- Decode: clean values byte for byte, nil, non-string refusal, the 35
unsafe payloads stripped with notices exactly when changed
- notices order, ten-name cut, plural forms in lang/en and lang/pl
- LooksLikeHTML, options, ListValue, Upload sniffing and safe names
- StoreMedia layout, suffixes, no overwrite, size and folder rules
- editor corpus and policy cross-check extended in place: more negatives,
notices only when stripped, stable second pass
- TestPostsEditorHooks: create and update, default and non-default
writes, no writes, no writer
- TestCategoriesAdminBlogEditor (Docker host): untouched saves keep
imported markup and NULL, clean edit, strip and report, blank to NULL,
editor upload
- element.test.ts: an untouched value survives Source tab, tab buttons,
preview and reattach byte for byte with no summer-change
- TestBlogEditorLoad: HTML verbatim, markdown as content_html, FormatHTML
fallback, nil and empty values
- TestPostsAdminResaveKeepsHTML (Docker host): GET then PUT the served
values for an HTML and a markdown post, exact bytes, no notices, then a
clean edited save in both locales
- The preview re-renders 300 ms after the last WYSIWYG edit, Source input or external value, never while off or after detach.
- YouTube placeholders show as img.youtube.com thumbnail cards with no player; the preview copy drops active elements and on* attributes, and its stylesheet uses colours resolved from the host's --c-* values.
- A per-element Preview toggle (aria-pressed, off by default) splits the editor 50/50 with an auto-fit grid that wraps the pane below on narrow widths.
- The pane is an iframe with an empty sandbox, content set only through srcdoc, created on first use; it reads only the value getter, so previewing never edits or emits summer-change.
- figure data-embed ^youtube$ and data-id ^[A-Za-z0-9_-]{11}$ (the embed
placeholder), img alt with any text, ol start ^[0-9]+$; nothing else
- TestEditorOutputPassesPolicy checks every editor-corpus.json entry byte
for byte with an empty report, plus the negative cases;
TestSanitizeHTMLReport pins the removal report
- CheckHTML documented as a predicate no write path refuses with; README
lists the four additions and the report API
- category content is the blogeditor type (uploadFolder categories): it is
stripped and reported like post content; the 422 CheckHTML gate is
retired and blank content still becomes NULL
- blogeditor and mlblogeditor Upload: magic-byte check for JPEG, PNG, GIF
and WebP matching the extension, safe lowercase names, storage through
classes.StoreMedia in the field's uploadFolder
- TestBlogEditorUploadSmoke, TestCategoriesAdminContent asserts the strip,
README describes the field types, admin saves and editor uploads
- classes.StoreMedia holds the media upload route's storage: extension
allowlist, 10240 KiB cap, /journal/<folder>/<name> keys with the unique
suffix, bucket write and public URL
- UploadMedia keeps authentication, permissions, the folder and form checks
and answers with the same 201 body and messages
- uniqueMediaKey fails instead of overwriting when every numbered name is
taken; the media path tests move to classes
- blogeditor and mlblogeditor field types (classes.BlogEditorTypes) on the
plugin; post content is mlblogeditor with htmlColumn content_html
- Decode stores SanitizeHTMLReport output per locale with notices naming
what was removed; clean HTML is stored byte for byte, nothing is refused
because of markup
- Load serves HTML as stored and markdown posts as their content_html
- the admin hooks copy written content to content_html per locale without
goldmark; untouched content leaves both columns as they are
- editor lang keys (en, pl plural notices), tracer smoke test, updated
Postgres admin tests
- SanitizeHTMLReport returns the policy output plus HTMLRemovals: removed
elements, attributes (repeats and changed values included) and comments,
at most ten distinct names per list with exact counts
- SanitizeHTML is the string half of it; FormatHTML, FormatTranslation and
CheckHTML keep their behaviour
- preservationExtensions: raw HTML cards for unmodelled blocks (shown as
text), figure with figcaption, the YouTube embed placeholder node, span
marks, a global attribute map (never on* handlers), tables without
colgroup or min-width, inline images without base64
- serializeDocument keeps the original bytes of every top-level block still
equal to the loaded one, so editing one paragraph changes only that
paragraph; tables serialize with thead and bare cell text
- Links accept only http, https, mailto and relative URLs (isPolicyUrl, the
rule both sanitizer policies apply) and gain no target, rel or class
- Toolbar with headings, marks, lists, links, blockquote, table editing,
images, embeds, raw HTML block, undo and redo; en and pl labels
- Images from the picker or a drop go out as summer-upload and are inserted
on summer-upload-result with alt text and an optional caption
- editor-corpus.json: the editor own output, rebuilt and checked by
corpus.test.ts (UPDATE_CORPUS=1 rewrites it) for the policy tests
- README Blog Editor section
- golem15-journal-blogeditor (BlogEditorElement): light-DOM element with a
TipTap WYSIWYG tab and a Source tab that edits the exact HTML string
- The value is the exact served string until a user edit; external values
go in with emitUpdate false; summer-change fires on user edits only and
an echo set is a no-op
- StarterKit without the trailing node, links without target, rel or class;
injectCSS false with the ProseMirror base rules in blogeditor.css under
the element tag, colours from --c-* only
- Committed bundle embedded through admin.go; vitest smoke on an imported
post fixture (footer, style block, spans, figure, table, entities)
- Private ESM package with exact pins: @tiptap/core, pm, starter-kit,
extension-table and extension-image 3.31.4; vite 7.3.5, vitest 3.2.7,
happy-dom 20.11.6 and typescript 5.9.3, the admin SPA toolchain
- vite.config.ts builds assets/src/blogeditor/index.ts into fixed-name
assets/dist/blogeditor.js and blogeditor.css, minified, and runs vitest
on happy-dom
- scripts/check-dist.sh rebuilds into a temp dir and fails when assets/dist
is stale; node_modules is ignored
golang.org/x/net/html's tokenizer keeps only the first of repeated
attribute names, so FormatHTML's byte-preserving comparison saw
<a href="https://x" href="javascript:...">, <img src=ok
src="javascript:..."> and a repeated style as unchanged and stored the
raw bytes, and CheckHTML accepted them.
htmlTokens now scans each start tag's raw bytes for its attribute names,
following the tokenizer's own readTag rules, and reports the document as
changed when that list differs from the attributes the tokenizer kept.
Such input is stored as bluemonday's output, which keeps the first value
as browsers do, and CheckHTML refuses it. Input without repeated
attributes is still stored byte for byte. A differential run of 2M
random tags found no disagreement between the scan and the tokenizer.
A translated content_html sent through the Journal API (syncTranslations
formatted only when content_html was empty) or through
journal:import-posts (no check) was stored verbatim and served by the
anonymous GET /_journal/api/v1/posts and /posts/{slug}. A translation
keyed on the default locale also wrote the host content_html column
past FormatHTML.
classes.FormatTranslation now sets content_html for every translated
locale before it is stored: rendered from a non-blank content with
FormatHTML (host-column parity; a supplied content_html is replaced),
otherwise a supplied content_html is sanitized with the new
classes.SanitizeHTML, which FormatHTML reuses. Both write paths call it.
PHP parity note: Winter's PostApiController::syncTranslations called
Post::formatHtml only when content_html was empty and otherwise stored
the supplied content_html verbatim; ImportPosts::syncTranslations stored
it verbatim; the MLJournalMarkdown admin widget always derived it from
content via formatHtml. The Go port now follows the admin widget on
every path. Response shapes and status codes for valid input are
unchanged; only the stored content_html of unsafe or content-mismatched
translations differs.
- FormatHTML sanitizes the goldmark output with a bluemonday UGC policy
extended only with what goldmark and the imported posts and categories
use; unsafe markup is stripped, as Winter's Html::clean strips it
- HTML the policy keeps whole is stored byte for byte (token comparison)
- CheckHTML keeps its signature and 422 contract, refusing HTML the
policy would change
- the three regexes are gone: the CR-01 bypasses are neutralized and
"Data:" or "metadata:" text is no longer refused (WR-01)
- TestFormatHTMLKeepsRawHTML: imported-style bodies (paragraphs, attributes, https links and images, entities) round-trip; markdown keeps a trailing raw footer and style
- TestFormatHTMLRejectsUnsafeHTML: every unsafe case must return an error now that the gate is the only defence; adds svg onload, mixed-case schemes and tags, object, embed, script in an HTML block and raw data URLs
- TestPostsAdminResaveKeepsHTML: an admin update of HTML content keeps content_html
- FormatHTML renders with goldmark html.WithUnsafe(), as Winter's
Markdown::parse passes raw HTML through, so an admin save, an import or
an API write no longer turns imported HTML into raw HTML omitted
- rejectUnsafe still runs after the render and refuses script, iframe,
object and embed tags, event handlers and javascript, vbscript and data
URLs; API response shapes are unchanged
- TestFormatHTMLKeepsRawHTML covers HTML paragraphs and a raw footer
- add a content textarea (size huge) after description, with en and pl phrases
- add content to Category.Fillable
- export classes.CheckHTML and run it from FormBeforeCreate and FormBeforeUpdate:
unsafe category content answers 422 on content, blank content is stored as NULL
- add the nullable TEXT column golem15_journal_categories.content (migration 202610090001)
- map it as models.Category.Content and emit category content on every categories row
- document the categories row shape and the stored-as-is HTML semantics
- AuthorPosts reuses the /posts published predicate, per_page clamp, sort allow-list and row serializer
- Bearer tokens are ignored; drafts and scheduled posts never appear
- Both author routes share one resolve-or-respond helper for identical 404/500 paths
- Document query keys, envelope and 404 in README
- Resolve {author} by golem15_bloghub_author_slug, then by login for users with a published post
- Project only id, names, login and author slug from backend_users; payload is id, slug, first_name, last_name
- JSON 404 {"error":"Author not found"} for unknown, soft-deleted and malformed values
- Document the route in README
The admin names a list page, its heading and breadcrumb after the first
side-menu item of its controller. The new_post item pointed at the posts
list too, came first and won. A side item cannot open the create form, so
drop it; the list toolbar's Create button stays.
Named JOURNAL-001/002 fillable, FormatHTML unsafe tags, rollback/remigrate, RSS/categories/tags/media, and TestSearchGateOff with zero Typesense HTTP.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add TestJournalEndToEnd through party/surf/cabana on real Postgres
- Extract the admin harness and activate user+translate+journal in Requires order
- Anonymous list hides drafts; Bearer writes; JOURNAL-005 404 has no data key
Co-authored-by: Cursor <cursoragent@cursor.com>
- POST /_journal/api/v1/media/upload requires access_posts and stays under journal/
- Anonymous GET rss is RSS 2.0 honoring rss_* settings; unpublished posts are omitted
- beachcomber Gate reads search_use_typesense (default false) so a fresh save makes no Typesense HTTP
Co-authored-by: Cursor <cursoragent@cursor.com>
- Show unpublished or future posts as 404 without a data key unless owner or access_other_posts
- POST/PUT/DELETE posts and featured-images require a backend-audience JWT and PHP {error} strings
- Anonymous GET categories and tags return the PHP list keys; frontend-audience tokens cannot write
Co-authored-by: Cursor <cursoragent@cursor.com>
- Public and write groups under /_journal/api/v1 with journal-public-api and journal-api buckets (Max 120)
- Index omits drafts and future published_at; per_page default 9 max 30
- Optional backend JWT on GET; missing Bearer on writes returns PHP {error:Authentication required}
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the remaining YAML admin screens and the settings singleton
so a host can boot Posts, Categories, Tags, and Code journal. Posts
update and delete refuse other authors without access_other_posts.
Co-authored-by: Cursor <cursoragent@cursor.com>
YAML-driven Posts screen stores translatable markdown and regenerates
content_html in the plugin. Publish writes without access_publish are
refused; list and form queries stay on the principal without
access_other_posts.
Co-authored-by: Cursor <cursoragent@cursor.com>
TestPostTranslatableSmoke ran Plugin.Migrations() on an empty Postgres, so the author_slug ALTER failed. Match TestJournalTables and migrate lagoon backend_users first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Operators get UI catalogs for plugin, journal, post, category, and tag
keys, plus an application-neutral README for the compiled plugin.
Co-authored-by: Cursor <cursoragent@cursor.com>
Squash the remaining golem15_journal_* tables plus the backend_users
author slug so a host migrate matches the frozen PHP schema.
Co-authored-by: Cursor <cursoragent@cursor.com>
summer build rejects models importing a sibling updates package, and a
go.mod translate replace collides with the host workspace module path.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Register golem15.journal requiring exactly golem15.translate
- Squash golem15_journal_posts DDL with unique slug and JSONB columns
- Persist one en/pl Post through translate helpers on real Postgres
Co-authored-by: Cursor <cursoragent@cursor.com>
