Add TODO.md backlog and docs/DESIGN.md (original plan)

Track the project backlog in-repo and preserve the original pre-implementation design with a note on where the build diverged. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-11 15:50:18 -05:00
parent 2ce89fa490
commit 830eb4f6dc
2 changed files with 136 additions and 0 deletions
@@ -0,0 +1,28 @@
+# WishNinja — TODO
+
+Lightweight backlog for the project. Check items off as they land; move to Gitea Issues if the
+list outgrows a single file.
+
+## Cleanup
+- [ ] Remove dead `IdentityNoOpEmailSender.cs` (leftover from the Blazor template scaffold; the
+      real sender is `Services/EmailSender.cs`).
+
+## Docs
+- [ ] Document deployment in the README: Gitea Actions runner setup (`catthehacker` label mapping),
+      Unraid container env vars, and the **Nginx Proxy Manager WebSocket toggle** required for Blazor.
+
+## Features / polish
+- [ ] Let users edit their own **display name** (Account → Manage).
+- [ ] Tag releases (`v0.1.0`, …) so CI also publishes versioned images alongside `:latest`.
+- [ ] Blazor reconnection UX polish (custom reconnect modal copy).
+
+## Security (revisit if onboarding ever opens beyond a trusted group)
+- [ ] Add an SSRF guard to the image-URL fetch (`ImageService.SaveFromUrlAsync`) to block
+      private/loopback IP ranges. Low risk while accounts are admin-invite-only.
+
+## Done (for reference)
+- [x] Initial build: Blazor + EF Core/SQLite + Identity, owner-hidden claims, admin invites.
+- [x] Dockerfile, docker-compose, Gitea Actions CI (test + push image), Unraid template.
+- [x] Deployed to Unraid behind Nginx Proxy Manager at https://wish.basso.land.
+- [x] Fix: SQLite can't `ORDER BY DateTimeOffset` — order by `Id` instead.
+- [x] All item images stored locally (URL inputs downloaded server-side).