# Prompt Log ## 2026-08-24 1. I want to build a firefox plugin as specified in the REQUIREMENTS.md file. 2. I want this written in python where possible. 3. Start implementation. 4. Make the frontend page and the Docker setup. 5. Continue. 6. go. 7. continue. 8. Continue. 9. Create a folder called VIBE and log our chat and promts. Previous and future. 10. implement next step. 11. continue implementation 12. Fix the Starlette/httpx deprecation by using an alternative 13. Clean up and create a README that includes full install instructions 14. Review Docker setup and configuration 15. Make sure all configurateion can be set using a .env file with docker 16. Execute all TODOs 17. Add authenticated admin/user configuration 18. Make sure the link-log page is responsive 19. next 20. Make the layout modern based on catpuccino mocha theme 21. docker compose up fails with Jinja2 errors 22. put the avatar and the username on the top right hand side, and wrap all other text around it. 23. add a login button on the top right of the page 24. add a link to the administrator page to the user configuration for users that have admin privilige 25. add the ability to add and remove users to the admin interface 26. Only show the add user interface when logged in as admin and only show 'Administrator sign-in required' when an administrator is not signed in. Also add a checkbox to users in the admin to assign admin rights. 27. /admin shows 'sign out' while the users has been signed out. 28. Show a login button when nobody is logged in for /admin 29. The signin and signout button are not still not visible 30. It seems that the session is not maintained. I want Login buttons when a user has logged in and logout buttons when a user has logged out. If an authenticated user tries to load the admin page without authorization it should say that the user has no authorization 31. When a logged in user gets to the profile page their username should be printed - it is inmutable. Available defaults should prepopulte the fields. 32. The username doesn't load. The firefox console reports: Uncaught SyntaxError: redeclaration of const logoutButton 33. Check the whole authentication flow as it seems broken. 34. In the admin interface allow to toggle administrative rights for users. But always enforce there to be at least one user with admin rights 35. remove default for bio and email in the profile page 36. Don't use an avatar URL but allow the user to upload an avatar 37. Show the avatar with all posts 38. Show the avatar with each entry on the home page. On the specific // page don't show the avatar and user name with each entry 39. For the user filter create a dropdown of all users that are available on the server 40. If I select a user filter I want the appropriate page to be opened (e.g. /user/ for user of / -home- for all-users) 41. git commit the whole lot 42. version the sql schema and make sure it can be upgraded in the future. 43. allow editing of individual links - add a edit button for the links owned by the authenticated user - otherwise do not show a link 44. Add authenticated link editing 45. Expose ownership if feed data 46. Render edit action for owned links 47. On every page, when a user has authenticated show its avatar and name in the header next to a sign out putton. 48. execute next todo 49. execute final todo (nummer 3) 50. Pressing signout (on the home page) does not log the user out 51. Instead of the buttons on the top of the page create a 'hamburger' dropdown menu. The menu items are sign in, profile, admin, and sign out with authenticated visibility rules. 52. The menu items on the dropdown render behind
53. The menu should not show the profile, admin and signout items when nobody is authenticated. 54. Add one entry on top of the hamburger menu 'home' that always directs to the home page. 55. where the hamburger menu shows the avatar and username, replace by username only and link to the /user/ page 56. Change both the plugin and the backed to allow a logged link to be tagged witn zero or more tags (10 max). In the pluggin tags can be selected from existing tags and new ones can be created. Add the ability to sort on tags on the front page. 57. The seed list is: #Internet #Cybersecurity #Fediverse #Food #Photography #Music #AI 58. The seed list is: #Internet, #Cybersecurity, #Fediverse, #Food, #Photography, #Music, #AI 59. On the home page allow filtering on tags 60. when editing lables I want to be able to selec multiple tags or add one myself. 61. Make the tags filtering case incensitive (but maintain case of tags) 62. Display the date as "2026 June 18 - 20:22" 63. Create a page where users can add, delete, or edit labels - Labels can be edited and deleted by the same user that created them. The administrator can delete any label. 64. The profile page shows in red: "can't access property \"classList\", document.querySelector(...) is null" 65. The post prefix is now 'From my #LinkLog: "' make that 'From my #LinkLog: ' 66. Use the logo.svg in both the plugin as well as on the web page 67. use the logo as the logo on the dropdown for firefox extensions but put it on a dark background 68. Make sure that the logo is used in the toolbar 69. For the logo in the toolbar make the background dark 70. Make sure the addon conforms to Firefox guidelines 71. Create a make file that will regenerate the logo and icon files from LinkLog.svg 72. Make sure the addon conforms to Firefox guidelines 73. How come when te container starts after docker compose down -v the database is still populated with old links 74. Refine the Plugins Settings page. When the user is logged in it shows all " logged in at " and a sign-out button. If the user is not logged in it shows the form as is now. 75. On the plugin, next to the logo, create a link of the form: [LinkLog](https:///) 76. Use the Asset Font from google foundry as font for the LinkLog text 77. Create an about page and add an entry in the hamburger menu. The about page explains what the linklog does 78. On the bottom of all files add a copyright statement (Olaf Kolkman) and a link to the git.kolkman.org/LinkLog repository in small print 79. the link in the site footer must be underlined and in the same color as the other text 80. Add copyright sign and 2026 to the copyright notices 81. in the footer make the link the same color as the mother text, when clicked use a tint from the Catpuccin theme 82. Add a GNU License file 83. Add a copyright statement to source files refer to GNU license 84. Add the version to the name of the resulting xpi 85. Set the version number of the backend to 0.1.0 86. Add the creation of an xpi bundle for the webextention to the Makefile 87. Correct: A signed XPI will be generated manually and checked into the repository under XPI/signed 88. The "data_collection_permissions" property is missing from the plugin 89. Validate the XPI during the make process of the unsigned xpi 90. pressing remove still does not remove a user. 91. Trying to remove user alice: Could not remove alice: Internal Server Error 92. create a gitea action that is ran every time main is updated and that creates a docker image tagged development 93. Use an access token to publish to registry, not username and password 94. Add SMTP capabilities to the backend. Use it to validate the email addresses using a validation link in mail 95. Do not configure default users at bootstrap. Instead present a configuration page (only present if no administrator is configured). The configuration page asks for the admin users credetials and allows to configure the SMTP settings and sends a test mail after configuration 96. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent." 97. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down. 98. when running the initial config use the defaults from the .env file when available 99. Use oauth to register with the mastodon account and obtain access to post 100. Allow user to enter the mastodon server to authenticate to 101. Clicking authenticate with this server (social.secret-wg.org) generates 502 error 102. Log the unlogged chat and promt in the VIBE directory 103. when password is mistyped send a password reset link 104. when running the initial config use the defaults from the .env file when available 105. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent." 106. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down. 107. Use oauth to register with the mastodon account and obtain access to post 108. Allow user to enter the mastodon server to authenticate to 109. Log the unlogged chat and promt in the VIBE directory 110. Continue to log prompts and chats in VIBE 111. use VIVE that is in the current directory 112. Posting to mastodon seems to fail, try to fix, add debug logging 113. LINKLOG_PUBLIC_URL and TRAEFIK_HOST are the same and can be merged. (use LINKLOG_PUBLIC_URL), fix docker-compose to use said variable 114. Format mastodon posts like From my #LinkLog: Title, optional comment, and from: URL 115. Only print the 'from' line if there is no title. Put the title directly behind the colon, and put all tags on the last line. 116. In the frontend do not show edit buttons on the home page even when a user is logged in. On the // page show the edit button on the right of the entry. Also add a delete button. 117. Put the buttons on the right hand side of the link item, make the buttons smaller and same color scheme 118. Put the mastodon button on the lower right corner of the log entry 119. Make sure that the makefile also rebuilds XPI if any of its source files are changed 120. Change that location to be immediately below the edit and delete button 121. When the user is authorized and on its // page show a Mastodon post button with logo; after posting keep it functional but change its color. 122. Continue to log interactions to the VIBE directory. 123. On the home page, when clicking on the avatar or the user, show the profile information. 124. Localize the firefox plugin. 125. Create a spanish, german, french and dutch locale. 126. On the admin page add the SMTP settings (with the validation button). 127. Populate the SMTP fields with the current values except for the password. Send the testmail to the currently authenticated admin user. Only use updated fields when testing. Use the same logic as in the configuration page to restrict endless testing. 128. Report any errors that may occur from the SMTP module to the user. 129. In the admin screen allow to select multiple themes for the backend. Create at least one plain day and one night theme, and add in all catpuccin themes for good measure. 130. For the day and latte themes the contrast on the link items is too low. 131. Add 3 other of the most popular themes. 132. Show the tags in the linklog on the bottom left, move the date to the bottom right - horizontally align the tags with the date. 133. Continue todos. 134. Do not show 'no comment provided' but leave empty when no comment has been provided. 135. Decrease the space between link-log items. 136. Perform the next items on the todo list. 137. Correct: move the sort and filter toolbar underneath the theme and menu, in the header, on the home page and on the pages. 138. Run frontend and style checks. 139. Keep the sort and filter bar left of the logo and pack it snug against the menu and theme selector. 140. Correction: the feed header should have the sort and filter bar to the right of the LinkLog logo, compact and underneath the theme selector and menu. 141. When a log entry is deleted then all mastodon posts are deleted too. 142. Don't forget to update the plugin to work with OTP. 143. When the user is not logged in then the plugin should just display no form fields but warn the user that they have to log in with a link to settings. 144. Remove DEFAULT_BACKEND setting in the plugin. 145. Change the title of the field "One-time password" to "One-time password (when configured)". 146. The plugin settings still show 'emailLabel'; make that 'email' as title for the email field. 147. When a URL with the same title is already in the database, warn the user, allow comment and hashtag changes, and retrigger plugins such as Mastodon reposting. 148. Display any errors that occur during posting. 149. When the plugin is activated and the link already exists, show "This link already exists. Comment and tags can be updated, and by submitting publishing will be retriggered." 150. When pressing save link the plugin should display "Link saved to " and hide all other information. It should only refresh when the plugin is opened again 151. Remove any leading and trailing spaces when entering fields in the settings page of the plugin. 152. Do a full security audit document in what you have done in detail in Security-audit.md 153. Address issue 1. and improve password storage 154. The login page should ask for OTP password 155. For the new password in the user setting add a validation field to make sure they are the same before submitting 156. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes 157. Make sure the web plugin follows same logic 158. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings 159. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes 160. Make sure the web plugin follows same logic 161. In the plugin emailLabel should read: Email 162. Allow addition of secondary or tertiary email addresses; validate them before authentication and support profile status/resend controls with holdback. 163. Enable the user to change primary email address and remove the original one while maintaining access and rights. 164. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5. 165. Make sure an email can only be selected when it has been validated. 166. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary. 167. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary. 168. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage 169. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects 170. Implement SA-005: login endpoint lacks rate limiting and lockout 171. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects. 172. When the user is logged in the webplugin should not display "Please sign in to use LinkLog." 173. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings 174. The plugin still does not behave as expected. It still shows that the user should sign in. 175. In the popup show that the user has logged in. 176. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage 177. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out. 178. The authenticated session text and sign-in block are still shown together. 179. Use the VIBE directory to log interactions. 180. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab. 181. Continue to document every prompt and chat in the VIBE directory. 182. Continue SA-006: store session credentials in the narrowest available extension storage, minimize token lifetime, support refresh-token rotation, and clear all session material on logout or token invalidation. 183. Also allow an admin to reset (disable) OTP for any user. 183. Fix SA-009: TOTP enrollment has no recovery codes or reset workflow. 183. Address SA-007 and use linklog.example.com as the default LINKLOG_PUBLIC_URL. 184. Run full backend and frontend test suites. 185. Solve SA-010: Avatar validation trusts the client MIME type. 186. Fix SA-015: Some destructive and administrative operations lack audit logging. 187. Format sent mail in the website style and include the logo. 188. Set the email logo to 120px wide and center it at the top. 189. Make the email logo 50px by 50px, place it top-left, and put "Hello" to its right in the Asset font. 190. Replace the email greeting with "Hello a message from ", linking the hostname to the LinkLog server. 191. Put the email header text to the right of the logo, align it at the top, and add a comma after Hello. 192. Put the email greeting in a separate top-aligned cell to the right of the logo. 193. Reduce the email greeting font size somewhat. 194. Replace LINKLOG_TOKEN_EXPIRY_DAYS with LINKLOG_TOKEN_EXPIRY_MINUTES, add LINKLOG_REFRESH_TOKEN_EXPIRY_DAYS to production Compose, and add a CI configuration consistency test. 195. Perform a new security audit overwriting Security-audit.md with new and remaining issues. 195. Update SA-012 and README for the implemented refresh-token lifecycle, revocation behavior, and refresh endpoint. 196. Remedy SA-001: migrate logout from JSON token transport to the Authorization bearer header. 197. Implement SA-002: replace raw infrastructure errors with redacted server-side logging, request IDs, and stable public reference messages. 198. Implement SA-005: reject missing/default/weak production secrets at startup and validate the Fernet encryption key, with configuration tests. 199. Fix Firefox manifest compatibility warnings by aligning the minimum version with data collection permissions and session storage support. 200. Add a Plugin section to the About page with a download link to the signed XPI file. 201. Below the Save profile button, add a link to download the signed plugin if it has not been downloaded yet. 202. Check the modified pages for the correct versioned signed XPI link. 203. When posting to Mastodon, add an empty line between "From my #LinkLog:" and the title. ## Future entries Append each new user prompt here with its date and preserve the chronological order.