robbertbos/waggle
robbertbos/waggle
1
0
Fork 0
Code Issues 1 Pull requests 6 Releases 14 Packages 2 Activity Actions

Attachments end-to-end: drafts, replies and scheduled posts (fase 2b) #145

Closed
robbertbos wants to merge 6 commits from fase-2b-kabel-v2 into main
pull from: fase-2b-kabel-v2
merge into: robbertbos:main
Conversation 0 Commits 6 Files changed 41 +1627 -648
robbertbos commented 2026-07-21 04:26:35 +00:00
Owner
Copy link

Fase 2b van "nieuw bericht opstellen + plannen". Base: main.

Bijlagen reizen nu end-to-end als geparkeerde refs (owned uuids) door concept, direct antwoord en gepland bericht, en uploaden pas naar Mattermost op het moment van verzenden (dat ontwijkt de 7-daagse vervaltermijn van MM voor niet-gekoppelde bestanden). De oude POST /cards/{id}/files-route (MM file_id-currency) is geschrapt ten gunste van de kaartloze POST /outgoing-files (ref-currency). Een dagelijkse orphan-sweep ruimt geparkeerde bestanden op die na 7 dagen door geen enkele rij meer worden gerefereerd.

Uit de adversariele review-pass (security / correctness / WCAG)

  • Concept-bijlagen rehydrateren bij het laden, zodat een heropend concept ze niet stil loskoppelt.
  • Een bijlage die tijdens uploaden wordt verwijderd lekt niet meer; een lopende concept-save wordt geflusht bij unmount.
  • Upload-fouten worden in een aria-live-regio aangekondigd en met tekst gemarkeerd (niet alleen kleur).
  • De runner verwijdert geparkeerde bestanden pas nadat STATE_SENT is vastgelegd.
  • _delete_orphan_refs is per-eigenaar gescoped; outgoing_files faalt dicht op een eigenaarloze sidecar.

BIO/DPIA/NeRDS-review-fixes (in deze PR verwerkt)

  • Bijlage-inhoud versleuteld at rest (eigen HKDF-domein waggle-parkedfile-v1).
  • Retry plaatst geen dubbele bijlage meer (mm_file_id-memo persistent).
  • Account loskoppelen ruimt de geparkeerde bijlagen op.
  • Toegankelijke upload-status + disabled-reden (WCAG 4.1.3 / 1.4.1).
  • Audit-events op de vertrouwensgrens: verzending naar MM + quota-weigering.
  • Docs: quota-grens, volume-encryptie/DPIA, bewaartermijn.

Poorten

Backend 1398 tests, 100% coverage; frontend tsc + vitest + build + eslint; pre-commit schoon. Postgres-parity + e2e via CI.

Fase 2b van "nieuw bericht opstellen + plannen". Base: main. Bijlagen reizen nu end-to-end als geparkeerde refs (owned uuids) door concept, direct antwoord en gepland bericht, en uploaden pas naar Mattermost op het moment van verzenden (dat ontwijkt de 7-daagse vervaltermijn van MM voor niet-gekoppelde bestanden). De oude `POST /cards/{id}/files`-route (MM file_id-currency) is geschrapt ten gunste van de kaartloze `POST /outgoing-files` (ref-currency). Een dagelijkse orphan-sweep ruimt geparkeerde bestanden op die na 7 dagen door geen enkele rij meer worden gerefereerd. ## Uit de adversariele review-pass (security / correctness / WCAG) - Concept-bijlagen rehydrateren bij het laden, zodat een heropend concept ze niet stil loskoppelt. - Een bijlage die tijdens uploaden wordt verwijderd lekt niet meer; een lopende concept-save wordt geflusht bij unmount. - Upload-fouten worden in een aria-live-regio aangekondigd en met tekst gemarkeerd (niet alleen kleur). - De runner verwijdert geparkeerde bestanden pas nadat STATE_SENT is vastgelegd. - `_delete_orphan_refs` is per-eigenaar gescoped; `outgoing_files` faalt dicht op een eigenaarloze sidecar. ## BIO/DPIA/NeRDS-review-fixes (in deze PR verwerkt) - Bijlage-inhoud versleuteld at rest (eigen HKDF-domein `waggle-parkedfile-v1`). - Retry plaatst geen dubbele bijlage meer (mm_file_id-memo persistent). - Account loskoppelen ruimt de geparkeerde bijlagen op. - Toegankelijke upload-status + disabled-reden (WCAG 4.1.3 / 1.4.1). - Audit-events op de vertrouwensgrens: verzending naar MM + quota-weigering. - Docs: quota-grens, volume-encryptie/DPIA, bewaartermijn. ## Poorten Backend 1398 tests, 100% coverage; frontend tsc + vitest + build + eslint; pre-commit schoon. Postgres-parity + e2e via CI.
robbertbos closed this pull request 2026-07-21 06:19:28 +00:00
robbertbos reopened this pull request 2026-07-21 18:46:53 +00:00
robbertbos force-pushed fase-2b-kabel-v2 from 37d283d720
Some checks failed
CI / pre-commit (pull_request) Successful in 55s
Details
CI / frontend-test (pull_request) Successful in 5m20s
Details
CI / release-scripts (pull_request) Successful in 10s
Details
security-scan / Python SCA (pip-audit) (pull_request) Failing after 22s
Details
security-scan / Python SAST (bandit) (pull_request) Failing after 22s
Details
security-scan / JS SCA (npm audit) (pull_request) Successful in 44s
Details
security-scan / Filesystem scan (trivy fs) (pull_request) Failing after 6s
Details
security-scan / SBOM (trivy) (pull_request) Successful in 17s
Details
test-build / build (backend) (pull_request) Failing after 7s
Details
test-build / build (frontend) (pull_request) Failing after 7s
Details
test-build / build (pull_request) Failing after 0s
Details
CI / backend-test (pull_request) Successful in 8m49s
Details
CI / e2e (pull_request) Successful in 8m55s
Details
CI / backend-test-postgres (pull_request) Successful in 10m2s
Details
to 5b59b3ad04
Some checks failed
CI / pre-commit (pull_request) Has been cancelled
Details
CI / backend-test (pull_request) Has been cancelled
Details
CI / backend-test-postgres (pull_request) Has been cancelled
Details
CI / frontend-test (pull_request) Has been cancelled
Details
CI / e2e (pull_request) Has been cancelled
Details
CI / release-scripts (pull_request) Has been cancelled
Details
security-scan / Python SAST (bandit) (pull_request) Successful in 37s
Details
security-scan / Python SCA (pip-audit) (pull_request) Successful in 56s
Details
security-scan / JS SCA (npm audit) (pull_request) Successful in 38s
Details
security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 24s
Details
security-scan / SBOM (trivy) (pull_request) Successful in 18s
Details
test-build / build (backend) (pull_request) Successful in 2m1s
Details
test-build / build (frontend) (pull_request) Successful in 2m21s
Details
test-build / build (pull_request) Successful in 0s
Details
2026-07-21 20:53:21 +00:00 Compare
robbertbos changed title from Connect the attachment cable end-to-end and harden it (fase 2b) to Attachments end-to-end: drafts, replies and scheduled posts (fase 2b) 2026-07-21 21:02:39 +00:00
Composer drag-and-drop: dropzone overlay + attachment thumbnails
Some checks failed
CI / pre-commit (pull_request) Successful in 53s
Details
CI / frontend-test (pull_request) Successful in 5m17s
Details
CI / release-scripts (pull_request) Successful in 10s
Details
security-scan / Python SCA (pip-audit) (pull_request) Successful in 1m0s
Details
CI / backend-test (pull_request) Successful in 8m38s
Details
security-scan / Python SAST (bandit) (pull_request) Successful in 36s
Details
security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 25s
Details
CI / e2e (pull_request) Successful in 8m11s
Details
security-scan / JS SCA (npm audit) (pull_request) Successful in 39s
Details
security-scan / SBOM (trivy) (pull_request) Successful in 19s
Details
CI / backend-test-postgres (pull_request) Failing after 9m33s
Details
test-build / build (backend) (pull_request) Successful in 2m6s
Details
test-build / build (frontend) (pull_request) Successful in 2m36s
Details
test-build / build (pull_request) Successful in 0s
Details
017715c474
 
- A dragged file is always attached, never inserted at a caret, so the
  ProseMirror drop-cursor (which promised placement) is turned off, and a
  dragover overlay ('Sleep bestanden hier...') makes the drop target explicit.
- Attachment chips show an image thumbnail (client-side object URL, revoked on
  removal/unmount) or a paperclip icon; there is no read-back route, so a
  rehydrated image falls back to the icon.
robbertbos closed this pull request 2026-07-23 21:18:31 +00:00
Some checks failed
CI / pre-commit (pull_request) Successful in 53s
Required
Details
CI / frontend-test (pull_request) Successful in 5m17s
Required
Details
CI / release-scripts (pull_request) Successful in 10s
Required
Details
security-scan / Python SCA (pip-audit) (pull_request) Successful in 1m0s
Required
Details
CI / backend-test (pull_request) Successful in 8m38s
Required
Details
security-scan / Python SAST (bandit) (pull_request) Successful in 36s
Required
Details
security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 25s
Required
Details
CI / e2e (pull_request) Successful in 8m11s
Required
Details
security-scan / JS SCA (npm audit) (pull_request) Successful in 39s
Required
Details
security-scan / SBOM (trivy) (pull_request) Successful in 19s
Required
Details
CI / backend-test-postgres (pull_request) Failing after 9m33s
Required
Details
test-build / build (backend) (pull_request) Successful in 2m6s
Details
test-build / build (frontend) (pull_request) Successful in 2m36s
Details
test-build / build (pull_request) Successful in 0s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
nldd ds

   
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
nldd ds
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
robbertbos/waggle!145
No description provided.