- nginx: add HSTS (max-age=31536000) and gzip for text/css/js/json
- entries: add limit/offset query params (default 200, max 1000)
- Ntfy: wire NTFY_URL/NTFY_TOKEN through env; notify on startup, new
registration, admin login, user disable, and user delete
- httpx==0.28.1 added for async Ntfy HTTP calls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Block disabled accounts at login and unimpersonate (C4, C2)
- Catch IntegrityError on register commit to return 409 instead of 500 (C5)
- Stop _seed_admin from overwriting existing admin password on restart (C8)
- Cap public/stats query at 500 users to bound memory usage (C3)
- Rate-limit PUT /me/password at 5/minute (C6)
- Bump SQLAlchemy to 2.0.50 and aiomysql to 0.3.2; re-enable pool_pre_ping (C7)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove pool_pre_ping=True to fix startup crash caused by aiomysql 0.2.0
async adapter requiring a reconnect argument SQLAlchemy does not pass.
Add slowapi rate limiting, structured logging, CORS config, backend
health check, and nginx security headers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add pool_pre_ping and pool_recycle to prevent lost connection errors on idle pool
- Add Why Bourbonacci card to about page
- Redirect to login on 401 in API layer
- Check JWT expiry in isLoggedIn instead of just token presence
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add about.html explaining infinity bottles, why to track, how to start
- Hero shows "What is it?" + "Track Your Bottle" when logged out; hides about button when logged in
- Redirect after login goes to index (community page) instead of dashboard
- redirectIfLoggedIn also sends to index
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add bottle_size field to User model and UserResponse/UserUpdate schemas
- Settings modal includes bottle size input (shots capacity)
- Community bottles and My Bottle page show fill bar based on bottle size
- Community bottle cards are clickable — opens searchable bourbon list modal
- Add total_shots_added stat to replace duplicate net volume on dashboard
- Reorder dashboard stats: Bourbons Added, Total Poured In, Shots Remaining, Est. Proof
- Theme-matched custom scrollbar (amber on dark)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace nav user area with display name (non-clickable), gear settings
modal, admin button (admins only), and logout button
- Settings modal handles display name, timezone, and password change
- Add admin.html + admin.js: user table with reset PW, disable/enable,
login-as (impersonation), and delete; return-to-admin flow in nav
- Add is_admin to UserResponse so frontend can gate the Admin button
- Fix all db.begin() bugs in admin.py and users.py (transaction already
active from get_current_user query; use commit() directly instead)
- Add email-validator and pin bcrypt==4.0.1 for passlib compatibility
- Add escHtml() to api.js and admin API namespace
- Group nav brand + links in nav-left for left-aligned layout
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
derekc