3 Commits

Author	SHA1	Message	Date
Jakub Zych	e54fd257ee	feat(12.2-02): add file removal, caption, reorder and protected downloads ... - DELETE, PUT and POST reorder under .../{id}/files/{field}, each scoped by one parent query (404 for a foreign file) - protected download and thumb routes: is_public=false only, nosniff, private no-store, sandbox CSP, inline only for jpeg/png/gif/webp - the save applies deferred removals, replaces attachOne files and rechecks maxFiles and required - blobs of deleted files are removed after commit - swagger2openapi emits binary content for file responses - admin OpenAPI, TS types, conformance, README and attachments docs	2026-10-02 18:11:56 +02:00
Jakub Zych	044e0450ef	feat(12.2-02): add the fileupload field with deferred uploads committed on save ... - type: fileupload compiles the D-08 keys and binds to the model's attach.Relation at boot - X-Session-Key (cabana.SessionKeyHeader) carries the form session key; RecordInput.SessionKey - GET and POST .../{id}/files/{field}: list with pending uploads, multipart upload into attach.Store - the create and update save attaches the session's pending files in its transaction - swagger2openapi folds formData parameters into a multipart requestBody - admin OpenAPI, TS types, conformance cases, README and forms docs	2026-10-02 18:04:34 +02:00
Jakub Zych	ef448da1cc	test(10-05): cover every Phase 10 Go change with branch-level tests ... - bouncer TestPhase10CookieGuard: cookie read without Bearer, Bearer wins, empty cookie, frontend audience and blacklisted jti rejected - boardwalk TestPhase10BoardwalkServing: HEAD, query strings, encoded traversal, index by name, nested prefix, MIME fallback, constructor errors - cabana TestPhase10Coverage: mounted unsafe routes vs the CSRF walk, option and filter edges, read-only labels, relation message defaults, bundle fallback locale, cookie refresh of an expired token in the refresh window - phrasebook override precedence, new locale, Bundle merge order, Forms shapes - surf prefix collision for deeper paths and the default /backend prefix - swagger2openapi TestUnionRewrite and converter branch tests - framework tests no longer name the application (acme fixtures instead)	2026-09-27 18:05:28 +02:00