| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
| |
change
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The detail panel called useTimeline() with no args, creating a separate
cache from the entry list's filtered query. Entries not in the first 50
of the global timeline had isSaved/isRead stuck at false.
|
| | |
|
| |
|
|
|
|
| |
Reverts the DB-level filter so individual hidden feeds still show
their own unread badge. Filters client-side in totalUnreadCount
and getFolderUnreadCount instead.
|
| |
|
|
|
| |
Themed scrollbars (default) use 6px thin bars matching the existing
colour palette. Synced to body via class toggle in Providers.
|
| | |
|
| |
|
|
|
|
| |
Adds a persisted appearance setting (disabled by default) that
partitions the entry list into unread-first, preserving original
order within each group.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
Add folders & custom feeds, muted phrases, full-text search,
customisable interface, installable PWA, and API & webhooks cards.
|
| | |
|
| |
|
|
|
|
|
| |
Service worker now only caches Supabase REST responses when the user's
tier allows offline reading. Client syncs tier status to SW via
postMessage after profile loads. Free users see a descriptive offline
banner instead of stale cached data.
|
| |
|
|
|
|
|
| |
New appearance setting (disabled by default) that silently refreshes
the entry list when new entries arrive, provided the user is scrolled
to the top. Falls back to notification when scrolled down to avoid
disrupting reading position.
|
| |
|
|
|
|
|
|
|
| |
- Mark all as read now scopes to current feed/folder instead of all
- Added undo button to mark-all-read toast notification
- Share notes can be toggled between public and private visibility
- Track share view count and display in shares list
- Activity-based share expiry: views reset the expiry timer
- Fixed notification panel z-index layering behind content area
|
| |
|
|
|
|
| |
Stop SW from intercepting cross-origin image requests (favicons,
remote entry images) which caused no-response errors in production.
Add Supabase env vars to CI build step.
|
| |
|
|
|
|
| |
Migrate existing display names from user_profiles to auth.users
user_metadata. Drop display_name column from user_profiles. Frontend
now reads from auth user metadata and updates via auth.updateUser().
|
| |
|
|
|
|
|
|
|
| |
Disable no-img-element (RSS reader needs <img> for arbitrary external
URLs). Remove unused variables/imports and redundant getUser() calls
guarded by middleware. Fix exhaustive-deps by adding stable deps,
wrapping handlers in useCallback, and suppressing intentional omissions.
Fix ref cleanup in use-realtime-entries. Allow triple-slash TS reference
directives in no-comments rule.
|
| |
|
|
|
|
| |
Webhook routes switched from admin client to server client (RLS).
Added DNS-resolution SSRF protection for webhook URLs with private IP
blocking. Added tier limit parity check script.
|
| |
|
|
|
|
|
|
|
|
|
| |
P0: add missing 'developer' case to check_custom_feed_limit trigger,
scope user_entry_states join to authenticated user in API v1 entries,
replace in-memory rate limiting with Supabase-backed check_rate_limit RPC.
P1: fix all 9 ESLint errors — useSyncExternalStore for useIsMobile,
restructure WebhookSection to avoid set-state-in-effect, move ref
mutations into useEffect, replace <a> with <Link> on shared page,
ignore generated public/sw.js in eslint config.
|
| |
|
|
|
|
| |
- Add missing 'developer' case to check_custom_feed_limit trigger (was falling through to else 1)
- Scope user_entry_states join to authenticated user in /api/v1/entries (admin client bypasses RLS)
- Replace in-memory rate limiting with Supabase-backed solution (UNLOGGED table + check_rate_limit RPC + pg_cron cleanup)
|
| |
|
|
|
|
|
| |
Paused mutations (read/save toggles) are now persisted to IndexedDB
and automatically resumed on reconnection or page reload via TanStack
Query's offlineFirst networkMode. Service worker caches images with
CacheFirst strategy (500 entries, 7-day expiry) for offline reading.
|
| |
|
|
|
|
|
| |
Prefetch content_html for the first 10 timeline entries in the
background so they are available offline without needing to click
each one. Add NetworkFirst runtime caching in service worker for
Supabase REST GET requests (24h expiry, 200 entry limit).
|
| |
|
|
|
|
| |
Persist React Query cache to IndexedDB via idb-keyval so timeline,
entry details, subscriptions, and other read data survive page reloads
and brief offline periods. Add network status banner in reader layout.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Move highlight and sharing limits from feature cards to pricing table,
reword keyboard shortcuts card to highlight mobile support, and correct
real-time updates description.
|
| |
|
|
|
|
| |
Apply sanitizeEntryContent() to dangerouslySetInnerHTML in the
interactive demo component. Content comes from the database and
should be sanitized before rendering on the public marketing page.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Add rate limiting to /api/share (30/min), /api/export (5/hr),
/api/account/data (3/day)
- Add client-side 30s throttle to forgot-password form
- Remove immediate tier upgrade on plan change; let invoice.paid
webhook handle tier promotion to prevent free upgrades on payment
failure
- Add SSRF validation to webhook URLs: block localhost, private IPs,
link-local, and metadata endpoints
- Log Stripe webhook signature verification errors instead of
swallowing silently
- Mask webhook secret in GET response (show first/last 4 chars only)
- Add error logging to API key last_used_at update
- Remove internal error message leaking from checkout session route
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Replace unlimited history claim with honest 90-day retention for
paid tiers. Timeline and search RPCs now filter by tier-appropriate
retention window.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|