plumber/todo.md

Plumber — follow-ups

From the project review. Priority order within each section.

Done recently

• Persist sessions — Custom sqlc-backed SessionStore (scs API kept; no postgresstore).
• Drop Dockerfile — DigitalOcean App Platform buildpack from go.mod.
• Rune-safe truncation — Form fields truncate by runes.
• Admin bootstrap — ADMIN_USERNAME seeds first admin only when none exist; /admin/users for promote/demote.
• Graceful shutdown — Signal-aware http.Server.Shutdown with timeouts.
• Handler tests — Vote HTMX, answer/hide, CSRF, session rotation via in-memory Store (no Postgres for web suite).
• App Platform listen port — Prefers PORT, then LISTEN, then :8080.
• Prod DB = PlanetScale Postgres — Required DATABASE_URL; DSN cleanup for PlanetScale/libpq-only params.

Docs & ops

• README — How to run locally, env vars (from .env.example), admin bootstrap, PlanetScale DATABASE_URL, App Platform notes (PORT, SECURE_COOKIE=1).
• Migrations story — Schema is applied on boot from schema.sql. OK for v1; plan real migrations before schema drifts.

Smaller / later

• Rate-limit login/register (bcrypt helps; still open to brute-force).
• Cursor pagination UI when hunt/profile lists hit their row limits.
• Optional Postgres integration tests (TEST_DATABASE_URL) for sqlc SessionStore / advisory locks.

Suggested order of attack

1. Short README (run, env, admin, App Platform + PlanetScale).
2. Migrations plan before the next schema change.
3. Rate-limit auth endpoints.