- Raise compare limit from 8 to 9 (server + client, toast on overflow)
- Make import textarea placeholder match selected format (CSV/JSON/YAML/auto)
- Add GuideHelp links to admin create/edit user dialogs and tool import dialog
- Remove all prior release notes and version snapshots (v0.6.0-v0.8.6)
- Rename handbook to *.de.md; keep *.en.md
- New release notes v0.9.0.de.md/.en.md with v0.9.0 snapshot
- generate-docs.mjs: .de/.en convention incl. search index and en-fallback
- docs.tsx: release fallback now uses version.de.md
- Wording: neutral tagline, anonymous user, no gender forms
- Add docs/examples/import-tools.yaml and link from administration docs
- Add POST /admin/tools/import with format auto-detect, CSV delimiters
(comma/semicolon/tab), per-row validation via CreateToolBody, bulk insert,
audit log entries per imported tool; gated by new 'tool-import' feature
flag (premium/enterprise; admins always pass)
- Add tool-import-dialog UI (format tabs, delimiter select, textarea, file
upload, result/error list) behind hasFeature('tool-import')
- Replace FieldHelp question marks and bare GuideHelp links with a NetBox-style
'Hilfe/Help' outline button (HelpCircle + text) in form headers only
- Sync locales to 482 keys per language (de/en), update handbook docs
(administration import section, index/plaene feature tables), regenerate
API client + zod schemas, add yaml dependency
- each release now carries a full docs snapshot (reference + handbook)
under docs/releases/<v>/; the docs frontend loads a version's snapshot
for /docs/vX.Y.Z/* and shows the handbook/reference of that version
- version dropdown navigates to /docs/<version> (docs home) instead of
the release notes page; old /docs/vX.Y.Z redirect removed
- generator: --snapshot writes handbook + reference; build copies
versioned snapshots (last 7 versions) into /docs/versions/<v>/
- fix Gitea tag links: /admin/tool-evaluator/tags/<v> was 404, correct
URL is /releases/tag/<v>
- add GuideHelp button to forms/pages linking to the matching handbook
guide (rating, tool add/edit, costs, compare, watchlist, analytics)
- sidebar was hidden below lg with no replacement; add a Sheet-based
nav drawer opened from a menu button in the header
- version dropdown stayed on 'aktuell' for /docs/releases/* pages because
only first-segment versions were parsed; derive header version from the
releases route too
- docs route renders without the app shell (own header, back-to-app link,
theme toggle)
- nav entry renamed to Hilfe (de) / Help (en)
- reference links now case-insensitive (schema/tag slugs)
- handbook rewritten as 17-page user guide with links into the API reference
- release notes v0.8.1 added
Full documentation hub replacing the release-notes-only view:
- Handbook pages (docs/handbook) for all features and admin/betrieb
- API reference generated from lib/api-spec/openapi.yaml via
scripts/src/generate-docs.mjs (replaces sync-release-docs.mjs):
endpoints, schemas/fields, search index, per-release snapshots
- mkdocs layout: sidebar nav, right TOC with scrollspy, search overlay,
version dropdown, repo link
- FieldHelp (?) buttons in forms linking to reference field docs
- v0.7.0 release notes backfilled, v0.8.0 release notes added
Adds a docs pipeline so each release has a version-bound Markdown
document (docs/releases/vX.Y.Z.md) rendered publicly in the app:
- sync-release-docs.mjs copies docs/releases/*.md into the toolrate
public dir and generates index.json before every dev/build
- /docs lists all releases; /docs/:version renders the sanitized
Markdown (marked + DOMPurify, typography styles)
- template + workflow documented in docs/README.md
- current release (v0.6.0) documented as the first entry
- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated
Phase 1: browse power-up
- faceted filters: tags + features (array containment) and min rating
on listTools; new ?tags=?features=?minRating= URL params with chips
- global Cmd+K command palette (cmdk) with tool search + navigation
- mini usefulness/usability bars on grid cards, wide cards and table rows
URL param had precedence over the user's toggle choice, so once
?view=table|rows was in the URL the override could never win. User
selection now takes precedence; URL param only applies on first load.
- tools: add deletedAt/deletedBy, soft delete via DELETE /tools/:id when
actor has trash entitlement, else immediate hard delete
- trash endpoints: GET /tools/trash, POST /tools/trash (admin bulk),
POST /tools/trash/restore, DELETE /tools/trash, POST /tools/trash/empty
- trash feature for premium/enterprise; exclude trashed from all public
surfaces (browse, categories, features, tags, similar, ratings, costs,
analytics, redundancy)
- TRASH_RETENTION_DAYS env (0 = keep forever) with hourly purge job
- frontend: /trash page (premium+, restore for all, permanent delete +
empty for admin), admin Tools tab with multi-select bulk trash,
sidebar Trash link, tool-detail delete hint
- visible brand text changed to toolr (sidebar, mobile header, topbar
fallback, login, 404, home heading, index.html title/og/twitter meta)
- brand logo now links to / in sidebar, mobile header, login, 404
- internal identifiers unchanged: package name, localStorage key
- ThemeToggle moved from sidebar footer to new desktop topbar (top-right),
page title shown left; mobile header + login unchanged
- dark theme primary switched from neon orange to amber/gold (38 92% 50%),
primary-foreground to dark navy for contrast; ring + chart-1 harmonized
- light theme stays orange
Backend security:
- Admin-gate /admin/redundancy (GET+POST) with zod validation and tool existence checks
- Restrict CORS to same-origin (plus CORS_ORIGIN allowlist) and SameSite=Lax cookie
- Validate returnTo to prevent open redirect in the OIDC flow
- Validate/coerce relations body, reject self-relations and non-admin 'recommended'
- Add central JSON error middleware (no more Express HTML 500s)
- Fail fast at startup when SESSION_SECRET/VOTER_SECRET missing in production
Backend correctness:
- Stop leaking voterToken in the create-rating response
- Allow clearing websiteUrl/iconUrl (nullable in UpdateToolBody, frontend sends null)
- Regenerate session after login/callback (session fixation) and add OIDC state check
- Block self-demotion and last-admin demotion in user PATCH
- Set created_by to NULL on user delete (FK-safe)
- Validate cost create/update bodies with zod
- Unique index (tool_id, voter_token) + 409 on race duplicate ratings
- Clamp audit limit, escape ilike wildcards in search, O(N) analytics queries
Frontend:
- tools-browse reads and syncs URL query params (fixes home 'View all' links)
- Invalidate analytics/top-tools/categories/features caches after mutations
- Sync category combobox input when the value changes externally
- Hide Write a Review for anonymous users, drop unreachable rating guard
- Invalidate categories/features queries after creating/editing tools so new
categories appear immediately in search, browse dropdown and tool form
- Always refetch categories/features when the combobox/suggestion inputs mount
- Return JSON 404 for unmatched /api routes instead of the SPA index.html
- Read the manually confirmed 'better tool' from the recommendation notes
instead of using the min tool id in the redundancy dashboard
- Require admin for cost/relation update+delete endpoints
- Stop exposing the voter token in the ratings list response
- Fix parseInt type error on user id params (Express 5 params typing)
opencode
henry
root