- Refactor notes-service to include shared notes in list/get/search/reorder
- Route per-user fields (pinned/archived/sortOrder) to noteUserState for collaborators
- Update API routes to delegate to service layer with access control
- Update sync server to handle shared note updates bidirectionally
- Add leaveNote() to client store
- Refactor search and notes API routes to use service layer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add noteCollaborators and noteUserState tables for sharing notes between
users. Implement access control helpers (canAccessNote, requireNoteAccess,
requireNoteOwnership) and collaborators CRUD service. Create API endpoints
for managing collaborators and searching users.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace brand-specific "Google Keep alternative" copy with generic
privacy-focused messaging across meta tags, hero subtitle, README,
and feature docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Platforms like WhatsApp require an explicit og:image to display
anything in link previews. Point it to the existing apple-touch-icon.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The apple-touch-icon already provides the pretzel logo for link
previews (like the app does). Remove the redundant OG image and switch
twitter:card to "summary" (icon-sized) instead of "summary_large_image".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Title and description are already shown in the link preview text,
so the image doesn't need to repeat them.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Messaging apps (WhatsApp, iMessage, etc.) use the apple-touch-icon to
display a site icon in link previews. Copy the existing icon from the
app and add the link tag to the landing page.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The og-image.png was referenced in meta tags but never created. Generate
a 1200x630 parchment-themed OG image and add missing twitter:title,
twitter:description, and twitter:image meta tags for proper social
media link previews.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Existing databases created from the original migration had password_hash
as NOT NULL. This adds an auto-migration that recreates the users table
with a nullable password_hash column, enabling OAuth-only user creation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Self-hosted auth provider is more relevant for a self-hosted app.
Also adds AUTH.md to the documentation table.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Admin can now toggle "OAuth-only (no password)" when creating a user.
These users have no password hash and authProvider set to 'none', so
they can only log in via an OAuth/SSO provider.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Create AUTH.md as the canonical reference for authentication: password
auth, OAuth/SSO setup, provider-specific guides (Authentik, Keycloak,
Okta/Auth0), env vars, callback URLs, security notes, and
troubleshooting. Fixes incorrect env var names and callback URL patterns
that had drifted in DEPLOYMENT.md. Other docs now cross-link to AUTH.md
instead of duplicating content.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Change "type": "streamable-http" to "type": "http" to match Claude
Code's actual MCP schema. Also clarify that the config targets
.claude/settings.json specifically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Dynamic import zxcvbn (820KB) in PasswordStrengthMeter so it only
loads when user starts typing a password
- Raise chunkSizeWarningLimit to 850KB for the lazy-loaded chunk
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add svelte-ignore for intentional state_referenced_locally patterns
- Wrap clickable images in button elements for keyboard accessibility
- Add proper ARIA roles (dialog, textbox) with tabindex and focus management
- Fix lightbox Escape key handling to not close parent editor overlay
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add missing userId arg to syncNoteTags() calls in notes-service
- Add seedUser option to createTestDb() for test setup
- Add explicit type annotations to MCP server.tool() callbacks (zod v4)
- Fix ambiguous getByText selector in settings e2e test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add /archive, /trash, /tag/[name] routes with proper <a> links
in the sidebar. Tags visible regardless of current filter.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Update FEATURES.md, ARCHITECTURE.md, DEPLOYMENT.md with MCP sections
- Add MCP endpoints to OpenAPI spec and regenerate API.md
- Add rebase-before-PR best practice to CLAUDE.md git conventions
- Update README with MCP/API feature mention
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Settings layout with sidebar nav (Profile, MCP Server, Users)
- Profile page: display name, email, password, sessions
- MCP page: API key CRUD, JSON config with copy button, LLM prompt
- Config auto-populates with actual API key when one is created
- Remove duplicate Settings link from sidebar
- Users page integrated into settings nav (admin only)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Shared notes-service.ts with userId-scoped queries for DRY
- McpServer with tools: list/get/create/update/trash/restore/
archive/unarchive/delete notes, search, list tags, pin,
reorder, upload image
- Streamable HTTP endpoint at POST /api/mcp
- Session management with GET/DELETE handlers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- API key generation with SHA-256 hashing and crumbs_ prefix
- User-scoped key validation, listing, and deletion
- Bearer token auth in hooks.server.ts for /api/mcp paths
- Populates event.locals.user from API key for downstream scoping
- 13 unit tests covering CRUD, validation, and user isolation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add `api_keys` table with userId foreign key to schema
- Add `@modelcontextprotocol/sdk` and `zod` dependencies
- Add auto-create SQL and test helpers for api_keys table
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add userId check to /api/notes/reorder (was completely unprotected)
- Scope syncNoteTags by userId to prevent cross-user tag pollution
- Verify attachmentId belongs to noteId in attachment operations (IDOR fix)
- Remove DEFAULT 0 from userId columns so missing userId fails loudly
- Update test helpers and test data to provide required userId
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move settings routes into (app) layout group for header/sidebar
- Replace all gray/white/dark-mode Tailwind classes with CSS variables
- Use rounded-sm, card-shadow, and parchment color tokens throughout
- Fix PasswordStrengthMeter to use themed colors
- Fix page titles from "KeepNotes" to "Crumbs"
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The HTML minlength="8" attribute triggered native browser validation
before the JS handler could run, preventing the custom error-message
element from appearing. JS already validates password length.
Also install missing zxcvbn and arctic dependencies from phase2 merge.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document the opacity-based pattern for hover actions that ensures
they're always visible on touch devices.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The drag handle was positioned top-right, overlapping with the pin
bookmark icon on pinned notes. Move it to top-left instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Make the Tiptap editor fill the full wrapper height using flexbox so
tapping anywhere in the content area focuses the editor, not just the
small text area at the top.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use opacity-based visibility (max-md:opacity-100) for image hover
actions so they're always accessible on touch devices
- Always show ImageUpload with delete/star when attachments exist,
not just when in image upload mode
- Replace drag-and-drop zone with compact "Add images" button on mobile
- Add showDropZone prop to ImageUpload for conditional drop zone display
- Clean up unused lightbox state from NoteEditor
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add globalSetup to clean test DB before each run. Split Playwright into
two projects: auth-setup (serial, runs first) and app (parallel, depends
on auth-setup). Skip rate limiting in test environment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
