Commit Graph
17 Commits
Author SHA1 Message Date
codegirl007 f0591ccea3 Generalize post reply notifications (#6)
## Summary
- Notify the direct parent post author for replies throughout nested conversations
- Skip root creation, self-replies, edits, disabled mail, and recipients without email
- Link directly to each reply and use per-reply Resend idempotency

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 16:03:33 +00:00
codegirl007 7412069ca6 Add nested posts UI (#5)
## Summary
- Cut hunt, question, submission, voting, hiding, and profile flows over to unified posts
- Render nested replies with permission-aware inline Reply/Edit controls and edited markers
- Add post profile queries and the author index migration they depend on

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 15:53:01 +00:00
codegirl007 4d994d5300 Add post mutation permissions (#4)
Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 14:28:21 +00:00
codegirl007 418ef93da5 Add polished answer notifications (#1)
Sends a branded Resend email when a question receives its first answer, records accepted and failed sends, and adds collapsed answer editing with cancel behavior.

Co-authored-by: codegirl-007 <s.raide@gmail.com>
2026-08-27 06:55:24 +00:00
codegirl007 35c8c9f391 Fix migrate lock scope and stop RealIP from bypassing proxy trust.
Hold a session advisory lock for the full migration apply path, and remove Chi RealIP so clientIP can validate the TCP peer before walking X-Forwarded-For.
2026-08-22 12:25:16 -07:00
codegirl007 29b0536215 Address production-readiness review: clearer errors, safer votes, and ops hardening.
Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
2026-08-22 12:16:59 -07:00
codegirl007 5bdaa8977f Fix auth throttle DoS and serialize admin bootstrap.
Evict/cap limiter keys, replace hard username lockouts with IP+user progressive delays cleared on success, and create bootstrap admins under the same advisory/mutex lock as role changes.
2026-08-22 11:54:10 -07:00
codegirl007 59513ab75e Harden auth: setup secret, throttling, session destroy, secure cookies.
Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.
2026-08-22 11:47:42 -07:00
codegirl007 96b0ce795a Address follow-up review: cheaper avatars, list limits, less chatter.
Switch avatar resize to ApproxBiLinear, cap hunt/profile/admin list queries, drop redundant admin/profile lookups, dedupe CI on app PRs, and refresh stale todo.md notes.
2026-08-22 09:55:32 -07:00
codegirl007 1a8c4eda14 Tighten avatar decode and encoded size limits.
Reject images over 1024px before pixel decode, resize down to 512 for storage, and cap re-encoded output at the upload byte limit.
2026-08-22 07:58:58 -07:00
codegirl007 f4cec32afb Make web tests database-free and finish review hardening.
Introduce a Store interface with Postgres and in-memory backends, cover mutations/CSRF/session rotation without Postgres, bound avatar decode dimensions, add truncate/prepareAvatar unit tests, and run go test -race in CI.
2026-08-22 07:36:13 -07:00
codegirl007 afd2476f3c Harden sessions, uploads, admin demotion, and HTTP timeouts.
Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.
2026-08-22 07:24:39 -07:00
codegirl007 c77298411e Refactor Store into SessionStore; move domain SQL onto User/Question/Answer. 2026-08-22 02:40:51 -07:00
codegirl007 a249965fc1 Rename Object to FileUpload; use native Postgres $n placeholders. 2026-08-21 23:53:00 -07:00
codegirl007 a36bc723cc Move Spaces FromEnv into blob; Upload takes Object; drop logSpaces. 2026-08-21 23:48:18 -07:00
codegirl007 3391cce7bd Address PR review: graceful shutdown, Role/NewUser, drop SQLite. 2026-08-21 23:40:59 -07:00
codegirl007 d167b9216a Initial commit: runnable Ask a Plumber First server. 2026-08-21 23:30:15 -07:00