- Add SVG favicon using pine/paper design tokens; wire into index.html
- Add SidebarLabel component with ResizeObserver overflow detection and
CSS-only tooltip (pine-deep bg, IBM Plex Mono, 0.08s fade, no delay)
- Fix Meilisearch invalid_api_key: default api key to None instead of ''
so no Authorization header is sent when auth is disabled
- Stub ResizeObserver in test setup for jsdom compatibility
- Wrap async renders in act() and advance fake timers inside act() to
eliminate all act() warnings in App.test.tsx
Markdown and image previews were rendering blank because
@monaco-editor/react loads its core assets from cdn.jsdelivr.net at
runtime, which the deployment server's network can't reach. Switching
to @uiw/react-codemirror removes the CDN dependency entirely (all
assets ship in the build) and cuts bundle size from ~2.5MB to ~770KB.
Also add proper image/* content-type detection so images render via
<img> instead of being force-decoded as editor text.
Adds a folder picker (webkitdirectory) and drag-and-drop directory
support (File System Entries API), preserving relative paths via
a new optional relative_path field on the upload endpoint.
Single-node deployment doesn't benefit from S3 abstraction overhead;
LocalFileClient keeps the same interface DocumentService depends on,
backed by a STORAGE_DIR volume mount instead of a separate Garage service.
The backend no longer mentions MinIO anywhere: MinioClient -> GarageClient
(minio_client.py -> garage_client.py), MINIO_* env vars -> GARAGE_*, and
the `minio` Python package is replaced with `boto3` (AWS's generic S3
client) since Garage is the only storage backend this project targets
now. S3 API semantics are unchanged, so document_service.py's behavior
is identical — this is a naming and dependency swap, not a logic change.
Also updates test fixtures/names (FakeMinioClient -> FakeGarageClient,
FakeMinioSDK -> FakeS3SDK) and storage/README.md, which no longer frames
Garage as a MinIO replacement (that migration note has served its purpose
now that no MinIO reference remains in the codebase).
Backend: 54/54 tests passing. Frontend: 38/38 tests passing (unaffected,
verified for regressions since it talks to the backend only through the
unchanged REST API).
- Default CORS_ORIGINS to http://localhost:5173 instead of "*" (still overridable)
- Reject ".." and leading "/" in document keys/paths across get/save/delete/upload,
mapped to HTTP 400 via new InvalidPathError
- Add a delete button to DocumentEditor wired to deleteDocument + onDeleted,
giving the existing DELETE API an actual UI entry point
- Share a single lru_cache'd Meilisearch (and Minio) SDK client instance instead
of constructing duplicates in dependencies.py
- Add a startup check that creates the MinIO bucket if missing, tolerating
MinIO being unreachable at boot without crashing the app
- main.py: remove duplicate /health endpoint definition
- text_extract.py: HTML-escape extracted plain text before indexing so raw
markup in uploaded documents can't render as live HTML via search snippets
(stored XSS fix)
- document_service.py: base64-encode content when UTF-8 decoding fails
instead of raising UnicodeDecodeError (500) on binary files; add upload
validation for file extension (allowlist) and size (10MB max)
- routers/documents.py: map new validation errors to HTTP 400 with a clear
detail message instead of letting them 500
- add/extend tests covering escaping, binary get_document, and upload
validation rejection + acceptance paths
