neko - self-hosted, single user rss reader

	Commit message (Collapse)	Author	Age	Files	Lines
*	Improve image proxy: streaming, size limits, Content-Type validationclaude/improve-image-proxy-5iY78	Claude	7 days	1	-41/+290
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Rewrites the image proxy handler to address several issues: - Stream responses with io.Copy instead of buffering entire image in memory - Add 25MB size limit via io.LimitReader to prevent memory exhaustion - Close resp.Body (was previously leaked on every request) - Validate Content-Type is an image, rejecting HTML/JS/etc - Forward Content-Type and Content-Length from upstream - Use http.NewRequestWithContext to propagate client cancellation - Check upstream status codes, returning 502 for non-2xx - Fix ETag: use proper quoted format, remove bogus Etag request header check - Increase timeout from 5s to 30s for slow image servers - Use proper HTTP status codes (400 for bad input, 502 for upstream errors) - Add Cache-Control max-age directive alongside Expires header Tests: comprehensive coverage for Content-Type filtering, upstream errors, streaming, ETag validation, User-Agent forwarding, and Content-Length. Benchmarks: cache hit path and streaming at 1KB/64KB/1MB/5MB sizes. https://claude.ai/code/session_01CZcDDVmF6wNs2YjdhvCppy
*	Remove legacy V2 React frontend and update build/test scripts to focus on ↵	Adam Mathes	9 days	1	-1/+1
\| \| \| \|	Vanilla JS (V3)
*	Fix v3 build process and CSRF login/logout exclusions	Adam Mathes	9 days	1	-2/+2
\| \| \| \| \| \| \|	- Update Makefile to correctly build and copy frontend-vanilla (v3) assets - Fix frontend-vanilla/vite.config.ts to build to its own dist directory - Normalize CSRF check path and exclude /api/logout to fix v3 session clearing - Include latest built assets for v3
*	Scaffold Vanilla JS Frontend (v3): Create directory, update Makefile/web.go, ↵	Adam Mathes	10 days	1	-4/+4
\| \| \| \|	embed dist/v3
*	Backend: Fix linting issues, improve error handling, and replace magic numbers	Adam Mathes	10 days	1	-44/+44
\|
*	Commit ticket updates and remaining backend lint fixes	Adam Mathes	10 days	1	-1/+2
\|
*	feat: add secure_cookies configuration option\n\n- Added SecureCookies bool ↵	Adam Mathes	11 days	1	-1/+2
\| \| \| \|	field to config.Settings\n- Added --secure-cookies command line flag\n- Updated CSRFMiddleware to use config setting instead of hardcoded value\n- Default is false for local development, set to true for production HTTPS\n- Updated config.example and README.md with documentation\n- Updated tests to pass config to CSRFMiddleware\n\nThis allows users to easily switch between insecure cookies (for local dev)\nand secure cookies (for production HTTPS) via config file or command line.
*	security: add HTTP security headers (fixing NK-7xuajb)	Adam Mathes	11 days	1	-0/+25
\|
*	security: implement CSRF protection and improve session cookie security ↵	Adam Mathes	11 days	1	-0/+44
\| \| \| \|	(fixing NK-gfh33y)
*	Refactor: project structure, implement dependency injection, and align v2 UI ↵	Adam Mathes	11 days	1	-5/+5
\| \| \| \|	with v1
*	Fix web tests by removing nil-box checks no longer applicable with go:embed	Adam Mathes	11 days	1	-89/+47
\|
*	refactor(backend): improve testability and add tests (NK-6q9nyg)	Adam Mathes	12 days	1	-0/+298
\|
*	Implement robust Gzip middleware and update page size analysis	Adam Mathes	12 days	1	-5/+47
\|
*	Fix frontend asset base path and add regression test for serving frontend	Adam Mathes	12 days	1	-0/+24
\|
*	Implement Frontend Logout with tests	Adam Mathes	12 days	1	-0/+26
\|
*	Implement frontend login logic with >90% coverage	Adam Mathes	12 days	1	-0/+55
\|
*	wip: tui updates (buggy)	Adam Mathes	12 days	1	-1/+69
\|
*	Refactor backend to a clean REST API	Adam Mathes	12 days	1	-400/+14
\| \| \| \| \| \| \| \| \| \|	- Created new 'api' package with testable router and RESTful handlers - Handlers in 'api' use proper HTTP methods and status codes - Standardized JSON responses and error handling - Refactored 'web' package to delegate logic to 'api' - Maintained backward compatibility for legacy frontend routes - Simplified 'web/web_test.go' and added comprehensive 'api/api_test.go' - All tests passing with improved modularity
*	Add comprehensive test suite — 81% cross-package coverage	Adam Mathes	13 days	1	-0/+647
	Bug fixes: - config: remove unused log import - item: fix Printf format %d->%t for boolean ReadState - util: update stale config.Read -> config.Init, remove config.Config.DBServer Test files added: - config/config_test.go: Init, readConfig, addDefaults (100%) - vlog/vlog_test.go: Printf, Println verbose/silent (100%) - models/db_test.go: InitDB tests - models/feed/feed_test.go: CRUD, filter, Categories, NewFeed, ResolveFeedURL (87%) - models/item/item_test.go: CRUD, Filter with category/search/starred, rewriteImages (71%) - exporter/exporter_test.go: all export formats (91%) - importer/importer_test.go: InsertIItem, ImportJSON (90%) - crawler/crawler_test.go: GetFeedContent, CrawlFeed, CrawlWorker, Crawl (89%) - web/web_test.go: auth, login/logout, stream, item, feed, category, export, crawl, imageProxy handlers (77%) Remaining 0% functions require HTTP/rice.MustFindBox/main entry and can't be unit tested without refactoring (see tickets NK-gqkh96, NK-6q9nyg).