- Enforce task ownership on PATCH/DELETE /api/tasks (was: any signed-in
user could edit or delete anyone's tasks)
- Validate all API request bodies with zod; escape user content and
restrict links to http(s) in the Drive export; block reverting a
SUBMITTED report
- Add @@unique([userId, date]) on Report with upsert to eliminate the
duplicate-daily-report race; switch startup from
`prisma db push --accept-data-loss` to `prisma migrate deploy` with
automatic baselining of existing databases (dedup migration merges
any pre-existing duplicates)
- Autosave: re-queue and retry failed task saves with a visible
saving/error indicator instead of silently dropping edits
- Paginate and filter GET /api/reports (?date, ?mine, ?q, ?take,
?cursor); report form fetches only today's report, admin dashboard
uses server-side search + Load more
- Type the frontend and lib layer (DTOs in src/types/api.ts); zero
eslint errors
- Update README and Unraid guide for migrations, upgrade path, and API
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The classic Docker builder (used by docker-build.yml on the host runner)
does not support heredoc COPY syntax, which caused 'COPY failed: no source
files were specified'. Replace the heredoc with a checked-in entrypoint.sh
copied normally.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With strategy:"database" there is no JWT cookie, so getToken() always
returns null. The Google access_token is stored in the Account table by
the PrismaAdapter. Query it directly via prisma.account.findFirst()
instead of the JWT helper.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Without prisma.config.ts in the runner stage, prisma db push has no
datasource URL (schema.prisma no longer carries url in Prisma 7) and
silently skips creating the database. Also add set -e to the entrypoint
so any db push failure is visible in logs and stops the container.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The mkdir was running before the standalone COPY, which could overwrite
/app/data contents or permissions. Move it to after all COPY statements
and use chmod 700 so only nextjs owns and can write the SQLite data dir.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
npm ci with a Windows-generated lockfile skips @libsql/linux-x64-musl
(optional native dep). Switching to npm install lets npm resolve the
correct platform-specific binary for the Alpine container. Also copy
node_modules into the runner stage so prisma db push and the libsql
native module are available at runtime.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PrismaLibSql constructor takes a Config object (with url), not a
pre-created Client instance. Remove the unnecessary createClient call
and the @libsql/client direct dependency.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
apk upgrade hangs on slow/unreliable Alpine mirrors and is not needed
for a build. node:20-alpine is sufficiently up to date.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
prisma.config.ts is a Prisma CLI config file, not part of the Next.js
app — exclude it from tsconfig to prevent type errors. Also revert the
migrate.adapter block (not a valid PrismaConfig key in 7.5) back to
datasource.url which is the correct CLI config for db push.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@libsql/client and libsql contain native bindings and non-JS assets
(README.md, LICENSE) that webpack cannot parse. Mark them as server
external packages so Next.js requires them at runtime instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prisma 7 removed support for `url` in schema.prisma datasources and the
`engineType = "library"` native binary engine. All connections now go
through a driver adapter.
- Remove engineType and url from schema.prisma (no longer supported)
- Configure prisma.config.ts with migrate.adapter using @libsql/client
- Instantiate PrismaClient with PrismaLibSQL adapter in src/lib/prisma.ts
- Add @libsql/client and @prisma/adapter-libsql dependencies
- Remove PRISMA_CLIENT_ENGINE_TYPE from Dockerfile (obsolete)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prisma 7's prisma.config.ts only configures the CLI, not the runtime
PrismaClient. Without url in the datasource block, the generated client
defaults to engineType "client" (WASM) which requires an adapter,
causing next-auth adapter errors on OAuth callback.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Jason Stedwell
jason