This commit is contained in:
@@ -1022,3 +1022,9 @@ Appended this visible interaction to the project VIBE chat and prompt logs in th
|
||||
|
||||
### Assistant outcome
|
||||
Made popup state transitions defensive by synchronizing both `hidden` attributes and CSS classes. Non-authentication tag-loading errors no longer switch the popup to signed-out state; only a rejected session does. Added `display: none !important` guards for both authentication blocks.
|
||||
|
||||
### User
|
||||
Continue to document every prompt and chat in the VIBE directory.
|
||||
|
||||
### Assistant outcome
|
||||
Recorded this prompt and its outcome in `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md`. Future visible prompts and chat outcomes will continue to be appended there.
|
||||
|
||||
+96
-95
@@ -87,101 +87,102 @@
|
||||
83. Add a copyright statement to source files refer to GNU license
|
||||
84. Add the version to the name of the resulting xpi
|
||||
85. Set the version number of the backend to 0.1.0
|
||||
84. Add the creation of an xpi bundle for the webextention to the Makefile
|
||||
85. Correct: A signed XPI will be generated manually and checked into the repository under XPI/signed
|
||||
86. The "data_collection_permissions" property is missing from the plugin
|
||||
87. Validate the XPI during the make process of the unsigned xpi
|
||||
88. pressing remove still does not remove a user.
|
||||
89. Trying to remove user alice: Could not remove alice: Internal Server Error
|
||||
90. create a gitea action that is ran every time main is updated and that creates a docker image tagged development
|
||||
91. Use an access token to publish to registry, not username and password
|
||||
92. Add SMTP capabilities to the backend. Use it to validate the email addresses using a validation link in mail
|
||||
93. Do not configure default users at bootstrap. Instead present a configuration page (only present if no administrator is configured). The configuration page asks for the admin users credetials and allows to configure the SMTP settings and sends a test mail after configuration
|
||||
94. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
||||
95. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
||||
96. when running the initial config use the defaults from the .env file when available
|
||||
97. Use oauth to register with the mastodon account and obtain access to post
|
||||
98. Allow user to enter the mastodon server to authenticate to
|
||||
99. Clicking authenticate with this server (social.secret-wg.org) generates 502 error
|
||||
100. Log the unlogged chat and promt in the VIBE directory
|
||||
101. when password is mistyped send a password reset link
|
||||
102. when running the initial config use the defaults from the .env file when available
|
||||
103. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
||||
104. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
||||
105. Use oauth to register with the mastodon account and obtain access to post
|
||||
106. Allow user to enter the mastodon server to authenticate to
|
||||
107. Log the unlogged chat and promt in the VIBE directory
|
||||
108. Continue to log prompts and chats in VIBE
|
||||
109. use VIVE that is in the current directory
|
||||
110. Posting to mastodon seems to fail, try to fix, add debug logging
|
||||
111. LINKLOG_PUBLIC_URL and TRAEFIK_HOST are the same and can be merged. (use LINKLOG_PUBLIC_URL), fix docker-compose to use said variable
|
||||
112. Format mastodon posts like From my #LinkLog: Title, optional comment, and from: URL
|
||||
113. Only print the 'from' line if there is no title. Put the title directly behind the colon, and put all tags on the last line.
|
||||
114. In the frontend do not show edit buttons on the home page even when a user is logged in. On the /<user>/ page show the edit button on the right of the entry. Also add a delete button.
|
||||
115. Put the buttons on the right hand side of the link item, make the buttons smaller and same color scheme
|
||||
116. Put the mastodon button on the lower right corner of the log entry
|
||||
117. Make sure that the makefile also rebuilds XPI if any of its source files are changed
|
||||
117. Change that location to be immediately below the edit and delete button
|
||||
116. When the user is authorized and on its /<user>/ page show a Mastodon post button with logo; after posting keep it functional but change its color.
|
||||
117. Continue to log interactions to the VIBE directory.
|
||||
118. On the home page, when clicking on the avatar or the user, show the profile information.
|
||||
119. Localize the firefox plugin.
|
||||
120. Create a spanish, german, french and dutch locale.
|
||||
121. On the admin page add the SMTP settings (with the validation button).
|
||||
122. Populate the SMTP fields with the current values except for the password. Send the testmail to the currently authenticated admin user. Only use updated fields when testing. Use the same logic as in the configuration page to restrict endless testing.
|
||||
123. Report any errors that may occur from the SMTP module to the user.
|
||||
124. In the admin screen allow to select multiple themes for the backend. Create at least one plain day and one night theme, and add in all catpuccin themes for good measure.
|
||||
125. For the day and latte themes the contrast on the link items is too low.
|
||||
126. Add 3 other of the most popular themes.
|
||||
127. Show the tags in the linklog on the bottom left, move the date to the bottom right - horizontally align the tags with the date.
|
||||
128. Continue todos.
|
||||
129. Do not show 'no comment provided' but leave empty when no comment has been provided.
|
||||
130. Decrease the space between link-log items.
|
||||
131. Perform the next items on the todo list.
|
||||
132. Correct: move the sort and filter toolbar underneath the theme and menu, in the header, on the home page and on the <user> pages.
|
||||
133. Run frontend and style checks.
|
||||
134. Keep the sort and filter bar left of the logo and pack it snug against the menu and theme selector.
|
||||
135. Correction: the feed header should have the sort and filter bar to the right of the LinkLog logo, compact and underneath the theme selector and menu.
|
||||
136. When a log entry is deleted then all mastodon posts are deleted too.
|
||||
137. Don't forget to update the plugin to work with OTP.
|
||||
138. When the user is not logged in then the plugin should just display no form fields but warn the user that they have to log in with a link to settings.
|
||||
139. Remove DEFAULT_BACKEND setting in the plugin.
|
||||
140. Change the title of the field "One-time password" to "One-time password (when configured)".
|
||||
157. The plugin settings still show 'emailLabel'; make that 'email' as title for the email field.
|
||||
163. When a URL with the same title is already in the database, warn the user, allow comment and hashtag changes, and retrigger plugins such as Mastodon reposting.
|
||||
166. Display any errors that occur during posting.
|
||||
164. When the plugin is activated and the link already exists, show "This link already exists. Comment and tags can be updated, and by submitting publishing will be retriggered."
|
||||
165. When pressing save link the plugin should display "Link saved to <url of linklog server>" and hide all other information. It should only refresh when the plugin is opened again
|
||||
141. Remove any leading and trailing spaces when entering fields in the settings page of the plugin.
|
||||
142. Do a full security audit document in what you have done in detail in Security-audit.md
|
||||
143. Address issue 1. and improve password storage
|
||||
144. The login page should ask for OTP password
|
||||
145. For the new password in the user setting add a validation field to make sure they are the same before submitting
|
||||
146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
||||
147. Make sure the web plugin follows same logic
|
||||
154. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings
|
||||
146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
||||
147. Make sure the web plugin follows same logic
|
||||
148. In the plugin <span data-i18n="emailLabel">emailLabel</span> should read: <span data-i18n="emailLabel">Email</span>
|
||||
149. Allow addition of secondary or tertiary email addresses; validate them before authentication and support profile status/resend controls with holdback.
|
||||
150. Enable the user to change primary email address and remove the original one while maintaining access and rights.
|
||||
151. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5.
|
||||
152. Make sure an email can only be selected when it has been validated.
|
||||
153. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
|
||||
155. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
|
||||
166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
||||
167. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects
|
||||
168. Implement SA-005: login endpoint lacks rate limiting and lockout
|
||||
167. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects.
|
||||
158. When the user is logged in the webplugin should not display "Please sign in to use LinkLog."
|
||||
156. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings
|
||||
159. The plugin still does not behave as expected. It still shows that the user should sign in.
|
||||
160. In the popup show that the user has logged in.
|
||||
166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
||||
161. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
|
||||
162. The authenticated session text and sign-in block are still shown together.
|
||||
163. Use the VIBE directory to log interactions.
|
||||
164. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab.
|
||||
86. Add the creation of an xpi bundle for the webextention to the Makefile
|
||||
87. Correct: A signed XPI will be generated manually and checked into the repository under XPI/signed
|
||||
88. The "data_collection_permissions" property is missing from the plugin
|
||||
89. Validate the XPI during the make process of the unsigned xpi
|
||||
90. pressing remove still does not remove a user.
|
||||
91. Trying to remove user alice: Could not remove alice: Internal Server Error
|
||||
92. create a gitea action that is ran every time main is updated and that creates a docker image tagged development
|
||||
93. Use an access token to publish to registry, not username and password
|
||||
94. Add SMTP capabilities to the backend. Use it to validate the email addresses using a validation link in mail
|
||||
95. Do not configure default users at bootstrap. Instead present a configuration page (only present if no administrator is configured). The configuration page asks for the admin users credetials and allows to configure the SMTP settings and sends a test mail after configuration
|
||||
96. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
||||
97. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
||||
98. when running the initial config use the defaults from the .env file when available
|
||||
99. Use oauth to register with the mastodon account and obtain access to post
|
||||
100. Allow user to enter the mastodon server to authenticate to
|
||||
101. Clicking authenticate with this server (social.secret-wg.org) generates 502 error
|
||||
102. Log the unlogged chat and promt in the VIBE directory
|
||||
103. when password is mistyped send a password reset link
|
||||
104. when running the initial config use the defaults from the .env file when available
|
||||
105. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
||||
106. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
||||
107. Use oauth to register with the mastodon account and obtain access to post
|
||||
108. Allow user to enter the mastodon server to authenticate to
|
||||
109. Log the unlogged chat and promt in the VIBE directory
|
||||
110. Continue to log prompts and chats in VIBE
|
||||
111. use VIVE that is in the current directory
|
||||
112. Posting to mastodon seems to fail, try to fix, add debug logging
|
||||
113. LINKLOG_PUBLIC_URL and TRAEFIK_HOST are the same and can be merged. (use LINKLOG_PUBLIC_URL), fix docker-compose to use said variable
|
||||
114. Format mastodon posts like From my #LinkLog: Title, optional comment, and from: URL
|
||||
115. Only print the 'from' line if there is no title. Put the title directly behind the colon, and put all tags on the last line.
|
||||
116. In the frontend do not show edit buttons on the home page even when a user is logged in. On the /<user>/ page show the edit button on the right of the entry. Also add a delete button.
|
||||
117. Put the buttons on the right hand side of the link item, make the buttons smaller and same color scheme
|
||||
118. Put the mastodon button on the lower right corner of the log entry
|
||||
119. Make sure that the makefile also rebuilds XPI if any of its source files are changed
|
||||
120. Change that location to be immediately below the edit and delete button
|
||||
121. When the user is authorized and on its /<user>/ page show a Mastodon post button with logo; after posting keep it functional but change its color.
|
||||
122. Continue to log interactions to the VIBE directory.
|
||||
123. On the home page, when clicking on the avatar or the user, show the profile information.
|
||||
124. Localize the firefox plugin.
|
||||
125. Create a spanish, german, french and dutch locale.
|
||||
126. On the admin page add the SMTP settings (with the validation button).
|
||||
127. Populate the SMTP fields with the current values except for the password. Send the testmail to the currently authenticated admin user. Only use updated fields when testing. Use the same logic as in the configuration page to restrict endless testing.
|
||||
128. Report any errors that may occur from the SMTP module to the user.
|
||||
129. In the admin screen allow to select multiple themes for the backend. Create at least one plain day and one night theme, and add in all catpuccin themes for good measure.
|
||||
130. For the day and latte themes the contrast on the link items is too low.
|
||||
131. Add 3 other of the most popular themes.
|
||||
132. Show the tags in the linklog on the bottom left, move the date to the bottom right - horizontally align the tags with the date.
|
||||
133. Continue todos.
|
||||
134. Do not show 'no comment provided' but leave empty when no comment has been provided.
|
||||
135. Decrease the space between link-log items.
|
||||
136. Perform the next items on the todo list.
|
||||
137. Correct: move the sort and filter toolbar underneath the theme and menu, in the header, on the home page and on the <user> pages.
|
||||
138. Run frontend and style checks.
|
||||
139. Keep the sort and filter bar left of the logo and pack it snug against the menu and theme selector.
|
||||
140. Correction: the feed header should have the sort and filter bar to the right of the LinkLog logo, compact and underneath the theme selector and menu.
|
||||
141. When a log entry is deleted then all mastodon posts are deleted too.
|
||||
142. Don't forget to update the plugin to work with OTP.
|
||||
143. When the user is not logged in then the plugin should just display no form fields but warn the user that they have to log in with a link to settings.
|
||||
144. Remove DEFAULT_BACKEND setting in the plugin.
|
||||
145. Change the title of the field "One-time password" to "One-time password (when configured)".
|
||||
146. The plugin settings still show 'emailLabel'; make that 'email' as title for the email field.
|
||||
147. When a URL with the same title is already in the database, warn the user, allow comment and hashtag changes, and retrigger plugins such as Mastodon reposting.
|
||||
148. Display any errors that occur during posting.
|
||||
149. When the plugin is activated and the link already exists, show "This link already exists. Comment and tags can be updated, and by submitting publishing will be retriggered."
|
||||
150. When pressing save link the plugin should display "Link saved to <url of linklog server>" and hide all other information. It should only refresh when the plugin is opened again
|
||||
151. Remove any leading and trailing spaces when entering fields in the settings page of the plugin.
|
||||
152. Do a full security audit document in what you have done in detail in Security-audit.md
|
||||
153. Address issue 1. and improve password storage
|
||||
154. The login page should ask for OTP password
|
||||
155. For the new password in the user setting add a validation field to make sure they are the same before submitting
|
||||
156. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
||||
157. Make sure the web plugin follows same logic
|
||||
158. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings
|
||||
159. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
||||
160. Make sure the web plugin follows same logic
|
||||
161. In the plugin <span data-i18n="emailLabel">emailLabel</span> should read: <span data-i18n="emailLabel">Email</span>
|
||||
162. Allow addition of secondary or tertiary email addresses; validate them before authentication and support profile status/resend controls with holdback.
|
||||
163. Enable the user to change primary email address and remove the original one while maintaining access and rights.
|
||||
164. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5.
|
||||
165. Make sure an email can only be selected when it has been validated.
|
||||
166. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
|
||||
167. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
|
||||
168. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
||||
169. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects
|
||||
170. Implement SA-005: login endpoint lacks rate limiting and lockout
|
||||
171. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects.
|
||||
172. When the user is logged in the webplugin should not display "Please sign in to use LinkLog."
|
||||
173. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings
|
||||
174. The plugin still does not behave as expected. It still shows that the user should sign in.
|
||||
175. In the popup show that the user has logged in.
|
||||
176. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
||||
177. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
|
||||
178. The authenticated session text and sign-in block are still shown together.
|
||||
179. Use the VIBE directory to log interactions.
|
||||
180. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab.
|
||||
181. Continue to document every prompt and chat in the VIBE directory.
|
||||
|
||||
## Future entries
|
||||
|
||||
|
||||
Reference in New Issue
Block a user