bvandeusenandClaude Opus 4.8 e4c898cd1b M2 attachments: image upload + owner-scoped media serving ...

- Migration 0007: note_attachments (path/mime/size). Upload POST
  /api/notes/<id>/attachments (multipart, png/jpeg/gif/webp, 12MB cap via
  MAX_CONTENT_LENGTH) stored under Config.media_root() (first use of DATA_DIR);
  owner/ACL-scoped GET serves the file (nosniff); DELETE removes row + file.
  Note responses include attachments[].
- Frontend: notes store uploadAttachment (FormData)/deleteAttachment; editor
  image button + paste-to-upload + thumbnail grid with remove; card shows the
  first image as a cover.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

2026-07-19 22:21:26 -04:00

..

conftest.py

M0: backend skeleton — Quart factory, async DB, auth, ACL spine, migrations

2026-07-19 13:09:37 -04:00

test_acl.py

M0: backend skeleton — Quart factory, async DB, auth, ACL spine, migrations

2026-07-19 13:09:37 -04:00

test_admin.py

M1.5 backend: admin role + DB-backed settings, DB-URL-only install

2026-07-19 18:25:04 -04:00

test_app.py

M0: backend skeleton — Quart factory, async DB, auth, ACL spine, migrations

2026-07-19 13:09:37 -04:00

test_labels.py

M2 labels backend: labels + note_labels, CRUD, note-label set, filter

2026-07-19 21:43:21 -04:00

test_notes.py

M2 attachments: image upload + owner-scoped media serving

2026-07-19 22:21:26 -04:00

test_security.py

M0: backend skeleton — Quart factory, async DB, auth, ACL spine, migrations

2026-07-19 13:09:37 -04:00

test_settings.py

M1.5 backend: admin role + DB-backed settings, DB-URL-only install

2026-07-19 18:25:04 -04:00