- admin.py: remove unused get_current_user import
- feed.py, flock.py, other.py: add IntegrityError handling on POST/PUT
endpoints; duplicate submissions now return 409 instead of crashing with
a 500 error
- stats.py: extract magic numbers into named module-level constants
(DAYS_ROLLING, DAYS_SHORT, PRECISION_AVG, PRECISION_HEN, PRECISION_COST);
add return type annotations to _total_feed_cost and _total_other_cost;
normalize both helpers to always return Decimal so budget_stats no longer
needs Decimal(str(...)) workarounds; simplify _cpe/_cpd helpers
- dashboard.js: read --green CSS variable at runtime instead of hardcoding
the hex value so chart color stays in sync with the stylesheet
- docker-compose.yml: add healthcheck to api service (polls /api/health
every 30s) so Docker knows when the API is unhealthy; add password
strength guidance comment above the db service
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- api.js: add exponential backoff retry (3 attempts, 500/1000/2000ms) for
GET requests on network errors and 5xx responses; mutating methods are
not retried since they are not idempotent
- api.js: add offline indicator — fixed pill banner appears at bottom of
page when navigator goes offline, disappears when back online
- style.css: add styles for offline banner and session expiry warning
- auth.js: show amber warning banner below nav when session expires within
24 hours (with exact hours remaining); dismissible with X button
- auth.js: fix password min-length client-side check from 6 to 10 to
match the backend
- log.js, flock.js, budget.js: disable submit button during async request
and re-enable in finally block to prevent double-submits and make loading
state visible
- dashboard.js: fix chart date labels to use user's configured timezone
instead of the browser's local timezone
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- models.py: add composite (user_id, date) indexes to flock_history,
feed_purchases, and other_purchases for faster date-filtered queries
(egg_collections already had one via its unique constraint)
- main.py: add v2.2 migration to create the three composite indexes on
existing installs at startup
- stats.py: fix N+1 query in monthly_stats — flock history is now fetched
once and looked up per month using bisect_right instead of one DB query
per month row; also remove unnecessary Decimal(str(...)) round-trips
since SQLAlchemy already returns Numeric columns as Decimal
- eggs.py: add limit parameter (default 500, max 1000) to list_eggs to
cap unbounded fetches on large datasets
- dashboard.js: pass start= (30 days ago) when fetching eggs so the
dashboard only loads the data it actually needs for the chart and
recent collections list
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx: add X-Content-Type-Options, X-Frame-Options, X-XSS-Protection,
and Referrer-Policy headers on all responses; rate limit /api/auth/login
to 5 req/min per IP (burst 3) to prevent brute force
- frontend: add escHtml() utility to api.js; use it on all notes fields
across dashboard, log, history, flock, and budget pages to prevent XSS
- log.js: fix broken loadRecent() call referencing removed #recent-body
element; replaced with loadHistory() from history.js
- schemas.py: raise minimum password length from 6 to 10 characters
- admin.py: add audit logging for password reset, disable, delete, and
impersonate actions; fix impersonate to use named admin param for logging
- main.py: add startup env validation — exits with clear error if any
required env var is missing; configure structured logging to stdout
- docker-compose.yml: add log rotation (10 MB / 3 files) to all services
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
