# WishNinja — TODO

Lightweight backlog for the project. Check items off as they land; move to Gitea Issues if the
list outgrows a single file.

## Cleanup
- [ ] Remove dead `IdentityNoOpEmailSender.cs` (leftover from the Blazor template scaffold; the
      real sender is `Services/EmailSender.cs`).

## Docs
- [ ] Document deployment in the README: Gitea Actions runner setup (`catthehacker` label mapping),
      Unraid container env vars, and the **Nginx Proxy Manager WebSocket toggle** required for Blazor.

## Features / polish
- [ ] Let users edit their own **display name** (Account → Manage).
- [ ] Tag releases (`v0.1.0`, …) so CI also publishes versioned images alongside `:latest`.
- [ ] Blazor reconnection UX polish (custom reconnect modal copy).

## Security (revisit if onboarding ever opens beyond a trusted group)
- [ ] Add an SSRF guard to the image-URL fetch (`ImageService.SaveFromUrlAsync`) to block
      private/loopback IP ranges. Low risk while accounts are admin-invite-only.

## Done (for reference)
- [x] Initial build: Blazor + EF Core/SQLite + Identity, owner-hidden claims, admin invites.
- [x] Dockerfile, docker-compose, Gitea Actions CI (test + push image), Unraid template.
- [x] Deployed to Unraid behind Nginx Proxy Manager at https://wish.basso.land.
- [x] Fix: SQLite can't `ORDER BY DateTimeOffset` — order by `Id` instead.
- [x] All item images stored locally (URL inputs downloaded server-side).