100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	16ab4a13f5	DRY pass #2, batch 4, F11: one email normaliser, one 401, one password-length refusal (#5372) ... common.normalize_email is the trim-and-lowercase that sign-up, sign-in, reset and invite each wrote inline. auth._unauthenticated is the 401 the six signed-out paths returned, and auth._password_refusal is the minimum-length check that register, reset and change repeated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:34:47 -04:00
bvandeusenandClaude Opus 5.5	a34d469e1e	An attachment's file leaves the disk one way: storage.unlink_media ... The purge wrote out its own try/unlink/log next to unlink_media, which says the same thing. It couldn't import it: unlink_media lived in the notes package, which imports retention. unlink_media moves down to storage.py, the module about what attachments occupy, and the purge, the delete route and sync all call it. DRY pass #2, batch 4, F10 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:33:11 -04:00
bvandeusenandClaude Opus 5.5	f5478a0ce0	The export and the Markdown frontmatter write times through common.iso ... common.iso is the server's one way to put a datetime on the wire, yet the JSON export and the importer's Markdown frontmatter wrote out the x.isoformat() if x else None idiom it replaces, seven times. Same output. DRY pass #2, batch 4, F10 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:33:11 -04:00
bvandeusenandClaude Opus 5.5	ac9035d9a5	Admin routes and the SPA fallback answer errors through responses.py ... responses.py is the app's one JSON error shape, yet invites, accounts, the SPA fallback and the test-email route still built jsonify({"error": ...}) by hand, and two parsed path ids with their own try/uuid.UUID. They now use json_error, not_found and parse_uuid. The download limiter's 429 stays for F13, with its Retry-After twin. DRY pass #2, batch 4, F10 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:33:11 -04:00
bvandeusenandClaude Opus 5.5	bfe2ed783f	The web's password forms read the server's minimum length ... The server's MIN_PASSWORD_LEN was 8, and the web wrote 8 out five times: two checks and three placeholders. The constant moves beside the other policy numbers in settings.py (auth.py imports it), /api/config serves it as min_password_length, and the config store hands it to Register, Reset and Account. 8 stays only as the fallback until the config answers. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:31:22 -04:00
bvandeusenandClaude Opus 5.5	1c4bf56058	A lone link's preview is looked up where the server filed it ... The server unfurls what detect_urls finds, trailing .,;:!? trimmed, and files the preview under that. The web and Android cards looked a lone link's preview up under body.trim(), punctuation included, so a note reading "https://example.com/a." never showed its card. - grammar.json gains a urls section: what the server finds in a body, and the link a lone-link note is filed under. - The web's rule moves out of NoteCard into notes/links.ts loneUrl(); Android's LinkPreviewRow gets the same loneUrl(); both trim like the server. - The server and web suites run the cases; Android's JVM test pins them by hand, as it does the tint. Fixes #5399. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:30:32 -04:00
bvandeusenandClaude Opus 5.5	3766d59b2e	The server's palette is checked against the shared fixture's hues ... The web already checked its tint keys against grammar.json; the server's NOTE_COLORS, which normalize_color accepts, had no such guard. It is now the fixture's hues plus "default". The core has no palette to check: it stores whatever the UI (which only offers palette keys) or the server sends. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:28:43 -04:00
bvandeusenandClaude Opus 5.5	4285026cfe	The repeat rules are pinned by the shared fixture ... daily/weekly/monthly/yearly was written out in the server (REMINDER_RECURRENCES), the core (recur::RECURRENCES), the web editor's <option>s and Android's picker, with nothing holding them together. grammar.json now has a recurrences list; the server, core and web suites each check theirs against it, and the web's options come from notes/recurrence.ts rather than the template. Android's picker pins the list by hand with its localised labels, as it does the tint: its JVM tests do not read the fixture. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:28:22 -04:00
bvandeusenandClaude Opus 5.5	db9e9a2dfb	A note's name is one rule, pinned by the shared fixture ... The server and the core each derived display_title and disagreed twice: the server cut it at 200 characters and the core didn't, and the server split lines with splitlines(), which also breaks on a lone \r or a U+2028, where the core and every other reading of the grammar split on \n alone. - grammar.json gains a display_titles section: blank lines, markers, an empty item, \r\n, a lone \r, U+2028, and a 201-character line of 'é' (the cut is characters, not bytes). - derive::display_title and DISPLAY_TITLE_CAP are the core's half, moved next to strip_marker. The server splits on "\n". Both suites run the cases. Behaviour: a device now names a note with a first line over 200 characters the way the web always has, and the server names a note containing a lone \r or a U+2028 the way devices always have. Fixes #5398. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:27:32 -04:00
bvandeusenandClaude Opus 5.5	2809c26214	Sync tests build a server note from wire::sample_note ... pull's note() and push's server_note each wrote out all nineteen fields of a wire::Note. wire::sample_note(id, revision) is that note; push's version changes only the body and attachments, by struct update. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:25:14 -04:00
bvandeusenandClaude Opus 5.5	2dec89bf8c	Core tests make a throwaway blob store with blobs::scratch ... blobs, store and portable each built a BlobStore in a temp directory their own way: pid+tag twice, a uuid once. blobs::scratch(tag) is that, with a counter, so two tests can never share a directory even if they pick the same tag. The desktop's and ffi's temp-dir helpers stay, one per crate: sharing them would need a test-util feature on the core crate. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:24:52 -04:00
bvandeusenandClaude Opus 5.5	3ea7c817bf	Core tests open their store through local::memory_conn ... Seven test modules each built a migrated in-memory store by hand: open, migrate, and (in sharing) wrap it in a Db. local::memory_conn() is that, and open_in_memory uses it too. Each module's db() is now one line, and the schema, Connection and Mutex imports it needed are gone. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:24:04 -04:00
bvandeusenandClaude Opus 5.5	c35e7fd589	cargo fmt: three chains rustfmt splits ... Formatting only. portable::instant (from F5), and the ffi's link and unlink (F2/F3), were laid out by hand without a toolchain; rustfmt splits each chain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:23:57 -04:00
bvandeusenandClaude Opus 5.5	ee771e3734	Every lock of the store goes through Db::conn ... Db::conn is documented as the one way to take the lock, yet five production and test sites reached past it with db.0.lock(): the startup summary, the desktop's trash sweep and config_get, and tests in sharing and update. All five now call conn(). DRY pass #2, batch 2, F8 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:23:07 -04:00
bvandeusenandClaude Opus 5.5	63dd206b91	Access and entity words are core constants: access::*, entity::* ... "owner"/"edit"/"view" and the entity names "note"/"label"/"attachment"/"preview" were literals at about thirty sites across store, pull and push, including match arms whose spelling had to agree with the rows a different module wrote. models::access and models::entity now name them, and push names its two ops. SQL text keeps its literals; Rust-side comparisons and writes read the constants. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:22:49 -04:00
bvandeusenandClaude Opus 5.5	8aa854d60b	The store's migrations are a table of steps, applied in order ... schema::migrate was thirteen hand-copied blocks of "if version < N, apply, stamp N". The versions are now a STEPS list (SQL, or code for v8). migrate walks the list, applies each step a store hasn't had and stamps it. A new version is a new entry at the end; there is no block to copy. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:21:47 -04:00
bvandeusenandClaude Opus 5.5	61658946d7	Which reminders are this device's is one predicate: OWN_REMINDERS ... reminders and due_reminders each wrote out "owner's, not trashed, has a time". The predicate is now one constant both queries read, carrying the reason a shared note's reminder is not ours. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:21:05 -04:00
bvandeusenandClaude Opus 5.5	dc9cf85cdc	rename_label writes its rename once, merge or not ... The rename UPDATE appeared twice: once for a merge's survivor and once for a plain rename. The branch now picks which row is renamed, and one UPDATE follows. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:45 -04:00
bvandeusenandClaude Opus 5.5	695efb3112	The store reads a note's body through note_body everywhere ... should_snapshot and snapshot_revision each wrote out the SELECT that note_body already is. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:36 -04:00
bvandeusenandClaude Opus 5.5	54b1e13750	"Pending" has one definition: has_pending reads pending_fingerprint ... has_pending listed the same four predicates as pending_fingerprint (dirty notes, dirty labels, pending deletes, unsent uploads) in a second query. It is now pending_fingerprint(..)?.is_some(). Counting where LIMIT 1 would do costs nothing on a local store. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:16 -04:00
bvandeusenandClaude Opus 5.5	fe84924f78	The opaque content type is one core constant: local::OPAQUE_MIME ... "application/octet-stream" was written out in the blob server, its test, the store's normalize_mime and the wire default. All four now read OPAQUE_MIME; the schema's SQL column default names the same string and says so. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:01 -04:00
bvandeusenandClaude Opus 5.5	4ac15d3557	Every call to the server fails the same way through client::send ... Seven calls each spelled out send, describe the transport error, map a 401, and refuse anything else as unexpected_status; two read the server's {"error"} words the same way. send_raw (transport + a 401 whose meaning the caller names), send (and anything but success is unexpected) and server_reason now hold those steps. Each call keeps only what is its own: device_login's and fetch_identity's 401 wording, the release's 404 = none, sharing's 404 and refusal reason, upload's retry split. DRY pass #2, batch 2, F6 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:19:38 -04:00
bvandeusenandClaude Opus 5.5	0101b05487	Stored timestamps have one writer: local::iso and local::now ... The store's time format (RFC 3339, UTC, milliseconds, Z) is what makes lexical order chronological. It was spelled out ten times as to_rfc3339_opts(SecondsFormat::Millis, true), with two private now() copies (store, pull). local::iso(t) and local::now() now hold it; store, pull, engine and portable call them. DRY pass #2, batch 2, F5 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:18:33 -04:00
bvandeusenandClaude Opus 5.5	ef839ba0cd	The store's layout names live in the core: local::DB_FILE, BLOBS_DIR ... "inkwell.db" and "blobs" were spelled out in the ffi and the desktop (whose copy of DB_FILE sat in the crossover shim). The layout is the core's, the same on every client, so the names are now core constants and both clients read them. DRY pass #2, batch 1, F4 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:17:26 -04:00
bvandeusenandClaude Opus 5.5	1f2ddd70d3	Unlinking a device is one flow in the core: link::unlink ... The desktop's sync_unlink and the ffi's unlink were both written out in full: try the revoke, clear the link either way, and log the outcome. link::unlink(db, held) now does that. Each client reads its link with state::credentials (with its seal) before the await and passes it in. DRY pass #2, batch 1, F3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:16:59 -04:00
bvandeusenandClaude Opus 5.5	91c47245ab	Linking a device is one flow in the core: sync::link ... The desktop's sync_link and the ffi's link_with_password/link_with_token were the same steps written out twice: probe, refuse an incompatible server before any credential is sent, log in or verify a pasted token, keep the link, and adopt the server's trash retention. link::authenticate(url, Credential) does the network half and link::store(conn, ..., seal) keeps it, sealed when the client has a seal. Each client now only reads its input and picks its seal. The desktop checks for a missing email/password before probing rather than after. Same error, sooner. DRY pass #2, batch 1, F2 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:16:53 -04:00
bvandeusenandClaude Opus 5.5	70274347af	One read of a device's link: state::credentials, with the client's seal ... Five places read the server address and token straight from sync_state: sharing, autosync, sync_unlink, update's download token, and the ffi. Reading it raw is how Android came to send its sealed token to the share routes (#5381). state::credentials(conn, seal) now holds that read. With a seal it opens the token (open_token), and without one (the desktop keeps it plain) it returns it as stored. Every site calls it. DRY pass #2, batch 1, F1 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:14:18 -04:00
bvandeusenandClaude Opus 5.5	17ae8c0863	A failed update install says the install failed, not the check ... installUpdate, and a failed channel or source switch, all fell back to "The update check failed." Each now names what failed. A check that runs after a successful switch keeps its own message. Fixes #5387. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:12:13 -04:00
bvandeusenandClaude Opus 5.5	1173c1cf12	A device's snooze is clamped to the server's range, 1 minute to 30 days ... The server clamped; the core took any i64, so 0 or less set a reminder in the past and a huge value overflowed Duration::minutes. Every caller passes 60 or 1440 today, so this was latent. Both sides now name the range, SNOOZE_MAX_MINUTES, and point at each other. Fixes #5386. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:11:53 -04:00
bvandeusenandClaude Opus 5.5	7259708f28	Session length, trash retention and attachment size have bounds ... Each accepted any integer. A session length of 0 expired every session at once, the admin's own included; an attachment limit above the 64 MB body ceiling allowed files no request could carry, and a negative one refused every upload. - session_ttl_days 1..3650, trash_retention_days 0..3650 (0 = keep), and max_attachment_mb 1..MAX_BODY_MB-1, leaving room for the multipart envelope. - MAX_BODY_MB is the one number app.py's MAX_CONTENT_LENGTH and that maximum both read. - A value stored before its bounds existed reads as the nearest bound. Fixes #5384. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:10:28 -04:00
bvandeusenandClaude Opus 5.5	bfab8746ad	Opening a purged note, or one of its files, is a 404 ... get_note and get_attachment selected with the ACL inline and skipped the purged filter, so a tombstone came back 200 (#2128 says a purged note reads as absent). Both now go through _get_visible, which cannot skip it. Reorder's batch lookup gains the same filter, so a stale id cannot write a place onto a tombstone. Fixes #5383. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:09:40 -04:00
bvandeusenandClaude Opus 5.5	8eff5f60a6	A deleted tag is a tombstone on every path, and the web skips tombstones ... The web deleted a tag's row outright (delete, and merge's source), so the change feed never carried it and linked devices kept the tag. A device's delete left a tombstone that the web still listed, matched by name on create and rename, minted #tags onto, and accepted in a picker. - labeling.tombstone_label is the one way a tag is deleted: drop its links, set purged_at. REST delete, merge and sync's op=delete all use it. - labeling.live(owner) is the one definition of a tag that exists; every catalog read uses it (list, lookup, create/rename matching, #tag minting, picker ids, export, and sync's name-clash check). - 0040: (owner_id, name) is unique among live tags only, so a tombstone gives its name back and #grocery can be made again, on the web or from a device. Fixes #5382. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:08:54 -04:00
bvandeusenandClaude Opus 5.5	be4897276c	Android sharing sends the opened device token, not the sealed one ... Android has stored its device token sealed ("sealed:…") since 8592b83, and core's sharing calls read the token from the store themselves. The ffi opened it in credentials() and then threw the result away, so every Share-sheet request went out as `Bearer sealed:…` and the server refused it. The sharing functions now take the server address and token from the caller. The ffi passes what credentials() opened; the desktop, which stores its token plain, reads it through sharing::stored_link. A new ffi test serves one request on a loopback port and checks the bearer token that arrives (#5381). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:05:10 -04:00
bvandeusenandClaude Opus 5.5	39b1ebae96	Settings → Activity: an audit log of what happened to accounts ... Sign-ins and failed sign-ins, accounts created and sign-ups refused, password changes, resets and reset links, devices linked and unlinked, invites made and revoked. Each is kept in `audit_events` with the address it came from, for `audit_retention_days` (Settings → Security, 90 by default, 0 keeps them forever), and listed newest first for admins under Settings → Activity. The retention loop deletes older events. `audit.record` writes in its own session, so a refusal is kept even when the request's transaction rolls back. A failure to record is logged and swallowed, never the reason a sign-in fails. A throttled attempt (429) is not recorded: a row per refused request would make each request in a flood cost a database write. Throttle trips stay in the app log. Also: the storage-limit test puts `storage_quota_gb` back afterwards, since settings outlive the per-test truncate. #2939 §5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 11:19:41 -04:00
bvandeusenandClaude Opus 5.5	043c87a8dc	Each account may store 5 GB of attachments; admins have no limit ... #2939 §4. max_attachment_mb capped one file, so any account could fill the volume. The new Settings → Attachments → storage_quota_gb (default 5, 0 for no limit) caps an account's total. That total is every attachment on every note the account owns, trash included, since trashed files stay on disk until emptied. Admins are exempt. storage.upload_refusal is now the one check every upload makes: per file, then per account. It is used by: - the web upload route; - the sync PUT, which judges the declared Content-Length before reading the bytes; - the importer, which learns the room left up front and refuses the whole archive if its attachments don't fit (nothing is committed). Over the limit is answered 507 Insufficient Storage, not 413. The core treats a 4xx as a permanent refusal it never retries, and a 5xx as worth another try. So a file refused for want of room syncs by itself once space is freed. The cost is that an over-limit device re-sends that file each cycle until then. GET /api/auth/storage returns used and limit, and the Account page shows it as a Storage row ("1.2 GB of 5 GB used"). docs/public-hosting.md drops the quota gap and gains a section on the limit. Its Android paragraph still said a public http:// address was only warned about; since 1dd6fc1 it is refused, and the paragraph now says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 11:12:26 -04:00
bvandeusenandClaude Opus 5.5	4b4659157e	Retire the bridge to the old dev channel release ... Scribe #3884. The dev channel's release tag moved from `dev` to `dev-rolling` on 2026-09-10. Since then, the manifest job has also written latest.json to the old `dev` release, so that desktop apps installed before the move could update across. The operator has had two desktop installs and is fine reinstalling, so the bridge goes. The old release and tag are deleted next, through the forge. - desktop.yml: the BRIDGE_TAG=dev export is removed. - write-manifest.sh: the TEMPORARY bridge block is removed. - ci-requirements.md: the "Transitional" paragraph becomes a note that the tag is gone, and that an app installed before 2026-09-10 reinstalls with install.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:46:37 -04:00
bvandeusenandClaude Opus 5.5	8592b83538	android: the device token is stored sealed under a Keystore key ... Family idea #5105, practice 12, as the operator chose on 2026-10-08: the token is encrypted, and Android backup stays on. The core: - Adds a TokenSeal trait in sync/state.rs, with set_sealed_link and open_token. - A sealed token is stored as "sealed:<value>". - A plain token, stored before this change or while sealing failed, is sealed in place on its next read. - A sealed token that won't open is dropped, and the server address and cursor are kept, so the app reads as unlinked and asks to sign in again. That is what happens after Android restores the app onto another phone. - The desktop passes no seal and keeps storing the token as before. The FFI: - Exports TokenSeal as a uniffi foreign trait (seal_token / open_token, null rather than an exception). - Requires it in Inkwell's constructor, so there is no moment a token could be stored unsealed. - Routes credentials(), unlink() and store_link() through it. Kotlin: - KeystoreTokenSeal is AES-GCM under an Android Keystore key, using the SealedBox framing from Minstrel's KeystoreSessionVault (Scribe snippet #5025), with no new dependency. - SealedBoxTest checks the framing on the JVM. allowBackup stays true, and the manifest says why. An unlinked phone's notes exist only on the phone, and the backup is their one other copy. The backup carries a token nothing can open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:23:22 -04:00
bvandeusenandClaude Opus 5.5	bb591871a4	Account page: change your password, or sign out everywhere else ... Family idea #5105, practice 4. Either action signs the account out of every other browser and unlinks every device. The browser that made the change stays signed in. - POST /api/auth/password needs the current password. A wrong one returns 403, not 401, so this browser doesn't read as signed out, and it counts against the sign-in throttle. A short new password returns 400. - POST /api/auth/sign-out-elsewhere does the same sign-out without a password change. Called from a device, it keeps that device linked. - _sign_out_elsewhere moves session_epoch on and deletes device tokens. The reset route now uses it too, keeping no device. - The page is renamed from "Linked devices" to "Account", in the router title and both nav entries. Its sections are Linked devices, Password (one short line, then the form) and Sessions (a single "Sign out everywhere else" row in the device rows' style), per preference 188: one line each, no paragraphs. - docs/public-hosting.md says how sessions end, and why a browser session isn't listed the way a device is: it is a signed cookie, ended by moving the epoch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:22:16 -04:00
bvandeusenandClaude Opus 5.5	1dd6fc1e20	Apps refuse to send their token over plain http:// to a public address ... Family idea #5105, practice 13, as the operator chose on 2026-10-08. The check lives in the shared core, so the desktop and Android both get it. compat::cleartext_allowed decides from the address text alone, with no DNS lookup. It allows https:// always. It allows http:// to private, loopback, link-local and CGNAT IPs (CGNAT covers Tailscale), to fc00::/7, fe80::/10 and ::1, to single-label names, and to LAN suffixes (.local, .lan, .home.arpa, .ts.net and others). The refusal runs in two places: - probe, so linking stops before a password or token is sent; - the top of run_cycle, so a device linked before this change stops syncing with a message telling it to re-link, instead of sending its token on every cycle. The server is unchanged and never forces HTTPS (rule 94). Plain http:// on a LAN links and syncs as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:14:14 -04:00
bvandeusenandClaude Opus 5.5	5d08d8a7a6	The first account can only be made in a 30-minute setup window ... Family idea #5105, practice 8 (Scribe #5113), the operator's choice of setup window over a setup code. Before this, whoever reached /register first on an empty server became its admin. On a fresh server at a public address, that could be a stranger, and a new DNS name is found within minutes. Now the first registration is refused once 30 minutes have passed since the server started (create_app records STARTED_AT). A restart opens the window again. It is a constant rather than a Setting, because there is no admin yet to change one. Once an account exists it no longer matters, so existing servers are unaffected. public-hosting.md says so, and two integration tests cover both sides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:08:29 -04:00
bvandeusenandClaude Opus 5.5	4c350838b1	Server idle timeout 120s, and say why there is no read timeout ... Family idea #5105, practice 9 (Scribe #5113). The body cap was already there (MAX_CONTENT_LENGTH, 64 MiB). For timeouts, read from hypercorn 0.18's source: - --keep-alive goes from 600 to 120. It is also the header timeout: hypercorn marks a connection busy only once a whole request has arrived, so a client dribbling headers was allowed ten minutes per connection. 120 stays above Traefik's 90s backend idle timeout, so the proxy never reuses a connection this server just closed. - No --read-timeout, deliberately. It bounds every socket read, including the whole of a streaming download while the client sends nothing, so it would cut off an APK fetched slowly over mobile data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:08:29 -04:00
bvandeusenandClaude Opus 5.5	65f004029b	Signed-in app downloads are cached privately, not publicly ... Quart's send_file marks every file it sends Cache-Control: public. The app download is behind a login, so a shared cache or proxy could have kept one account's copy and handed it to anyone. send_artifact now marks it private, as the attachment route already does. Family idea #5105, practice 11 (Scribe #5113). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 09:33:48 -04:00
bvandeusenandClaude Opus 5.5	97b04f9f92	Close the gaps family idea #5103 found in how Inkwell distributes its app ... Three of the idea's practices this project still owed (Scribe #5118): Practice 3, CI fails on the wrong signer. The signing step printed the certificate and went on. It now fails unless the APK has exactly one signer and that signer is the release certificate (SHA-256 408a5835…, pinned from run 8753). The steps that publish come after it in the same job, so a wrongly signed build is never staged or published. Practice 6, app downloads are throttled and carry a sha256 ETag. - The download route counts per account and answers 429 with Retry-After past the limit. The limit is a new Settings → Security value, "App downloads per account per hour" (default 30), live like the sign-in limits. - The ETag is the sidecar's sha256, not Quart's mtime-and-path, so a phone resuming a download across a redeploy is not told its partial copy is stale. Quart's own ETag and conditional handling are off, and the route runs the conditional pass after setting the ETag, so Range and If-Range are judged against the content. Practice 9, the update offer and debug builds. - The install-permission notice re-reads the grant each time the app comes back, as ReminderNotice does. Read once, it stayed up after someone granted the permission in Settings and came back. - A debuggable build says it can't update itself and checks for nothing. Android would refuse the release-signed APK over a debug signature anyway. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 09:21:40 -04:00
bvandeusenandClaude Opus 5.5	f0ce5687cc	android: build the signed APK's Rust with the release profile ... Every APK so far carried a debug-profile libinkwell_ffi.so (opt-level 0), because the workspace's release profile sets strip = true, which removes the symbols uniffi's --library mode reads the interface from (run 4077). The cargoNdk task now builds --release with two environment overrides, for this build only: - CARGO_PROFILE_RELEASE_STRIP=debuginfo keeps the symbol table. A release build has no debug info, so this keeps symbols and nothing else. - CARGO_PROFILE_RELEASE_PANIC=unwind keeps a core panic reaching Kotlin as an exception, which the board shows as an error, not an app exit. Phones have always had unwind, because debug unwinds, so this keeps what they do. Overrides rather than a profile of our own because cargo-ndk copies its -o output from the release directory, and nothing says it handles another. The desktop's binaries are unchanged. android.yml passes release on the signed path; the unsigned debug path keeps debug. Scribe #2810. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:39:36 -04:00
bvandeusenandClaude Opus 5.5	8cdb36dc2a	web: two board columns on a phone, as the Android app has ... The board was one column below 640px, so on a phone it read as a list while the app showed two. It is now two columns from the smallest width, with an 8px gap there (16px from sm up). Two columns at 16px on a 390px screen would leave ~170px cards. NoteCard's bottom margin, the vertical half of the gap, tightens with it. NoteGrid is the only place the board's columns are defined, so board, search, timeline and reminders all change together. Fill order is untouched. CSS columns fill top to bottom, so note #2 sits under #1 rather than beside it, unlike Android. That is left until it has been looked at on a phone, as #2950 recommends. Scribe #2950. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:32:16 -04:00
bvandeusenandClaude Opus 5.5	87725ecab7	android: search narrows the board in view, and combines with its filters ... As on the web, the search box is now one more facet on the board you are looking at, rather than a separate unfiltered search. "These words, in notes tagged grocery" works: on the main board the text is sent to the core together with the Filters sheet's tags, attachment and shared switches, and the core ANDs them in list_notes. Archive, Trash and a tag's view take the text alone. A search typed on Reminders, which is not a board view, moves to the main board, as the web does. The Filters chip stays while you search; it was hidden before, on the mistaken claim that the web hides its filters too. Drag-to-reorder stays off during a search, since a filtered subset can't be renumbered against notes it can't see. store::search and the FFI's search_notes had no other callers, and are removed. They also searched archived notes and ignored pinning, which the board's query does not. Scribe #2942. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:19:50 -04:00
bvandeusenandClaude Opus 5.5	5fa261cea7	android: hold Coil at 3.5.0, the last release that builds on compileSdk 36 ... Run 8731 failed checkAarMetadata: Coil 3.6.x requires compileSdk 37, and it pulls in Compose 1.12, which requires AGP 9.1. This project is on compileSdk 36 and AGP 9.0.1. Coil 3.5.0's AARs ask for 36, and its Compose (JetBrains 1.11.1) is within this project's BOM (Compose 1.11.2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 07:59:09 -04:00
bvandeusenandClaude Opus 5.5	a213e2e186	android: link preview cards show the page's image, as on the web ... The card draws the linked page's og:image in a strip down its left edge, cropped to the card's height: 96dp full, 48dp compact, matching the web's w-24 and w-12. The image is remote, so the phone fetches it from whatever host the link points at, exactly as a browser does for the web card. The operator chose that parity (Scribe #3307). The image is Coil 3's AsyncImage, with OkHttp as its fetcher. Coil's disk cache means a card scrolled past twice costs one download. When there is no image, or it fails to load, nothing is drawn rather than an empty box, and the card is the text card it was before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 07:47:26 -04:00
bvandeusenandClaude Opus 5.5	10412a2fb7	desktop: rustfmt's shape for the server feed arm ... Run 8721's format check; clippy and the Rust tests were already green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 07:00:07 -04:00
bvandeusenandClaude Opus 5.5	b03c9cf81a	desktop: in-app updates follow the server you installed from ... Milestone 325 step 6 (Scribe #3254). The server publishes its AppImage in the updater's own format at /api/client/linux-appimage/update.json: the ordering key as `version`, the signature, and an absolute download URL built on the host that was asked, so the token the updater attaches goes nowhere else. Unsigned platforms and a server with no AppImage 404. The desktop's update source is now Fabled-Git (and its channel) or one server: - `read_source` is the one reader. The installer's `install-server` marker feeds the `update_server` pref once per new value, exactly as the channel marker feeds its pref; tauri.conf.json's endpoint is never consulted. - From a server, the check and the download carry the sync link's token when the app is linked to that same server. Without one the update shows and says to link rather than offering a button that 401s. - A server with no build says so. A 404 is "up to date" only on the forge, where it means an unpublished channel. - Sync → App updates offers the source once there is a server to offer (the chosen one, or the linked one), and only shows the channel for the forge. The trust anchor does not move: whatever the source, the updater verifies the AppImage against the public key built into the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 06:56:36 -04:00
bvandeusenandClaude Opus 5.5	871878de41	install.sh installs from your own server, not just from the forge ... Milestone 325 step 5 (Scribe #3253). curl -fsSL https://notes.example.com/install.sh | sh The server serves the installer at /install.sh with its own address written into it (installer.py). Settings → Public address when set, the request's own address otherwise. The substitution is one variable, given a value that has passed a strict shape check, and the script checks it again; an address that cannot pass makes the route refuse rather than serve a script pointed elsewhere. `public_url` joins the live settings cache so the route needs no database. From a server, the script: - resolves each Linux bundle from the public /api/client/<platform>, and builds the download URL from the platform id rather than reading it from the reply; - asks for a device token (from the terminal, since stdin is the script), or takes TS_TOKEN, and sends it from a file rather than the command line; - checks the sha256 the server published before anything installs; - revokes a prompted token once the download is done; - records `install-server` for the updater (step 6) instead of the channel. The forge path is unchanged, and stays the default for the copy the forge serves. The Account page's downloads card shows the one-line command whenever the server holds a Linux client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 06:44:39 -04:00
bvandeusenandClaude Opus 5.5	802eab4ef9	android: bring BoardScreen and NoteCard back under detekt's complexity limit ... Run 8693's detekt failed both on CyclomaticComplexMethod (17 and 15 against 15) after the filters and drag-to-reorder landed. - BoardState now carries `filterable` and `reorderable`, so the board's rules for when the filter row shows and when a card can be carried live with the state they read instead of as boolean chains in the screen. - NoteCard's contents (tags, body, links, attachments, reminder, sharing) move to their own CardContents composable, leaving NoteCard the gestures, the frame and the menu. No behaviour change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:38:37 -04:00
bvandeusenandClaude Opus 5.5	3b4fe310b8	android: the board's Filters and drag-to-reorder, as on the web ... Filters: a chip under the search bar opens a sheet with Has attachment, Shared with me and tags (a note must carry all of them), applied as they are tapped, with a count on the chip and a Clear beside it. Only the main board filters and search spans everything, as on the web; opening another view starts it unfiltered, a deleted tag drops out of the filters as it does from the lens, and an empty filtered board says so. Reorder: hold a card, then move it. The hold is the long press that opens the card's menu, which closes as the card starts to move; lifting without moving leaves the menu as before, and moving before the hold is a scroll. Cards trade places live and the drop writes the order through the core's reorder, newly exposed over the ffi as reorder_notes. Only on the plain main board, and only on the same side of the pinned line, since the store sorts pinned first. #5313. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:28:22 -04:00
bvandeusenandClaude Opus 5.5	4149229988	web: component tests for the Share dialog ... @vue/test-utils and jsdom as dev dependencies, jsdom chosen per file with the vitest environment comment so the existing unit tests stay on node. The dialog's repo.shares is faked; the tests cover offering everyone, sharing with a person and a group, changing and removing a share (and the board's shared flag that follows), a refused share keeping the choice, the load retry, and the single-person instance. #5313. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:28:22 -04:00
bvandeusenandClaude Opus 5.5	3829d52e4d	ci: find our own container from mountinfo, the way Steward does ... The integration lookup read the job's id from /etc/hostname, which holds only while the runner leaves the hostname as the container id. Steward's fix (#5104) reads it from the /etc/hostname bind mount's path in /proc/self/mountinfo and falls back to the hostname, so one recipe now serves every repo (#5313). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:12:52 -04:00
bvandeusenandClaude Opus 5.5	c614e6859a	Revert the deliberately failing core test ... It proved the APK gate (#5237): run 8667 failed at the core's tests, skipped the APK job and still dispatched the server image. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:46:39 -04:00
bvandeusenandClaude Opus 5.5	d682ae026d	ci: the core checks run in their own job on ci-tauri, and the APK needs it ... The step added in 42db4cd ran cargo on the Android image, which has OpenSSL only for the Android targets; the host build died at openssl-sys (run 8663) before reaching a test. The core's clippy and tests are now a 'rust' job on ci-tauri, the image desktop's verify runs them on, and the APK job needs it. The server-image dispatch moves to its own job: it was a step inside the APK job, and a skipped job runs no steps, so failing core checks would have silently stopped the server image too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:42:17 -04:00
bvandeusenandClaude Opus 5.5	a682d6d225	core: a deliberately failing test, to prove the APK gate (reverted next) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:35:06 -04:00
bvandeusenandClaude Opus 5.5	42db4cde6b	ci: the APK waits for the core's clippy and tests ... android.yml never ran cargo, so a core test that failed in desktop.yml's verify job stopped the desktop installers and not the APK, which links the same core through android/ffi (#5237). The Kotlin + Rust job now runs clippy and the tests for inkwell-core and inkwell-ffi before anything is assembled or published. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:35:06 -04:00
bvandeusenandClaude Opus 5.5	82aa5ba7b6	android: wrap the board's column choice the way ktlint wants ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 21:48:15 -04:00
bvandeusenandClaude Opus 5.5	d9f755b128	ci: the integration lane finds its own Postgres, not another job's ... Run 8653 failed at 'alembic upgrade head' with a password error: two integration jobs were on the runner at once, and the name=integration filter took the other one's database (#5312). The lookup is now scoped to this job's GITEA-ACTIONS-TASK-<id>- prefix, read from the job container's own name, and requires exactly one match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 21:40:36 -04:00
bvandeusenandClaude Opus 5.5	d6757fc0fc	android: the board takes three and four columns on a wide window, as the web does ... The board was Fixed(2) at every width, so a tablet showed two wide columns where the web shows three or four (#5311). The column count now follows the web's NoteGrid breakpoints on the window's width: three from 1024dp, four from 1280dp. A phone keeps two. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 21:36:41 -04:00
bvandeusenandClaude Opus 5.5	b019172d47	all: remove saved views, the Has-reminder filter and the Created range ... Step 18 of the audit follow-through (#5180), on the operator's decisions. Inkwell is for capture and recall (note 2897), and these three duplicated a surface that does the job already: - Saved views. They lived only on the web; the desktop kept its own set that never synced, and Android had none. Tags in the drawer already give one-click recall. Gone from the server (routes, model, migration 0038 drops the table), the core (store functions, schema v13 drops its table), the desktop commands, the web adapters, the drawer's Views list and the "Save view" link. - The "Has reminder" facet. The Reminders page lists them, sorted by due. - The FilterBar's "Created" range. Timeline is the date lens and keeps the created_after/created_before query it builds from local days, which also retires the UTC/local-day disagreement between the two (B3). An old link that still carries the removed keys opens the plain board; a web test pins that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 21:29:28 -04:00
bvandeusenandClaude Opus 5.5	888c6410f0	all: trim the history essays out of the longest comments ... From the audit (#5179). Ten comment blocks narrated how the code got here: milestone numbers, earlier values, the operator's verdict on an old design. Each now says what the code does and why, and the history stays in git, Scribe and docs/sync.md. The protocol-version comment in sync.py points at docs/sync.md's policy section, which already lists every bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 20:03:44 -04:00
bvandeusenandClaude Opus 5.5	e75e3d37d0	web: shared note actions, reminder chips, page header, formatters and settings seam ... From the audit (#5179, web half). - NoteActions: share, pin, archive and trash (restore and delete forever when trashed), as both the card and the editor offer them. The editor's history toggle goes in its slot, and it closes on `acted`. - ReminderActions: the Done / 1h / 1d chips on the card and in the editor, which are now the same chips. - PageHeader: the back-to-board header that Settings, Sync and Linked devices each wrote out, now with a `back` icon from the shared set. - notes/datetime: formatShortDateTime (was formatReminder and the editor's revLabel) and formatDateTime (the two `fmt` copies). - notes/colors: labelDotClasses (the sidebar's and the tag manager's labelDot). - Drawer links use exact-active-class instead of route.name ternaries. - BoardView binds its three grids from one gridBinds object. - Settings goes through repo.settings (rest, plus a local adapter that answers "needs a server") and shows load failures through AsyncState. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 20:02:18 -04:00
bvandeusenandClaude Opus 5.5	05c82c2362	core, desktop: Db::conn everywhere, Change::default, notes_where, and shared row mappings ... From the audit (#5179, core and desktop half). - Every `db.0.lock().map_err(|e| e.to_string())?` (about 50 sites in core and the desktop) is now `db.conn()?`. The few sites that deliberately handle a poisoned lock differently, and the tests, keep their own spelling. - push::Change derives Default, so its four constructors name only the fields they set. - store: list_notes, reminders, titles and search share notes_where (ids from a query, each loaded through load_note). Labels share LABEL_SELECT/label_row, and saved filters share SAVED_FILTER_SELECT/saved_filter_row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:57:24 -04:00
bvandeusenandClaude Opus 5.5	646a115701	server: one credential check, one coerce_bool, one top-position query, and the shared response helpers ... From the audit (#5179, server half). - auth: login and device-login share _check_credentials (dummy hash for a missing account, throttle bookkeeping, the failure log line) and _bad_credentials. - settings uses common.coerce_bool. Its private copy differed only in treating a non-string as its truthiness, which the shared one now does. - notes: create and import share helpers.top_position. - auth, settings_api, sync and client_dist return errors through responses.json_error / not_found, and parse ids with parse_uuid. - sync: push replies are built by _result(id, entity, status, **extra). Already merged by earlier steps, so nothing to do here: attachment storage (store_attachment), the preview upsert (only unfurl_queue writes one now), and _serialize_note (delegates to _serialize_notes). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:55:01 -04:00
bvandeusenandClaude Opus 5.5	b8f13cfc4a	tests: the share ACL test's final body no longer expects the removed add-item route's eggs ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:13:44 -04:00
bvandeusenandClaude Opus 5.5	e2e0740b06	tests: stop posting to the removed add-item route in the share ACL test ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:06:42 -04:00
bvandeusenandClaude Opus 5.5	7eacd0569c	all: delete the code nothing calls ... From the audit (#5178). Each was unreachable from every client: - Checklist add-item and delete-item: REST POST /items and DELETE /items/<id>, the Tauri commands, the store, rest and local adapters, the core's add_item/delete_item, set_item_text and remove_item, and the FFI exports. Adding, rewording and removing an item are body edits in every editor. The checked toggle stays, and its rewriter is simpler without the drop branch. - Manual unfurl: POST /unfurl and its adapters. Previews arrive in the background after a save (unfurl_queue). - The /api/config `android_client` key, android_release() and the APK_NAME/MANIFEST_NAME aliases. Phones poll /api/client/android. - users.email_verified and users.avatar_path (migration 0037). Nothing set the first or read the second; the SMTP reset never checked verification. - derive::extract_tags (only tests used it; the shared fixture now runs through extract_tag_spans), the unused check and link icons, and the unused editor_add_item string. - The blob scheme is renamed tsblob -> inkblob. URLs are built as notes are read, so nothing stored carries the old one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:00:44 -04:00
bvandeusenandClaude Opus 5.5	fd1d50662f	android: share a note with a group ... The Share sheet lists groups after people, shows a group share as its name and how many are in it, and shares through the FFI's ShareTarget. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 18:25:16 -04:00
bvandeusenandClaude Opus 5.5	442cca4398	web, core, desktop: share a note with a group, and Settings → Groups ... The Share dialog lists people and groups in one picker and shows a group share as its name and member count. Settings gains a Groups section for the admin: create, rename, delete, and add or remove people. The core client reads the directory's groups and group shares (ShareTarget: a member or a group); the desktop command takes user_id or group_id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 18:25:16 -04:00
bvandeusenandClaude Opus 5.5	5f3cfe8bb7	groups: admin-managed groups, sharing a note with one, and membership in the feed ... /api/groups (admin) creates, renames and deletes groups and adds or removes members. The member directory lists every group, and a share may name a group_id instead of a user_id; a note's shares answer with `member` or `group`. A note shared with a group reaches whoever is in it now, so membership is what the feed follows: joining grants each of the group's notes to the new member's devices, and leaving (or the group being deleted) revokes them unless a direct share or another group still reaches that person. recipients() never counts the note's own owner, who may sit in a group it is shared with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 18:25:16 -04:00
bvandeusenandClaude Opus 5.5	2e2714a50b	core: clippy — a one-element slice from a reference in the store test ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:18:53 -04:00
bvandeusenandClaude Opus 5.5	4f5459cb94	android: pin and archive a note someone shared with you ... The card's long-press menu and the editor's overflow now open on shared notes with Pin and Archive; Labels, Share and Move to trash stay the owner's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:13:58 -04:00
bvandeusenandClaude Opus 5.5	89cd1c76bb	core, web: pin, archive and reorder a note someone shared with you ... Schema v12 adds notes.state_at: a recipient's own pin, archive and order are stamped there instead of on updated_at, which stays the text's time. Push sends them only to a server advertising `shared_state` (push::Accepts), a view share included; the first pull at that level starts the feed over once so held copies drop their owner's pins. The client speaks protocol 7 and lists `shares` and `shared_state` among the features a server may lack. The web card and editor offer pin, archive and drag on shared notes; share and trash stay the owner's, and the board's trash key skips notes you don't own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:13:58 -04:00
bvandeusenandClaude Opus 5.5	63955bbe97	sync: recipients keep their own pin, archive and place on shared notes ... A note_user_state row per (note, recipient) holds what used to be the owner's columns as far as anyone else could tell. The board filters and orders through the viewer's own state; PATCH and reorder write it for a note shared at any level; the feed's revision for a shared note is the later of the note's and the caller's row, so a recipient's pin reaches their devices and no one else's. Push takes the three with their own `state_at` stamp (protocol 7, `shared_state`), so pinning a copy whose text is behind never makes that text win over the owner's edit. A body is only stamped as an edit when it changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:13:58 -04:00
bvandeusenandClaude Opus 5.5	5e8c6dc7bf	android: detekt — check the link before loading shares, and NoteAccess gets its own file ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:52:21 -04:00
bvandeusenandClaude Opus 5.5	2e7db21b21	android: share a note, and read or edit one shared with you ... The editor's menu has Share…, which opens a sheet of who the note is shared with and lets you add someone at view or edit, change it, or stop sharing; unlinked, it says sharing needs a server. A note shared to view opens read-only; at edit only its text can change. Cards say who shared a note ("From Robin") or that yours is shared, and a view-only note's boxes don't tick. Also: two core store tests used unwrap_err on a Result<Note>, which needs Note: Debug; they use err().expect() now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:42:30 -04:00
bvandeusenandClaude Opus 5.5	aa36b43dc3	core: shared notes on the desktop and phone, and Share from the desktop ... The core pulls with shares from a server offering them (protocol 6): a note says how it is held (owner, edit, view) and who shared it, and a revoked note leaves the device. The first such pull starts the feed over once, so notes shared before this build arrive. The store refuses what a share doesn't allow (view: everything; edit: anything but the text), push sends only the text of someone else's note, and their notes stay out of trash, reminders and reordering. Unlinking drops them. The Share dialog's calls go to the linked server over the device token, as Tauri commands and through the FFI. The desktop now offers Share and "Shared with me"; unlinked, the dialog says sharing needs a server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:33:16 -04:00
bvandeusenandClaude Opus 5.5	75928c7afd	sync: shared notes in the feed, revocations, and text pushes from an edit share ... The change feed answers `?shares=1` with every note the caller can see, each saying how it is held, plus a `revoked` list of notes that left them. Granting a share moves the note past the recipient's cursor; ending one, or the owner deleting the note, leaves a revocation on the same cursor. A recipient at edit may push the note's text, and nothing else. Protocol 6, feature `shares`; opt-in, so the floor stays at 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:25:13 -04:00
bvandeusenandClaude Opus 5.5	2e2d8667dd	password reset by email: Settings → Email, Forgot password?, and a test-email button ... The operator asked for self-service reset over SMTP. It reuses #5173's password_resets table, /reset-password page, one-hour single-use token and sign-out-everywhere. - Settings (rule 25, not env): a new Email group (SMTP server, port, encryption as a choice, username, password, from), General → Public address, and Security → Reset emails per account. The registry gains `choices`, `secret` (the value is never sent back, `is_set` says one is saved, an empty save keeps it) and `url` (http(s), trailing slash stripped). - mailer.py: stdlib smtplib on a worker thread, 20 s timeout, starttls | tls | none. mail_settings() is None until a server, a sender and the public address are set. Links are built from the public address because the Host header can be forged. - POST /api/auth/forgot-password: the same answer at the same speed for any address. The link is made and mailed off the request (send_later). It is throttled like a sign-in per visitor address, and capped per typed email by reset_emails_per_account; past the cap it answers the same and sends nothing. - POST /api/settings/test-email: mails the admin with the saved settings and shows the server's error if it fails. - Public config `password_reset_by_email`. Sign-in shows "Forgot password?" only then, linking to a new /forgot-password page. - docs/public-hosting.md: an "Email and forgotten passwords" section. Tests: the secret stays server-side; emailed link → reset; the same answer for unknown addresses; the cap; test email success and failure; validation units. #5266. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:15:43 -04:00
bvandeusenandClaude Opus 5.5	ca242e59a6	tests: adding a checklist item answers 201 ... The edit-share test expected 200 from POST …/items, which creates. #5174. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:06:39 -04:00
bvandeusenandClaude Opus 5.5	f53d377766	sharing: share a note from the web, at view or edit, with anyone on the instance ... The ACL has gated every read since M0, but nothing could write a share. Server: - shares_api: GET /api/users/directory (everyone but you, signed-in only), GET/POST /api/notes/<id>/shares and DELETE …/shares/<share_id>, owner only. Sharing again with the same person changes the permission (ON CONFLICT on the new unique index). - acl.visible_to_user takes permission=; granted_to and shared_ids feed the serializer. - Edit covers body and checklist (_get_editable). Everything else stays _get_owned. A view share's write is a 404 like a stranger's (#1984). An editor's PATCH naming anything but body is a 403. - Serialized notes carry permission, shared and shared_by. A recipient never gets the owner's labels, and a #tag an editor types files under the owner's (it always went to note.owner_id). - ?shared=with_me, also allowed in saved views. Trash and reminders are the owner's. purge_note drops the note's shares. - Migration 0034: one share per note and person (and per group), permission limited to view and edit, an index for "shared with me". Web: - ShareDialog (one, mounted by the shell): pick a member, Can view or Can edit, change or remove existing shares, with loading, error and empty states. - Card: "Shared by X" or "Shared" chip; owner-only actions and reminder buttons hidden for recipients; checkboxes inert at view. - Editor: read-only at view; text and checklist only at edit; Share button for the owner. - FilterBar: Shared with me. Repo seam gains `shares`; the offline desktop shows none of it (#5175 brings sharing there). Tests: owner, recipient and stranger across reads, every write at view and edit, tag filing, unshare, trash, delete and validation; web unit tests for the facet and permission helpers. #5174. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:01:53 -04:00
bvandeusenandClaude Opus 5.5	f100e5ef85	tests: the self-revoke routing check reads the URL map; its 400 moves to Postgres ... test_devices signed a fake account into a session and relied on login_required answering without the database. Since 3dd0b44 the session path reads the account's epoch, so the fake account hit an unreachable database and 500ed. The routing property (the static /devices/self rule beats /devices/<device_id>) is now asserted on the URL map, and the view's 400 for a web session is an integration test with a real account. #5173. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 14:41:44 -04:00
bvandeusenandClaude Opus 5.5	3dd0b44cb9	password reset: an admin makes a one-hour link, and using it signs the account out everywhere ... There is no mail path, so a forgotten password needed a hand on the database (#2939 §2). Settings → People lists the accounts; Reset password makes a link that works once within an hour, shown once for the admin to hand over. Making another link for the same account closes the earlier one. Using it (/reset-password) sets the password, deletes the account's device tokens, and moves users.session_epoch on. Sessions are signed cookies the server can't delete, so each now carries the epoch it signed in under and login_required reads the account's epoch by primary key. A cookie from before this has no epoch and reads as 0, the starting value, so the upgrade signs nobody out. A deleted account's session now stops working too. The one-time link reveal moves out of InviteList into OneTimeLink, and the link-building into router/links.ts, shared by invites and resets. Migration 0033. #5173. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 14:35:58 -04:00
bvandeusenandClaude Opus 5.5	28fa8badcb	invites: an admin lets one person register while registration stays closed ... Until now adding a second person meant re-opening registration to the whole internet while they signed up (#2939 §1). An admin now makes an invite in Settings: a link that works once, expires (7 days by default, 1 to 30), and can be pinned to one email address. Only the token's hash is stored, so the link is shown once. POST /api/auth/register takes `invite`. Redemption is one conditional UPDATE inside the transaction that creates the account, so two people racing one link can't both get in, and a taken email leaves the invite unused. Every refusal says "invalid or expired invite". The register page reads ?invite= and opens even while registration is closed. Refs #5172 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 13:13:03 -04:00
bvandeusenandClaude Opus 5.5	df85535ea2	desktop: reminders reach you when the window isn't in front ... A Rust worker reads due reminders from the local store every 15 s and announces each occurrence once: always to the main window as a toast, and as a system notification (tauri-plugin-notification) when that window isn't focused. The page no longer polls on the desktop; its Notification went nowhere in WebKitGTK and its timer stopped with the window. The Reminders page says what each surface actually does. Core gains store::due_reminders, compared by instant, not by string. Refs #5171 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 12:46:02 -04:00
bvandeusenandClaude Opus 5.5	5989ffc1c6	desktop: Import and Export work offline; the menu toggle is reachable; errors say why ... Export and Import were a link to the server and a reject("needs a server") on the desktop. Both now run in the core with no server: - core/src/local/portable.rs builds the same zip the server writes (notes.json, a Markdown file per note, each attachment this device holds) and reads either export marker or a Google Keep Takeout zip, with the server's decompression budget and an all-or-nothing transaction. Export saves to Downloads (no new plugin) and the sidebar says where; Import takes the archive as raw IPC bytes. - core/testdata/portable.json pins the format for both copies: the server runs its Keep and native readers against it (test_portable_fixture.py) and checks its real export's keys (test_integration.py); the core runs the same cases. - Found on the way: both importers skipped a Keep note that is only a photo as "empty". It now imports, on the server and in the core. - New dependency, approved: `zip` (deflate only) plus `flate2` on its pure-Rust backend, both already in the lockfile. The AppImage applications-menu toggle moves from Account, which the desktop never shows, to the Sync page; the first-run prompt now says so. errorMessage (#5236) replaces the hand-rolled `.error ?? …` / `.message ?? e` reads at the remaining catch sites, so a desktop failure shows its real reason. Task #5170. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 11:36:42 -04:00
bvandeusenandClaude Opus 5.5	ac4427f834	android: shows and attaches files, and the share sheet takes images ... The phone downloaded every attachment and drew none of them, so a photo note looked empty. Now: - Cards show a note's first image and name its other files; the editor shows every image at full width and every file as a row. Tapping one opens it in whatever app handles its type (a cache copy under its real name, through a FileProvider that serves only those copies). Each can be removed, and a file the server refused says why under it. - The editor's toolbar has an Attach button (any type, several at once). Files are stored on the phone straight away and upload on the next sync that reaches a server, through the core's step-6 path. Link previews show in the editor too, and can be dismissed. - Share → Inkwell accepts one or several images, with or without a caption, finishing #1899's deferred image/* target. - The FFI gains add_attachment, delete_attachment, delete_preview and blob_path. The sync summary counts uploads and failed uploads. Images decode at the size they are drawn (BitmapFactory sampling plus EXIF rotation, small LRU cache), so no image library is added. Files over 50 MB are refused on the phone before they are read whole into memory. Task #5169. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:59:36 -04:00
bvandeusenandClaude Opus 5.5	5b11490858	core: the compat forward-compat test builds its feature list from the constants ... A literal list went stale the moment attachment_sync was added (run 8513), the same way pinned version numbers did at v2 — for a reason unrelated to what the test checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:13:17 -04:00
bvandeusenandClaude Opus 5.5	2b2ceaa82e	attachments sync: attach offline, upload when linked, removals stick (#5168) ... Desktop could not create an attachment at all, and a removed attachment or dismissed preview came back on the next pull. Now: - core: add_attachment keeps the bytes in the blob store and queues the row (schema v10: attachments.uploaded / upload_error). Push uploads it once its note has landed. A refusal that retrying won't fix (too large, id clash, hash mismatch) is recorded on the file and not re-sent every cycle; the editor shows it. - core: removing a synced attachment or dismissing a preview leaves a tombstone in pending_deletes; push sends it as an `attachment`/`preview` delete, and a pull while it waits doesn't put the row back. A pull also keeps files still waiting to upload instead of replacing them wholesale. - server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent, size-capped) and child deletes in push, which apply regardless of LWW and answer noop for rows the caller can't see. One store_attachment helper for the upload route, the importer and sync. Protocol 5, feature attachment_sync; the client sends neither to a server without it. - server: migration 0031 makes a link preview's insert/delete bump its note, so background-fetched previews and web dismissals reach linked devices. - desktop: Attach and paste-image work offline (raw-bytes IPC command). - SVG is served as a download by the desktop blob scheme too (as #1981 did for the web), and drawn as a file chip on both. - autosync: drop the catch_unwind; release builds abort on panic, so it only ever worked in debug builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:07:52 -04:00
bvandeusenandClaude Opus 5.5	efb141e555	desktop: syncs on its own — at launch, soon after an edit, every few minutes and on focus ... Until now the only caller of the sync engine was the "Sync now" button. A worker thread now owns every cycle (the button's included, so two never overlap): - launch: one cycle as the app opens; - edit: every 10s it reads a fingerprint of the pending set and sends when that moved. A fingerprint rather than "anything pending", because a rejected change stays pending and would otherwise be resent every tick forever; - timer: a pull every 5 minutes with nothing to send; - focus: at most once per 30s. Failed automatic cycles back off (doubling from 10s to 5 minutes). A panicking cycle counts as a failed one rather than ending the thread. Every cycle is emitted as inkwell://synced: the board reloads when the pull changed something, and the Sync screen shows the last automatic failure. No final push on quit; the launch cycle sends whatever was left. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:40:27 -04:00
bvandeusenandClaude Opus 5.5	09239ee3c7	web: the app's type-check leaves the unit tests out; CI checks them separately ... Run 8478 passed every test lane and then failed `Build & push image`. The Dockerfile's frontend stage copies only frontend/, and `npm run build` type-checks with tsconfig.json, which covered grammar.test.ts. Its import of ../core/testdata/grammar.json doesn't exist inside that stage. Nothing was published: the build is the publish and it stopped. tsconfig.json now excludes `*.test.ts`. The new tsconfig.test.json extends it with the tests included, and ci.yml's typecheck lane runs that one, so the tests are still type-checked before anything ships. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:34:14 -04:00
bvandeusenandClaude Opus 5.5	38da5160a0	grammar: a #tag starts after whitespace and with a letter, on every surface ... The shared fixture went red on the server (run 8468: 5 failed), because the three tag rules disagreed: - core and web: any non-tag character counts as a boundary, so `(#todo)` and `end.#tag` are tags, and so is the `/#section` of a pasted URL; - server: only whitespace counts, but `#1st` and `#_x` are tags. A note's labels could therefore change every time it synced. All three now share the strict rule: start of line or whitespace, then a letter, then letters, digits, `_` and `-`. Nothing becomes a tag that wasn't already one everywhere, and URL anchors stop becoming labels on desktop and Android. The server's existing `http://x/#nope` test already expected this. derive.rs's boundary, markdown.ts's lookbehind and tags.py's regex change together; `_is_tag` goes because the regex now requires the letter. The fixture flips `(#todo)`, `end.#tag` and its lift case, and adds the URL case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:22:53 -04:00
bvandeusenandClaude Opus 5.5	535331c5b2	tests: one fixture for the note grammar, run by the core, the server and the web ... The checklist grammar and the #tag rule are implemented three times (derive.rs, checklist.py/tags.py, markdown.ts), and the tag colour twice (colors.ts, DerivedTint.kt). Only Rust and Kotlin had tests. core/testdata/grammar.json now holds one set of cases (task lines, rendered items, tags, standalone-tag lifts and the tint hashes), and every suite reads it. - web: vitest, a dev dependency approved for #5166, with `npm test`. grammar.test.ts runs the fixture, and titles.test.ts pins #5165's palette fix. - ci.yml runs the web tests in the job the image build needs. desktop.yml's verify job runs them too, because the installers embed this frontend and can't see ci.yml's verdict (rule 177). - core: derive.rs reads the fixture. server: tests/test_grammar_fixture.py. - Android keeps its hand-written tint values; its doc now points at the fixture. The server is expected red here, on purpose. tags.py only takes a tag after whitespace and lets it start with a digit or `_`, while the core (the definition) takes any non-tag boundary and needs a letter. So `(#todo)` is a label on the phone and plain text on the server. The fix follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:11:26 -04:00
bvandeusenandClaude Opus 5.5	af0389ed13	web: the command palette finds notes written since it was first opened ... The palette's note list loaded once per session behind a `loaded` flag, and the `reload()` that would have cleared it had no caller. So a note written after the first open couldn't be found by name until the page reloaded (#5165, audit B4). The list is now fetched again on every open, and the last list stays visible meanwhile. The input takes focus before the fetch, and a failed fetch keeps the old list instead of breaking the palette. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:51:36 -04:00
bvandeusenandClaude Opus 5.5	8db9f3685b	server: one save path for a note's text, so a restored link gets its preview ... A body edit is a sequence: keep a revision, rename the note, lift #tags, commit, queue link previews. It was written out in PATCH, the item routes, restore and sync push, and the copies had drifted. Now they all call `notes/body.py: write_body`, which says how the old text is kept ("session", "always" for restore, "never" for a new note) and returns whether the text changed. The routes commit through `_commit_note`, which queues previews after the commit. Fixes, both red on 1a2f71e (run 8441): - restoring a revision queues previews for its links (#5164, audit B5); - a pushed note keeps the client's edit time when a standalone #tag is lifted. The lift's extra flush used to let `onupdate` stamp the server clock over it. Sync push also queues its previews after the batch commits, not mid-batch, where a fast fetch could look for a note that wasn't committed yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:31:41 -04:00
bvandeusenandClaude Opus 5.5	86409e02b0	ci: drop the deliberate failure — the gate held on run 8437 ... Run 8437 failed `verify` on purpose, and the Linux build, the Windows installer and the update manifest all reported skipped. This removes the red step, so this push is the other direction: a green verify still publishes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:26:48 -04:00
bvandeusenandClaude Opus 5.5	1a2f71e381	tests: every note-text write path is pinned, and two of them fail today ... Integration tests for the edit sequence at each door: create, PATCH, ticking an item, restoring a revision and sync push. Two fail on today's code, on purpose: - restoring a revision never queues link previews, so a restored link stays a bare URL (#5164, audit B5); - a pushed note whose standalone #tag gets lifted stores the server's clock as its edit time instead of the client's, because the lift's second flush lets the column's onupdate overwrite it. The fix follows in the next commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:26:15 -04:00