Commit Graph
19 Commits
Author SHA1 Message Date
codegirl007 8a2c7de8ca Add post permalinks (#8)
CI / test (pull_request) Successful in 6m17s
Reviewed-on: #8
Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 16:21:38 +00:00
codegirl007 f420f888af Remove legacy question storage (#7)
Deletes obsolete question/answer/vote persistence and the compatibility answer endpoint. Existing databases drop the legacy tables through migration 009. Plumber replies now notify the root homeowner even when nested beneath another plumber reply. Post and reply forms prevent duplicate submissions and show progress while posting.

Reviewed-on: #7
Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 16:17:57 +00:00
codegirl007 f0591ccea3 Generalize post reply notifications (#6)
## Summary
- Notify the direct parent post author for replies throughout nested conversations
- Skip root creation, self-replies, edits, disabled mail, and recipients without email
- Link directly to each reply and use per-reply Resend idempotency

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 16:03:33 +00:00
codegirl007 7412069ca6 Add nested posts UI (#5)
## Summary
- Cut hunt, question, submission, voting, hiding, and profile flows over to unified posts
- Render nested replies with permission-aware inline Reply/Edit controls and edited markers
- Add post profile queries and the author index migration they depend on

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 15:53:01 +00:00
codegirl007 4d994d5300 Add post mutation permissions (#4)
Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 14:28:21 +00:00
codegirl007 418ef93da5 Add polished answer notifications (#1)
Sends a branded Resend email when a question receives its first answer, records accepted and failed sends, and adds collapsed answer editing with cancel behavior.

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 06:55:24 +00:00
codegirl007 35c8c9f391 Fix migrate lock scope and stop RealIP from bypassing proxy trust.
Hold a session advisory lock for the full migration apply path, and remove Chi RealIP so clientIP can validate the TCP peer before walking X-Forwarded-For.
2026-08-22 12:25:16 -07:00
codegirl007 29b0536215 Address production-readiness review: clearer errors, safer votes, and ops hardening.
Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
2026-08-22 12:16:59 -07:00
codegirl007 5bdaa8977f Fix auth throttle DoS and serialize admin bootstrap.
Evict/cap limiter keys, replace hard username lockouts with IP+user progressive delays cleared on success, and create bootstrap admins under the same advisory/mutex lock as role changes.
2026-08-22 11:54:10 -07:00
codegirl007 59513ab75e Harden auth: setup secret, throttling, session destroy, secure cookies.
Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.
2026-08-22 11:47:42 -07:00
codegirl007 96b0ce795a Address follow-up review: cheaper avatars, list limits, less chatter.
Switch avatar resize to ApproxBiLinear, cap hunt/profile/admin list queries, drop redundant admin/profile lookups, dedupe CI on app PRs, and refresh stale todo.md notes.
2026-08-22 09:55:32 -07:00
codegirl007 1a8c4eda14 Tighten avatar decode and encoded size limits.
Reject images over 1024px before pixel decode, resize down to 512 for storage, and cap re-encoded output at the upload byte limit.
2026-08-22 07:58:58 -07:00
codegirl007 f4cec32afb Make web tests database-free and finish review hardening.
Introduce a Store interface with Postgres and in-memory backends, cover mutations/CSRF/session rotation without Postgres, bound avatar decode dimensions, add truncate/prepareAvatar unit tests, and run go test -race in CI.
2026-08-22 07:36:13 -07:00
codegirl007 afd2476f3c Harden sessions, uploads, admin demotion, and HTTP timeouts.
Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.
2026-08-22 07:24:39 -07:00
codegirl007 c77298411e Refactor Store into SessionStore; move domain SQL onto User/Question/Answer. 2026-08-22 02:40:51 -07:00
codegirl007 a249965fc1 Rename Object to FileUpload; use native Postgres $n placeholders. 2026-08-21 23:53:00 -07:00
codegirl007 a36bc723cc Move Spaces FromEnv into blob; Upload takes Object; drop logSpaces. 2026-08-21 23:48:18 -07:00
codegirl007 3391cce7bd Address PR review: graceful shutdown, Role/NewUser, drop SQLite. 2026-08-21 23:40:59 -07:00
codegirl007 d167b9216a Initial commit: runnable Ask a Plumber First server. 2026-08-21 23:30:15 -07:00