Jim BassoandClaude Opus 4.8
830eb4f6dc
Track the project backlog in-repo and preserve the original pre-implementation design with a note on where the build diverged. Co-Authored-By: Claude Opus 4.8 <[email protected]>
29 lines
1.4 KiB
Markdown
29 lines
1.4 KiB
Markdown
# WishNinja — TODO
|
|
|
|
Lightweight backlog for the project. Check items off as they land; move to Gitea Issues if the
|
|
list outgrows a single file.
|
|
|
|
## Cleanup
|
|
- [ ] Remove dead `IdentityNoOpEmailSender.cs` (leftover from the Blazor template scaffold; the
|
|
real sender is `Services/EmailSender.cs`).
|
|
|
|
## Docs
|
|
- [ ] Document deployment in the README: Gitea Actions runner setup (`catthehacker` label mapping),
|
|
Unraid container env vars, and the **Nginx Proxy Manager WebSocket toggle** required for Blazor.
|
|
|
|
## Features / polish
|
|
- [ ] Let users edit their own **display name** (Account → Manage).
|
|
- [ ] Tag releases (`v0.1.0`, …) so CI also publishes versioned images alongside `:latest`.
|
|
- [ ] Blazor reconnection UX polish (custom reconnect modal copy).
|
|
|
|
## Security (revisit if onboarding ever opens beyond a trusted group)
|
|
- [ ] Add an SSRF guard to the image-URL fetch (`ImageService.SaveFromUrlAsync`) to block
|
|
private/loopback IP ranges. Low risk while accounts are admin-invite-only.
|
|
|
|
## Done (for reference)
|
|
- [x] Initial build: Blazor + EF Core/SQLite + Identity, owner-hidden claims, admin invites.
|
|
- [x] Dockerfile, docker-compose, Gitea Actions CI (test + push image), Unraid template.
|
|
- [x] Deployed to Unraid behind Nginx Proxy Manager at https://wish.basso.land.
|
|
- [x] Fix: SQLite can't `ORDER BY DateTimeOffset` — order by `Id` instead.
|
|
- [x] All item images stored locally (URL inputs downloaded server-side).
|