291 lines
25 KiB
Markdown
291 lines
25 KiB
Markdown
# Prompt Log
|
|
|
|
## 2026-08-24
|
|
|
|
1. I want to build a firefox plugin as specified in the REQUIREMENTS.md file.
|
|
2. I want this written in python where possible.
|
|
3. Start implementation.
|
|
4. Make the frontend page and the Docker setup.
|
|
5. Continue.
|
|
6. go.
|
|
7. continue.
|
|
8. Continue.
|
|
9. Create a folder called VIBE and log our chat and promts. Previous and future.
|
|
10. implement next step.
|
|
11. continue implementation
|
|
12. Fix the Starlette/httpx deprecation by using an alternative
|
|
13. Clean up and create a README that includes full install instructions
|
|
14. Review Docker setup and configuration
|
|
15. Make sure all configurateion can be set using a .env file with docker
|
|
16. Execute all TODOs
|
|
17. Add authenticated admin/user configuration
|
|
18. Make sure the link-log page is responsive
|
|
19. next
|
|
20. Make the layout modern based on catpuccino mocha theme
|
|
21. docker compose up fails with Jinja2 errors
|
|
22. put the avatar and the username on the top right hand side, and wrap all other text around it.
|
|
23. add a login button on the top right of the page
|
|
24. add a link to the administrator page to the user configuration for users that have admin privilige
|
|
25. add the ability to add and remove users to the admin interface
|
|
26. Only show the add user interface when logged in as admin and only show 'Administrator sign-in required' when an administrator is not signed in. Also add a checkbox to users in the admin to assign admin rights.
|
|
27. /admin shows 'sign out' while the users has been signed out.
|
|
28. Show a login button when nobody is logged in for /admin
|
|
29. The signin and signout button are not still not visible
|
|
30. It seems that the session is not maintained. I want Login buttons when a user has logged in and logout buttons when a user has logged out. If an authenticated user tries to load the admin page without authorization it should say that the user has no authorization
|
|
31. When a logged in user gets to the profile page their username should be printed - it is inmutable. Available defaults should prepopulte the fields.
|
|
32. The username doesn't load. The firefox console reports: Uncaught SyntaxError: redeclaration of const logoutButton
|
|
33. Check the whole authentication flow as it seems broken.
|
|
34. In the admin interface allow to toggle administrative rights for users. But always enforce there to be at least one user with admin rights
|
|
35. remove default for bio and email in the profile page
|
|
36. Don't use an avatar URL but allow the user to upload an avatar
|
|
37. Show the avatar with all posts
|
|
38. Show the avatar with each entry on the home page. On the specific /<user>/ page don't show the avatar and user name with each entry
|
|
39. For the user filter create a dropdown of all users that are available on the server
|
|
40. If I select a user filter I want the appropriate page to be opened (e.g. /user/ for user of / -home- for all-users)
|
|
41. git commit the whole lot
|
|
42. version the sql schema and make sure it can be upgraded in the future.
|
|
43. allow editing of individual links - add a edit button for the links owned by the authenticated user - otherwise do not show a link
|
|
44. Add authenticated link editing
|
|
45. Expose ownership if feed data
|
|
46. Render edit action for owned links
|
|
47. On every page, when a user has authenticated show its avatar and name in the header next to a sign out putton.
|
|
48. execute next todo
|
|
49. execute final todo (nummer 3)
|
|
50. Pressing signout (on the home page) does not log the user out
|
|
51. Instead of the buttons on the top of the page create a 'hamburger' dropdown menu. The menu items are sign in, profile, admin, and sign out with authenticated visibility rules.
|
|
52. The menu items on the dropdown render behind <main class='container'>
|
|
53. The menu should not show the profile, admin and signout items when nobody is authenticated.
|
|
54. Add one entry on top of the hamburger menu 'home' that always directs to the home page.
|
|
55. where the hamburger menu shows the avatar and username, replace by username only and link to the /user/ page
|
|
56. Change both the plugin and the backed to allow a logged link to be tagged witn zero or more tags (10 max). In the pluggin tags can be selected from existing tags and new ones can be created. Add the ability to sort on tags on the front page.
|
|
57. The seed list is: #Internet #Cybersecurity #Fediverse #Food #Photography #Music #AI
|
|
58. The seed list is: #Internet, #Cybersecurity, #Fediverse, #Food, #Photography, #Music, #AI
|
|
59. On the home page allow filtering on tags
|
|
60. when editing lables I want to be able to selec multiple tags or add one myself.
|
|
61. Make the tags filtering case incensitive (but maintain case of tags)
|
|
62. Display the date as "2026 June 18 - 20:22"
|
|
63. Create a page where users can add, delete, or edit labels - Labels can be edited and deleted by the same user that created them. The administrator can delete any label.
|
|
64. The profile page shows in red: "can't access property \"classList\", document.querySelector(...) is null"
|
|
65. The post prefix is now 'From my #LinkLog: "' make that 'From my #LinkLog: '
|
|
66. Use the logo.svg in both the plugin as well as on the web page
|
|
67. use the logo as the logo on the dropdown for firefox extensions but put it on a dark background
|
|
68. Make sure that the logo is used in the toolbar
|
|
69. For the logo in the toolbar make the background dark
|
|
70. Make sure the addon conforms to Firefox guidelines
|
|
71. Create a make file that will regenerate the logo and icon files from LinkLog.svg
|
|
72. Make sure the addon conforms to Firefox guidelines
|
|
73. How come when te container starts after docker compose down -v the database is still populated with old links
|
|
74. Refine the Plugins Settings page. When the user is logged in it shows all "<user> logged in at <url>" and a sign-out button. If the user is not logged in it shows the form as is now.
|
|
75. On the plugin, next to the logo, create a link of the form: [LinkLog](https://<host>/<user>)
|
|
76. Use the Asset Font from google foundry as font for the LinkLog text
|
|
77. Create an about page and add an entry in the hamburger menu. The about page explains what the linklog does
|
|
78. On the bottom of all files add a copyright statement (Olaf Kolkman) and a link to the git.kolkman.org/LinkLog repository in small print
|
|
79. the link in the site footer must be underlined and in the same color as the other text
|
|
80. Add copyright sign and 2026 to the copyright notices
|
|
81. in the footer make the link the same color as the mother text, when clicked use a tint from the Catpuccin theme
|
|
82. Add a GNU License file
|
|
83. Add a copyright statement to source files refer to GNU license
|
|
84. Add the version to the name of the resulting xpi
|
|
85. Set the version number of the backend to 0.1.0
|
|
86. Add the creation of an xpi bundle for the webextention to the Makefile
|
|
87. Correct: A signed XPI will be generated manually and checked into the repository under XPI/signed
|
|
88. The "data_collection_permissions" property is missing from the plugin
|
|
89. Validate the XPI during the make process of the unsigned xpi
|
|
90. pressing remove still does not remove a user.
|
|
91. Trying to remove user alice: Could not remove alice: Internal Server Error
|
|
92. create a gitea action that is ran every time main is updated and that creates a docker image tagged development
|
|
93. Use an access token to publish to registry, not username and password
|
|
94. Add SMTP capabilities to the backend. Use it to validate the email addresses using a validation link in mail
|
|
95. Do not configure default users at bootstrap. Instead present a configuration page (only present if no administrator is configured). The configuration page asks for the admin users credetials and allows to configure the SMTP settings and sends a test mail after configuration
|
|
96. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
|
97. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
|
98. when running the initial config use the defaults from the .env file when available
|
|
99. Use oauth to register with the mastodon account and obtain access to post
|
|
100. Allow user to enter the mastodon server to authenticate to
|
|
101. Clicking authenticate with this server (social.secret-wg.org) generates 502 error
|
|
102. Log the unlogged chat and promt in the VIBE directory
|
|
103. when password is mistyped send a password reset link
|
|
104. when running the initial config use the defaults from the .env file when available
|
|
105. After saving the configuration - add link to home page together with "LinkLog is configured and the SMTP test mail was sent."
|
|
106. In the confiuration seperate the safe and send mail functionality. Allow the user to resend test mail 5 times with a 20 seconds interval and then hold back for 2 minutes - show a visual timer counting down.
|
|
107. Use oauth to register with the mastodon account and obtain access to post
|
|
108. Allow user to enter the mastodon server to authenticate to
|
|
109. Log the unlogged chat and promt in the VIBE directory
|
|
110. Continue to log prompts and chats in VIBE
|
|
111. use VIVE that is in the current directory
|
|
112. Posting to mastodon seems to fail, try to fix, add debug logging
|
|
113. LINKLOG_PUBLIC_URL and TRAEFIK_HOST are the same and can be merged. (use LINKLOG_PUBLIC_URL), fix docker-compose to use said variable
|
|
114. Format mastodon posts like From my #LinkLog: Title, optional comment, and from: URL
|
|
115. Only print the 'from' line if there is no title. Put the title directly behind the colon, and put all tags on the last line.
|
|
116. In the frontend do not show edit buttons on the home page even when a user is logged in. On the /<user>/ page show the edit button on the right of the entry. Also add a delete button.
|
|
117. Put the buttons on the right hand side of the link item, make the buttons smaller and same color scheme
|
|
118. Put the mastodon button on the lower right corner of the log entry
|
|
119. Make sure that the makefile also rebuilds XPI if any of its source files are changed
|
|
120. Change that location to be immediately below the edit and delete button
|
|
121. When the user is authorized and on its /<user>/ page show a Mastodon post button with logo; after posting keep it functional but change its color.
|
|
122. Continue to log interactions to the VIBE directory.
|
|
123. On the home page, when clicking on the avatar or the user, show the profile information.
|
|
124. Localize the firefox plugin.
|
|
125. Create a spanish, german, french and dutch locale.
|
|
126. On the admin page add the SMTP settings (with the validation button).
|
|
127. Populate the SMTP fields with the current values except for the password. Send the testmail to the currently authenticated admin user. Only use updated fields when testing. Use the same logic as in the configuration page to restrict endless testing.
|
|
128. Report any errors that may occur from the SMTP module to the user.
|
|
129. In the admin screen allow to select multiple themes for the backend. Create at least one plain day and one night theme, and add in all catpuccin themes for good measure.
|
|
130. For the day and latte themes the contrast on the link items is too low.
|
|
131. Add 3 other of the most popular themes.
|
|
132. Show the tags in the linklog on the bottom left, move the date to the bottom right - horizontally align the tags with the date.
|
|
133. Continue todos.
|
|
134. Do not show 'no comment provided' but leave empty when no comment has been provided.
|
|
135. Decrease the space between link-log items.
|
|
136. Perform the next items on the todo list.
|
|
137. Correct: move the sort and filter toolbar underneath the theme and menu, in the header, on the home page and on the <user> pages.
|
|
138. Run frontend and style checks.
|
|
139. Keep the sort and filter bar left of the logo and pack it snug against the menu and theme selector.
|
|
140. Correction: the feed header should have the sort and filter bar to the right of the LinkLog logo, compact and underneath the theme selector and menu.
|
|
141. When a log entry is deleted then all mastodon posts are deleted too.
|
|
142. Don't forget to update the plugin to work with OTP.
|
|
143. When the user is not logged in then the plugin should just display no form fields but warn the user that they have to log in with a link to settings.
|
|
144. Remove DEFAULT_BACKEND setting in the plugin.
|
|
145. Change the title of the field "One-time password" to "One-time password (when configured)".
|
|
146. The plugin settings still show 'emailLabel'; make that 'email' as title for the email field.
|
|
147. When a URL with the same title is already in the database, warn the user, allow comment and hashtag changes, and retrigger plugins such as Mastodon reposting.
|
|
148. Display any errors that occur during posting.
|
|
149. When the plugin is activated and the link already exists, show "This link already exists. Comment and tags can be updated, and by submitting publishing will be retriggered."
|
|
150. When pressing save link the plugin should display "Link saved to <url of linklog server>" and hide all other information. It should only refresh when the plugin is opened again
|
|
151. Remove any leading and trailing spaces when entering fields in the settings page of the plugin.
|
|
152. Do a full security audit document in what you have done in detail in Security-audit.md
|
|
153. Address issue 1. and improve password storage
|
|
154. The login page should ask for OTP password
|
|
155. For the new password in the user setting add a validation field to make sure they are the same before submitting
|
|
156. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
|
157. Make sure the web plugin follows same logic
|
|
158. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings
|
|
159. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
|
|
160. Make sure the web plugin follows same logic
|
|
161. In the plugin <span data-i18n="emailLabel">emailLabel</span> should read: <span data-i18n="emailLabel">Email</span>
|
|
162. Allow addition of secondary or tertiary email addresses; validate them before authentication and support profile status/resend controls with holdback.
|
|
163. Enable the user to change primary email address and remove the original one while maintaining access and rights.
|
|
164. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5.
|
|
165. Make sure an email can only be selected when it has been validated.
|
|
166. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
|
|
167. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
|
|
168. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
|
169. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects
|
|
170. Implement SA-005: login endpoint lacks rate limiting and lockout
|
|
171. Address SA-004 by validating Mastodon instances as HTTPS public hostnames, rejecting unsafe DNS/IP ranges including mapped IPv6, and blocking redirects.
|
|
172. When the user is logged in the webplugin should not display "Please sign in to use LinkLog."
|
|
173. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings
|
|
174. The plugin still does not behave as expected. It still shows that the user should sign in.
|
|
175. In the popup show that the user has logged in.
|
|
176. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
|
|
177. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
|
|
178. The authenticated session text and sign-in block are still shown together.
|
|
179. Use the VIBE directory to log interactions.
|
|
180. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab.
|
|
181. Continue to document every prompt and chat in the VIBE directory.
|
|
182. Continue SA-006: store session credentials in the narrowest available extension storage, minimize token lifetime, support refresh-token rotation, and clear all session material on logout or token invalidation.
|
|
183. Also allow an admin to reset (disable) OTP for any user.
|
|
183. Fix SA-009: TOTP enrollment has no recovery codes or reset workflow.
|
|
183. Address SA-007 and use linklog.example.com as the default LINKLOG_PUBLIC_URL.
|
|
184. Run full backend and frontend test suites.
|
|
185. Solve SA-010: Avatar validation trusts the client MIME type.
|
|
186. Fix SA-015: Some destructive and administrative operations lack audit logging.
|
|
187. Format sent mail in the website style and include the logo.
|
|
188. Set the email logo to 120px wide and center it at the top.
|
|
189. Make the email logo 50px by 50px, place it top-left, and put "Hello" to its right in the Asset font.
|
|
190. Replace the email greeting with "Hello a message from <public hostname>", linking the hostname to the LinkLog server.
|
|
191. Put the email header text to the right of the logo, align it at the top, and add a comma after Hello.
|
|
192. Put the email greeting in a separate top-aligned cell to the right of the logo.
|
|
193. Reduce the email greeting font size somewhat.
|
|
194. Replace LINKLOG_TOKEN_EXPIRY_DAYS with LINKLOG_TOKEN_EXPIRY_MINUTES, add LINKLOG_REFRESH_TOKEN_EXPIRY_DAYS to production Compose, and add a CI configuration consistency test.
|
|
195. Perform a new security audit overwriting Security-audit.md with new and remaining issues.
|
|
195. Update SA-012 and README for the implemented refresh-token lifecycle, revocation behavior, and refresh endpoint.
|
|
196. Remedy SA-001: migrate logout from JSON token transport to the Authorization bearer header.
|
|
197. Implement SA-002: replace raw infrastructure errors with redacted server-side logging, request IDs, and stable public reference messages.
|
|
198. Implement SA-005: reject missing/default/weak production secrets at startup and validate the Fernet encryption key, with configuration tests.
|
|
199. Fix Firefox manifest compatibility warnings by aligning the minimum version with data collection permissions and session storage support.
|
|
200. Add a Plugin section to the About page with a download link to the signed XPI file.
|
|
201. Below the Save profile button, add a link to download the signed plugin if it has not been downloaded yet.
|
|
202. Check the modified pages for the correct versioned signed XPI link.
|
|
203. When posting to Mastodon, add an empty line between "From my #LinkLog:" and the title.
|
|
204. Fix the release workflow because the runner's curl does not support `--fail-with-body`.
|
|
205. The release action should work differently. Rather than publishing the signed XPI and `updates.json`, it should produce a README describing the project, the latest Docker container version, and the latest signed XPI download URL with version number.
|
|
206. The tagged version will be the version of the backend. However, the version of the plugin is set manually, just use the most recent signed plugin version that lives in the signed repo.
|
|
207. Update the VIBE directory with what you have done.
|
|
|
|
## 2026-08-27
|
|
|
|
205. Maintain actions in the logs if VIBE.
|
|
206. Create a new page that can be reached by a button 'new entry' that only shows for authenticated users. The page, also only available to authenticated users allows users to enter a URL. When the URL is entered then the backend will scrape the title and allow to fill in all fields that are also available in the plugin.
|
|
207. The plugin finds a different title than the new-entry page, see e.g. https://docs.gitea.com/administration/config-cheat-sheet/
|
|
208. The plugin and the new entry page are still inconsistent.
|
|
209. For https://docs.gitea.com/administration/config-cheat-sheet/ I want the title to be Configuration Cheat Sheet | Gitea Documentation
|
|
210. After an entry is saved move to the /<user>/ page
|
|
211. Don't put new entry in the hamburger menu but present it as a seperate button next to the style selector
|
|
212. Put the new entry button left of the hamburger menu
|
|
213. The style selection should move into the hamburger menu - but in such a way that it becomes a submenu so that it doesn't clutter the menu structure
|
|
214. I want that the users is able to edit or delete labels(tags) that were created by the user itself. Also validate that any logged in user will only see the labels created by default, in the admin panel, and those by themselves, not by any other user. If this leads to an update in the database then if ownership of labels is unknown they may be grandfathered as-if created in the admin interface
|
|
215. Make sure that in the admin interface the labels can be edited
|
|
216. Make sure that the logs in VIBE are updated
|
|
217. Update Changelog too
|
|
218. In the Admin interface allow to minimize each settings pannel to only show its header, In order to easely navigate the page.
|
|
219. Make sure all setting-panels are collapsed when opening the page
|
|
218. In the Admin interface allow to minimize each settings pannel to only show its header, In order to easely navigate the page.
|
|
219. Give the header of each setting-panel a somewhat differing color.
|
|
220. Change the background of the header too.
|
|
221. Apply exactly the same functionality to the profile page
|
|
222. On the admin page under Available Themes, the page does not load available themes
|
|
218. Give the header of each setting-panel a somewhat differing color
|
|
218. In the Admin interface allow to minimize each settings pannel to only show its header, In order to easely navigate the page.
|
|
219. Clicking on the collapse button doesn't toggle
|
|
218. In the Admin interface allow to minimize each settings pannel to only show its header, In order to easely navigate the page.
|
|
223. On the new-entry page the checkbox should be following the labels - now they are positioned above.
|
|
224. The checkboxes should be immediately to the left of the label not below left
|
|
225. The checkbox takes the full width of the grid which forces the label to be printed underneath instead of directly next to it.
|
|
226. Only show the Mastodon publishing on new page if the user has Mastodon posting configured. Then default the checkbox to yes
|
|
227. In the currently running contaier the user olaf has no mastodon configured but the mastodon checkbox is still visible
|
|
228. When clicking on the logo always go to the home page
|
|
229. Add a red collor theme
|
|
230. Make the theme brighter and darker red
|
|
231. Since checkin d433a305f5cd8ccdafde8a0f7764462e8c167162 on the home page the filter toolbar moved so that the menu button and new entry are not in the top left anylonger - revert to the previous layout
|
|
232. I want every user to filter on every available tag/label
|
|
233. tag filter doesn't seem to respond when pressed
|
|
234. The tag filter still does not allow me to select tags, even though the raw html contains the correct content. Also the user filter and the sort functionality work too
|
|
235. I believe tag selection was still working for v0.1.0 - it is still broken
|
|
236. Don't let the frontend and plugin pull from the google foundry but make sure any necessary fonts are served from the linklog server. I would prefer the fonts to be updated at docker image building time.
|
|
|
|
## 2026-08-28
|
|
|
|
237. On the new-entry page follow the logic for existing pages that already exists in the plugin and display "This link already exists. Comment and tags can be updated, and by submitting publishing will be retriggered." when the link exists. Also assess if the Auto-fill title button is necessary, or if the functionality can be automated while the URL is entered.
|
|
238. Also: detect as duplicate when the URL has arguments (not already stripped). And: add a button to re-fetch the title for if the URL has been fetched but the user still edits the field.
|
|
|
|
|
|
239. If the link already exist with URL arguments then also display the warning, but add that the link has been stored additional parameters.
|
|
240. I want this last change to be more precise: I do not want to be warned when parameters are stripped, but when the URL entered has arguments/parameters and the URL in the database has none or different ones (even after tracking parameters are stripped).
|
|
241. In the check duplicate I have a `<br>` tag, but that shows as formatted text on the page, I want a real break to occur at that position.
|
|
242. Update VIBE and Changelog.
|
|
243. Make sure the webplugin has the same functionality as just implemented in the new-entry page. Increase its version number to 0.2.0.
|
|
244. Add a feature to the Make file that updates the updates.json file based on available signed releases.
|
|
245. Add sha hashes to the updates.json
|
|
246. Update changelog and VIBE
|
|
247. Make sure that when the plugin is signed the version in the link it the about page is updated too
|
|
248. Release script fails because the runner's hashlib module has no file_digest attribute.
|
|
249. The filtering on tags does not work. When I click on the button I cannot select. Remember that any visitor on the site should be able to filter the tag for the link-feed.
|
|
250. Update VIBE and Changelog
|
|
|
|
## 2026-08-30
|
|
|
|
251. Create a skill for this project, make sure you capture the VIBE directory update
|
|
|
|
## 2026-08-30
|
|
|
|
252. In the mastodon post change the line: From:< URL>
|
|
to
|
|
Logged on <date> from: <url>
|
|
|
|
Where date format is like: 2026 August 29 - 21:10
|
|
|
|
## Future entries
|
|
|
|
Append each new user prompt here with its date and preserve the chronological order.
|