6 Commits

Include renames

Author	SHA1	Message	Date
codingetandCodex	a1992eb57a	fix: restrict user email visibility ... Co-Authored-By: gpt-5.6-sol <noreply@openai.com>	2026-07-23 18:49:49 +00:00
codingetandClaude	ccb970f200	feat: add export/import streaming to the pluggable backends ... Add backend-agnostic data export/import over an NDJSON wire format, plus an inspect utility, exposed via three new CLIs and an HTTP export endpoint. - ExportImport types + filter helpers (kind/record scoping, hard-intersection of filters) in src/db/{types/ExportImport,export/filter}.ts - SqliteInterface implements Exportable + Importable: signal-checked async generator export (one query per table, per-record yield, trailing error sentinel on mid-stream failure) and a manually-driven import transaction that rolls back on any error/abort and never commits partial data - ApiInterface implements Exportable via its own fetch({signal}) - computeForcedExportFilter enforces non-global-admin scope (resided-in abodes + co-resident users, intersected with apikey restrict_*); GET /export intersects it with the caller's filter and wires an AbortController to the response socket - inspectExportStream reports kinds/counts from any stream without a db - abode-export / abode-import / abode-inspect CLIs (import is sqlite-only) - Secrets are not exported: imported users default to '#unset' passwords and apikeys are re-minted a token (ClientApikey view round-trips exactly) - test/tools/export-import.test.ts: round-trip, filter narrowing, forced-scope, export/import cancellation, in-process Koa endpoint, inspect Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 22:29:03 +00:00
codingetandCodex	31d4636dde	ci: add pull request quality gates ... Co-Authored-By: gpt-5.6-terra <noreply@openai.com>	2026-07-22 21:50:29 +00:00
codingetandClaude	dd8d31633f	feat: implement notes CRUD for SQLite and API backends ... Fills in all 7 previously-unimplemented note methods in SqliteInterface and ApiInterface, adds cast/query helpers for notes, and fixes the apirouter (missing updatenote validator, two /user/ → /users/ typos that were also bypassing auth middleware). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-20 02:33:37 +02:00
codingetandClaude	73c4b169c5	fix(auth): invalidate session server-side on logout, not just the cookie ... /auth/logout previously only cleared the client's cookie, leaving the session token valid in the sessions table — a stolen cookie captured before logout would still work afterwards. Add BackendDbInterface#deleteSession (implemented in SqliteInterface) and call it from the logout route using the session token from the cookie. Caught by the new auth-http.test.ts integration test, updated to assert the session is actually invalidated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-02 01:43:50 +00:00
codinget	3b9a6bc85c	feat: initial commit	2026-06-29 23:07:14 +00:00