prek is a standalone uv-installed binary, not provided by mise install.
When absent from PATH, `prek run -av` fails with a misleading
"failed to run cargo fmt -- --check" message. Add the `uv tool install
prek` step and a note clarifying the failure mode.
Add an authenticated POST /api/v1/invites endpoint that mints a
single-use, 7-day registration link after the first-user bootstrap.
Expose it via a new "Invite" section on the admin page and a
`brewlog invite create` CLI command.
The registration_tokens table, repository, and NewRegistrationToken
already supported additional tokens; this adds the authenticated
surfaces (session cookie or bearer token) to trigger creation.
Allow creating a brew when coffee_weight exceeds the bag's remaining
amount — remaining is clamped to 0 rather than returning a 409 error.
Brews against open bags with 0g remaining also succeed, keeping
remaining at 0. Only closed bags are rejected.
Add brewlog user/group (UID/GID 1000) to chiseled rootfs via
base-passwd_data slice and useradd. Set USER 1000:1000 in the
runtime stage. Requires a one-time remediation deploy (with
gosu + chown entrypoint) to fix existing volume permissions
before this can be used.
The Deploy workflow on main failed because .cargo/config.toml requires
the mold linker, but deploy.yml only installed lld. The earlier fix
commit only updated push.yml, missing deploy.yml.
Add mold to system deps (needed by .cargo/config.toml linker setting)
and explicitly install rustfmt/clippy components since mise-action
doesn't always install Rust components.
djlint corrupts Askama/Jinja templates and cannot be used safely.
Remove .djlintrc, install-py-deps task, and all djlint references
from prek.toml. Restore full README.md that was lost during rebase.
Replace snap-installed Chromium/chromedriver with Chrome for Testing
installed via npx @puppeteer/browsers. Binaries live in
$MISE_DATA_DIR/chrome-for-testing/ with version-agnostic path lookup.
Add install-e2e mise task and required apt packages to README and CI.
Remove treefmt and djlint from pre-commit hooks. djlint corrupted
Askama template syntax on first run. Use individual formatters
(cargo fmt, shfmt, oxfmt) directly instead. Update prek hooks
to use fmt-rs and fmt-sh separately.
Replace Nix flake with mise for toolchain management, treefmt for
formatting, prek for pre-commit hooks, and a Dockerfile for container
builds. Update CI workflows to use jdx/mise-action instead of Nix.
Add system dependency instructions to README.md and CLAUDE.md.
The finished_at field previously stored only a date, causing bag "finished"
timeline events to sort before same-day brews. Now stores a full datetime
and uses the actual close time for timeline ordering.
Replace tower-http RequestBodyLimitLayer with Axum's DefaultBodyLimit
for the global 5 MB request body cap. RequestBodyLimitLayer enforced a
hard limit that prevented per-route DefaultBodyLimit overrides (backup
restore at 50 MB, scan/image at 10 MB) from taking effect, causing
HTTP 413 on backup restore.
The webauthn-rs `start_passkey_registration` sets residentKey to
"discouraged", which iOS Safari respects strictly — creating
non-discoverable credentials that never appear in autofill. Desktop
password managers ignore this flag. Patch the creation challenge to
require resident keys so discoverable passkeys work on all platforms.
Replace rustPlatform.buildRustPackage with crane to split the Rust
compilation into a deps-only derivation (keyed on Cargo.lock) and a
source derivation. The deps derivation is cached in the Nix store
between CI runs, avoiding full recompilation on every deploy.
The formatter converted the register container from a div with onclick
to a semantic form with onsubmit, improving accessibility and enabling
native form submission behavior.
Enables password managers (1Password, iCloud Keychain) to offer passkey
suggestions via autofill on the login page, matching behavior of other
passkey-enabled websites.
Merge separate lint and test jobs into a single check job so clippy's
compilation artifacts are reused by tests. Add actions/cache for the
Cargo target directory and registry to enable incremental builds across
runs. Drop unnecessary fetch-depth: 0 from CI jobs.
Add background timeline rebuild task (mirroring stats cache pattern)
that refreshes denormalized timeline event snapshots when entities are
updated. Includes cascade logic so editing a roaster refreshes timeline
events for its roasts, bags, brews, and cups.
- Add update_by_entity/delete_by_entity/delete_all to TimelineEventRepository
- Add TimelineInvalidator with debounced background rebuild task
- Add invalidate() calls to all 7 entity update handlers
- Add delete_by_entity cleanup to define_delete_handler! macro
- Add gear_id filter to BrewFilter for cascade traversal
- Add `brewlog timeline rebuild` CLI command for full rebuild
- Add 5 integration tests for timeline sync behavior
Session cookie lacked a Max-Age attribute, making it ephemeral. Safari's
standalone PWA mode aggressively clears session cookies on app suspend,
causing frequent logouts. Set Max-Age to 30 days to match the server-side
session lifetime.
Address findings from the templates code review:
- Fix XSS in admin.html onclick handlers via data attributes
- Fix XSS in 5 edit page signal initializations via JSON serialization
- Fix register.html token exposure by moving to data attribute
- Add entity_icon, quick_notes_toggles, add_form_submit macros
- Replace hardcoded colors with design tokens (warning, error, success)
- Add warning design tokens to CSS theme
- Scope MutationObserver to main element
- Add defer to webauthn.js script tags
- Refactor login/register JS to arrow functions
- Guard lightbox script behind image_url check
- Fix else-if to elif in 5 templates
Convert single-argument from_domain() methods to impl From<T> for
consistency with the existing CafeView, RoasterView, and option view
patterns. Affected: BagView, BrewView, CupView, GearView,
GearDetailView, CafeDetailView, RoasterDetailView, TimelineEventView.
RoastView retains from_domain() since it takes extra parameters.
- Replace .iter().copied().cloned() with .into_iter() on str slices in
NearbyCafeView::from
- Remove unused _addr: SocketAddr parameter from run_callback_server
and its call site in tokens.rs
- Add parse_and_categorize() in tasting_notes.rs, replacing identical
split-trim-categorize pipelines in mod.rs, roasts.rs, and timeline.rs
- Add used_percent() in bags.rs, deduplicating the calculation in
BagView::from_domain and BagDetailView::from_parts
- Add format_datetime() in views/mod.rs, replacing 16 paired occurrences
of .format("%Y-%m-%d") / .format("%H:%M") across 7 view files
- Add build_origin_roaster_map() in views/mod.rs, replacing identical
map-entry building blocks in bags.rs, brews.rs, and roasts.rs detail views
The presentation layer was importing NearbyCafe directly from
infrastructure::foursquare, violating the dependency flow
(presentation -> application -> domain <- infrastructure). Introduce
NearbyCafeResult in domain:☕:nearby_cafes and update all
references.
Add define_sort_key! macro to listing.rs and convert all 8 SortKey
enum + impl blocks to use it, eliminating ~270 lines of repetitive
boilerplate across roasters, roasts, bags, brews, cups, cafes, gear,
and timeline.
Replace stringly-typed entity references with a compile-time-safe
EntityType enum throughout timeline events, images, and repository
operations. Also replace raw i64 fields in TimelineBrewData with
typed BagId/GearId wrappers.
