Gitea #10 Option B:
- new VerificationRequest model — owner submits a message via the pet
edit page, moderator reviews against a fixed 4-item checklist
(authenticity/impersonation risk, complete profile, good standing,
established presence). All four met -> approved, Pet.isVerified flips
on; any unmet -> auto-rejected with an itemized note of what's missing
- new admin queue /p/[secret]/verification (Moderator+ only, same gate
as the audit log), status filter, review dialog enforces the checklist
- owner is notified automatically either way via a "PawFeed Team" DM —
extracted the team-pet lookup/create logic (previously only inline in
startTeamConversation) into src/lib/team-pet.ts, adding sendTeamMessage
which reuses the normal Conversation/Message + MESSAGE notification
- review decisions log to ModerationLog with role+IP, same as every
other Gitea #10 action this session
Both had no onError handler, so a failed request (e.g. a permission
check) silently did nothing — the verify button looked broken with no
indication why. Now shows a toast on both success and failure.
Gitea #10 Phase 2:
- Warning model (append-only, no delete — Owner history), issueWarning +
listWarnings, surfaced on the Users page with a badge + dialog
- Pet.isVerified checkmark (lives on Pet, not Owner — pets are the social
identity per CLAUDE.md), toggleable from the Users page, shown on the
public profile page
- listReports now derives a HIGH/MEDIUM/LOW severity from ReportReason
and sorts severity-first; Reports page shows the derived badge
- Admin-triggered GDPR Art. 17 erasure: extracted the self-service
/api/account/delete logic into a shared deleteOwnerAccount() helper,
new admin.deleteUserAccount (SUPER_ADMIN only, requires typing the
exact ownerId to confirm, blocks self-deletion) reuses it — Delete
button only renders for SUPER_ADMIN/bootstrap callers
- all four new/changed mutations log to ModerationLog with role+IP
flex-wrap with long IDs/IPs pushed content past the viewport edge instead
of wrapping. Switched to a fixed-column grid with truncation + title
tooltips, wrapped in a horizontal-scroll container so the whole table
scrolls as a unit on narrow screens instead of individual cells clipping.
Gitea #10 follow-up:
- new admin.getMyRole procedure (no minRole gate) so the panel can answer
"what's my own role" without hitting a permission wall
- fixes a regression from the permission-matrix change: layout.tsx was
using listModerators (now MODERATOR+) just to check "does this user have
any admin access at all", which locked SUPPORT accounts out of the
entire panel — swapped to getMyRole
- getModerationLog gains cursor pagination, action/targetType/moderatorId
filters, and resolves each entry's moderator to a pet name
- new /p/[secret]/log page renders the filterable log; the nav link only
shows for MODERATOR/SUPER_ADMIN/bootstrap, and the page itself shows a
clear "no permission" state if a SUPPORT account hits the URL directly
Gitea #10 follow-up:
- assertAdmin now takes a minRole (SUPPORT < MODERATOR < SUPER_ADMIN)
instead of a boolean requireSuperAdmin flag, and returns the caller's
resolved role so mutation sites can log it. Applied per the agreed
matrix: read-only/support tasks stay SUPPORT, destructive content/user
actions require MODERATOR, ads/roles/invites/legal-doc-publishing
require SUPER_ADMIN.
- ModerationLog gains moderatorRole and ipAddress (both nullable —
historical rows predate capture), populated on every write for
login-abuse forensics.
Gitea #10 follow-up, Phase 1:
- AdminRoleType gains SUPPORT (same access as MODERATOR for now, pending
a permission-matrix pass to scope it down)
- listUsers gains search (Clerk query + local pet-name match), ban-status,
and role filters
- ModerationLog now also captures ad create/update/delete and role
grant/revoke, which previously left no audit trail
- new getModeratorThroughput query surfaces per-moderator action counts
on the Moderators page
Post moderation grid rendered milestone and repost posts as an empty
ImageOff placeholder with no way to tell what they were. Now shows the
milestone icon+label, or the original post's thumbnail and pet name
for reposts.
Replaces the sharp-stitched sidebar+feed composite with a cleaner
screenshot the user captured directly, and switches the Image from
fill+aspect-[16/10] (cropping) to its natural 872x926 size since the
new capture has a different aspect ratio and shouldn't be cropped.
The landing page was hardcoded English, so switching languages had no
visible effect on it — added a "Landing" namespace to both message
catalogs and wired src/app/page.tsx up via getTranslations, matching
the pattern already used by other server-rendered pages.
Regional-indicator flag emoji render as bare "GB"/"DE" text on stock
Windows (no color-flag font substitution), which defeated the point
of switching from text labels to flags — swaps in small inline SVG
flag components instead, guaranteed to render everywhere.
Also re-crops the app-preview screenshot: the original had a wide
empty gap between the sidebar and the feed column baked into the
capture (an artifact of the live app's centered-column layout at that
viewport width). Stitches the sidebar and feed regions together
tightly via sharp instead.
The new public landing page (/) was hero-only — missing a language
switcher, legal links, and anything showing what the product actually
looks like. Adds:
- A slim header with the wordmark and a flag-based language switcher
(LanguageSwitcher now shows 🇬🇧/🇩🇪 instead of English/Deutsch text,
used here and everywhere else it's already mounted)
- An app-preview section: a real screenshot of the live feed inside a
browser-chrome mockup card
- A 4-item feature overview (pet-first profiles, posts/stories/video,
health tracking, pet-to-pet messaging)
- A footer with Impressum/Datenschutz/AGB links, matching what the
authenticated sidebar already links to
/ unconditionally redirected to /feed, gated entirely by proxy.ts's
auth.protect() — so logged-out visitors AND social-media crawlers
scraping og:image for link previews got bounced to Clerk's hosted
sign-in before Next.js ever rendered this route's metadata (surfaced
as Facebook Sharing Debugger's "og:image should be explicit" warning,
since the crawler never saw our actual tags).
Adds "/" to proxy.ts's public matcher and moves the
authenticated-redirect into the page itself via a plain auth() read
(not .protect()), so it can render a real hero page — matching the OG
image's warm gradient + paw-mark visual language — for logged-out
visitors and crawlers alike, while still bouncing authenticated users
straight to /feed as before.
Replaces the code-generated opengraph-image.tsx (placeholder circles,
default font) with a static opengraph-image.png exported from the
designer's refined SVG — a properly-shaped paw mark and a different
typeface. The source SVG traces letterforms as vector paths and embeds
a raster background, which isn't practical to reproduce in a
next/og ImageResponse component, so it's shipped as a static asset
via Next.js's file-convention instead (same og:image/twitter:image
wiring, no proxy.ts change needed — same route path as before).
Social-media crawlers (Facebook, Twitter/X, Slack, Discord) never
have a Clerk session, so the new OG image route was 307-redirecting
every one of them to /sign-in instead of serving the image — found
while live-testing right after deploy, same class of bug as the
GDPR-export route fix.
Social-sharing previews had no image — layout.tsx's OG/Twitter tags
existed but pointed at nothing. Adds src/app/opengraph-image.tsx using
next/og's ImageResponse to render a branded card (paw mark, wordmark,
tagline) at request time instead of shipping a static asset, and
switches twitter.card to summary_large_image now that there's an
image for it to show.
Advertisement.species existed in the schema but was never wired up —
the admin form never let you set it and the feed's ad query ignored it
entirely, showing every active ad to every pet regardless of species.
Adds a new Advertisement.breeds field alongside it and wires both
through the whole path: a targeting UI in the ad create/edit dialog
(species checkboxes, each expandable into its own breed checklist),
and a filter in admin.getActiveAds (now scoped to the viewing pet) so
cat food ads stop reaching dog owners. Empty species/breeds = shown to
everyone, unchanged from today's behavior.
The aspect-square container had no overflow-hidden, so with overflow
default-visible its own box height wasn't enforced against a
percentage-sized child image — portrait photos fell back to their
intrinsic (taller) aspect ratio instead of getting cropped square,
found while visually verifying the deployed grid. Landscape images
were unaffected, which masked the bug in earlier local testing.
The list view made post content hard to scan — thumbnails rendered at
inconsistent sizes and captions were easy to miss. Switches to a
responsive grid (3 cols on desktop) with a fixed-size thumbnail per
card, a same-size placeholder for posts without media, a caption
below each card, and a play-icon overlay + Mux thumbnail for video
posts (listPosts now also selects videoPost.muxPlaybackId).
The Clerk route matcher was redirecting the new GDPR export download
link to /sign-in, breaking the pawfeed.org token flow just shipped —
found while live-testing the link right after deploy.
Replaces the emailed Supabase signed URL with a bespoke DataExportToken
DB record, delivered via a new /api/gdpr-export/[token] route that
streams the file server-side. The storage backend is now an internal
implementation detail; every link the user sees reads pawfeed.org.
Aggregates everything held about an Owner (gdpr-export.ts: pets, posts,
stories, comments, reactions, reposts, follows/blocks, health records,
messages, notifications, reports, ban/consent history, Clerk profile)
into a single JSON bundle, uploads it to a private Supabase Storage
bucket (data-export-storage.ts — separate from the public pet-avatars
bucket used for media), and emails the owner a 7-day signed download
link via the new SMTP module. Triggered from a new export button per
user in /p/[secret]/users, logged to ModerationLog.
Deliberately not a zip with embedded media bytes: avoids new archiving
dependencies, the risk of a slow synchronous request for owners with
many posts, and the fact that Mux video assets aren't trivially
re-downloadable — media is referenced by its existing CDN URL instead.
Ad interactions and issued invite codes are not yet included, flagged
in the export's own scope note rather than silently omitted.
Verified end-to-end against the live shared DB before committing:
built a real export, uploaded it, generated a signed URL, and sent a
real test email — all succeeded.
Thin nodemailer wrapper reading SMTP config from env vars. Uses a
provider-hosted mailbox (Strato, same as the domain host) rather than
a self-hosted relay from the NAS's residential/dynamic IP, which would
get spam-flagged by most receiving servers regardless of DKIM/SPF.
Foundation for the GDPR Art. 15 data-export feature (Plan B: expiring
download link + email notification) — no caller wired up yet. Verified
end-to-end with a real test send before committing.
Gitea #6 (parts 1+2): admin.listUsers now batch-fetches email/name from
Clerk (users only stored the Clerk userId locally, everything else
lives in Clerk) instead of showing a bare userId. Adds
admin.startTeamConversation, which lazily creates a "PawFeed Team"
system Pet under ADMIN_OWNER_ID and reuses the existing pet-to-pet
Conversation/Message model instead of a parallel admin-inbox system —
the admin panel switches ActivePet to Team and opens the ordinary
/messages/[conversationId] thread, so no new UI is needed on the
recipient's side.
Known limitation: only the literal ADMIN_OWNER_ID account can act as
Team, since assertPetOwnership requires an exact owner match.
Extending this to every AdminRole holder is left for a follow-up.
Part 3 (GDPR Art. 15 data export) is deliberately not included —
research only per the issue's own "erst prüfen dann bauen" note.
Absolutely positioning it at top-4 right-4 over the centered content
overlapped the step headings on narrow viewports (reported live).
Gives it its own row in a flex-col layout instead, so it never
competes for space with the card content below it.
New visitors always got the English default because locale resolution
only ever read the NEXT_LOCALE cookie — never set until a user visits
a page with the LanguageSwitcher, which only lives in the authenticated
app Sidebar. /onboarding/pet runs before that, so a German browser
landed in English with no way to change it (reported live after
deploying the upload-consent step from Gitea #3).
Adds an Accept-Language fallback in src/i18n/request.ts (only consulted
when no cookie is set) and renders the existing LanguageSwitcher on the
onboarding page so users can override the guess.
Gitea #1: prevents blank image flashes while photos load. Blurhash is
computed client-side at upload time (canvas downsampling + the
blurhash package) for posts, milestones, and stories, stored alongside
each PostImage/Story row, and decoded into a smooth color placeholder
via the new BlurImage component that cross-fades to the loaded photo.
Wired into every content-photo surface: feed cards, post detail zoom,
reposts, milestone cards, story viewer, explore/search grids,
notification thumbnails, profile grid, and the admin posts/reports
panels. Pet avatars and ad creatives intentionally excluded — separate
content pipelines with disproportionate effort for the payoff.
Gitea #2: the site is now public (INVITE_REQUIRED=false), so the
alpha-status clause and invite-code registration requirement no longer
apply and are removed. Hardens the remaining terms: age/capacity
requirement, DSA host-provider privilege with a notice-and-action
section referencing the existing report feature, a proportionate
suspension clause, a limited-liability clause based on the
unentgeltliche-Nutzung privilege (§§ 521, 599, 690 BGB), a
§308-Nr.5-BGB-compliant change clause with objection period, an EU
consumer-protection carve-out, and a severability clause.
Gitea #3: harden Datenschutz for the now-public site. Adds a blocking
first-pet-onboarding step (two checkboxes) confirming the owner holds
rights to uploaded photos/videos and consents to data transfer to
Clerk/Cloudflare/Mux/Supabase. Consent timestamps are stored separately
on Owner so either declaration can be re-requested independently later.
Also documents GlitchTip as a processor and adds an explicit consent
section to the Datenschutzerklärung.
Sentry's Next.js App Router setup requires this file to capture React
rendering errors at the root layout level — GlitchTip's own setup
checklist flagged it as missing.
Server, edge, and client instrumentation wired up via SENTRY_DSN /
NEXT_PUBLIC_SENTRY_DSN. Fully inert without a DSN configured (verified
with a clean local build + full test suite) — safe to ship ahead of
actually having a Sentry project. Source-map upload is opt-in via
SENTRY_AUTH_TOKEN (kept out of the Docker build-arg chain since build
args land in image layer history; only the public DSN is a build arg).
cors_origin was hardcoded to "*" for all environments. Now restricted
to NEXT_PUBLIC_APP_URL when NODE_ENV=production; stays "*" in dev so
localhost uploads keep working.
Public launch prep — link previews on social/messaging apps were
falling back to bare URLs with no title/description. No branded OG
image exists yet (public/ only has create-next-app placeholders), so
this ships text-only; a real 1200x630 image is a follow-up.
Enforcing it blanked the whole app in production (ClerkProvider wraps
the tree in layout.tsx; a blocked resource during Clerk's client init
throws uncaught). Adding wss://clerk.pawfeed.org to connect-src did not
fix it. Next attempt: ship as Content-Security-Policy-Report-Only first
to see real violation reports before enforcing again. All other
security headers (HSTS, X-Frame-Options, etc.) and rate limiting stay
active and are unaffected.
Clerk's client SDK opens a WebSocket to the frontend API for session
sync; the CSP only allowed https:// to that origin, silently breaking
login (blank page, "Connection closed" exception) once enforced.
Public go-live hardening: Redis-backed rate limiting on the previously
invite-gated public surface (explore browsing, post/comment creation,
invite-cookie routes) plus CSP, HSTS, and standard security headers on
every response, now that the invite gate no longer filters traffic.
User feedback: pet profile pictures couldn't be enlarged. New
PetAvatarZoom client component wraps the profile avatar in a button —
clicking opens a lightbox Dialog showing the full photo, reusing
DialogContent's existing zoom-in-95 + fade entrance animation rather
than hand-rolling a new transition. A subtle hover scale + cursor-zoom-in
signals it's interactive. No-op when the pet has no avatar set (falls
back to initials, nothing to zoom into).
Advertisers/admins had no way to see how many times an ad was actually
shown — only engagement counts (reactions/comments/reposts) existed.
Adds Advertisement.adViewCount, a denormalized counter matching the
existing engagement-counter pattern.
AdCard.tsx fires ads.recordView once per card, the first time it
scrolls ≥50% into view (react-intersection-observer's triggerOnce,
already a project dependency via FeedList's pagination sentinel) —
matches standard "viewable impression" semantics rather than counting
on mount (which would also count ads that render off-screen and are
never actually seen). Not deduplicated per pet, unlike reactions/reposts
— an impression counts every time an ad becomes visible, matching how
ad platforms report view counts.
Admin ads panel (/p/[secret]/ads) now shows view/reaction/comment/
repost counts inline on every ad row — the actual "results" advertisers
want from a placement, previously not surfaced anywhere despite already
existing on the Advertisement row for the other three counters.
Two new chart panels on the admin dashboard, each with a day/week/month
granularity toggle:
- "Posts over time" — bar chart of new posts per bucket (trailing 30
days / 12 weeks / 12 months, zero-filled so gaps show as zero, not
missing points).
- "Owner growth" — line+area chart of the cumulative total registered
owners, seeded from a pre-window baseline count so the curve starts
at the correct absolute total instead of zero.
Backend: admin.getPostsOverTime/getOwnerGrowth bucket timestamps in
plain JS (UTC-consistent day/ISO-week-Monday/month-1st truncation) —
deliberately not raw SQL date_trunc, to avoid DB-session-timezone
ambiguity and keep this testable without hitting Postgres. Data volume
is small enough (Alpha-stage app) that fetching bare createdAt columns
and bucketing in memory is the simpler, lower-risk choice over adding
the codebase's first raw-SQL query.
Frontend: new src/components/admin/ (TimeSeriesChart, GranularityToggle)
following the dataviz skill — thin 2px marks, rounded bar corners,
recessive gridlines, hover crosshair+tooltip on both variants, single
brand-orange hue since each chart is one series (no legend needed).
Admin surface is fixed dark (zinc-950), so colors are hardcoded rather
than light/dark-aware, unlike the app-wide WeightChart this borrows its
SVG approach from.
Added 2 regression tests covering zero-fill bucketing and the
cumulative-with-baseline math. prisma-mock.ts gained owner.findMany/
owner.count (previously missing).
New users landed directly on pet creation with no prompt to acknowledge
community guidelines — the existing LegalUpdateBanner/LegalDocumentVersion
mechanism only ever ran *after* the first pet existed (since the Owner
row wasn't created until pets.create's owner.upsert), and turned out to
be entirely dormant (zero LegalDocumentVersion rows had ever been
published in prod).
Adds a step 0 to /onboarding/pet: OnboardingGuidelines queries the same
legal.getPendingUpdate the in-app update banner uses and shows the
latest published summary before letting the user continue to pet
creation. Reuses the existing LegalDocumentVersion/admin-publish
infrastructure (/p/[secret]/legal) instead of hardcoding copy, so
content stays editable without a deploy. If nothing has been published
yet, the step is skipped automatically — no dead-end for a fresh
deployment.
legal.acknowledge switched from owner.update to owner.upsert since it
can now be called before the Owner row exists (pre-first-pet).
Deliberately did NOT add a cookie-consent checkbox: Datenschutz §5
already discloses that only strictly-necessary session cookies are used
and no tracking/ad cookies are set without explicit consent — under
GDPR/ePrivacy, strictly-necessary cookies don't require active consent,
only disclosure. The guidelines step links to both Nutzungsbedingungen
and Datenschutz instead of a redundant separate consent mechanism.
Side effect (intentional): existing owners who never explicitly
acknowledged anything will see the same content once via the in-app
LegalUpdateBanner the next time a version is published, since it's the
same underlying data model.
A brand-new pet with zero posts of its own and no followees with posts
saw a completely empty feed on first visit. Instead of that dead-feeling
first impression, getFeed now falls back to recent posts from other pets
of the same species, ranked by the existing algoScore (engagement +
recency) — same idea as a "For You" feed, scoped by species instead of
follows.
Only kicks in on the first page (no cursor) of the primary Redis-backed
path, so paginating an already-empty follow feed doesn't keep serving
discovery pages. Response carries a `source: "following" | "discovery"`
flag; FeedList shows a small dismissless banner explaining the posts
aren't from follows yet, otherwise the feed renders identically
(WelcomeCard, feed-mode toggle, PostCard list all unchanged).
Added 2 regression tests covering the discovery-fallback trigger and
the "don't discovery-fallback while paginating" edge case.
ExploreCard already set whitespace-normal/break-words on the breed
Badge so long names wrap onto a second line, but Badge's base variant
locks height to h-5 with overflow-hidden (it's designed as a single-line
pill everywhere else it's used) — the pill's border never grew with the
wrapped text, clipping the second line. Overridden locally to h-auto/
overflow-visible (min-h-5 keeps the usual pill height for short names)
instead of touching the shared Badge component used across the app.
User found "Cat" showing English on a German-locale profile page. Root
cause: Species.name/Breed.name are the canonical English values; a
SpeciesTranslation/BreedTranslation table + seed data (Hund/Katze/Vogel
etc.) already existed in the schema, and PetForm's species/breed picker
already used it correctly via an explicit locale input param — but every
*display* surface (pet profile, PetCard, Sidebar/MobileNav, search,
explore, followers/following lists, mention @-search, health-card) just
read the raw untranslated name.
Adds `locale` to the tRPC context (createTRPCContext reads the
NEXT_LOCALE cookie the same way i18n/request.ts does), so read
procedures can resolve translations without every caller needing to
pass a locale param. New src/lib/localized-name.ts::pickLocalizedName()
does the lookup with a same-shape fallback to the raw name.
Updated: pets.ts (list/byId/getProfile/update), search.ts (pets/byOwner),
explore.ts (listPets), follows.ts (listFollowers/listFollowing).
health-card/[token]/page.tsx (public, unauthenticated, intentionally
all-German) resolves with a fixed "de" locale instead of ctx.locale,
consistent with its existing hardcoded WeightChart locale.
Verified the seed data is actually present in the production DB
(SpeciesTranslation has Dog→Hund, Cat→Katze, Bird→Vogel) — this fix is
immediately effective on deploy, not blocked on a missing seed run.
The entire /pets area (My Pets grid, pet profile page, followers/following
lists, the profile options dropdown, ReportSheet, BlockDialog) had zero
i18n despite ProfileTabs right next to it being fully translated — user
reported still seeing English after switching the app to German.
Adds 7 new message namespaces (PetsPage, PetProfile, FollowersPage,
FollowingPage, ProfileActions, ReportSheet, BlockDialog) with full EN/DE
parity, plus bio/adoptionStory placeholder keys to the existing PetForm
namespace (two placeholders were hardcoded English template literals
despite the rest of that form already being translated).
Server Components (pets/page.tsx, pets/[petId]/page.tsx,
followers/following pages) use getTranslations from next-intl/server
instead of the useTranslations client hook.
admin