156 Commits

Author	SHA1	Message	Date
Claude Fable 5	5255cdce06	Fix latenten Flake in links.service.db.test (Phantom-Sortierung) ... pondGraph-Test sortierte die EMPFANGENEN Phantom-Slugs, verglich aber gegen ein UNsortiertes Literal. Da beide Slugs (ghost-<sfx>, ghost-secret-<sfx>) den Zufalls-Suffix teilen, kippt ihre Sortierreihen- folge auf ~1/5 der Suffixe (wenn sfx[0] > 's') → nicht-deterministischer Fehlschlag. In CI-Lauf 372 traf es zu (Suffix „vpxwe…"). Fix: beide Seiten sortieren. Vorbestehender Bug, unabhängig von M17–M19. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 06:12:55 +02:00
Claude Fable 5	d5b895ada2	#135 Fix: /read-Route deklariert Zugriffsregel explizit (@AuthenticatedOnly) ... route-permissions.e2e.db.test.ts (#52) verlangt, dass JEDE Route ihre Zugriffsregel explizit deklariert (PERMISSION_KEY, @Public oder SiteAdminGuard). Der neue GET /read/:pond/:slug hatte keinen Decorator (verließ sich auf den Default-Guard) → Coverage-Test rot in CI. @AuthenticatedOnly() ergänzt (Session erforderlich; per-Page-Recht prüft weiterhin der Service via resolve→canAccessPage→404). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 06:01:45 +02:00
Claude Fable 5	15376d4ac2	#135 Seiten-Einbettung ![[Seite]] (Transklusion) im Lesemodus ... Obsidian-Syntax `![[slug]]` (optional `![[slug|Anzeige]]`) als Seiten- Einbettung. Im Lese- und öffentlichen Modus wird der Inhalt der Zielseite inline gerendert; im Editier-Modus zeigt die NodeView eine Platzhalter- Karte (Titel + Öffnen-Link). Shared (Vorbild plugin_block): - Neuer Block-Atom-Node `transclusion` (targetSlug + optional displayText). - Markdown: Block-Regel für eine reine `![[…]]`-Zeile (vor `paragraph` registriert; mitten im Absatz greift sie bewusst nicht), Token→Node- Mapping, Serializer — Round-Trip stabil. - html.ts: Platzhalter `<div class="dt-transclusion" data-transclusion>`. - extractWikilinkSlugs erfasst jetzt auch Transklusionen → Einbettung zählt als Backlink/Graph-Kante. Backend (zentraler Render-Pfad): - PublicService expandiert Platzhalter zur gerenderten Body-HTML der Zielseite: SELBER Pond, read-permission-geprüft, Tiefe ≤2 + Zyklen- Guard (visited); Fehlend/unlesbar/zyklisch → neutraler Wikilink. Medien werden EINMAL über den ganzen Baum aufgelöst (kein Doppel-Processing). - Neuer authentifizierter Endpoint GET /read/:pondSlug/:pageSlug (nicht @Public) liefert dieselbe gerenderte HTML — für die NodeView im authentifizierten Lesemodus, auch bei nicht-öffentlichen Seiten. Web: - NodeView `transclusion.tsx`: Editier-Modus → Karte; Lesemodus → holt /read/:pond/:slug und rendert den (server-sanitisierten) Inhalt inline. - WikilinkAutocomplete unterstützt `![[` → fügt einen Transklusions-Block ein (statt Wikilink). - CSS für Karte (.dt-transclusion-card) und Embed (.dt-embed), i18n de+en. Tests: shared Round-Trip-Unit (5), public-DB-Test um Embed-Expansion (zyklus-sicher, Fehlend→Link) erweitert — grün. typecheck/lint/i18n grün. Visuelle Editor-Verifikation folgt auf dem Test-Stage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 04:01:18 +02:00
Claude Fable 5	a84e9880bd	#133 Fix: Typfehler im public-Kommentar-Test (noUncheckedIndexedAccess) ... body.threads[0] ist unter noUncheckedIndexedAccess möglicherweise undefined; per Destrukturierung + Non-null-Assertion nach dem toHaveLength(1)-Check geglättet. (Der Fehler rutschte durch, weil der #133-Commit nach dem Nachtragen des Tests nicht erneut getypecheckt wurde.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 03:54:30 +02:00
Claude Fable 5	f014a61480	#133 Kommentare fest inline im Lesemodus (Slide-in-Panel ablösen) ... Kommentare erscheinen jetzt fest im Lesefluss zwischen Backlinks und lokalem Graph statt in einem ein-/ausblendbaren Panel. Der Kopfleisten-Toggle (Icon + Unread-Badge) entfällt. Frontend: - CommentsPanel → CommentsSection (Inline-Sektion, ohne Panel-Chrome/ Close-Knopf; markiert beim Sichtbarwerden als gelesen). Neue Read-only-Variante PublicComments für die anonyme öffentliche Ansicht. - Umzug auf die äußere Ebene in PageEditorPage (view-Modus, zwischen BacklinksPanel und LocalGraphPanel). Das Schreibrecht (collab rw) wird per onWriteAccess aus dem inneren PageEditor hochgereicht, damit die äußere Ebene den Composer bei commentPolicy=editors korrekt zeigt/ verbirgt. - Deep-Link ?comments=1 scrollt jetzt zur Inline-Sektion statt ein Panel zu öffnen. Resolve/Unresolve-Knöpfe zusätzlich an mayComment gekoppelt (früher nur an isRoot) — Leser sehen keine 403-Knöpfe mehr; Read-only blendet alle Aktions-Controls aus. - CSS comments-panel* → comments-section*; tote Unread-Badge-Regeln raus. Backend: - GET /public/:pondSlug/:pageSlug/comments (@Public), read-only. Nutzt den vorhandenen resolve()-Pfad (erzwingt ggf. anonymen Lesezugriff → nicht öffentliche Seiten 404en) und CommentsService.list. PublicModule importiert CommentsModule. Tests: public.e2e.db.test.ts um anonymen Kommentar-Lesezugriff + 404-Fälle ergänzt (grün gegen frische Test-DB); comments.spec.ts auf die Inline-UI umgestellt. typecheck/lint/i18n:check grün. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 01:22:22 +02:00
Claude Fable 5	c858f12592	#134 Statuszeile zwischen Navigation und Artikel ... Neue schlanke Statuszeile (letzte Aktualisierung · Wortzahl · geschätzte Lesezeit) zwischen Seitenkopf und Artikel — im authentifizierten Lesemodus und in der öffentlichen Ansicht. - Geteilte Komponente `PageStatusBar` (Datum via Intl in der aktiven Sprache, Lesezeit = ceil(Wörter/200), Singular/Plural, Lesezeit ausgeblendet bei 0 Wörtern). - `countWords`/`htmlToText`-Helfer in lib/word-count.ts. - Authentifiziert (`PageEditorPage`, nur Lesemodus): Wortzahl aus dem vorhandenen Markdown-Export (geteilter Query-Key ['page-markdown']), `updatedAt` direkt von `page.data`. - Öffentlich (`PublicPageView`): Wortzahl aus dem server-gerenderten HTML per DOMParser — kein Editor-Bundle nötig; kein Backend-Change. - i18n common.statusbar (de+en), CSS `.page-statusbar` (middot-getrennt, gedämpft). Gates grün (typecheck/lint/i18n:check); visuell verifiziert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 01:04:11 +02:00
Claude Fable 5	d1d98a9575	#137 Checkbox-Aufzählungen: Textzeile vertikal ausrichten ... Die Task-List-CSS war auf `.editor-content` gescoped und griff daher in keinem Lese-Container (public/comment/legal/home/history-preview), wo docToHtml sein `<li><input><p>`-Markup einspeist — dort blieb der Bullet sichtbar, die Checkbox lag inline und das Block-`<p>` mit Default- `margin: 1em 0` versetzte den Text in die nächste Zeile. Fix: Task-List-Regeln über das eindeutige `data-type='task_list'`-Attribut (nur von docToHtml und der Editor-NodeView erzeugt) entscopen, sodass sie im Editor UND in allen Lese-Containern greifen; Checkbox per kleinem margin-top auf die erste Textzeile ausrichten und Ober-/Untermarge des Item-Absatzes neutralisieren. Deckt beide DOM-Formen ab: Lesemodus `li > input` + `li > p`, Editor `li > label > input` + `li > div > p`. Visuell verifiziert (Vorher/Nachher, beide Pfade). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC	2026-07-19 00:55:18 +02:00
Claude Fable 5	4f79a816e4	Toast stack: drop role=status from the global live region ... The always-mounted toast container carried role="status", so every page-scoped getByRole('status') locator suddenly resolved to two elements — legal.spec failed CI with a strict-mode violation. The region keeps aria-live="polite" (announcements work the same); the status role stays with the per-page elements that had it before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:16:20 +02:00
Claude Fable 5	6c98a71d34	Favorites: personal page stars, golden icons, sidebar filter (#132) ... Semantics changed from the issue during planning (documented there, comment 1192): favorites are PERSONAL per user, not pond-wide — the sys-fav label approach is dropped entirely. Storage is a page_favorites table (userId+pageId, FK cascade); PUT/DELETE /pages/:id/favorite toggles idempotently and needs read access only (#60 404 semantics — a star is a note-to-self, not a page modification), GET /ponds/:id/favorites lists the account's stars sliced to still-readable pages. Trashed pages keep their rows, so restore keeps the star; purge cascades it away. Web: one shared ['favorites', pondId] query feeds the TopBar star (between labels and history, golden when set), the golden tree icons in the sidebar, and a latching "Favorites" filter button next to the view switch that narrows either view (combinable with the label filter). No public-API/MCP exposure — with the label approach gone, that parity is no longer free; favorites stay UI-only for now. New favorites e2e pack (star toggle, golden icon, filter, per-user isolation) wired into CI; DB suite covers the round-trip, read gating, and the trash/restore/purge lifecycle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:03:55 +02:00
Claude Fable 5	48d4c60af7	Trash: checkbox multi-select with bulk restore and purge (#128) ... Each trash row gets a checkbox, a toolbar above the list offers "select all" (native indeterminate for partial selections) and the two bulk actions; bulk purge confirms with the selection count (pluralized). Processing is sequential on purpose — purge promotes leftover children (#107), so concurrent tree mutations would race. Failures don't strand the rest: the loop keeps going, failed pages stay selected for a retry, and an alert banner reports the count. Single-row actions run through the same path, which also fixes their previously unhandled rejection. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:03:35 +02:00
Claude Fable 5	36cdd4fbca	Editor: confirm snapshots with a toast; wire ui.toast for plugins (#130) ... Cmd/Ctrl+S used to snapshot silently. A new app-wide ToastProvider (components/Toast.tsx) owns a bottom-center stack — permanent polite live region, auto-dismiss after 2.5 s, click to dismiss early, error variant. Both snapshot paths (the keyboard chords in PageEditorPage and the save-version TopBar button) now confirm with the version name when there is one, and their failure alert becomes an error toast. The plugin host capability ui.toast (declared since #74, wired nowhere) connects to the same stack: PluginBlockScope carries the showToast handle, plugin-block passes it into the sandbox context. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:03:17 +02:00
Claude Fable 5	d23e5dc10c	Pond graph: size the canvas to the viewport, not the width ratio (#131) ... The SVG scaled to container width with height following the fixed 800×560 viewBox ratio — on wide windows the graph grew taller than the viewport, the page got a scrollbar, and wheel-zoom scrolled along. The graph page is now a flex column filling the main column; the canvas takes the remaining height (flex: 1, min-height: 0), a ResizeObserver feeds its measured size to ForceGraph as width/height, and the SVG fills it exactly. LocalGraphPanel keeps its fixed defaults. Scope deliberately layout-only (issue comment 1187): with no scrollbar there is nothing for the wheel to scroll, so no non-passive listener needed. The graph pack now asserts the main column does not overflow vertically on the graph route. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:02:56 +02:00
Claude Fable 5	31557f09e5	Sidebar: pin the action icon row to the visible bottom (#129) ... .sidebar is itself the scroll container, so the footer's margin-top: auto only pinned the icon row to the end of the CONTENT — behind the fold on long page lists. The row is now position: sticky with negative bottom/side margins undoing the sidebar padding, a background, and a top border, so the list scrolls away beneath it and the four actions stay visible at any list length. The import progress list keeps floating above the row (absolute within the sticky footer). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-16 12:02:40 +02:00
Claude Fable 5	1b9dd7d475	Give the zip-bomb rejection test headroom against loaded runners ... Compressing and inflating the 257-MiB zero buffer is CPU-bound and exceeded vitest's 5 s default on a busy CI runner (5.4 s — the M15 push ran CI and CD concurrently). Flaky tests are defects (ADR 0014): the test gets an explicit 30 s timeout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 13:45:47 +02:00
Claude Fable 5	78a913c47b	Vault import: decode ZIP names as UTF-8 and NFC-normalize them ... Real vault ZIPs broke umlauts in page titles ("Fußball zum Götzen" → mojibake, slug fua-ball…goi-tzen): fflate honors only the ZIP UTF-8 flag, which common archivers omit, and decodes unflagged names as Latin-1. That decoding is byte-lossless, so parseVaultZip now re-reads any name whose chars all fit one byte as UTF-8 (a strict decoder — genuine Latin-1 and flag-decoded precomposed chars fall back unchanged), then NFC-normalizes: macOS zips store umlauts decomposed, which silently broke slugify's ä→ae digraphs, wikilink matching, and duplicate-basename detection. slugify itself also precomposes first as defense in depth for NFD input from other paths. Unit tests pin both cases: a hand-patched ZIP whose UTF-8 name bytes carry no UTF-8 flag, and an NFD-named note that must come out precomposed with an ueber- slug. Pages already imported with garbled titles stay as they are — delete the imported subtree and re-import after this lands (or rename by hand). Fixes #127 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 13:24:58 +02:00
Claude Fable 5	32d4cd0e4b	Footer: show the Dorfteich version next to the connection status ... The Dockerfile has passed the release tag into the web build as VITE_APP_VERSION since the beginning, but nothing consumed it — the footer now renders it right of the live/offline icon; dev builds show the 0.0.0-dev placeholder. Fixes #126 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 13:18:53 +02:00
Claude Fable 5	0428892ef2	Editor shortcuts: "e" edits, the platform chord+S snapshots versions ... In reading mode a plain "e" (guarded against typing targets) switches to edit mode. In edit mode the platform's native chord — Cmd on macOS, Ctrl elsewhere — +S saves an unnamed manual snapshot in place, and +Shift+S asks for a name and returns to reading mode; both always swallow the browser's save dialog. The shared isTypingTarget guard moves from TopBar into lib/keyboard.ts next to the new modifier helper. Unnamed snapshots needed the API to accept them: the version label is optional now (trigger stays MANUAL, label null), and the history list's existing null-label fallback text becomes "Manueller Schnappschuss" / "Manual snapshot" — it only ever shows for exactly those. DB test for the label-less path, e2e coverage in the CI content pack. Fixes #125 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 13:17:09 +02:00
Claude Fable 5	44a90a53ac	Sidebar: pin the four actions as an icon row at the bottom ... Graph, new page, import, and trash collapse from scattered text links into one icon row pinned to the sidebar's bottom edge, in that order, each with a hover hint (the trash reads "Papierkorb anzeigen"). The new-page button now toggles the inline form, which still renders above the footer with the same classes; the import trigger becomes an icon whose progress list floats above the row so the icons stay put. All e2e class hooks (.sidebar__new-page, .sidebar__graph-link, .sidebar__import-*) are unchanged. Fixes #124 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 13:09:31 +02:00
Claude Fable 5	1781f12f6e	Knowledge graph: live Obsidian-like simulation with tunable physics ... The force layout used to run once (tick(250)) and freeze; dragging moved a single node with no reaction from its neighbors. The simulation now stays alive: React renders the SVG structure (testids, edge/ring classes — the e2e contract is unchanged) while each tick writes positions imperatively into the element refs, and it settles to rest via alpha decay, which also keeps Playwright's stability wait happy. Dragging pins the node (fx/fy) and reheats the physics, so the neighborhood gets pulled along; a plain click still just opens the page. Surviving nodes keep their positions across data refreshes, e.g. when a phantom becomes a real page. The graph page gains four sliders — attraction, repulsion, node size, font size — persisted per pond (ui.graph.settings.<pondId>) with a reset; the inner view is keyed by pond id because usePersistentState reads its key only on mount (#108 trap). The local panel adopts those settings (no second set of sliders) and swaps the two fixed hop buttons for a 1–5 depth slider. Fixes #123 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 11:29:03 +02:00
Claude Fable 5	d4fb2a3c51	Sidebar tree: stack parents above children, compact rows, icons ... The tree reused .sidebar__page-item's flex ROW from the flat list, so the nested children <ul> sat BESIDE the parent row and align-items: center made the parent float vertically centered next to its subtree. Stack the two in tree view instead: parent first, children indented below (about two characters per level). Rows get compacter (smaller font, tighter padding) so a deep imported vault fits on screen, and folder pages now read differently from leaf pages at a glance: lucide Folder/FolderOpen vs FileText, with the caret glyph upgraded to a ChevronRight that keeps the existing CSS rotation. Caret button, classes, and aria-labels stay untouched for the e2e contract (#101 convention: no page title in the caret label). Fixes #122 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 11:01:54 +02:00
Claude Fable 5	b8546eb249	Vault import: always show the label section, create labels inline ... The label multiselect was gated on the pond already having labels — but before a first import that is the common case, so the section silently vanished and no import-wide label could be chosen. Render the fieldset unconditionally (with a hint when empty) and add an inline create field: POST the new label directly to get its id back, refresh the shared label query, and tick it right away. Same pond_admin permission as the dialog itself. The e2e pack now creates its label through the dialog instead of the API, covering exactly the empty-pond path that slipped through. Fixes #121 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 10:58:50 +02:00
Claude Fable 5	e356d82d51	Define the missing --color-surface token; modals were transparent ... .modal (and three other rules) referenced --color-surface without a fallback, but the token was never defined — the background declaration was silently dropped and every modal panel rendered see-through over the page. Define the token in tokens.css (white, matching the #fff fallbacks other rules already carried) and pin the vault-import dialog's opaque background in the e2e pack. Fixes #120 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn	2026-07-15 10:55:49 +02:00
Claude Fable 5	2d51a55119	QA: wire the M13 packs into CI, document the vault import (#119) ... CI runs the two new packs after the graph pack (chained, each preceded by the login rate-limit reset): create-missing-page.spec.ts (#115) and import-vault.spec.ts (#117/#118). Docs: the pond-admin guide gains a full 'Import an Obsidian vault' chapter — the three dialog choices, and what happens to folders, links (including the duplicate-name rule: the alphabetically first vault path wins), tags, images, and embeds, plus the limits and the all-or-nothing semantics. The user guide explains following a link to a page that does not exist yet. features.md gets both bullets. German mirrors updated throughout (English stays authoritative). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 18:28:45 +02:00
Claude Fable 5	704ebe48a6	Vault import dialog in the pond settings (#118) ... An admin-only 'Import an Obsidian vault' section on the pond settings page opens a dialog with everything the #117 endpoint expects: the ZIP, an indented mount-parent picker over the page tree (the MovePageDialog pattern), a multi-select over the pond's label tree, and the frontmatter radio (strip / keep as code block). Submit uploads and polls the job with a vault-sized budget (600 x 1 s), then invalidates pages, graph, phantom-links, and labels so the sidebar tree, graph, and pickers show the import without a reload — and links to the mount page. apiUploadFile now takes extra multipart fields (the options JSON); existing callers are unchanged. e2e import-vault.spec.ts: an admin imports the fixture vault through the dialog and the app shows the folder tree under the mount page, a rewritten Obsidian link navigates to the right page, the embedded image renders, and the nested tag labels exist next to the dialog's extra label; a plain editor gets no section at all. 3x flake-free locally (CI wiring lands with #119). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 18:26:26 +02:00
Claude Fable 5	8ae010218e	Obsidian vault import: endpoint, job orchestration, rollback (#117) ... POST /ponds/:pondId/import/vault (pond-admin-gated; a vault import creates a subtree, uploads files, and creates labels — administration, not everyday editing) takes the ZIP plus a JSON options field {parentPageId?, labelIds?, frontmatterMode}. The archive is parsed at enqueue for fast 400s; the job (new kind import_vault, riding the existing isImportKind worker routing) re-parses and runs the #116 transform, then: containers top-down → notes (asset placeholders → uploaded pond files; non-images become page attachments) → tags to labels (nested tags build a label hierarchy via LabelsService, so locking and cache invalidation apply) plus the dialog labels. All-or-nothing: any failure hard-deletes the created pages (children first) and removes the stored files (quota restored), then surfaces as import_vault_invalid_zip / import_vault_too_large / quota_exceeded / conversion_failed — and makes the worker's retry policy safe. Supporting changes: - conversion_jobs gains a nullable options jsonb column; enqueue takes kind-specific options and a maxInputBytes override (the 25 MiB default protects the pandoc sidecar, which a vault never touches — vaults use the 64 MiB upload limit). - insertPage accepts a pre-reserved slug (the batch reserves all slugs up front against pond ∪ batch). - NEW: pages born with content seed their outgoing page_links rows (deriveContent now returns wikilinkSlugs) — imported pages would otherwise stay invisible to backlinks and the graph until their first collab save. Collab still rewrites the rows on every save, and the existing phantom resolution heals batch creation order. import-vault.e2e.db.test.ts (4 tests, real worker drained): gating + input rejection, the full fixture import (tree under a mount page, collision suffixes, link rows incl. phantom, nested tag labels, extra label everywhere, frontmatter stripped, image embedded + PDF attached), complete quota rollback, and a clean re-import with fresh suffixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 17:13:11 +02:00
Claude Fable 5	269b36c761	Fix the gates the #116 commit skipped past ... The asset type lost its name field during the split into path+extension (tsc error), and the fixture's .obsidian/app.json needed Prettier's formatting. Lesson from the /srv move repeated within one day: the gate chain must gate — never '; echo' past a failing typecheck. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 16:53:11 +02:00
Claude Fable 5	09abda3ada	Obsidian vault transform module (#116) ... Pure functions from vault ZIP to import plan — no DB, no DI: - parseVaultZip: fflate unzip with the plugin-package protections (zip-slip rejection, incremental unpacked ceiling 256 MiB, parameterized for tests); dot-directories like .obsidian/ skipped; deterministic ordering. - extractFrontmatter: leading --- block, tags:/tag: in scalar, inline- array, and block-list forms; strip mode drops the block, preserve re-emits it as a fenced yaml code block. - extractInlineTags: fence- and inline-code-aware #tag / #nested/tag extraction and removal (headings and pure numbers untouched). - rewriteLinks: [[Name]], [[Name|Display]], [[Name#Heading]] (fragment stripped), [[folder/Name]] (path match beats basename) → the FINAL slug with the human name as display; unresolvable → slugified phantom; ![[img]] and relative  → vault-asset: placeholders the uploader resolves (#117); non-image embeds → italic filename + page attachment; SVG deliberately stays an attachment (never inline, security.md); note embeds degrade to plain wikilinks. - planFolders: folder chains merged at the deepest levels to fit MAX_PAGE_DEPTH below the mount page (merged titles read c/d). - planSlugs: -n suffixing against existing ∪ batch; duplicate basenames resolve to the lexicographically first vault path. - planVaultImport ties it together into containers + notes + the referenced-asset set. Fixture vault under fixtures/import/obsidian-vault/ (umlauts, duplicate basenames, nested tags, deep folders, embeds, code traps); 13 unit tests colocated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 16:51:31 +02:00
Claude Fable 5	64e21e9f94	Offer creating the page on the not-found screen (#115) ... Following a phantom wikilink now ends with a way out instead of a dead end: when the pond resolved and the page 404s as plain not_found, the error screen offers creating the page in place. Title = the URL slug (the PhantomPagesView mechanic), so every wikilink pointing at the address resolves; the invalidated page query then mounts the editor on the same URL. The affordance is deliberately ungated like the sidebar's new-page button — the client cannot tell 'never existed' from 'not readable' (#60), and a reader's POST surfaces as the regular 403 banner. The page_trashed branch (#31) is untouched. Rides along: PhantomPagesView now also invalidates ['pond-links'] — the graph views kept showing a just-created target as a phantom. e2e pack create-missing-page.spec.ts (CI wiring lands with #119): author a phantom link, follow it, create, backlink proves resolution; reader path asserts the 403 banner and no editor mount. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 16:45:27 +02:00
Claude Fable 5	14711a18c2	QA: page-tree and graph e2e packs in CI, manuals updated (#114) ... Two new CI-wired Playwright packs, each in its own shared pond so the fixture ponds stay untouched: - page-tree.spec.ts — create-as-child with the form hint, collapsible folder view (collapse state survives reload), label view grouping, the local view override vs the owner-set pond default (fresh context without localStorage sees the new default), the Move-to dialog with the own subtree disabled, promote vs subtree delete, and a restored orphan re-attaching at the root. - graph.spec.ts — pond graph nodes/edges/legend, node click-through, the phantom-create flow (dashed node turns solid), the local panel with hop toggle and highlight ring, and the permission slice: a label-denied reader sees neither the hidden node nor its edge. Both packs 3× flake-free locally. Manuals: user guide (page tree, moving/deleting with subpages, knowledge graph + local graph), pond admin guide (sidebar view default), features.md (knowledge graph bullet) — with the docs/de mirrors updated (English authoritative). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:10:14 +02:00
Claude Fable 5	a72cb1b1c5	Local neighborhood graph on the page (#113) ... A collapsible 'Local graph' panel joins the backlinks below the page content in read mode: the current page (highlight ring) with its wikilink neighbors in both directions, switchable between direct neighbors and two hops. Computed client-side by BFS over the cached pond-wide graph response — no second endpoint; the TanStack query is shared with the pond graph view. Phantom targets render dashed; a click navigates to the neighbor; pages without any links show no panel at all. Reuses the ForceGraph renderer from #112 unchanged. Verified live: hop toggle reveals the second-hop page, ring on the current page, click-through, and the panel's absence on a lonely page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:01:47 +02:00
Claude Fable 5	dbbe229cb9	Pond knowledge graph view (#112) ... /p/:pondSlug/graph (static segment ranked above :pageSlug, same documented reserved-slug gap as trash/settings) renders the pond's readable wikilink graph from GET /ponds/:id/links: pages as nodes colored by their first label (legend included, DEFAULT_LABEL_COLOR for unlabeled), resolved links as edges, phantom targets as dashed nodes — clicking one offers to create the page, which resolves its links. Rendering is a self-contained SVG force graph: only d3-force is bundled (no d3 DOM/zoom modules, zero external requests); the layout runs synchronously to rest, zoom/pan/node-drag are plain pointer math. SVG over canvas deliberately — every node carries a data-testid the e2e packs can click. Ponds beyond 500 pages get a capped-view notice. Sidebar footer links every member to the graph (trash stays owner-only). New i18n namespace graph (de+en). Verified live: nodes/edges/legend render, node click opens the page, phantom click creates it and the node turns solid. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:59:07 +02:00
Claude Fable 5	ffcc337ed0	Page-tree parity for the public REST API and MCP (#110) ... The slug-based machine surfaces now see and shape the hierarchy: - REST: page list/detail carry parent (the parent page's slug, nulled when the token's user may not read it — same no-leak rule as the internal list); create accepts parent; PATCH accepts parent (slug nests, null moves to the top level, appended at the end of the new sibling group via the new PagesService.moveToEnd). Cycle/depth refusals keep their regular error codes. OpenAPI updated. - MCP: list_pages returns parent, create_page takes an optional parent slug, update_page moves with parent (slug|null); tool errors carry the api code (page_cycle covered in the e2e pack). - ZIP export deliberately stays flat — noted in features.md; the hierarchy is organizational only. e2e: REST pack covers nested create, list shape, move/root-move, 409 page_cycle, 404 unknown parent; MCP pack covers nested create, list parent, and the cycle tool error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:49:52 +02:00
Claude Fable 5	0308bc712d	Drag-onto reparent, Move-to dialog, and the delete decision (#109) ... Sidebar folder view: a row now has three drop bands — the edges keep the within-group reorder, the middle band nests the dragged page under the row (appended to its new sibling group, with a drop-into outline cue). Cycle/depth refusals surface as a translated banner; successful moves are announced for screen readers. The overflow menu gains 'Move to…': a modal parent picker over the page tree (top level first, the page's own subtree disabled) that works in every sort mode. Delete now decides per case: childless pages keep the plain confirm; pages with subpages open a dialog offering promote (default wording: move subpages up) or subtree delete. The children lookup reads the CACHED pages list on purpose: an async fetch before window.confirm broke the click→confirm→DELETE rhythm the content pack (and users) rely on, and a stale childless read errs toward promote — never toward a silent subtree delete. Sidebar caret labels deliberately exclude the page title: accessible names are matched by substring in the specs (#101), and a title like 'Editor…' collided with the edit-mode toggle. Verified live: move dialog (subtree option disabled), promote and subtree delete flows; content/trash/export packs green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:40:08 +02:00
Claude Fable 5	e957c2a28f	Pond-wide wikilink graph endpoint (#111) ... GET /ponds/:pondId/links returns the caller's readable slice of the wikilink graph in one read: nodes (id, title, slug, labelIds for the coloring), resolved edges deduplicated per direction (a rename can leave several slugs pointing at one target), and phantom targets with their referrer ids. An edge survives only when both endpoints are readable; a phantom disappears entirely once its last readable referrer is filtered — a hidden page's existence never leaks through any of the three collections. Trashed pages and their links are excluded. Shared PondGraphView types feed the knowledge-graph views (#112/#113). DB tests cover the owner's full graph, the label-DENY reader slice, edge dedup, trash exclusion, and labelIds on nodes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:21:25 +02:00
Claude Fable 5	15184876bd	Sidebar folder view, label view, and the view toggle (#108) ... The sidebar now presents pages as a collapsible tree built from parentId (folder view) or grouped under the hierarchical label tree (label view, read-only; multi-label pages appear under each label, untagged ones in an 'unlabeled' group). The pond owner sets the default via a new sidebarView pond setting (PATCH-merged like the other keys); every user can override it locally (ui.sidebar.view.<pondId>), and the toggle sits above the page list. Collapse state persists per pond. New pages created while a page is open become its children — the inline form says so and sends parentId. Reordering (buttons and drag-between) now operates within one sibling group; the label filter stays a folder-view feature and falls back to the flat list while active, so the filtered order is never mistaken for a partial tree. SidebarContent is keyed by pond id so the per-pond localStorage hooks mount with the right key. e2e hooks (.sidebar__pages, .sidebar__page, reorder buttons) kept; reorder/labels/content packs green locally, plus a live smoke of nesting, collapse persistence, and both views. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:17:36 +02:00
Claude Fable 5	12ff3c099f	Delete modes and subtree trash semantics for the page tree (#107) ... DELETE /pages/:id?mode=promote|subtree — promote (the default) moves the page's live children up to its parent; subtree trashes every live descendant with one timestamp and requires write permission on all of them (no partial deletes; trash access is write capability, ADR 0013). Trashed pages keep their parentId. Restore re-attaches to the nearest live ancestor (else root), which makes restore order-independent: restoring a parent afterwards never re-claims an already-restored child. Purge promotes any remaining children to the purged page's parent; the FK's SetNull stays as backstop only. tree-trash.e2e.db.test.ts covers promote, subtree + one-timestamp, the 403 descendant gate (label-DENY editor), order-independent restore, and child promotion on purge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:05:10 +02:00
Claude Fable 5	eb6b0d5d02	Page hierarchy: parentId, create-under-parent, reparent (#106) ... Pages form a tree via a nullable parent_id self-relation (SetNull backstop; the real trash/purge semantics follow with #107). Slugs and URLs stay flat and pond-unique, so moving a page never breaks links. - Shared: generic parent-id tree helpers in tree.ts (labels re-export them; buildLabelTree keeps its name-sorted behavior), MAX_PAGE_DEPTH=6, parentId on PageView, createPageInputSchema.parentId (nullish), repositionPageInputSchema.parentId (optional; absent = keep parent). - API: create validates the parent (same pond, live, depth); PATCH /pages/:id/position reparents atomically with the placement, rejecting cycles (page_cycle) and depth violations (page_depth_exceeded); GET /ponds/:id/pages nulls parentId when the caller may not read the parent, so hidden page ids never leak. - New error codes translated de+en; hierarchy.db.test.ts covers create, 404s, depth, cycle, atomic reparent, and the permission nulling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 09:57:47 +02:00
Claude Fable 5	04abda5724	Keep the landing editor off the .legal-editor class ... The landing form reused LegalTextField, whose .legal-editor wrapper the legal e2e selects by index (nth(1) = privacy policy). Placed before the legal form it shifted those indices, so the test drove the imprint field and the published privacy text never appeared. Generalize the component to MarkdownTextField with a wrapperClass prop: legal keeps .legal-editor, the landing editor uses .markdown-field. Verified locally: legal, admin-users, admin-quotas packs green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-13 00:14:03 +02:00
Claude Fable 5	abf49c7c0e	Give the landing-page save button its own label ... The landing form reused the legal namespace's "Save legal pages" label, so two buttons shared that text and the legal e2e's page-wide button lookup hit a strict-mode violation. Use a dedicated settings-namespace "Save landing page" label instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 23:59:59 +02:00
Claude Fable 5	9c64166b10	Editable landing page for the Site Admin ... The public home page (/) now renders Markdown the Site Admin stores in the new home.content instance setting, through the same sanitizing pipeline as the legal pages; empty falls back to the built-in welcome text. New public GET /home/content, an Admin → Settings editor with live preview, and an e2e test covering default/configured/escaping/ admin-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 23:50:16 +02:00
Claude Fable 5	a7760335cb	Remove an unused eslint-disable directive in main.ts ... no-console is not enforced for apps/api, so the directive on the boot-time restore-wait log line was flagged as unused and failed the lint gate (--report-unused-disable-directives). Keep the console.log and its rationale as a plain comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 20:45:29 +02:00
Claude Fable 5	627f128ab8	Pond lifecycle in the UI: create shared ponds, delete from settings ... The pond switcher grows a "+ New pond" entry with an inline form (name + optional description, quota errors surfaced translated); the pond settings of shared ponds end in a danger section that moves the pond to the site-level trash after typing its name to confirm. Personal ponds keep hiding the section. .button--danger is now a solid red button (also fixes the admin restore button, which showed red text on the accent-green background). Manuals no longer call these actions API-only; covered by a members-pack e2e test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 19:15:34 +02:00
Claude Fable 5	c8ec549fa5	UI polish: frameless plugin blocks in read mode, sticky toolbar, pinned footer, icon uninstall ... Three refinements from Stefan's review of the plugin work: - read mode integrates plugin output like normal content: no border, no name bar, no selection outline around plugin blocks — same principle as the frameless reading shell (M10) - the editor toolbar pins to the top of the scrolling content area on long articles instead of scrolling away (position: sticky within the main scroll container) - the app footer (connection status + legal links) moved out of the scroll container into a main-column wrapper — always visible at the bottom edge of the window on every view - the plugin uninstall buttons in the admin list are icon buttons now (Trash2, house pattern: aria-label keeps the accessible name) - lint hygiene: eslint/prettier ignore packages/plugins/*/vendor — the unpacked drawio webapp drove eslint out of memory Verified in the browser against a local stack (5/5 scripted checks: icon buttons, toolbar sticky at scroll bottom, footer pinned in edit and read mode, plugin block computed border/outline none in read mode) plus 8 layout-sensitive e2e packs re-run individually, all green (comments, collab, legal, content, plugin-admin, plugin-blocks, page-tools, plugins). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 15:33:32 +02:00
Claude Fable 5	97f94f247b	draw.io reference plugin: fullscreen editing, inline SVG rendering ... A new block plugin bundling the OFFICIAL draw.io editor — nothing ever loads from diagrams.net; the sandbox CSP pins every request to the plugin's own version-pinned asset path (zero-external-network verified live via a request-capture run). Plugin (packages/plugins/drawio): - block data { xml, svg }: xml is the draw.io source (document of record), svg the rendered snapshot as raw markup — render mode, office/PDF exports (the existing fallback renderer already inlines data.svg) and the public view all show the diagram without running diagram code - edit mode: snapshot + "edit in fullscreen" (an empty block opens the editor immediately); the bundled editor runs in a child iframe of the plugin's own assets and speaks draw.io's JSON embed protocol — Save & Exit exports xmlsvg, persists { xml, svg } via blockData, and drops back to the inline size - build.mjs fetches the pinned release (v30.3.6) into a gitignored vendor/ cache (fonts-build pattern; skipped in CI — plugin.js still bundles, the installable ZIP needs a dev machine) and packs a trimmed webapp subset: no dev sources, no embed.diagrams.net integrations bundle, no standalone viewers, no MathJax/templates/PWA — 27 MiB ZIP, 85 MiB unpacked, de+en editor languages Host/SDK extensions (generic, not drawio-specific): - new ui.enterFullscreen()/exitFullscreen(): the surface's frame becomes a viewport-covering overlay — same sandboxed iframe, only geometry changes; destroy removes the frame, so a vanished plugin can never leave the app covered - sandbox CSP: connect-src/frame-src now allow the plugin's OWN asset path (was 'none') — bundled apps lazy-load their resources and run in a child frame, but the api and external hosts stay unreachable; HTML assets are served with the same CSP so a packaged page cannot widen the rules, and child frames inherit the sandbox attribute - plugin size limits raised (ZIP 5→64 MiB, unpacked 20→256 MiB) for bundled-app plugins; content types for xml/txt/ico assets Verified end to end against a local stack (9/9): install via dropzone (85 MiB validation), block insert, fullscreen entry, bundled editor boots inside the double sandbox (German UI), shape drawn, Save & Exit persists, snapshot renders inline, survives reload, zero off-origin requests throughout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 14:15:30 +02:00
Claude Fable 5	52192eb05f	Backup mirror to BASEL: rsync of the sets after every successful run (#84) ... The operator-level extra beside the admin-configured Nextcloud target (#103), unblocked now that the ONE→BASEL tunnel is stable again. - sidecar: optional mirror step (mirror.ts) driven purely by env — BACKUP_MIRROR_TARGET (rsync-over-ssh), BACKUP_MIRROR_SSH_KEY (private key on the secrets volume, never in image or repo), BACKUP_MIRROR_SSH_PORT. Runs after the prune of every successful run, so --delete aligns the remote retention with the local one (the newest-complete-set guarantee carries over). Only set files travel (db-*.dump, files-*.tar.gz); status files and bundles stay local. Host key pinned via accept-new into .mirror_known_hosts on the backups volume; fixed remote modes (dirs 750, files 640, symbolic --chmod — octal needs rsync ≥ 3, macOS dev machines ship 2.6.9). rsync + openssh-client added to the sidecar image. - status: additive `mirror` block in status.json (outcome, transferred count, lastSuccessAt carried across failures) — shown on the admin backup card; failures alert via a new backupMirrorFailed mail (de+en) while the local run still counts as succeeded. - deploy/backup-basel.md: complete BASEL-side walkthrough — dedicated user dorfteich-backup with a /home/ home and a bash login shell, explicitly avoiding the Debian backup-user (UID 34) pitfalls (nologin shell rejects rsync sessions, /var/backups home), key placement through the api container onto the secrets volume, .env values, on-demand verification. - tests: rsync-arg/stats-parsing units plus an integration suite against the real rsync binary (local target; skips where rsync is absent) — transfer, idempotent re-run (0 files), retention alignment, failure path carrying lastSuccessAt. Verified live against the real BASEL host from a native sidecar run: initial transfer, host-key pinning, retention alignment after a local prune, idempotency, and the failure path (surfaced in status.json while the local run stayed green). BASEL side provisioned per the doc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 12:20:32 +02:00
Claude Fable 5	04e21a0aac	Built-in MCP endpoint (Streamable HTTP) on top of the public API (#105) ... AI clients talk to the instance directly at /api/mcp — under the /api/ path (deviation from the issue's literal /mcp) so every existing reverse proxy already routes it; no deployment changes anywhere. - Transport: official @modelcontextprotocol/sdk server, STATELESS — each POST builds a fresh server+transport pair, no session store, replicas stay trivial; GET/DELETE answer 405. Auth per PAT bearer (#104 tokens), per-token rate limit (429 + Retry-After). - Own switches, independent of REST: instance mcp.enabled (admin settings, default off; off = 404, feature invisible) + pond setting mcpEnabled (pond-settings toggle, default off) — pinned independent in both directions by tests. - Tools (thin wrappers over the #104 services, same permission gates, audit-logged writes): list_ponds, list_pages, read_page, search, create_page, update_page (replace semantics through the collab-owned restore path — open editors converge), add_comment, list_labels, set_page_labels (exact replace), export_pond (link to the REST ZIP). Tool errors carry the api error codes; results carry stable slugs/ids. MCP resources stay the documented stage-2 stretch goal. - Deliberately on the SDK's low-level Server API with a hand-written tool table (mcp-tools.ts): the typed registerTool generics drove tsc out of memory in a program this size; manual Zod validation keeps the wire behavior explicit. - PublicApiService exposure filtering parameterized ('api' | 'mcp', shared pondFeatureEnabled helper) — one implementation, two switches. - Docs: "Connect Claude Code / MCP clients" section in public-api.md (claude mcp add one-liner + mcp-remote bridge for stdio clients). Verification: 8-test e2e pack driving the real MCP SDK client over Streamable HTTP against a listening api (initialize + tools/list, switch independence in both directions, anonymous/garbage 401, opt-in 404 semantics, page roundtrip incl. restore-NOTIFY, labels/comments, read scope blocked from writes with scope_required); live check through the web proxy against the seeded stack (tools list, create, read, update, search — LIVE CHECK PASSED); full api suite 61/61 files green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:36:02 +02:00
Claude Fable 5	52975bad0a	Deflake the collab restore-listener DB test (poll for the PRE_RESTORE row) ... The client converges on the restored content via the broadcast INSIDE the document transact — before the listener commits the PRE_RESTORE version row. Asserting the row immediately after convergence is a race that CI lost on the #104 run; poll for it instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:23:18 +02:00
Claude Fable 5	0c85293830	Public REST API v1: personal access tokens, instance switch + per-pond opt-in (#104) ... Token-authenticated machine access at /api/public/v1 — the foundation for the built-in MCP endpoint (#105). Personal access tokens: - api_tokens table (SHA-256 hash, scope read|write, optional pond restriction, expiry, revocation, throttled last-used) + migration; secrets are dt_pat_<random>, shown exactly once - lifecycle endpoints under /users/me/api-tokens (session-only — a leaked token can never mint more tokens) with audit entries api.token_created/api.token_revoked - settings UI section (create with scope/expiry/pond restriction, one-time reveal with copy, list with status + revoke), de+en Activation (404 semantics per #60 on both levels): - instance setting api.enabled (default off, admin settings switch) - pond setting apiEnabled (default off, pond settings toggle; the PondsService settings-merge learned the key — the #92 lesson) Surface (/api/public/v1, excluded from the SPA's global prefix): - me, ponds, pages (list/read as Markdown+HTML, create from Markdown via the shared pipeline, PATCH title/content, DELETE to trash), search (permission-filtered + narrowed to exposed ponds, highlights as **…**), markdown ZIP export, labels (tree, create/rename/recolour/move/delete, assign/unassign), comments (threads, create, resolve/reopen) - content replacement travels the collab-owned document path: the new state lands as a MANUAL version "API update", then the established restore NOTIFY applies it — open editors converge, history stays append-only, no second lineage (VersionsService.replaceContent) - hand-maintained OpenAPI 3.1 document at /openapi.json, pinned to the controller by a route-coverage test in both directions Enforcement: - PublicApiGuard: instance switch → bearer PAT auth (request.user is the token's user) → per-token rate limit (429 + Retry-After) → scope (403 scope_required) → pond opt-in + token restriction - the shared PermissionGuard then applies the unchanged permission model; PageParamSource gained pondSlugParam for the slug+slug routes - no cookies anywhere → no CSRF surface (pinned by a hostile-Origin test) - every write audit-logged as api.write with the token attributed Tests/verification: - 12-test e2e pack: lifecycle, switches, permission matrix (reader/editor/outsider × scopes), restriction, page roundtrip incl. restore-NOTIFY assertion, labels, comments incl. policy, search narrowing, ZIP export, rate limit; full api suite 60/60 green (quota fixture via per-user override — never the instance default) - new collab-pack test proves an open editor converges onto an API content replacement (green against a local seeded stack) - UI smoke against the built SPA: token create/reveal/revoke, pond opt-in persists, admin switch persists (10/10) - docs/self-hosting/public-api.md + README link Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 11:17:03 +02:00
Claude Fable 5	5cef359b8f	Nextcloud backup target: admin-configured, manual + scheduled uploads, in-app restore (#103) ... Off-host backups for every self-hoster, configured entirely in the admin UI — supersedes the host-specific mirror plan behind #84. shared: - webdav.ts (new package entry like token-crypto): minimal WebDAV client with basic auth — PROPFIND (tolerant multistatus parser), MKCOL, PUT (streamed), GET, DELETE; Nextcloud DAV path derived from the plain server URL, explicit DAV bases pass through - backup-status.ts: additive remote-upload status in status.json, the restore-status.json contract (running/succeeded/failed + staleness bound), the backup_command/backup_maintenance NOTIFY channels, and the one-bundle-per-set naming (dorfteich-backup-<id>.tar.gz) - backup-set.ts moved here from apps/backup (api lists local sets) backup sidecar: - reads the backup.* instance settings directly from the database (admin changes apply next run; local retention row overrides the env) and the app password from the secret store - after each successful set: bundle dump + files archive + manifest into ONE self-contained tar.gz, upload via WebDAV per schedule (off/daily/weekly; manual runs always upload), prune remote bundles — never the newest — and record the outcome in status.json; upload failures alert via a new backupUploadFailed mail (de+en) - command listener on backup_command (run / restore) with a serial queue against the nightly timer - restore orchestrator: restore-status.json → maintenance NOTIFY → grace → (remote: download + manifest-verify bundle) → terminate other DB connections → shared perform-restore path (same code as restore.sh) → final status + maintenance exit api: - MaintenanceGuard (global, registered before the setup gate): 503 maintenance_mode while restore-status says running; health endpoints and the new public GET /backup/restore-status stay exempt; a stale running state (crashed sidecar) unblocks after 30 min - MaintenanceStateService watches the file and restarts the api after a successful restore (fresh caches, migrate-on-start for older dumps); main.ts refuses to touch the database while a restore runs — a container restarting mid-restore must not race pg_restore with migrate deploy - worker sweeps (conversion, mail outbox, scheduler) catch transient database failures instead of dying on an unhandled rejection — the restore's connection termination crashed the api in verification - backup admin endpoints under /admin/system/backup: settings (live connection test before save, password write-only into the secret store), nextcloud/test, sets (local via the ro backups mount + remote via WebDAV), run + restore (type-to-confirm backstop, source validation) — commands travel as NOTIFY payloads; audit actions backup.settings_changed/run_triggered/restore_requested - readyz: new warning-level backup_remote check while a target is configured (26 h daily / 170 h weekly bound) collab: - maintenance listener: on enter, persist + close every live session and refuse new connections until exit (failsafe timeout 30 min) — no in-memory document may write pre-restore content back afterwards web: - Admin → System backup section: status card with remote facts and a "Back up now" button, the Nextcloud settings form with test button, and the restore picker (local + remote sets, type-to-confirm) - global maintenance screen: any 503 maintenance_mode flips the SPA to a status page polling the exempt endpoint, reloading when the instance returns Verified end-to-end against a live stack (fresh DB, native api + sidecar, fake WebDAV server): configure → test → manual backup → bundle upload → readyz/sets/status surfaces → remote restore with maintenance gate, marker rollback and api restart; suites: shared 21, backup 9, collab 11, api 58 files green, lint + i18n:check + typecheck clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 10:39:18 +02:00
Claude Fable 5	83fa23bbf9	Polish round 2: content footer, dismissable menus, manual versions, substring search, icon actions in settings (M10 follow-up) ... - content footer: the collab status is an icon (wifi/off/refresh, localized tooltip + visually-hidden text, class/data-status hooks kept for e2e) on the left, the legal links right-aligned; read mode drops the editor frame and its inner padding, edit mode keeps it - menus (page overflow, user, notifications bell, pond switcher) close on outside click and Escape via a shared useDismissable hook; the bell got its missing tooltip - side panels (labels, history) stack vertically in one column - edit mode gains a Save-version icon (prompt for the name, POST /pages/:id/versions); the history panel lists contributors by display name — more than three collapse to two plus an expandable ellipsis (PageVersionView.contributors resolved server-side, deleted users drop out) - search finds partial words via a LIKE fallback next to the tsquery (FTS matches still rank first; regression-pinned in the db pack), and the recent-searches list has a clear button - pond owners create labels directly in the label picker (plus a permanent link to the full manager); add/remove/delete buttons across the pond settings (members, access rules, labels, files) and the watch/unwatch toggles in pond/user settings are icon buttons now — class hooks and accessible names unchanged for the e2e packs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1	2026-07-12 07:13:34 +02:00