journal-post resolved any post by id, so a menu entry or sitemap row
pointing at a draft or future post published its title and slug on the
anonymous menu API and in sitemap.xml. resolvePost now applies the
published filter; the reference list still offers drafts so editors can
wire a menu before the post goes live.
- journal-category (category tree references, nesting returns the subtree),
all-journal-categories (by name), all-journal-posts (published, by title)
and category-journal-posts (category and descendants, published, by title)
- list types take the record type's DefaultPattern and set PatternFrom, and
build their items from the layered pattern
- menuitem labels for all five types in en and pl
- README section Menu item types and API reference rows
- TestMenuItemTypesSmoke covers host and item overrides, nesting, ordering,
the published filter and x-default
- posts: FormAfterCreate/Update purge after the content_html translations,
new FormAfterDelete; categories: FormAfterCreate and FormAfterDelete
- NewSiteCachePurger refuses half configuration, non-http(s) URLs, user
info, fragments, http to a non-loopback host and tokens under 32 chars;
Boot logs the endpoint host and path once
- TestPostsAdminPurgesSiteCache smoke test
- README: Configuration section (keys, contract, timing, scope), API rows
captureAttributes and renderCaptured dropped only on* names, so id,
name, style, srcset, background and the like from stored HTML were
rendered by ProseMirror into the live admin DOM (DOM clobbering of
document.querySelector, fixed-position overlays, remote loads). htmlAttrs
now keeps an allowlist: class, title, alt, width, height, colspan,
rowspan, start, rel, target and data-*; href and src stay with the link
and image nodes. Other attributes are dropped from a block once it is
edited; untouched documents and untouched blocks keep their bytes.
- figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$ (the embed
placeholder), img alt with any text, ol start ^[0-9]+$; nothing else
- TestEditorOutputPassesPolicy checks every editor-corpus.json entry byte
for byte with an empty report, plus the negative cases;
TestSanitizeHTMLReport pins the removal report
- CheckHTML documented as a predicate no write path refuses with; README
lists the four additions and the report API
- category content is the blogeditor type (uploadFolder categories): it is
stripped and reported like post content; the 422 CheckHTML gate is
retired and blank content still becomes NULL
- blogeditor and mlblogeditor Upload: magic-byte check for JPEG, PNG, GIF
and WebP matching the extension, safe lowercase names, storage through
classes.StoreMedia in the field's uploadFolder
- TestBlogEditorUploadSmoke, TestCategoriesAdminContent asserts the strip,
README describes the field types, admin saves and editor uploads
- preservationExtensions: raw HTML cards for unmodelled blocks (shown as
text), figure with figcaption, the YouTube embed placeholder node, span
marks, a global attribute map (never on* handlers), tables without
colgroup or min-width, inline images without base64
- serializeDocument keeps the original bytes of every top-level block still
equal to the loaded one, so editing one paragraph changes only that
paragraph; tables serialize with thead and bare cell text
- Links accept only http, https, mailto and relative URLs (isPolicyUrl, the
rule both sanitizer policies apply) and gain no target, rel or class
- Toolbar with headings, marks, lists, links, blockquote, table editing,
images, embeds, raw HTML block, undo and redo; en and pl labels
- Images from the picker or a drop go out as summer-upload and are inserted
on summer-upload-result with alt text and an optional caption
- editor-corpus.json: the editor own output, rebuilt and checked by
corpus.test.ts (UPDATE_CORPUS=1 rewrites it) for the policy tests
- README Blog Editor section
golang.org/x/net/html's tokenizer keeps only the first of repeated
attribute names, so FormatHTML's byte-preserving comparison saw
<a href="https://x" href="javascript:...">, <img src=ok
src="javascript:..."> and a repeated style as unchanged and stored the
raw bytes, and CheckHTML accepted them.
htmlTokens now scans each start tag's raw bytes for its attribute names,
following the tokenizer's own readTag rules, and reports the document as
changed when that list differs from the attributes the tokenizer kept.
Such input is stored as bluemonday's output, which keeps the first value
as browsers do, and CheckHTML refuses it. Input without repeated
attributes is still stored byte for byte. A differential run of 2M
random tags found no disagreement between the scan and the tokenizer.
A translated content_html sent through the Journal API (syncTranslations
formatted only when content_html was empty) or through
journal:import-posts (no check) was stored verbatim and served by the
anonymous GET /_journal/api/v1/posts and /posts/{slug}. A translation
keyed on the default locale also wrote the host content_html column
past FormatHTML.
classes.FormatTranslation now sets content_html for every translated
locale before it is stored: rendered from a non-blank content with
FormatHTML (host-column parity; a supplied content_html is replaced),
otherwise a supplied content_html is sanitized with the new
classes.SanitizeHTML, which FormatHTML reuses. Both write paths call it.
PHP parity note: Winter's PostApiController::syncTranslations called
Post::formatHtml only when content_html was empty and otherwise stored
the supplied content_html verbatim; ImportPosts::syncTranslations stored
it verbatim; the MLJournalMarkdown admin widget always derived it from
content via formatHtml. The Go port now follows the admin widget on
every path. Response shapes and status codes for valid input are
unchanged; only the stored content_html of unsafe or content-mismatched
translations differs.
- FormatHTML sanitizes the goldmark output with a bluemonday UGC policy
extended only with what goldmark and the imported posts and categories
use; unsafe markup is stripped, as Winter's Html::clean strips it
- HTML the policy keeps whole is stored byte for byte (token comparison)
- CheckHTML keeps its signature and 422 contract, refusing HTML the
policy would change
- the three regexes are gone: the CR-01 bypasses are neutralized and
"Data:" or "metadata:" text is no longer refused (WR-01)
- FormatHTML renders with goldmark html.WithUnsafe(), as Winter's
Markdown::parse passes raw HTML through, so an admin save, an import or
an API write no longer turns imported HTML into raw HTML omitted
- rejectUnsafe still runs after the render and refuses script, iframe,
object and embed tags, event handlers and javascript, vbscript and data
URLs; API response shapes are unchanged
- TestFormatHTMLKeepsRawHTML covers HTML paragraphs and a raw footer
- add a content textarea (size huge) after description, with en and pl phrases
- add content to Category.Fillable
- export classes.CheckHTML and run it from FormBeforeCreate and FormBeforeUpdate:
unsafe category content answers 422 on content, blank content is stored as NULL
- add the nullable TEXT column golem15_journal_categories.content (migration 202610090001)
- map it as models.Category.Content and emit category content on every categories row
- document the categories row shape and the stored-as-is HTML semantics
- AuthorPosts reuses the /posts published predicate, per_page clamp, sort allow-list and row serializer
- Bearer tokens are ignored; drafts and scheduled posts never appear
- Both author routes share one resolve-or-respond helper for identical 404/500 paths
- Document query keys, envelope and 404 in README
- Resolve {author} by golem15_bloghub_author_slug, then by login for users with a published post
- Project only id, names, login and author slug from backend_users; payload is id, slug, first_name, last_name
- JSON 404 {"error":"Author not found"} for unknown, soft-deleted and malformed values
- Document the route in README
- POST /_journal/api/v1/media/upload requires access_posts and stays under journal/
- Anonymous GET rss is RSS 2.0 honoring rss_* settings; unpublished posts are omitted
- beachcomber Gate reads search_use_typesense (default false) so a fresh save makes no Typesense HTTP
Co-authored-by: Cursor <cursoragent@cursor.com>
Operators get UI catalogs for plugin, journal, post, category, and tag
keys, plus an application-neutral README for the compiled plugin.
Co-authored-by: Cursor <cursoragent@cursor.com>
