURE_COOKIE=1`).
- [ ] **Migrations story** — Schema is applied on boot from `schema.sql` (+ sessions DDL). OK for v1; plan real migrations before schema drifts.
- [x] **App Platform listen port** — Prefers `PORT`, then `LISTEN`, then `:8080`.
- [x] **Prod DB = PlanetScale Postgres** — App opens Postgres via required `DATABASE_URL`; DSN cleanup strips PlanetScale/libpq-only params (`sslrootcert=system`, `sslnegotiation`). Use dashboard URI on **5432** for boot schema create; **6432** (PgBouncer) later if you need pooling.
- [ ] **Migrations story** — Schema is applied on boot from `schema.sql`. OK for v1; plan real migrations before schema drifts.
## Smaller / later
- [ ] Rate-limit login/register (bcrypt helps; still open to brute-force).
- [ ] Graceful shutdown instead of bare `ListenAndServe`.
- [ ] More tests: vote HTMX paths, admin answer/hide, archive redirects; optional Postgres integration test.
- [ ] Cursor pagination UI when hunt/profile lists hit their row limits.
- [ ] Optional Postgres integration tests (`TEST_DATABASE_URL`) for sqlc SessionStore / advisory locks.
## Suggested order of attack
1. ~~Persist sessions~~ done.
2. ~~Drop Dockerfile~~ done (App Platform).
3. ~~Wire `PORT`~~ done.
4. ~~Admin roles page~~ done.
5. Short README (run, env, admin, App Platform + PlanetScale).
6. Rune-safe truncation + a couple of handler tests (vote, admin hide).
1. Short README (run, env, admin, App Platform + PlanetScale).
2. Migrations plan before the next schema change.
3. Rate-limit auth endpoints.