- Move /image-proxy to public (unauthenticated) route so CachedNetworkImage
can fetch proxied GIFs without Bearer token (fixes 401 errors)
- Expand image proxy SSRF allowlist to include i.imgur.com + media.giphy.com
- Broaden GIF filter in gif_picker: accept i.redd.it, preview.redd.it,
i.imgur.com URLs (not just .gif extension) so Reddit posts actually show
- Change GIF search hint to 'Search GIFs…' (no subreddit mention)
- Add i.imgur.com + media.giphy.com to client-side needsProxy() list
- Create lib/widgets/composer/composer_bar.dart — single ComposerBar widget
with ComposerConfig presets (publicPost/comment/threadReply/chat/privatePost)
that handles text, GIF picker, image picker, upload, and send button uniformly
- Apply ComposerBar to: group feed posts, group feed comments sheet,
group thread reply bar, quips comment sheet, group chat bar
- Remove all duplicate TextField+send-button+media-button implementations
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add capsule_reports table and admin UI: new /capsule-reports page with list/update handlers
- POST /capsules/:id/entries/:entryId/report: members can report encrypted entries with voluntary decrypted sample
- GET /image-proxy: stream external images (Reddit, GifCities) through server to hide client IPs
- group_chat_tab: add GIF picker, report button, proxy external GIF URLs through ApiConfig.proxyImageUrl()
- api.ts: add list
- Add GET /feed/personal alias for /feed (Flutter uses this endpoint)
- Fix 'Neighborhood unavailable' board bug: GetMyNeighborhood now
creates the neighborhood group lazily if group_id is NULL in the seed,
matching the same auto-create logic as the Detect endpoint
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Routes POST /users/:userId/unfollow, GET /users/:userId/is-following, and
GET /users/:userId/mutual-followers conflicted with /users/:id/* routes.
Renamed :userId to :id and updated follow_handler.go accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both were wired in Flutter but missing from Go routes:
- GET /media/sign?path=X — resolves R2 relative keys to full URLs
- GET /users/by-handle/:handle — profile lookup for capsule invite flow
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move auth ALTCHA challenge inside auth group
- Move admin ALTCHA challenge to v1 group
- Move test endpoint to v1 group
- This should fix the route registration issue
- Remove duplicate ALTCHA routes outside v1 group
- Keep only the routes inside the v1 group where they belong
- This should resolve the route registration issue
- Move test and ALTCHA endpoints inside the v1 group where they belong
- Fix route registration issue by placing routes in correct scope
- Both auth and admin ALTCHA challenge endpoints should now work
- Add simple test endpoint to verify routing works
- Register both auth and admin ALTCHA challenge endpoints
- Use consistent routing pattern for both endpoints
- Separate ALTCHA challenge from rate-limited auth group
- Register ALTCHA challenge directly on v1 router
- This should resolve the route registration issue
- Move auth ALTCHA challenge to /api/v1/auth group
- Move admin ALTCHA challenge to root router before admin login
- Fix route registration issue where endpoints were not accessible
- Add ALTCHA service with challenge generation and verification
- Update auth and admin handlers to use ALTCHA tokens
- Replace Turnstile widget with ALTCHA widget in Flutter app
- Update admin frontend to use ALTCHA token
- Add ALTCHA challenge endpoints for both auth and admin
- Maintain development bypass for testing
- Remove Turnstile dependencies from authentication flow
