Reject non-http(s) URL schemes (javascript:, data:, etc.) in both
NewRoaster::normalize() and new UpdateRoaster::normalize(). The HTML
input type="url" provides browser-side validation, but the API path
had no server-side check.
GearCategory is a Rust enum so this was not exploitable, but the
format!() pattern is a code smell. Use a match returning &'static str
literals instead for consistency with the rest of the parameterised
query codebase.
- Await session DB insert before setting cookie, preventing orphaned sessions
- Invert cookie Secure default: now on by default, opt out via
BREWLOG_INSECURE_COOKIES=true for local HTTP development
- Add Content-Security-Policy, X-Frame-Options, X-Content-Type-Options,
Referrer-Policy, and Strict-Transport-Security response headers
- Set explicit 5 MB request body size limit via RequestBodyLimitLayer
- Enable tower-http "limit" and "set-header" features
Only persist theme to localStorage when the user's choice differs from
the OS preference. Clear it when they match so the prefers-color-scheme
listener remains active and automatically tracks system theme changes.
- Add brewlog-container package using dockerTools.buildImage
- Include cacert for TLS with /etc/ssl/certs and /bin linked
- Run as uid/gid 1000 with database at /data/brewlog.db
- Document Docker usage in README
- Create light (orange-700) and dark (orange-600) coffee cup SVG favicons
- Add explicit routes for both SVG variants
- Set correct favicon on initial load before body renders
- Swap favicon href on manual theme toggle
- Listen for OS prefers-color-scheme changes when no manual override set
Add view-layer mapping that categorises tasting notes into 9 colour
families (floral, fruity, citrus, sweet, nutty, spice, roasted, sour,
vegetal) based on the SCA Coffee Tasting Wheel. Matching uses
case-insensitive exact lookup against ~90 known terms, then substring
fallback, with pill-muted as the default for unrecognised notes.
- Add tasting_notes module with NoteCategory enum and categorize()
- Add 9 pill CSS variants with light and dark mode support
- Update roast list and timeline templates to render coloured pills
- Add used_percent field to BagView computed from amount/remaining
- Display accent-colored progress bar on homepage bag cards
- Replace Open pill with progress bar in bag data table (desktop and mobile)
- Merge Weight column into Status column showing remaining/total
- Add full-width progress bar to mobile card view for open bags
- Sort Status column by remaining grams (closed bags treated as 10000g)
- Hide Finished field on mobile for open bags
- Use small-caps typography for remaining text labels
- Add spacious flat table CSS for desktop (transparent card wrapper,
lighter dividers, visible hover, larger cell padding)
- Split roaster/cafe columns into separate Country and City columns
with sortable headers
- Split cup Roast/Roaster into separate desktop columns with city
sort support (full-stack: domain, repo, view, template)
- Add sortable Status column to bags with colored pills (green Open,
amber Closed) and remaining weight subtext
- Style bag Finished column as date-only (NaiveDate) and Weight
column with smaller text
- Show status pill next to mobile bag card actions menu
- Add city to cups mobile card view
- Use middle dot separator for brew recipe weight/volume
- Add tasting notes pills to roast list, brew notes to brew list
- Fix build.rs to use rerun-if-changed for CSS and templates
- Add `define_cli_auth_test!` macro for authentication-required tests
- Add `define_cli_list_test!` macro for unauthenticated list tests
- Replace 18 auth tests and 5 list tests with macro invocations
- Add `create_entity_cli()` generic, convert per-entity helpers to
thin wrappers
- Move `create_bag` and `create_gear` from brews_cli.rs to helpers.rs
- Remove bordered card wrapper from table sections on desktop
- Strip thead background, rely on typography for header distinction
- Increase cell vertical padding from 0.75rem to 1rem
- Add white row backgrounds with explicit horizontal borders
- Add accent-tinted hover with left bar indicator
- Float pagination below table as un-bordered footer
- Shrink pagination prev/next to compact card-style buttons
Replace CLI test child process with in-process server on a background
thread, eliminating orphan processes after test runs. Simplify server
test helpers to use AppState::from_database() instead of manual repo
construction.
- Remove sqlite/postgres feature flags from Cargo.toml
- Replace "any" sqlx feature with direct "sqlite" feature
- Remove all #[cfg] conditional compilation from database.rs
- Update README.md and CLAUDE.md to reflect SQLite-only support
Consolidate from ~250 lines to ~130, focusing on intro, quick start,
configuration reference, contributing, and license. Replace build-from-source
with cargo install instructions.
- Reorganise from single mega-section into layer-based structure
(Backend, Datastar/Frontend, Design System, Tables/Lists)
- Promote 8 critical gotchas into dedicated top-level section
- Deduplicate signal naming (3x), route patterns (3x), form patterns
- Replace code examples with macro reference table pointing to source
- Trim design token table to name→class mapping (reference input.css)
- Consolidate error/logging rules into single section
- All patterns, rules, and conventions preserved
- Add page header, card-wrapped sections, and surface-alt item cards
to the account page for visual consistency with the rest of the app
- Style CLI callback page with centered icon + heading layout matching
the login page, with dark-mode-safe colors
- Add dark mode variants to all error/success alerts on account page
- Add check_circle icon for CLI callback success state
Remove all rerun-if-changed directives so Cargo runs the build
script unconditionally, ensuring tailwindcss always regenerates
styles.css without manual steps.
Replace the full-width inline menu with a compact right-aligned dropdown
that floats over page content. Adds click-outside-to-close via an
invisible backdrop, and uses z-50 to sit above timeline sticky headings.
- Replace database icon with squares (2x2 grid) for Data link
- Remove 5 unused icon macros: star, pen, login, sparkles, clipboard
- Add hover highlight (bg-surface-alt) to dropdown items
After AI extraction, check if the roaster and roast already exist by
slug. When matched, show compact summary cards instead of full edit
forms. Each card has a "Change" link to revert to the form if the
match is wrong.
- Add match_existing_entities() for slug-based roaster/roast lookup
- Return _matched-roaster-id and _matched-roast-id signals from extraction
- Add submit_existing_roast() path to skip creation when roast exists
- Dynamic submit buttons: Save Roaster & Roast / Save Roast / Open Bag
- Hidden inputs bound to signals handle all form submission cleanly
- Add initial-value attribute to searchable-select web component
- Update bag card Brew link to pass bag_id query parameter to add page
- Thread bag_id through route handler and template to pre-select the bag
Without AUTOINCREMENT, SQLite can reassign the highest deleted ROWID to
a new row. This is a data integrity bug: a deleted entity's ID could be
assigned to a completely different entity, breaking bookmarks, API
caches, and URL stability.
Remove inline signal reset chains before extraction (server already
returns all signals) and before reload (reload destroys signal store).
Change gear and bags default sort from Make/RoastDate to CreatedAt so
data tables show newest entries first.
Replace fetch/classList DOM manipulation with Datastar signals and @post.
Server now returns signal patches for Datastar requests while preserving
the JSON API for CLI usage.
The timeline line used `bg-border` but `--color-border` was missing from
the @theme block, so Tailwind never generated the utility class and the
line was invisible.
- Convert data.html search from manual fetch+debounce to Datastar @get
- Replace filterList() on checkin page with <searchable-select> component
- Convert account.html form show/hide from classList to data-show signals
- Rename _scanWaiting/_scanError to _extracting/_extractError for consistency
- Delete unused render_signals_fragment() and escape_html_attr() from support.rs
- Document Datastar vs JS guidelines in CLAUDE.md
- Add quick_notes_raw field to BrewView with comma-separated form values
- Include quick_notes hidden input in all three brew-again forms
(homepage, brew list desktop, brew list mobile)
Add dark: variants for the green success banner on the account page
so it doesn't appear overly bright against the dark background.
Also tidy .gitignore to catch all .db and .db-journal files.
No production instances exist, so safe to rewrite from scratch.
Drops columns that were added then removed (notes, password_hash,
cup rating), standardises timestamp format and primary key style,
and creates all tables in their final form without incremental
ALTER TABLE churn.
Replace ~268 hardcoded text-stone-* classes with theme-aware token
utilities (text-text, text-text-secondary, text-text-muted) across all
templates and JS components. Adjust dark mode token values to meet
WCAG AA contrast ratios on dark surfaces.
- Remove unused passkey_name from RegisterStartRequest (only used in RegisterFinishRequest)
- Rename AiUsageView fields from total_calls/total_tokens/total_cost to calls/tokens/cost
- Move quick notes pills into border-t footer row, left-aligned
- Show "No Notes" muted pill when brew has no quick notes
- Replace text "Brew Again" button with compact refresh icon button
- Footer now always visible (pills + optional brew-again action)
