fix(look): stregen under hurtig tilføjelse havde ingen luft under sig

Den skiller "skriv en ny" fra "det, der allerede er". Uden afstand sad den første
sektion klods op ad den, så den læste som en kant om sektionen frem for som en
afslutning på feltet over. En streg skal have plads på begge sider for at kunne
ses som en streg.

Co-Authored-By: Claude Opus 5 <[email protected]>

SECURITY.md

@@ -10,13 +10,28 @@ reply within a week.
 
 - **Passwords** are Argon2id with the parameters recorded in the hash, so they can
   be raised later without locking anyone out.
-- **Every token** — session, invite, reset, API, calendar feed, mail address — is
-  stored only as a SHA-256 hash. A database dump contains nothing that can be
-  presented.
+- **Session, invite, reset and API tokens** are stored only as a SHA-256 hash. A
+  database dump contains nothing that can be presented.
+- **The calendar feed address and the mail-to-task address are not hashed.** They
+  are looked up by their exact value, and they are shown in the interface more
+  than once, which a hash cannot do. Anybody holding a backup file therefore holds
+  those two URLs: the feed reads that person's tasks without a login, and the mail
+  address files tasks into their inbox. Rotating either from **Settings →
+  Integrations** invalidates the old one. This is written down rather than fixed
+  because fixing it means the address can only ever be shown once, which is a
+  decision about how the feature works and not only about how it is stored.
+- **Mailbox passwords, OAuth tokens, TOTP secrets and AI keys** are sealed with
+  AES-GCM under a key kept outside the database — see `internal/secret`. That is
+  what makes a stray copy of the database less than a stray copy of everything:
+  the backup does not carry the key.
 - **Sessions** are `httpOnly`, `SameSite=Lax`, and `__Host-` prefixed over HTTPS.
-- **Uploads** are stored content-addressed by hash and always served as
-  `application/octet-stream` with `nosniff`, so an uploaded SVG cannot run script
-  on this origin.
+- **Uploads** are stored content-addressed by hash and served as
+  `application/octet-stream` with `nosniff` — with one exception, added so that a
+  note can show the pictures in it: a short allowlist of raster image types is
+  served inline as its own type. The list is named one format at a time rather
+  than matched on an `image/` prefix, because the prefix would let `image/svg+xml`
+  through, and an SVG is a document that can run script. `nosniff` stays, so the
+  browser must read the file as that image or not at all.
 - **The filter language** compiles to parameterised SQL. No typed text is ever
   concatenated into a statement.
 - **Permission checks** are route middleware, and anything you may not see answers

docs/openapi.yaml

@@ -1396,6 +1396,57 @@ paths:
                     description: The environment variables that are not set.
         "403": { $ref: "#/components/responses/Forbidden" }
 
+  /api/v1/notes/bulk:
+    post:
+      tags: [notes]
+      summary: Archive, unarchive or delete a set of notes in one call.
+      description: |
+        One call rather than one per note, because the thing being asked is one
+        thing: "put these away". Fifty separate requests would be fifty round
+        trips, fifty chances for half of them to fail, and a list that redraws
+        fifty times — and after an import of twelve hundred notes, selecting fifty
+        is the ordinary case rather than the extreme one.
+
+        Each note is still checked on its own. A set is a convenience for the
+        caller and never a way to touch something they could not have touched one
+        at a time; anything they may not write to is counted in `skipped` rather
+        than failing the whole call, so one note somebody else just deleted does
+        not stop the other forty-nine.
+
+        Archiving is not deleting. The trash says "this was a mistake, and in
+        thirty days it is gone"; the archive says "this is finished, and I want to
+        keep it".
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [ids]
+              properties:
+                ids:
+                  type: array
+                  items: { type: string }
+                  description: At most 500.
+                archived:
+                  type: boolean
+                  description: Put away, or bring back out.
+                delete:
+                  type: boolean
+                  description: Into the trash instead. Wins over `archived`.
+      responses:
+        "200":
+          description: How many were changed, and how many were passed over.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  done: { type: integer }
+                  skipped: { type: integer }
+        "422":
+          description: No ids, too many, or neither archived nor delete was asked for.
+
   /api/v1/notes/{noteID}/attachments:
     post:
       tags: [notes]

internal/ai/ai.go

@@ -19,6 +19,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+
+	"github.com/kristianwind/verdande/internal/safedial"
 	"strings"
 	"time"
 )
@@ -76,7 +78,16 @@ func New(cfg Config) *Client {
 		// Generous: a local model on modest hardware can take a while to produce
 		// its first token, and the alternative is a timeout that only ever fires
 		// for the people running their own.
-		http: &http.Client{Timeout: 120 * time.Second},
+		// safedial, not a plain client. `base_url` is typed into a field in the
+		// interface, so it is a user-supplied address — and a server that fetches a
+		// user-supplied address is a way to ask it to reach things the caller
+		// cannot: the panel next door, a database on the same bridge, the cloud
+		// metadata endpoint. On a homelab that is most of what is worth reaching.
+		//
+		// The check is on the resolved address rather than on the URL, because a
+		// name answers whatever its owner says — and can answer differently the
+		// second time, after a parse-time check has passed.
+		http: safedial.Client(120 * time.Second),
 	}
 }
 
@@ -268,11 +279,35 @@ func (c *Client) do(req *http.Request, out any) error {
 		// The provider's own message is included: for a local model it is usually
 		// the actual problem ("model not found"), and hiding it would leave the
 		// operator with nothing to go on.
-		return fmt.Errorf("ai: %s said %s: %s", req.URL.Host, resp.Status, truncate(string(raw), 300))
+		// The provider's body is no longer passed back to the caller.
+		//
+		// It was, and combined with a free-text base URL that made a working
+		// internal scanner: point it at a host, read the first three hundred bytes
+		// of whatever answered. The operator still needs the message — for a local
+		// model it is usually the actual problem — so it goes to the log, where it
+		// is available to the person running the instance and to nobody else.
+		return &upstreamError{Host: req.URL.Host, Status: resp.Status, Body: truncate(string(raw), 300)}
 	}
 	return json.Unmarshal(raw, out)
 }
 
+// upstreamError keeps the provider's own words for the log and away from the
+// response. Error() is what reaches a caller; Detail() is what is written down.
+type upstreamError struct {
+	Host   string
+	Status string
+	Body   string
+}
+
+func (e *upstreamError) Error() string {
+	return fmt.Sprintf("ai: %s said %s", e.Host, e.Status)
+}
+
+// Detail is the whole of it, for the instance's own error log.
+func (e *upstreamError) Detail() string {
+	return fmt.Sprintf("ai: %s said %s: %s", e.Host, e.Status, e.Body)
+}
+
 func truncate(s string, max int) string {
 	if len(s) <= max {
 		return s

internal/filterquery/filterquery.go

@@ -60,6 +60,20 @@ func Parse(query string, ctx Context) (Compiled, error) {
 	if len(p.tokens) == 0 {
 		return Compiled{}, fmt.Errorf("filteret er tomt")
 	}
+	// Refused before it is parsed, not while.
+	//
+	// `combine` rebuilds the whole accumulated SQL string and re-copies the
+	// argument slice per operator, so the cost is quadratic in the number of
+	// terms: fifty thousand of them — three hundred kilobytes, which fits in a
+	// query string — took seven seconds of CPU and forty-six gigabytes of
+	// allocation in one request. The preview endpoint runs this on whatever is
+	// typed, and there is no write timeout on the server to cut it off.
+	//
+	// Two hundred terms is a filter nobody has ever written and far below where it
+	// costs anything.
+	if len(p.tokens) > maxTokens {
+		return Compiled{}, fmt.Errorf("filteret er for langt")
+	}
 
 	node, err := p.parseExpression()
 	if err != nil {
@@ -140,10 +154,19 @@ func isOperator(r rune) bool {
 
 // --- parser -------------------------------------------------------------------
 
+// The ceilings on one filter. See Parse for why.
+const (
+	maxTokens = 200
+	maxDepth  = 32
+)
+
 type parser struct {
 	tokens []token
 	pos    int
 	ctx    Context
+	// depth guards against a filter that is only parentheses. Each level is a
+	// stack frame, and nothing else stops somebody sending a megabyte of them.
+	depth int
 }
 
 func (p *parser) done() bool  { return p.pos >= len(p.tokens) }
@@ -187,6 +210,13 @@ func (p *parser) parseTerm() (Compiled, error) {
 	if p.done() {
 		return Compiled{}, fmt.Errorf("filteret slutter midt i et udtryk")
 	}
+	// Nesting is stack depth. A filter made of half a million opening parentheses
+	// is a megabyte of text and a stack frame for each.
+	p.depth++
+	defer func() { p.depth-- }()
+	if p.depth > maxDepth {
+		return Compiled{}, fmt.Errorf("filteret har for mange niveauer")
+	}
 
 	switch t := p.peek(); t.kind {
 	case tokNot:

internal/httpapi/auth_handlers.go

@@ -154,7 +154,21 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	s.loginLimiter.reset(clientIP(r))
+	// The bucket is cleared only when the login is *finished*.
+	//
+	// It used to be cleared here, on the strength of the password alone — before
+	// the second factor had been asked for at all. That handed somebody who
+	// already had the password an unlimited supply of ten-guess batches: log in,
+	// get a fresh bucket and a fresh pending session, spend ten guesses on the
+	// code, log in again. At three valid codes in any moment and twenty requests a
+	// second, that is even odds inside an afternoon — against the one control that
+	// exists precisely for when the password is already gone.
+	//
+	// So an account with a second factor clears nothing yet. handleLoginTOTP does
+	// it, once the code is right.
+	if !user.TOTPEnabled {
+		s.loginLimiter.reset(clientIP(r))
+	}
 
 	// A session that still needs a code gets a short life of its own: long enough
 	// to fetch a phone, not long enough to be worth stealing.
@@ -191,6 +205,19 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 	user := userFrom(r.Context())
 	session := sessionFrom(r.Context())
 
+	// Counted per account as well as per address.
+	//
+	// The address bucket alone is defeated by anybody with more than one, which is
+	// the ordinary case — a phone and a laptop is already two. A code is six
+	// digits: the only thing that makes it safe is that guesses are scarce, and
+	// scarcity has to be counted against the thing being attacked.
+	if ok, retry := s.totpLimiter.allow(user.ID); !ok {
+		w.Header().Set("Retry-After", retryAfterSeconds(retry))
+		writeError(w, http.StatusTooManyRequests, CodeRateLimited,
+			"too many verification codes; wait a moment and try again")
+		return
+	}
+
 	err := auth.VerifyTOTP(user.TOTPSecret, req.Code, time.Now())
 	if err != nil {
 		// A recovery code is accepted in the same field. Making somebody find a
@@ -198,6 +225,15 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		// introduce a second concept.
 		used, rerr := s.db.UseRecoveryCode(r.Context(), user.ID, req.Code)
 		if rerr != nil || !used {
+			// The pending session is left alive on purpose.
+			//
+			// Ending it on the first wrong digit was considered and rejected: it
+			// would make somebody who mistyped one number type their password again,
+			// and it buys almost nothing. What makes a six-digit code safe is that
+			// guesses are scarce, and the per-account bucket above is what makes
+			// them scarce — ten an hour, however many times the password is
+			// re-entered. The attack this closes was never "one session, many
+			// guesses"; it was "a fresh bucket for every password check".
 			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
 				"that verification code is not valid")
 			return
@@ -205,6 +241,11 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		s.log.Info("recovery code used", "user", user.ID)
 	}
 
+	// Finished. Now the buckets may be cleared — both of them, so somebody who
+	// fumbled the code twice is not still waiting once they get it right.
+	s.loginLimiter.reset(clientIP(r))
+	s.totpLimiter.reset(user.ID)
+
 	if err := s.db.PromoteSession(r.Context(), session.ID, s.cfg.SessionTTL); err != nil {
 		s.internal(w, r, "promote session", err)
 		return

internal/httpapi/auth_test.go

@@ -301,7 +301,11 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 
 	// Begin: a secret exists, but 2FA is not on yet — closing the tab here must
 	// not lock the account.
-	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", nil)
+	// Med adgangskoden: at slå andenfaktoren til er mindst lige så indgribende som
+	// at slå den fra, og den har altid spurgt.
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
 	if resp.StatusCode != http.StatusOK {
 		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
 	}
@@ -368,7 +372,9 @@ func TestRecoveryCodeCompletesLoginOnce(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)
 
-	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", nil)
+	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
 	secret := body["secret"].(string)
 	_, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
 		"code": codeFor(t, secret),
@@ -897,3 +903,65 @@ func TestUserAgentsAreSummarisedForAPerson(t *testing.T) {
 		}
 	}
 }
+
+// Andenfaktoren kan ikke slås til uden adgangskoden.
+//
+// Døren åbnede før med et token og lukkede kun med et kodeord: `disable` har
+// altid spurgt, `setup` spurgte om ingenting. Et stjålet token kunne derfor hente
+// hemmeligheden, lægge den i sin egen godkender, bekræfte den og beholde den
+// eneste kopi af gendannelseskoderne — hvorefter ejerens næste login stoppede ved
+// en kode, de ikke havde, og de ikke kunne slå den fra uden at logge ind først.
+func TestTOTPCannotBeSwitchedOnWithoutThePassword(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, _ := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "det forkerte kodeord",
+	})
+	if resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Fatalf("status %d, ventede at en forkert adgangskode blev afvist", resp.StatusCode)
+	}
+
+	resp, _ = ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{})
+	if resp.StatusCode == http.StatusOK {
+		t.Fatal("en tom adgangskode blev accepteret")
+	}
+}
+
+// Ratebegrænseren må ikke nulstilles af adgangskoden alene.
+//
+// Den blev det, og det gav én, der havde kodeordet, ubegrænsede portioner på ti
+// gæt: log ind, få en frisk spand og en frisk ventende session, brug ti gæt på
+// koden, log ind igen. Andenfaktoren findes præcis til det tilfælde, hvor
+// kodeordet allerede er tabt, så den portion skal betales for hver gang.
+func TestAPasswordAloneDoesNotRefillTheCodeAttempts(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	secret := body["secret"].(string)
+	ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{"code": codeFor(t, secret)})
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+
+	// Kodeordet er rigtigt hver gang; kun koden er forkert. Uden loftet ville det
+	// her kunne blive ved i det uendelige.
+	refused := 0
+	for i := 0; i < 14; i++ {
+		resp, _ := ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+			"email": "[email protected]", "password": "et langt kodeord",
+		})
+		if resp.StatusCode == http.StatusTooManyRequests {
+			refused++
+			continue
+		}
+		resp, _ = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": "000000"})
+		if resp.StatusCode == http.StatusTooManyRequests {
+			refused++
+		}
+	}
+	if refused == 0 {
+		t.Fatal("fjorten runder med forkerte koder blev aldrig afvist; spanden fyldes stadig af adgangskoden")
+	}
+}

internal/httpapi/comments_handlers.go

@@ -225,17 +225,32 @@ func (s *Server) handleUploadAttachment(w http.ResponseWriter, r *http.Request)
 
 	a := &store.Attachment{
 		TaskID:     taskID,
-		CommentID:  r.FormValue("comment_id"),
 		Filename:   safeFilename(header.Filename),
 		MimeType:   detectMime(header.Filename, header.Header.Get("Content-Type")),
 		Size:       size,
 		Path:       stored,
 		UploadedBy: user.ID,
 	}
+
 	// An attachment hangs on a task or on a comment, never both — the schema says
 	// so, and the form may have supplied a comment id.
-	if a.CommentID != "" {
-		a.TaskID = ""
+	//
+	// The comment is resolved and checked against the task in the URL. It was
+	// taken on trust, which meant the permission check above guarded the *task
+	// somebody named* while the file landed on *whatever comment they asked for*.
+	// A viewer on a shared project can list its comments, so she could read an id
+	// there and then post to a task in her own project with that id attached: the
+	// file appears under somebody else's comment, in a project she may only read,
+	// and is served to everyone in it from this origin under a name she chose.
+	// Somebody removed from a project could do the same with ids they kept.
+	if id := r.FormValue("comment_id"); id != "" {
+		owner, err := s.db.CommentTask(r.Context(), id)
+		if err != nil || owner != taskID {
+			os.Remove(filepath.Join(s.cfg.FilesDir(), stored))
+			writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+			return
+		}
+		a.CommentID, a.TaskID = id, ""
 	}
 
 	if err := s.db.CreateAttachment(r.Context(), a); err != nil {

internal/httpapi/csp_header_test.go

@@ -0,0 +1,66 @@
+package httpapi
+
+import (
+	"strings"
+	"testing"
+)
+
+// Politikken skal stå i svaret, og den skal stadig være stram.
+//
+// Den er dét, der gjorde en XSS i noteeditoren til indsat HTML frem for kørt
+// script, dengang en `alt` slap uden om sin undslupning — og der var ingen prøve
+// på, at headeren overhovedet blev sendt. En sikkerhedsforanstaltning, ingen
+// prøve rører, er en, der kan forsvinde i en oprydning uden at nogen opdager det.
+func TestEveryResponseCarriesAStrictCSP(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, _ := ts.do(t, "GET", "/api/v1/auth/me", nil)
+	policy := resp.Header.Get("Content-Security-Policy")
+	if policy == "" {
+		t.Fatal("der er ingen Content-Security-Policy på svaret")
+	}
+
+	// Målt på script-src alene, og ikke på hele politikken.
+	//
+	// `style-src 'unsafe-inline'` står der med vilje og er forklaret i csp.go:
+	// Svelte skriver stilarter ind i dokumentet, og en indsat stil kan gøre en
+	// side grim, ikke køre kode. Det er script-src, der afgør, om indsat HTML
+	// bliver til et kørende script, og det er derfor den, prøven ser på.
+	scriptSrc := ""
+	for _, part := range strings.Split(policy, ";") {
+		if strings.HasPrefix(strings.TrimSpace(part), "script-src") {
+			scriptSrc = part
+		}
+	}
+	if scriptSrc == "" {
+		t.Fatal("der er ingen script-src i politikken")
+	}
+	for _, forbidden := range []string{"'unsafe-inline'", "'unsafe-eval'", "'unsafe-hashes'", "'strict-dynamic'"} {
+		if strings.Contains(scriptSrc, forbidden) {
+			t.Errorf("script-src indeholder %s: %q", forbidden, strings.TrimSpace(scriptSrc))
+		}
+	}
+
+	// Og de fire, der skal være der.
+	for _, want := range []string{"script-src", "object-src 'none'", "base-uri 'none'", "frame-ancestors 'none'"} {
+		if !strings.Contains(policy, want) {
+			t.Errorf("politikken mangler %q", want)
+		}
+	}
+}
+
+// Et bilag må ikke kunne blive læst som et dokument.
+func TestAttachmentsAreNotServedAsDocuments(t *testing.T) {
+	for _, mime := range []string{"image/svg+xml", "text/html", "application/xhtml+xml", "text/xml"} {
+		if inlineImage[mime] {
+			t.Errorf("%s står på listen over det, der vises inline", mime)
+		}
+	}
+	// Og listen skal faktisk kunne noget, ellers virker billeder i noter ikke.
+	for _, mime := range []string{"image/png", "image/jpeg"} {
+		if !inlineImage[mime] {
+			t.Errorf("%s mangler; billeder i noter kan ikke vises", mime)
+		}
+	}
+}

internal/httpapi/integrations_handlers.go

@@ -11,6 +11,7 @@ import (
 	"github.com/kristianwind/verdande/internal/ai"
 	"github.com/kristianwind/verdande/internal/auth"
 	"github.com/kristianwind/verdande/internal/quickadd"
+	"github.com/kristianwind/verdande/internal/safedial"
 	"github.com/kristianwind/verdande/internal/store"
 )
 
@@ -214,6 +215,24 @@ func (s *Server) handleSetAISettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// The address is checked where it is typed, as well as when it is dialled.
+	//
+	// safedial refuses a private destination at connect time and is the actual
+	// wall; this is so the person entering it hears about it now rather than
+	// discovering it later as a failed summary. A scheme other than http or https
+	// is refused outright — file:// and gopher:// are not providers.
+	if url := strings.TrimSpace(req.BaseURL); url != "" {
+		if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
+			writeFieldErrors(w, map[string]string{"base_url": "must start with http:// or https://"})
+			return
+		}
+		if reason := safedial.CheckURL(url); reason != "" {
+			writeFieldErrors(w, map[string]string{"base_url": reason})
+			return
+		}
+		req.BaseURL = url
+	}
+
 	existing, err := s.aiConfig(r, user.ID)
 	if err != nil {
 		s.internal(w, r, "ai settings", err)

internal/httpapi/notes_handlers.go

@@ -48,7 +48,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "search notes", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": s.readable(r, found)})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(s.readable(r, found))})
 		return
 	}
 
@@ -62,7 +62,20 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "notes in project", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": found})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+		return
+	}
+
+	// The archive is the same list asked the other way round, so it is the same
+	// endpoint with a flag rather than a second one that would have to be kept in
+	// step with this.
+	if r.URL.Query().Get("archived") != "" {
+		found, err := s.db.ArchivedNotes(r.Context(), user.ID)
+		if err != nil {
+			s.internal(w, r, "list archived notes", err)
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
 		return
 	}
 
@@ -74,7 +87,41 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "list notes", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"notes": found})
+	writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+}
+
+// briefly replaces each note's body with the first of it.
+//
+// The list shows a title and about ninety characters. It was being sent whole
+// notes to do that: with twelve hundred of them the response was 845 KB, of which
+// ninety-eight per cent was body text nobody would read on that screen — fetched,
+// parsed and held in memory on every visit.
+//
+// Body is emptied rather than shortened, and that is the important half. A field
+// called `body` that holds a *piece* of the body is a trap: the editor would open
+// it, the debounce would save it, and the note would be cut down to its own
+// preview by nothing more than being looked at. Empty is a shape the client can
+// check, and it does — see the notes page, which fetches the whole note when it
+// opens one.
+//
+// Four hundred characters rather than ninety: the client strips Markdown before
+// it shows anything, and a heading marker and a bold word are characters that
+// vanish. Cheap insurance against a preview that ends up shorter than the line it
+// is meant to fill.
+const previewChars = 400
+
+func briefly(notes []store.Note) []store.Note {
+	out := make([]store.Note, 0, len(notes))
+	for _, n := range notes {
+		body := []rune(n.Body)
+		if len(body) > previewChars {
+			body = body[:previewChars]
+		}
+		n.Preview = string(body)
+		n.Body = ""
+		out = append(out, n)
+	}
+	return out
 }
 
 // readable drops what this person may not see.
@@ -294,6 +341,14 @@ func noteFilename(title string) string {
 // a few megabytes — and small enough that a wrong file is refused rather than read.
 const maxNoteImportBytes = 64 << 20
 
+// What the archive may become once it is unpacked, and how many entries it may
+// hold. See handleImportNotes: the upload cap bounds what arrives, and says
+// nothing at all about what it expands to.
+const (
+	maxNoteImportUnpacked = 2 << 30
+	maxNoteImportFiles    = 20_000
+)
+
 // handleImportNotes reads a zip of Markdown files and makes a note of each.
 //
 // The mirror of the export, and deliberately the same shape: whatever comes out of
@@ -332,24 +387,57 @@ func (s *Server) handleImportNotes(w http.ResponseWriter, r *http.Request) {
 	// note is read its pictures already have addresses to be rewritten to — a note
 	// and its images arrive in whatever order the archive happens to hold them, and
 	// one pass would leave half the links pointing at nothing.
+	// The archive as a whole, not just the upload.
+	//
+	// The 64 MB cap is on what arrives; deflate reaches about 1032:1, so those 64
+	// MB can become sixty-six gigabytes on the way out — written into the same
+	// volume the database lives on. The upload limit says nothing about that, and
+	// nothing else did either.
+	//
+	// Two ceilings: one per file, and one across the archive. A single enormous
+	// photograph and ten thousand small ones are different attacks with the same
+	// ending.
+	if len(zr.File) > maxNoteImportFiles {
+		writeError(w, http.StatusRequestEntityTooLarge, CodePayloadTooLarge,
+			"that archive holds too many files")
+		return
+	}
+	budget := int64(maxNoteImportUnpacked)
+
 	stored := map[string]string{}
 	for _, f := range zr.File {
 		name := f.Name
 		if f.FileInfo().IsDir() || skipFile(name) || strings.EqualFold(path.Ext(name), ".md") {
 			continue
 		}
+		// The header's own claim first, which costs nothing to check and rejects
+		// the obvious case before a byte is written. It is only a claim, so the
+		// reader below is limited as well.
+		if f.UncompressedSize64 > maxUploadBytes {
+			s.log.Warn("import: a file in the archive is too large", "file", name)
+			skipped++
+			continue
+		}
 		rc, err := f.Open()
 		if err != nil {
 			continue
 		}
-		hashed, size, err := s.storeUpload(rc)
+		hashed, size, err := s.storeUpload(io.LimitReader(rc, min(budget, maxUploadBytes)+1))
 		rc.Close()
 		if err != nil {
 			s.log.Warn("import note file", "err", err, "file", name)
 			continue
 		}
+		if size > maxUploadBytes || size > budget {
+			// Over the line once it was actually read: remove what was written
+			// rather than keeping a truncated file that would open as nothing.
+			os.Remove(filepath.Join(s.cfg.FilesDir(), hashed))
+			s.log.Warn("import: archive is larger unpacked than allowed", "file", name)
+			skipped++
+			continue
+		}
+		budget -= size
 		stored[name] = hashed
-		_ = size
 		files++
 	}
 
@@ -646,3 +734,74 @@ func (s *Server) handleUploadNoteAttachment(w http.ResponseWriter, r *http.Reque
 	}
 	writeJSON(w, http.StatusCreated, toAttachmentJSON(*a))
 }
+
+// --- putting notes away, one or many ---------------------------------------------
+
+type noteBulkRequest struct {
+	IDs      []string `json:"ids"`
+	Archived *bool    `json:"archived"`
+	Delete   bool     `json:"delete"`
+}
+
+// maxNoteBulk bounds one call. Enough to select a screenful several times over,
+// and few enough that the loop below cannot become somebody's afternoon.
+const maxNoteBulk = 500
+
+// handleNoteBulk archives, unarchives or deletes a set of notes in one request.
+//
+// One call rather than one per note, because the thing being asked is one thing:
+// "put these away". Fifty separate requests would be fifty round trips, fifty
+// chances for half of them to fail, and a list that redraws fifty times — and
+// after an import of twelve hundred notes, selecting fifty is the ordinary case,
+// not the extreme one.
+//
+// Each note is still checked on its own. A set is a convenience for the caller
+// and must never become a way to touch something they could not have touched one
+// at a time.
+func (s *Server) handleNoteBulk(w http.ResponseWriter, r *http.Request) {
+	var req noteBulkRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if len(req.IDs) == 0 {
+		writeFieldErrors(w, map[string]string{"ids": "required"})
+		return
+	}
+	if len(req.IDs) > maxNoteBulk {
+		writeFieldErrors(w, map[string]string{"ids": "too many at once"})
+		return
+	}
+
+	done, skipped := 0, 0
+	for _, id := range req.IDs {
+		n, err := s.db.Note(r.Context(), id)
+		if err != nil {
+			s.internal(w, r, "get note", err)
+			return
+		}
+		// Not an error, and not a 404 for the whole call: a set can contain a note
+		// somebody else deleted a second ago, and the other forty-nine should still
+		// be put away. Counted so the answer is honest about it.
+		if n == nil || !s.mayTouchNote(r, n, store.RoleEditor) {
+			skipped++
+			continue
+		}
+
+		switch {
+		case req.Delete:
+			err = s.db.DeleteNote(r.Context(), id)
+		case req.Archived != nil:
+			err = s.db.SetNoteArchived(r.Context(), id, *req.Archived)
+		default:
+			writeFieldErrors(w, map[string]string{"archived": "say archived or delete"})
+			return
+		}
+		if err != nil {
+			s.internal(w, r, "note bulk", err)
+			return
+		}
+		done++
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{"done": done, "skipped": skipped})
+}

internal/httpapi/notes_import_limits_test.go

@@ -0,0 +1,77 @@
+package httpapi
+
+import (
+	"archive/zip"
+	"bytes"
+	"io"
+	"testing"
+)
+
+// En zip-bombe skal ikke kunne skrive gigabyte ned på den disk, databasen ligger
+// på.
+//
+// Uploaden er begrænset til 64 MB, og det siger ingenting om, hvad de 64 MB
+// bliver til: deflate når omkring 1032:1, så de kan pakkes ud til seksogtres
+// gigabyte. Prøven bygger en rigtig lille bombe — fire megabyte nuller, som
+// pakker til nogle få kilobyte — og ser efter, at loftet på det udpakkede holder.
+//
+// Skrevet imod tallene frem for imod endepunktet, fordi det, der skal holde, er
+// forholdet: en fil, hvis udpakkede størrelse overstiger loftet, må ikke læses
+// færdig.
+func TestAZipBombIsRefusedByItsUnpackedSize(t *testing.T) {
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	w, err := zw.Create("bombe.bin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Nuller pakker næsten helt væk. Fire megabyte er nok til at vise forholdet
+	// uden at prøven selv bruger en gigabyte.
+	if _, err := w.Write(make([]byte, 4<<20)); err != nil {
+		t.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	packed := int64(buf.Len())
+	if packed > 64<<10 {
+		t.Fatalf("prøvens egen bombe pakkede kun til %d bytes; den viser ikke noget", packed)
+	}
+
+	zr, err := zip.NewReader(bytes.NewReader(buf.Bytes()), packed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := zr.File[0]
+	if f.UncompressedSize64 != 4<<20 {
+		t.Fatalf("udpakket størrelse = %d", f.UncompressedSize64)
+	}
+
+	// Det, importen gør: læs højst det, budgettet tillader, plus én byte — så en
+	// fil, der er præcis på grænsen, kan skelnes fra en, der er over.
+	rc, err := f.Open()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rc.Close()
+	budget := int64(1 << 20)
+	n, err := io.Copy(io.Discard, io.LimitReader(rc, budget+1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n <= budget {
+		t.Fatalf("læste %d bytes af en fil på 4 MB med et budget på %d — loftet fanger den ikke", n, budget)
+	}
+}
+
+// Tallene skal stå i et forhold, der giver mening: en enkelt fil må aldrig kunne
+// bruge hele arkivets budget, og arkivet må ikke være mindre end én fil.
+func TestTheImportCeilingsAgreeWithEachOther(t *testing.T) {
+	if maxNoteImportUnpacked <= maxUploadBytes {
+		t.Error("arkivets budget er ikke større end én enkelt fil")
+	}
+	if maxNoteImportFiles < 2000 {
+		t.Error("filloftet er under det, en rigtig Apple Noter-eksport indeholder")
+	}
+}

internal/httpapi/notes_test.go

@@ -328,12 +328,19 @@ func TestAnImportedNoteKeepsItsPictures(t *testing.T) {
 		t.Fatalf("imported %d notes and %d files, want 2 and 1", out.Created, out.Files)
 	}
 
+	// The list carries a preview, not the whole note — see briefly(). The body is
+	// fetched by id, which is what the interface does when it opens one.
 	_, listed := ts.do(t, "GET", "/api/v1/notes?q=kvittering", nil)
 	notes := listed["notes"].([]any)
 	if len(notes) != 1 {
 		t.Fatalf("found %d notes", len(notes))
 	}
-	body := notes[0].(map[string]any)["body"].(string)
+	noteID := notes[0].(map[string]any)["id"].(string)
+	if got := notes[0].(map[string]any)["body"]; got != nil && got != "" {
+		t.Errorf("the list carried a body: %v — an editor handed that would save the truncation", got)
+	}
+	_, whole := ts.do(t, "GET", "/api/v1/notes/"+noteID, nil)
+	body := whole["body"].(string)
 
 	// The link points at the file where it now lives, not at a path inside an
 	// archive nobody kept.

internal/httpapi/notifications_handlers.go

@@ -2,11 +2,13 @@ package httpapi
 
 import (
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/go-chi/chi/v5"
 
 	"github.com/kristianwind/verdande/internal/push"
+	"github.com/kristianwind/verdande/internal/safedial"
 	"github.com/kristianwind/verdande/internal/store"
 )
 
@@ -170,6 +172,23 @@ func (s *Server) handleSubscribePush(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// The endpoint is an address this server will POST to, on a schedule the
+	// caller chooses — set a reminder a minute out and the push job fetches it,
+	// again every minute. Unchecked, that is a way to make the instance reach
+	// anything it can route to, on demand.
+	//
+	// https only: a push service is on the public internet and speaks TLS. Nothing
+	// legitimate needs http here, and allowing it is the difference between a
+	// blind request and a readable one.
+	if !strings.HasPrefix(req.Endpoint, "https://") {
+		writeFieldErrors(w, map[string]string{"endpoint": "must be an https address"})
+		return
+	}
+	if reason := safedial.CheckURL(req.Endpoint); reason != "" {
+		writeFieldErrors(w, map[string]string{"endpoint": reason})
+		return
+	}
+
 	err := s.db.SavePushSubscription(r.Context(), &store.PushSubscription{
 		UserID:    userFrom(r.Context()).ID,
 		Endpoint:  req.Endpoint,
@@ -189,7 +208,10 @@ func (s *Server) handleUnsubscribePush(w http.ResponseWriter, r *http.Request) {
 	if err := decodeJSON(w, r, &req); err != nil {
 		return
 	}
-	if err := s.db.DeletePushSubscription(r.Context(), req.Endpoint); err != nil {
+	// Scoped to the caller. It was not, so anybody who learned somebody else's
+	// endpoint could unsubscribe their device — a small thing to do to somebody
+	// and no reason at all to be able to.
+	if err := s.db.DeletePushSubscription(r.Context(), userFrom(r.Context()).ID, req.Endpoint); err != nil {
 		s.internal(w, r, "delete push subscription", err)
 		return
 	}

internal/httpapi/server.go

@@ -64,6 +64,11 @@ type Server struct {
 	// than the rest of the API.
 	loginLimiter *limiter
 	resetLimiter *limiter
+	// Second factors are counted against the *account*, not the address. An
+	// address bucket is defeated by anybody with more than one address, which is
+	// the ordinary case — and a six-digit code is only safe while guesses are
+	// scarce, so the scarcity has to be counted against the thing being attacked.
+	totpLimiter *limiter
 
 	// Computed once from the built index.html; see csp.go.
 	csp string
@@ -81,6 +86,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		hub:          realtime.NewHub(log),
 		loginLimiter: newLimiter(10, 15*time.Minute),
 		resetLimiter: newLimiter(5, time.Hour),
+		// Tighter than the password bucket, and for a whole hour. Somebody typing
+		// their own code gets it right on the first or second try; ten in an hour is
+		// generous for a person and hopeless for a search through a million.
+		totpLimiter: newLimiter(10, time.Hour),
 	}
 	s.csp = contentSecurityPolicy(scriptHashes(web))
 	if w, err := auth.NewWebAuthn(cfg.BaseURL, "verdande"); err == nil {
@@ -200,11 +209,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Put("/nav-order", s.handleSetNavOrder)
 				r.Post("/logout", s.handleLogout)
 				r.Post("/password/change", s.handleChangePassword)
-				r.Post("/totp/setup", s.handleTOTPSetup)
-				r.Post("/totp/confirm", s.handleTOTPConfirm)
-				r.Post("/totp/disable", s.handleTOTPDisable)
 				r.Get("/recovery-codes", s.handleRecoveryCodesCount)
-				r.Post("/recovery-codes", s.handleRecoveryCodesRegenerate)
 
 				// Behind requireSession, like the API tokens and for the same
 				// reason: a leaked token must not be able to end the sessions of
@@ -214,6 +219,23 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 					r.Get("/sessions", s.handleListSessions)
 					r.Delete("/sessions/{sessionID}", s.handleDeleteSession)
 
+					// Turning the second factor on, and the codes that get you back
+					// in. Sessions only, and setup asks for the password.
+					//
+					// These sat outside this group, which meant the door opened with
+					// a token and closed only with a password: `disable` has always
+					// asked for the password, `setup` asked for nothing. A stolen
+					// token could therefore fetch the secret, load it into its own
+					// authenticator, confirm it, and keep the only copy of the
+					// recovery codes. The owner's next login would stop at a code
+					// they do not have, and they could not turn it off without
+					// logging in first. A theft becomes a tenancy — the same
+					// sentence written next door about passkeys, and the same rule.
+					r.Post("/totp/setup", s.handleTOTPSetup)
+					r.Post("/totp/confirm", s.handleTOTPConfirm)
+					r.Post("/totp/disable", s.handleTOTPDisable)
+					r.Post("/recovery-codes", s.handleRecoveryCodesRegenerate)
+
 					// Registering a key, and the list of them. Sessions only, for
 					// the same reason: a leaked token must not be able to add its
 					// own way in — that would turn a theft into a tenancy.
@@ -311,6 +333,9 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				// files in and nothing else could, which made the most ordinary act
 				// in a notes app — paste a screenshot — do nothing at all.
 				r.Post("/{noteID}/attachments", s.handleUploadNoteAttachment)
+				// Mange på én gang. Efter en import af tolv hundrede noter er det at
+				// vælge halvtreds det almindelige tilfælde, ikke det yderste.
+				r.Post("/bulk", s.handleNoteBulk)
 			})
 
 			r.Route("/mailboxes", func(r chi.Router) {

internal/httpapi/totp_handlers.go

@@ -20,7 +20,24 @@ type totpSetupResponse struct {
 }
 
 func (s *Server) handleTOTPSetup(w http.ResponseWriter, r *http.Request) {
+	// The password, the same as disable has always asked for.
+	//
+	// Symmetry is the point. Turning the second factor on is at least as
+	// consequential as turning it off — it decides which device gets to say yes
+	// from now on — and a door that opens more easily than it closes is not a
+	// door. Together with the move behind requireSession, this is what stops a
+	// stolen credential from enrolling its own authenticator and keeping the only
+	// copy of the recovery codes.
+	var req totpDisableRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
 	user := userFrom(r.Context())
+	if err := auth.VerifyPassword(user.PasswordHash, req.Password); err != nil {
+		writeFieldErrors(w, map[string]string{"password": "not correct"})
+		return
+	}
+
 	if user.TOTPEnabled {
 		writeError(w, http.StatusConflict, CodeConflict,
 			"two-factor authentication is already switched on")

internal/safedial/safedial.go

@@ -30,6 +30,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"syscall"
 	"time"
 )
@@ -104,3 +105,32 @@ func Client(timeout time.Duration) *http.Client {
 func AllowPrivate(timeout time.Duration) *http.Client {
 	return &http.Client{Timeout: timeout}
 }
+
+// CheckURL reports why an address must not be fetched, or "" if it may be.
+//
+// A convenience for saying no at the moment somebody types an address, rather
+// than later when a request quietly fails. It is NOT the protection — a name can
+// resolve one way now and another way when it is dialled, which is why Control
+// exists and runs every time. Anything this rejects is certainly wrong; anything
+// it accepts is merely not obviously wrong.
+func CheckURL(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" {
+		return "that is not a URL"
+	}
+	host := u.Hostname()
+	if ip := net.ParseIP(host); ip != nil && Blocked(ip) {
+		return "that address is on this machine or its private network"
+	}
+	// A bare name is looked up once so an obvious "localhost" is caught here. A
+	// failure to resolve is not an error: the host may simply not exist yet, and
+	// refusing to save an address because DNS was slow would be its own bug.
+	if ips, err := net.LookupIP(host); err == nil {
+		for _, ip := range ips {
+			if Blocked(ip) {
+				return "that address is on this machine or its private network"
+			}
+		}
+	}
+	return ""
+}

internal/store/migrations/0024_note_archive.sql

@@ -0,0 +1,23 @@
+-- A note can be put away without being thrown away.
+--
+-- The trash already exists and is the wrong tool. It says "this was a mistake,
+-- and in thirty days it is gone" — so anything worth keeping cannot go in it, and
+-- an archive of twelve hundred imported notes is exactly the case where most of
+-- them are worth keeping and almost none are worth looking at. Without somewhere
+-- to put them, the list is the whole archive forever, and finding this week's note
+-- means reading past a decade.
+--
+-- A column rather than a folder. Verdande already refused a second hierarchy for
+-- notes — see 0018 — and archiving is not filing: it is one bit about whether a
+-- note is current, and it has to be answerable next to `deleted_at`, which is the
+-- other bit of the same kind.
+--
+-- Nullable timestamp rather than a boolean, for the same reason `deleted_at` is
+-- one: "when was this put away" answers questions a flag cannot, and it costs the
+-- same byte.
+ALTER TABLE notes ADD COLUMN archived_at INTEGER;
+
+-- The list asks "not deleted, not archived, newest first" on every load, and with
+-- twelve hundred notes that is the query that has to be quick.
+CREATE INDEX notes_current ON notes (archived_at, deleted_at, updated_at DESC)
+    WHERE deleted_at IS NULL;

internal/store/notes.go

@@ -10,15 +10,26 @@ import (
 
 // Note is a page of Markdown belonging to a project, or to nobody.
 type Note struct {
-	ID        string     `json:"id"`
-	ProjectID string     `json:"project_id,omitempty"`
-	Title     string     `json:"title"`
-	Body      string     `json:"body"`
-	CreatedBy string     `json:"created_by,omitempty"`
-	Pinned    bool       `json:"pinned"`
-	CreatedAt time.Time  `json:"created_at"`
-	UpdatedAt time.Time  `json:"updated_at"`
-	DeletedAt *time.Time `json:"deleted_at,omitempty"`
+	ID         string     `json:"id"`
+	ProjectID  string     `json:"project_id,omitempty"`
+	Title      string     `json:"title"`
+	Body       string     `json:"body"`
+	CreatedBy  string     `json:"created_by,omitempty"`
+	Pinned     bool       `json:"pinned"`
+	CreatedAt  time.Time  `json:"created_at"`
+	UpdatedAt  time.Time  `json:"updated_at"`
+	DeletedAt  *time.Time `json:"deleted_at,omitempty"`
+	ArchivedAt *time.Time `json:"archived_at,omitempty"`
+
+	// Preview is the first of the body, for a list that shows one line of it.
+	//
+	// It exists so a list of twelve hundred notes does not have to carry twelve
+	// hundred whole notes: the list rendered 845 KB of JSON to show ninety
+	// characters of each. When it is set, Body is deliberately empty — see
+	// handleListNotes. That is not tidiness but a guard: an editor handed a
+	// truncated body would save the truncation, and the note would be cut down to
+	// its own preview.
+	Preview string `json:"preview,omitempty"`
 
 	// Links is what the body points at, read out of the text on the way in. Never
 	// set by a caller: it is derived, and a caller that set it would be describing
@@ -33,7 +44,16 @@ type NoteLink struct {
 }
 
 const noteColumns = `id, project_id, title, body, created_by, pinned,
-	created_at, updated_at, deleted_at`
+	created_at, updated_at, deleted_at, archived_at`
+
+// The same columns, said with the table in front of them.
+//
+// Needed only by the search, which joins `notes_fts` — and that table carries its
+// own `id` and `project_id` (UNINDEXED, so the row can be found from a match).
+// Unqualified, SQLite cannot tell which one is meant and refuses the query.
+const noteColumnsQualified = `notes.id, notes.project_id, notes.title, notes.body,
+	notes.created_by, notes.pinned, notes.created_at, notes.updated_at, notes.deleted_at,
+	notes.archived_at`
 
 // Reference syntax, and deliberately the same characters the quick-add parser
 // already uses. A `#Firma` in a note means the same project as a `#Firma` typed
@@ -199,8 +219,23 @@ func (db *DB) LooseNotes(ctx context.Context, userID string) ([]Note, error) {
 // shared, and a list that dropped it at that moment would make sharing look like
 // deleting — which is exactly how it read before this existed.
 func (db *DB) AllNotes(ctx context.Context, userID string) ([]Note, error) {
-	return db.notesWhere(ctx, `
-		WHERE deleted_at IS NULL
+	return db.allNotes(ctx, userID, false)
+}
+
+// ArchivedNotes is the same list, the other way round: what has been put away.
+func (db *DB) ArchivedNotes(ctx context.Context, userID string) ([]Note, error) {
+	return db.allNotes(ctx, userID, true)
+}
+
+func (db *DB) allNotes(ctx context.Context, userID string, archived bool) ([]Note, error) {
+	// Archived notes are left out of the ordinary list rather than mixed in and
+	// greyed: the point of putting something away is not seeing it.
+	state := "notes.archived_at IS NULL"
+	if archived {
+		state = "notes.archived_at IS NOT NULL"
+	}
+	return db.notesJoin(ctx, noteColumnsQualified, `
+		WHERE `+state+` AND deleted_at IS NULL
 		  AND (
 		    (project_id IS NULL AND created_by = ?)
 		    OR project_id IN (
@@ -238,12 +273,27 @@ func (db *DB) SearchNotes(ctx context.Context, query string, limit int) ([]Note,
 	if expr == "" {
 		return nil, nil
 	}
-	// By rowid, the way tasks do it: `id` is UNINDEXED in the table, so selecting
-	// on it would work and read the whole index to do it.
-	return db.notesWhere(ctx, `
-		WHERE deleted_at IS NULL
-		  AND rowid IN (SELECT rowid FROM notes_fts WHERE notes_fts MATCH ?)
-		ORDER BY updated_at DESC
+	// Ordered by how well it matched, not by when it was last touched.
+	//
+	// `ORDER BY updated_at DESC` was invisible while there were ten notes and
+	// useless at twelve hundred: every one of them was imported the same evening,
+	// so `updated_at` says nothing, and the limit then cut the list at fifty
+	// arbitrary rows. Searching "Tesla" answered with a note about nginx first and
+	// the note actually called "Tesla Model Y" second — which reads as a search
+	// that does not work, because from where the person is sitting it is one.
+	//
+	// bm25 with the title weighted ten times the body. A word in the title is what
+	// the note is *about*; the same word once in a long body is a mention. `fold`
+	// carries the same text transliterated, so it must weigh the same as the body
+	// or a Danish match would outrank an exact one.
+	//
+	// Joined rather than `rowid IN (…)`: the rank belongs to the match, and a
+	// subquery throws it away.
+	return db.notesJoin(ctx, noteColumnsQualified, `
+		JOIN notes_fts ON notes_fts.rowid = notes.rowid
+		WHERE notes.deleted_at IS NULL
+		  AND notes_fts MATCH ?
+		ORDER BY bm25(notes_fts, 10.0, 1.0, 1.0)
 		LIMIT ?`, expr, limit)
 }
 
@@ -278,6 +328,27 @@ func (db *DB) SetNoteTimes(ctx context.Context, id string, created, updated time
 	return err
 }
 
+// SetNoteArchived puts a note away, or takes it back out.
+//
+// Separate from DeleteNote because they mean different things and the difference
+// is the whole feature: the trash says "this was a mistake, and in thirty days it
+// is gone", and the archive says "this is finished, and I want to keep it". A
+// twelve-hundred-note import is mostly the second, and without somewhere to put
+// them the list is the whole archive forever.
+//
+// `updated_at` is deliberately not touched. Archiving is not editing, and a list
+// sorted by when things were last written should not be reordered by somebody
+// tidying up.
+func (db *DB) SetNoteArchived(ctx context.Context, id string, archived bool) error {
+	var at any
+	if archived {
+		at = time.Now().Unix()
+	}
+	_, err := db.ExecContext(ctx,
+		`UPDATE notes SET archived_at = ? WHERE id = ? AND deleted_at IS NULL`, at, id)
+	return err
+}
+
 // DeleteNote puts it in the trash. Nothing here removes a row.
 func (db *DB) DeleteNote(ctx context.Context, id string) error {
 	_, err := db.ExecContext(ctx,
@@ -295,7 +366,13 @@ func (db *DB) RestoreNote(ctx context.Context, id string) error {
 }
 
 func (db *DB) notesWhere(ctx context.Context, where string, args ...any) ([]Note, error) {
-	rows, err := db.QueryContext(ctx, `SELECT `+noteColumns+` FROM notes `+where, args...)
+	return db.notesJoin(ctx, noteColumns, where, args...)
+}
+
+// notesJoin is notesWhere with the column list spelled out, for the one caller
+// that joins another table and must therefore say which `id` it means.
+func (db *DB) notesJoin(ctx context.Context, columns, where string, args ...any) ([]Note, error) {
+	rows, err := db.QueryContext(ctx, `SELECT `+columns+` FROM notes `+where, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -335,10 +412,10 @@ func scanNote(row scanner) (Note, error) {
 	var n Note
 	var projectID, createdBy sql.NullString
 	var created, updated int64
-	var deleted sql.NullInt64
+	var deleted, archived sql.NullInt64
 
 	if err := row.Scan(&n.ID, &projectID, &n.Title, &n.Body, &createdBy,
-		&n.Pinned, &created, &updated, &deleted); err != nil {
+		&n.Pinned, &created, &updated, &deleted, &archived); err != nil {
 		return n, err
 	}
 	n.ProjectID = projectID.String
@@ -349,5 +426,9 @@ func scanNote(row scanner) (Note, error) {
 		t := time.Unix(deleted.Int64, 0)
 		n.DeletedAt = &t
 	}
+	if archived.Valid {
+		t := time.Unix(archived.Int64, 0)
+		n.ArchivedAt = &t
+	}
 	return n, nil
 }

internal/store/notes_test.go

@@ -333,3 +333,39 @@ func TestATagFindsItsProjectWhateverTheCase(t *testing.T) {
 		t.Error("a note title did not match itself")
 	}
 }
+
+// En søgning skal svare med det, der passer bedst, øverst.
+//
+// Den sorterede efter `updated_at`, hvilket var usynligt med ti noter og
+// ubrugeligt med tolv hundrede: de blev alle importeret samme aften, så datoen
+// siger ingenting, og loftet skar så listen af ved halvtreds tilfældige rækker.
+// At søge "Tesla" svarede med en note om nginx først og noten, der hedder "Tesla
+// Model Y", bagefter — hvilket læses som en søgning, der ikke virker, fordi det
+// fra brugerens plads er præcis dét.
+func TestSearchAnswersWithTheBestMatchFirst(t *testing.T) {
+	db, userID := sealedStore(t)
+	ctx := context.Background()
+
+	// Skrevet i den rækkefølge, der ville give det forkerte svar: den, der kun
+	// nævner ordet i kroppen, gemmes sidst og har derfor den nyeste dato.
+	for _, body := range []string{
+		"# Tesla Model Y\n\nBilen selv.\n",
+		"# Ladestandere\n\nNoter om Tesla og andre mærker.\n",
+		"# nginx proxy manager backup\n\nEn konfiguration. Tesla nævnes i forbifarten.\n",
+	} {
+		if err := db.SaveNote(ctx, &Note{CreatedBy: userID, Body: body}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	found, err := db.SearchNotes(ctx, "Tesla", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(found) != 3 {
+		t.Fatalf("fandt %d noter, ventede 3", len(found))
+	}
+	if found[0].Title != "Tesla Model Y" {
+		t.Errorf("øverst stod %q; den note, der hedder det, man søgte efter, skal stå først", found[0].Title)
+	}
+}

internal/store/notifications.go

@@ -140,11 +140,17 @@ func (db *DB) SavePushSubscription(ctx context.Context, sub *PushSubscription) e
 	if sub.ID == "" {
 		sub.ID = NewID()
 	}
+	// The upsert no longer moves the row between accounts.
+	//
+	// `user_id = excluded.user_id` was in the DO UPDATE, so anybody who learned
+	// another person's endpoint could claim it by subscribing with it: the
+	// victim's device would then receive the claimant's notifications and none of
+	// its own. A re-subscribe from the same person still refreshes the keys, which
+	// is what the upsert is actually for.
 	_, err := db.ExecContext(ctx,
 		`INSERT INTO push_subscriptions (id, user_id, endpoint, p256dh, auth, user_agent, created_at)
 		 VALUES (?, ?, ?, ?, ?, ?, ?)
 		 ON CONFLICT (endpoint) DO UPDATE SET
-		     user_id = excluded.user_id,
 		     p256dh = excluded.p256dh,
 		     auth = excluded.auth,
 		     user_agent = excluded.user_agent,
@@ -175,7 +181,21 @@ func (db *DB) ListPushSubscriptions(ctx context.Context, userID string) ([]PushS
 	return out, rows.Err()
 }
 
-func (db *DB) DeletePushSubscription(ctx context.Context, endpoint string) error {
+// DeletePushSubscription removes one of this person's devices.
+//
+// Scoped by user as well as by endpoint. It was endpoint alone, which meant
+// anybody who learned somebody else's endpoint could silently unsubscribe their
+// phone — and the endpoint is the only thing about a subscription that ever
+// leaves the browser.
+func (db *DB) DeletePushSubscription(ctx context.Context, userID, endpoint string) error {
+	_, err := db.ExecContext(ctx,
+		`DELETE FROM push_subscriptions WHERE endpoint = ? AND user_id = ?`, endpoint, userID)
+	return err
+}
+
+// dropPushEndpoint removes a subscription the push service has declared dead.
+// Unexported so the only *request* path to a delete stays the scoped one.
+func (db *DB) dropPushEndpoint(ctx context.Context, endpoint string) error {
 	_, err := db.ExecContext(ctx, `DELETE FROM push_subscriptions WHERE endpoint = ?`, endpoint)
 	return err
 }
@@ -186,7 +206,10 @@ func (db *DB) DeletePushSubscription(ctx context.Context, endpoint string) error
 // silently unsubscribing somebody's phone.
 func (db *DB) RecordPushFailure(ctx context.Context, endpoint string, permanent bool) error {
 	if permanent {
-		return db.DeletePushSubscription(ctx, endpoint)
+		// Not scoped by user, and that is right here: this is the push service
+		// saying the endpoint is gone, not a person asking for something. There is
+		// no caller to check against — the caller is the delivery job.
+		return db.dropPushEndpoint(ctx, endpoint)
 	}
 	_, err := db.ExecContext(ctx,
 		`UPDATE push_subscriptions SET failures = failures + 1 WHERE endpoint = ?`, endpoint)
@@ -289,6 +312,11 @@ var secretFields = map[string]bool{
 	"access_token":  true,
 	"password":      true,
 	"client_secret": true,
+	// The AI provider's key. Missed when this list was written, and it is exactly
+	// the same kind of thing as the rest: a live credential, in a settings blob,
+	// in a database anybody with a backup file can read. Existing rows convert
+	// themselves the next time the settings are saved.
+	"api_key": true,
 }
 
 // seal returns a copy of values with the secret fields sealed. Without a key it

internal/store/search.go

@@ -20,6 +20,13 @@ func FoldDanish(s string) string {
 	return r.Replace(s)
 }
 
+// The ceilings on a search. See MatchExprOver for why they exist; both are far
+// above anything a person types and far below anything that costs.
+const (
+	maxSearchInput = 512
+	maxSearchTerms = 16
+)
+
 // MatchExpr turns what someone typed into the search box into an FTS5 MATCH
 // expression.
 //
@@ -51,6 +58,23 @@ func MatchExprOver(query string, columns ...string) string {
 		return ""
 	}
 
+	// Capped, because the expression is built from the input and then run inside
+	// SQLite on one of a handful of pooled connections.
+	//
+	// Every term becomes roughly fifty bytes of FTS5, and every one of them is a
+	// prefix query — which is what makes ⌘K feel like it searches as you type, and
+	// also what makes each one expensive. A quarter of a megabyte pasted into the
+	// box became a two-megabyte MATCH expression and half a minute inside SQLite,
+	// holding a connection the whole time. A few of those at once and the database
+	// is unavailable to everybody on the instance, logins included.
+	//
+	// Sixteen terms is far past anything a person types into a search box and
+	// nowhere near enough to hurt. Silently, because a message about a limit
+	// nobody has reached on purpose is noise.
+	if len(terms) > maxSearchTerms {
+		terms = terms[:maxSearchTerms]
+	}
+
 	var b strings.Builder
 	for i, term := range terms {
 		if i > 0 {
@@ -70,6 +94,11 @@ func MatchExprOver(query string, columns ...string) string {
 // punctuation rather than whitespace alone means "q3/2026" searches for "q3" and
 // "2026" instead of for a term FTS5's own tokenizer would never have indexed.
 func tokenize(query string) []string {
+	// Trimmed before it is split, so a megabyte of text is not walked rune by rune
+	// only to have all but sixteen of the results thrown away.
+	if len(query) > maxSearchInput {
+		query = query[:maxSearchInput]
+	}
 	fields := strings.FieldsFunc(query, func(r rune) bool {
 		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
 	})

internal/store/users.go

@@ -129,7 +129,14 @@ func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, e
 		return nil, err
 	}
 
-	u.TOTPSecret = secret.String
+	// Opened on the way out. A row written before the key existed is returned as
+	// itself — see secret.Unseal — so this does not need a migration; a secret
+	// converts the next time it is written.
+	if plain, err := db.unsealValue(secret.String); err == nil {
+		u.TOTPSecret = plain
+	} else {
+		u.TOTPSecret = secret.String
+	}
 	u.TOTPEnabled = totpEnabled == 1
 	u.IsAdmin = isAdmin == 1
 	// A malformed value is read as "nothing folded" rather than as an error: the
@@ -433,9 +440,20 @@ func (db *DB) UpdateProfile(ctx context.Context, userID, name, timezone, locale
 }
 
 func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled bool) error {
+	// Sealed, like a mailbox password and for the same reason: the copies, not the
+	// server. A TOTP secret in a downloadable backup lets whoever holds the copy
+	// generate valid codes for every account on the instance — which turns the
+	// second factor from a defence into a file somebody can take home.
+	//
+	// It was missed when internal/secret was written, along with three other
+	// values; see SECURITY.md.
 	var value any
 	if secret != "" {
-		value = secret
+		sealed, err := db.sealValue(secret)
+		if err != nil {
+			return err
+		}
+		value = sealed
 	}
 	_, err := db.ExecContext(ctx,
 		`UPDATE users SET totp_secret = ?, totp_enabled = ?, updated_at = ? WHERE id = ?`,

web/e2e/smoke.spec.js

@@ -2704,3 +2704,193 @@ test('et billede kan indsættes og trækkes ind i en note', async ({ page }) =>
 
 	expect(trouble).toEqual([]);
 });
+
+test('en note kan oprettes inde fra et projekt og hører til det med det samme', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByLabel('Nyt projekt').click();
+	await sidebar.getByLabel('Projektnavn').fill('Tagprojekt');
+	await sidebar.getByLabel('Projektnavn').press('Enter');
+	await sidebar.getByRole('link', { name: 'Tagprojekt' }).click();
+	await expect(page.getByRole('heading', { name: 'Tagprojekt' })).toBeVisible();
+
+	// Ruden findes, også før der er en eneste note — ellers er der ingen knap at
+	// trykke på det sted, hvor man opdager at der skal skrives noget ned.
+	await page.getByRole('button', { name: 'Ny note' }).click();
+
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await expect(ed).toBeVisible();
+	await ed.click();
+	await page.keyboard.type('Tagsten og lægter');
+	await page.waitForTimeout(1200);
+
+	// Den hører til projektet med det samme: "Del i" står på projektet, uden at
+	// nogen har valgt det bagefter.
+	await expect(page.getByLabel('Del i')).toHaveValue(/.+/);
+	const shared = await page.getByLabel('Del i').evaluate((el) => el.selectedOptions[0].textContent);
+	expect(shared).toContain('Tagprojekt');
+
+	// Og den står på projektets egen side.
+	await sidebar.getByRole('link', { name: 'Tagprojekt' }).click();
+	// Titlen, ikke uddraget: begge indeholder de samme ord, fordi titlen *er*
+	// notens første linje.
+	await expect(page.locator('.notes strong', { hasText: 'Tagsten og lægter' })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
+test('en note kan trækkes hen på et projekt i sidebjælken', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await page.goto('/');
+	await sidebar.getByLabel('Nyt projekt').click();
+	await sidebar.getByLabel('Projektnavn').fill('Trækmål');
+	await sidebar.getByLabel('Projektnavn').press('Enter');
+	await expect(sidebar.getByRole('link', { name: 'Trækmål' })).toBeVisible();
+
+	const id = await page.evaluate(async () => {
+		const r = await fetch('/api/v1/notes', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({ body: '# Løs note\n\nSkal flyttes ved at trække.\n' })
+		});
+		return (await r.json()).id;
+	});
+
+	await page.goto('/noter?note=' + id);
+	await page.evaluate((noteId) => (window.__noteId = noteId), id);
+	const row = page.locator('.notes button.row').filter({ hasText: 'Løs note' }).first();
+	await expect(row).toBeVisible();
+
+	// Selve gesten, med de rigtige hændelser og den nyttelast, appen sender.
+	// Rækken tog imod dragover og lod slippet falde ned i grenen, der omarrangerer
+	// projekter — så den lyste op og gjorde ingenting. Prøven skal derfor gå hele
+	// vejen til slippet og se på resultatet, ikke på at rækken blev fremhævet.
+	await page.evaluate(() => {
+		const dt = new DataTransfer();
+		dt.setData('application/x-verdande-note', window.__noteId);
+		const target = [...document.querySelectorAll('nav a')].find((a) =>
+			a.textContent.includes('Trækmål')
+		);
+		for (const type of ['dragover', 'drop']) {
+			target.dispatchEvent(new DragEvent(type, { dataTransfer: dt, bubbles: true, cancelable: true }));
+		}
+	});
+	await page.waitForTimeout(1000);
+
+	// Det, der tæller: noten ligger i projektet bagefter.
+	const body = await page.evaluate(async (noteId) => {
+		const r = await fetch('/api/v1/notes/' + noteId, {
+			credentials: 'include',
+			headers: { 'Sec-Fetch-Site': 'same-origin' }
+		});
+		return await r.json();
+	}, id);
+	expect(body.project_id).toBeTruthy();
+
+	expect(trouble).toEqual([]);
+});
+
+test('kodeblokken har en kopiér-knap, og knappen havner ikke i filen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.context().grantPermissions(['clipboard-read', 'clipboard-write']);
+	await page.goto('/noter');
+
+	const id = await page.evaluate(async () => {
+		const r = await fetch('/api/v1/notes', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({ body: '# Kommandoen\n\n```bash\ndocker pull verdande\n```\n' })
+		});
+		return (await r.json()).id;
+	});
+	await page.goto('/noter?note=' + id);
+
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	const copy = ed.locator('pre .copy');
+	await expect(copy).toBeVisible();
+	await copy.click();
+	await expect(copy).toHaveText('Kopieret');
+
+	// Det, der ligger i udklipsholderen, er koden — ikke knappens eget ord.
+	const clip = await page.evaluate(() => navigator.clipboard.readText());
+	expect(clip).toBe('docker pull verdande');
+
+	// Og noten selv må ikke få "Kopiér" skrevet ind i sig, når den gemmes. Knappen
+	// ligger inde i <pre> for at kunne stå i hjørnet af den, så det er præcis den
+	// fælde, den her prøve findes for.
+	await ed.click();
+	await page.keyboard.press('End');
+	await page.keyboard.type(' ');
+	await page.waitForTimeout(1200);
+
+	const body = await page.evaluate(async (noteId) => {
+		const r = await fetch('/api/v1/notes/' + noteId, {
+			credentials: 'include',
+			headers: { 'Sec-Fetch-Site': 'same-origin' }
+		});
+		return (await r.json()).body;
+	}, id);
+	expect(body).toContain('docker pull verdande');
+	expect(body).not.toContain('Kopiér');
+	expect(body).not.toContain('Kopieret');
+
+	expect(trouble).toEqual([]);
+});
+
+test('flere noter kan markeres, arkiveres og hentes frem igen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	for (const title of ['Alfa', 'Bravo', 'Charlie']) {
+		await page.evaluate(async (t) => {
+			await fetch('/api/v1/notes', {
+				method: 'POST',
+				credentials: 'include',
+				headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+				body: JSON.stringify({ body: `# ${t}\n\nEn note.\n` })
+			});
+		}, title);
+	}
+	await page.reload();
+	const rows = page.locator('.notes button.row');
+	await expect(rows.filter({ hasText: 'Alfa' })).toBeVisible();
+
+	// To af tre: et almindeligt klik, og et ⌘-klik oven i. Den, der lige er åbnet,
+	// hører med i markeringen — ellers ville det andet klik markere én og glemme
+	// den, man stod på.
+	await rows.filter({ hasText: 'Alfa' }).click();
+	await rows.filter({ hasText: 'Bravo' }).click({ modifiers: ['Meta'] });
+	await expect(page.getByText('2 markeret')).toBeVisible();
+
+	await page.getByRole('button', { name: 'Arkivér', exact: true }).click();
+	await page.waitForTimeout(900);
+
+	// Væk fra listen, og ikke i papirkurven: arkivering er ikke sletning.
+	await expect(rows.filter({ hasText: 'Alfa' })).toHaveCount(0);
+	await expect(rows.filter({ hasText: 'Charlie' })).toBeVisible();
+
+	await page.getByLabel('Vis arkivet').click();
+	await page.waitForTimeout(900);
+	await expect(rows.filter({ hasText: 'Alfa' })).toBeVisible();
+	await expect(rows.filter({ hasText: 'Bravo' })).toBeVisible();
+	await expect(rows.filter({ hasText: 'Charlie' })).toHaveCount(0);
+
+	// Og tilbage igen — med rækkens egen knap, som er vejen for den ene. Et
+	// almindeligt klik rydder markeringen med vilje, så bjælken er til flere.
+	await rows.filter({ hasText: 'Alfa' }).hover();
+	await page.locator('.rowline', { hasText: 'Alfa' }).getByLabel('Tag frem igen').click();
+	await page.waitForTimeout(900);
+	await expect(rows.filter({ hasText: 'Alfa' })).toHaveCount(0);
+
+	await page.getByLabel('Vis arkivet').click();
+	await page.waitForTimeout(900);
+	await expect(rows.filter({ hasText: 'Alfa' })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});

web/src/lib/api.js

@@ -203,7 +203,7 @@ export const api = {
 	changePassword: (current_password, new_password) =>
 		post('/auth/password/change', { current_password, new_password }),
 
-	totpSetup: () => post('/auth/totp/setup'),
+	totpSetup: (password) => post('/auth/totp/setup', { password }),
 	totpConfirm: (code) => post('/auth/totp/confirm', { code }),
 	totpDisable: (password) => post('/auth/totp/disable', { password }),
 	listSessions: () => get('/auth/sessions'),
@@ -345,6 +345,7 @@ export const api = {
 
 	uploadAttachment: (taskId, file) => upload(`/tasks/${taskId}/attachments`, file),
 	uploadNoteFile: (noteId, file) => upload(`/notes/${noteId}/attachments`, file),
+	noteBulk: (body) => post('/notes/bulk', body),
 	deleteAttachment: (id) => del(`/attachments/${id}`),
 	attachmentURL: (id) => `/api/v1/attachments/${id}`,
 

web/src/lib/components/NoteEditor.svelte

@@ -121,12 +121,71 @@
 	 * monospace hele tiden; farverne kommer, når man forlader den, hvilket er når
 	 * man læser den.
 	 */
+	/**
+	 * En kopiér-knap på hver kodeblok.
+	 *
+	 * Lagt oven på blokken frem for skrevet ind i den: alt inde i `.page` er tekst,
+	 * der bliver til Markdown, når noten gemmes, så en knap derinde ville ende i
+	 * filen. Den her er `contenteditable="false"` og hænger uden for tekstflowet —
+	 * den findes for øjet og musen, ikke for dokumentet.
+	 *
+	 * `navigator.clipboard` fejler, når siden ikke er sikker eller ikke har fokus,
+	 * og en knap, der siger "Kopieret" uden at have gjort det, er værre end ingen
+	 * knap. Derfor siges det kun, når skrivningen faktisk lykkedes.
+	 */
+	function addCopyButtons() {
+		if (!editor) return;
+		for (const pre of editor.querySelectorAll('pre')) {
+			if (pre.querySelector('.copy')) continue;
+			const btn = document.createElement('button');
+			btn.className = 'copy';
+			btn.type = 'button';
+			btn.contentEditable = 'false';
+			btn.textContent = t('notes.copyCode');
+			btn.addEventListener('mousedown', (e) => e.preventDefault());
+			btn.addEventListener('click', async (e) => {
+				e.preventDefault();
+				e.stopPropagation();
+				const text = codeTextOf(pre);
+				try {
+					await navigator.clipboard.writeText(text.replace(/\n$/, ''));
+					btn.textContent = t('notes.copied');
+					setTimeout(() => (btn.textContent = t('notes.copyCode')), 1200);
+				} catch {
+					app.toast(t('notes.copyFailed'));
+				}
+			});
+			pre.appendChild(btn);
+		}
+	}
+
+	/**
+	 * Teksten i en kodeblok, uden knapper og andet, editoren har lagt oven på den.
+	 *
+	 * Ét sted, fordi to steder skal bruge det samme svar: farvelægningen, som
+	 * skriver resultatet tilbage i blokken, og oversættelsen til Markdown, som
+	 * skriver det i filen. Var de to uenige, ville forskellen ende i noten.
+	 */
+	function codeTextOf(pre) {
+		const from = pre.querySelector('code') ?? pre;
+		return [...from.childNodes]
+			.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
+			.map((n) => n.textContent ?? '')
+			.join('');
+	}
+
 	function colourCode() {
 		if (!editor) return;
 		const inside = currentBlock();
 		for (const pre of editor.querySelectorAll('pre')) {
 			if (pre === inside || pre.contains(inside)) continue;
-			const code = pre.textContent ?? '';
+			// Blokkens tekst uden det, vi selv har lagt oven på den.
+			//
+			// `pre.textContent` tog kopiér-knappens eget ord med, og linjen under
+			// maler resultatet tilbage ind i blokken — så et klik på "Kopiér" skrev
+			// "Kopieret" ind i koden, og den næste gemning lagde det i filen. Knappen
+			// spiste den kode, den var sat der for at kopiere.
+			const code = codeTextOf(pre);
 			const lang = pre.getAttribute('data-lang') || guessLanguage(code);
 			if (lang) pre.setAttribute('data-lang', lang);
 			const painted = highlight(code, lang);
@@ -135,6 +194,7 @@
 			const target = pre.querySelector('code') ?? pre;
 			if (target.innerHTML !== painted) target.innerHTML = painted;
 		}
+		addCopyButtons();
 	}
 
 	function changed() {
@@ -814,7 +874,17 @@
 		 *
 		 * Kun teksten, ikke arket: værktøjslinjen og foden hører til ruden og skal
 		 * blive i den. */
-		max-width: 46rem;
+		/* Bredden vokser med ruden, men ikke i det uendelige.
+		 *
+		 * 46rem var for stramt: på en skærm, der er halvanden gang så bred, stod
+		 * teksten i en smal søjle med en håndflade tom plads ved siden af — og
+		 * kodeblokke og billeder, som er de to ting i en note, der *vil* have
+		 * bredde, blev klemt sammen uden grund.
+		 *
+		 * clamp frem for et tal: en smal rude får det hele, en bred får en
+		 * linjelængde, øjet kan finde tilbage i. Øvre grænse omkring 68rem, hvor en
+		 * linje er lang nok til at rumme en kommando og kort nok til at læse. */
+		max-width: clamp(38rem, 92%, 68rem);
 		width: 100%;
 	}
 
@@ -915,6 +985,40 @@
 		color: var(--ink-muted);
 	}
 
+	/* Kopiér-knappen, øverst til højre i blokken.
+	 *
+	 * Synlig hele tiden, ikke kun ved hover. En knap, der først findes, når musen
+	 * er det rigtige sted, er en knap, folk ikke ved er der — og på en berøringsskærm
+	 * findes den slet ikke. Den er i stedet dæmpet nok til ikke at tage
+	 * opmærksomhed fra koden.
+	 *
+	 * `z-index` sagt højt: uden det lå den bag blokkens eget indhold i
+	 * stakrækkefølgen, og et klik ramte <pre> i stedet for knappen. */
+	.page :global(pre) {
+		position: relative;
+	}
+
+	.page :global(pre .copy) {
+		position: absolute;
+		z-index: 1;
+		top: 6px;
+		right: 6px;
+		font-family: var(--font);
+		font-size: var(--text-xs);
+		padding: 2px var(--s2);
+		border-radius: var(--radius-sm);
+		background: rgb(255 255 255 / 0.08);
+		color: rgb(255 255 255 / 0.55);
+		transition: background var(--fast) var(--ease), color var(--fast) var(--ease);
+	}
+
+	.page :global(pre:hover .copy),
+	.page :global(pre .copy:hover),
+	.page :global(pre .copy:focus-visible) {
+		background: rgb(255 255 255 / 0.2);
+		color: #fff;
+	}
+
 	/* En kodeblok ser ud som en terminal, fordi det er hvad den er.
 	   Monospace er altid kode i praksis — Apple Noters "Monotype" er stort set kun
 	   brugt til kommandoer og udskrifter — og en mørk flade siger det på afstand,

web/src/lib/components/QuickAdd.svelte

@@ -221,6 +221,13 @@
 		gap: var(--s3);
 		padding: var(--s3) var(--s2);
 		border-bottom: 1px solid var(--line);
+		/* Luft under stregen.
+		 *
+		 * Stregen skiller "skriv en ny" fra "det, der allerede er", og uden afstand
+		 * sad den første sektion klods op ad den — så den læste som en kant om
+		 * sektionen frem for som en afslutning på feltet over. En streg skal have
+		 * plads på begge sider for at kunne ses som en streg. */
+		margin-bottom: var(--s4);
 	}
 
 	.plus {

web/src/lib/components/Sidebar.svelte

@@ -363,6 +363,15 @@
 		overProject = project.id;
 	}
 
+	/**
+	 * Et slip på et projekt, uanset hvad der bliver sluppet.
+	 *
+	 * Rækken kaldte den her for opgaver og lod noter falde ned i grenen, der
+	 * omarrangerer projekter — hvor en note ikke betyder noget. Samtidig tog
+	 * `onTaskDragOver` imod begge, så rækken lyste op, når en note blev trukket hen
+	 * over den. Den værst mulige form for i stykker: den så ud, som om den ville
+	 * virke, helt indtil man slap.
+	 */
 	async function onTaskDrop(event, project) {
 		event.preventDefault();
 		overProject = null;
@@ -371,9 +380,12 @@
 		// The same target takes both. A note dropped on a project is filed there,
 		// which is also how it gets shared — one gesture, one meaning, and the
 		// sidebar already reads as "put this here".
-		const noteID = dragged(event, NOTE);
-		if (noteID) {
-			await app.moveNoteToProject(noteID, project.id);
+		// Nyttelasten er ét eller flere id'er adskilt af mellemrum. Markerer man
+		// halvtreds noter og trækker dem herhen, hører de alle sammen til det ene
+		// sted, man slap dem — det er én handling, uanset hvor mange den flytter.
+		const noteIDs = (dragged(event, NOTE) ?? '').split(' ').filter(Boolean);
+		if (noteIDs.length) {
+			for (const id of noteIDs) await app.moveNoteToProject(id, project.id);
 			return;
 		}
 
@@ -569,14 +581,17 @@
 			ondragstart={(e) => sortable && onDragStart(e, project)}
 			ondragend={clearDrag}
 			ondragover={(e) => {
-				if (carries(e, TASK)) onTaskDragOver(e, project);
+				if (carries(e, TASK) || carries(e, NOTE)) onTaskDragOver(e, project);
 				else if (sortable) onDragOver(e, project);
 			}}
 			ondragleave={() => {
 				overId = null;
 				overProject = null;
 			}}
-			ondrop={(e) => (carries(e, TASK) ? onTaskDrop(e, project) : sortable && onDrop(e, project))}
+			ondrop={(e) =>
+				carries(e, TASK) || carries(e, NOTE)
+					? onTaskDrop(e, project)
+					: sortable && onDrop(e, project)}
 		>
 			<span class="dot" style="background: {colorVar(project.color)}" aria-hidden="true"></span>
 			{projectName(project)}

web/src/lib/locales/da.js

@@ -44,6 +44,21 @@ export const da = {
 	'beacon.byVersion': 'Efter version (30 dage):',
 	'beacon.publish': 'Offentliggør tallet på /api/v1/beacon/count',
 	'beacon.publishHint': 'Uden login, mellemlagret et minut. Viser installationer set de seneste 30 dage — ikke et løbende total, som kun ville stige.',
+	'notes.newHere': 'Ny note',
+	'notes.noneInProject': 'Ingen noter endnu. En note, der nævner #projektet, dukker også op her.',
+	'notes.clearSearch': 'Ryd søgningen',
+	'notes.found': '{count} noter',
+	'notes.picked': '{count} markeret',
+	'notes.archive': 'Arkivér',
+	'notes.unarchive': 'Tag frem igen',
+	'notes.clearPick': 'Ryd markering',
+	'notes.showArchive': 'Vis arkivet',
+	'notes.deleteMany': 'Slet {count} noter?',
+	'notes.archiveOne': 'Arkivér noten',
+	'notes.emptyArchive': 'Arkivet er tomt.',
+	'notes.copyCode': 'Kopiér',
+	'notes.copied': 'Kopieret',
+	'notes.copyFailed': 'Kunne ikke kopiere',
 	'notes.strike': 'Gennemstreget',
 	'notes.showSource': 'Vis som kode',
 	'notes.source': 'Notens kildetekst',

web/src/lib/locales/en.js

@@ -40,6 +40,21 @@ export const en = {
 	'beacon.byVersion': 'By version (30 days):',
 	'beacon.publish': 'Publish the count at /api/v1/beacon/count',
 	'beacon.publishHint': 'No login, cached for a minute. Reports installations seen in the last 30 days — not a running total, which would only ever climb.',
+	'notes.newHere': 'New note',
+	'notes.noneInProject': 'No notes yet. A note that mentions #theproject turns up here too.',
+	'notes.clearSearch': 'Clear the search',
+	'notes.found': '{count} notes',
+	'notes.picked': '{count} selected',
+	'notes.archive': 'Archive',
+	'notes.unarchive': 'Bring back',
+	'notes.clearPick': 'Clear selection',
+	'notes.showArchive': 'Show the archive',
+	'notes.deleteMany': 'Delete {count} notes?',
+	'notes.archiveOne': 'Archive this note',
+	'notes.emptyArchive': 'The archive is empty.',
+	'notes.copyCode': 'Copy',
+	'notes.copied': 'Copied',
+	'notes.copyFailed': 'Could not copy',
 	'notes.strike': 'Strikethrough',
 	'notes.showSource': 'Show as code',
 	'notes.source': 'Note source',

web/src/lib/richtext.js

@@ -339,7 +339,15 @@ export function htmlToMarkdown(root) {
 					// else and an indent does not.
 					const lang = child.getAttribute('data-lang') ?? '';
 					emit('```' + lang);
-					for (const l of (child.textContent ?? '').replace(/\n$/, '').split('\n')) {
+					// Knapper og andet, editoren har lagt oven på blokken, hører ikke til
+					// i filen. Kopiér-knappen ligger inde i <pre> for at kunne placeres i
+					// hjørnet af den, og `textContent` ville ellers skrive ordet "Kopiér"
+					// ind i hver eneste kodeblok, hver gang noten blev gemt.
+					const code = [...child.childNodes]
+						.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
+						.map((n) => n.textContent ?? '')
+						.join('');
+					for (const l of code.replace(/\n$/, '').split('\n')) {
 						emit(l);
 					}
 					emit('```');

web/src/routes/indstillinger/+page.svelte

@@ -143,6 +143,7 @@
 	let recoveryCodes = $state([]);
 	let remaining = $state(null);
 	let disablePassword = $state('');
+	let enablePassword = $state('');
 
 	$effect(() => {
 		if (app.user?.totp_enabled) {
@@ -150,13 +151,21 @@
 		}
 	});
 
-	async function beginTOTP() {
+	async function beginTOTP(event) {
+		event?.preventDefault?.();
+		totpErrors = {};
 		try {
-			const r = await api.totpSetup();
+			// Adgangskoden, ligesom når man slår den fra. At slå den til er mindst
+			// lige så indgribende som at slå den fra — det afgør, hvilken enhed der
+			// fra nu af må sige ja — og en dør, der åbnes lettere end den lukkes, er
+			// ikke en dør.
+			const r = await api.totpSetup(enablePassword);
+			enablePassword = '';
 			totpSecret = r.secret;
 			totpURI = r.uri;
 		} catch (e) {
-			app.toast(humanMessage(e));
+			totpErrors = e.fields ?? {};
+			if (!Object.keys(totpErrors).length) app.toast(humanMessage(e));
 		}
 	}
 
@@ -475,9 +484,21 @@
 			</div>
 		</form>
 	{:else}
-		<div class="row">
-			<button class="primary" onclick={beginTOTP}>{t('account.totpOn')}</button>
-		</div>
+		<form onsubmit={beginTOTP}>
+			<div class="field">
+				<label for="enable-pw">{t('account.password')}</label>
+				<input
+					id="enable-pw"
+					type="password"
+					autocomplete="current-password"
+					bind:value={enablePassword}
+				/>
+				{#if totpErrors.password}<p class="error">{totpErrors.password}</p>{/if}
+			</div>
+			<div class="row">
+				<button class="primary" type="submit">{t('account.totpOn')}</button>
+			</div>
+		</form>
 	{/if}
 </section>
 

web/src/routes/noter/+page.svelte

@@ -53,7 +53,16 @@
 
 	// Favoritter står øverst uanset rækkefølge. Det er hele meningen med at gøre en
 	// note til favorit, og en sortering, der blandede dem ind igen, ville tage den.
-	let ordered = $derived(
+	let ordered = $derived.by(() => {
+		// En søgning har allerede en rækkefølge, og den er bedre end nogen af de
+		// tre herunder: serveren har sorteret efter hvor godt hver note matchede.
+		// Sorterede vi den om efter dato, ville vi kaste netop det væk, der gør en
+		// søgning i tolv hundrede noter brugbar.
+		if (query.trim()) return notes;
+		return sortedByChoice();
+	});
+
+	const sortedByChoice = () =>
 		[...notes].sort((a, b) => {
 			if (a.pinned !== b.pinned) return a.pinned ? -1 : 1;
 			if (order === 'title') {
@@ -61,10 +70,106 @@
 			}
 			const field = order === 'created' ? 'created_at' : 'updated_at';
 			return new Date(b[field]).getTime() - new Date(a[field]).getTime();
-		})
-	);
+		});
 	let selected = $state(null);
+	// Hvilken række der er valgt. Se open(): editoren venter på hele noten.
+	let selectedId = $state(null);
+
+	/**
+	 * Flere ad gangen.
+	 *
+	 * Et sæt frem for et flag på noten, fordi markeringen hører til skærmen og ikke
+	 * til noten: den forsvinder, når man går et andet sted hen, og den skal ikke
+	 * gemmes nogen steder.
+	 *
+	 * `anchor` er den, et skift-klik måler fra. Uden den ville et interval skulle
+	 * gættes ud fra "den valgte", og den flytter sig, hver gang man klikker.
+	 */
+	let picked = $state(new Set());
+	let anchor = $state(null);
+	let showArchive = $state(false);
+
+	function rowClick(event, note) {
+		const many = event.metaKey || event.ctrlKey;
+		const range = event.shiftKey;
+
+		if (!many && !range) {
+			picked = new Set();
+			anchor = note.id;
+			open(note);
+			return;
+		}
+
+		const next = new Set(picked);
+		if (range && anchor) {
+			// Fra ankeret til her, i den rækkefølge listen faktisk står i — ikke i
+			// notens egen, som er en anden, når der er sorteret eller søgt.
+			const ids = ordered.map((n) => n.id);
+			const from = ids.indexOf(anchor);
+			const to = ids.indexOf(note.id);
+			if (from !== -1 && to !== -1) {
+				for (const id of ids.slice(Math.min(from, to), Math.max(from, to) + 1)) next.add(id);
+			}
+		} else {
+			// Den, der lige er åbnet, hører med i markeringen: ellers ville et
+			// ⌘-klik nummer to markere to noter og glemme den, man stod på.
+			if (!next.size && selectedId) next.add(selectedId);
+			next.has(note.id) ? next.delete(note.id) : next.add(note.id);
+			anchor = note.id;
+		}
+		picked = next;
+	}
+
+	/** Arkivér, tag frem igen, eller slet — for det, der er markeret. */
+	async function bulk(change) {
+		const ids = [...picked];
+		if (!ids.length) return;
+		if (change.delete && !confirm(t('notes.deleteMany', { count: ids.length }))) return;
+		try {
+			await api.noteBulk({ ids, ...change });
+			picked = new Set();
+			if (ids.includes(selectedId)) open(null);
+			await load(query);
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
+	/** Én note lagt væk, uden at markere den først. */
+	async function archiveOne(note) {
+		try {
+			await api.noteBulk({ ids: [note.id], archived: !note.archived_at });
+			if (selectedId === note.id) open(null);
+			await load(query);
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
 	let query = $state('');
+
+	/**
+	 * Det, der står i feltet, og det, der er søgt efter.
+	 *
+	 * To ting, fordi de ikke er den samme: `draftQuery` opdateres ved hvert
+	 * tastetryk,
+	 * så feltet føles som et felt, og `query` halter en kvart sekund bagefter, fordi
+	 * det er den, der koster en forespørgsel. Uden det sendte "kaffe" fem søgninger
+	 * gennem tolv hundrede noter, hvoraf de fire var forældede, inden de kom
+	 * tilbage — og svarene kunne lande i den forkerte rækkefølge.
+	 */
+	let draftQuery = $state('');
+	let typing = $state(false);
+	let searchTimer;
+
+	function search(next) {
+		draftQuery = next;
+		typing = next.trim() !== '' && next !== query;
+		clearTimeout(searchTimer);
+		searchTimer = setTimeout(() => {
+			query = draftQuery;
+			typing = false;
+		}, 250);
+	}
 	let status = $state('loading');
 	let saving = $state(false);
 
@@ -74,6 +179,7 @@
 	let timer;
 
 	$effect(() => {
+		showArchive;
 		load(query);
 	});
 
@@ -81,7 +187,7 @@
 	// opens it rather than dropping the person on a list to find it again.
 	let asked = $derived($page.url.searchParams.get('note'));
 	$effect(() => {
-		if (!asked || selected?.id === asked) return;
+		if (!asked || selectedId === asked) return;
 		const found = notes.find((n) => n.id === asked);
 		if (found) open(found);
 		else api.note(asked).then(open).catch(() => {});
@@ -89,19 +195,60 @@
 
 	async function load(q) {
 		try {
-			notes = (await api.notes(q ? { q } : {})).notes ?? [];
+			const params = q ? { q } : showArchive ? { archived: '1' } : {};
+			notes = (await api.notes(params)).notes ?? [];
 			status = 'ready';
-			if (selected && !notes.some((n) => n.id === selected.id)) open(notes[0] ?? null);
+			if (selectedId && !notes.some((n) => n.id === selectedId)) open(notes[0] ?? null);
 		} catch (e) {
 			status = 'failed';
 			app.toast(humanMessage(e));
 		}
 	}
 
-	function open(note) {
+	/**
+	 * Åbner en note — og henter den hel først, hvis listen kun har uddraget.
+	 *
+	 * Listen bærer `preview` og en tom `body`, så en liste på tolv hundrede noter
+	 * ikke er tolv hundrede hele noter. Editoren må aldrig få det uddrag: den ville
+	 * gemme det efter sin pause, og noten ville være skåret ned til sit eget uddrag
+	 * af ingenting andet end at være blevet kigget på.
+	 *
+	 * Derfor hentes den hele her. Rækken vises med det samme, så det ikke føles som
+	 * at vente; teksten kommer, når den er der.
+	 */
+	async function open(note) {
 		clearTimeout(timer);
-		selected = note;
-		draft = note?.body ?? '';
+		if (!note) {
+			selectedId = null;
+			selected = null;
+			draft = '';
+			return;
+		}
+
+		// Rækken fremhæves med det samme; editoren får først noten, når den er hel.
+		//
+		// De to er skilt ad, fordi editoren indlæser sin tekst, når notens *id*
+		// skifter — og hvis den fik uddraget først og hele noten bagefter, ville
+		// id'et være det samme begge gange, så den anden aldrig blev vist. Man ville
+		// sidde med en tom note, der lige havde haft en titel.
+		selectedId = note.id;
+		if (note.body) {
+			selected = note;
+			draft = note.body;
+			return;
+		}
+		selected = null;
+
+		try {
+			const full = await api.note(note.id);
+			// Kun hvis den stadig er den, der er valgt: skifter man note, mens
+			// hentningen er undervejs, må den forrige ikke lande oven i den nye.
+			if (selectedId !== note.id) return;
+			selected = full;
+			draft = full.body ?? '';
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
 	}
 
 	/**
@@ -151,6 +298,14 @@
 		return at.toLocaleDateString(tag(), { day: '2-digit', month: '2-digit', year: 'numeric' });
 	}
 
+	/** Hvilken dato rækken viser: den, der sorteres efter. */
+	const shownDate = (note) => (order === 'created' ? note.created_at : note.updated_at);
+
+	/** Begge datoer, til den, der holder musen stille. */
+	const stamp = (note) =>
+		`${t('notes.sortCreated')}: ${new Date(note.created_at).toLocaleString(tag())}\n` +
+		`${t('notes.sortUpdated')}: ${new Date(note.updated_at).toLocaleString(tag())}`;
+
 	function projectName(id) {
 		return app.projects.find((p) => p.id === id)?.name ?? '';
 	}
@@ -161,7 +316,11 @@
 
 	function onDragStart(event, note) {
 		dragging = note.id;
-		startDrag(event, NOTE, note.id);
+		// Trækker man en note, der er markeret, følger hele markeringen med. Trækker
+		// man en, der ikke er, er det den ene — ellers ville et træk i en tilfældig
+		// række flytte halvtreds noter, man havde glemt var markeret.
+		const ids = picked.has(note.id) ? [...picked] : [note.id];
+		startDrag(event, NOTE, ids.join(' '));
 	}
 
 	async function create() {
@@ -194,7 +353,10 @@
 		saving = true;
 		try {
 			const saved = await api.updateNote(id, { body });
-			notes = notes.map((n) => (n.id === id ? saved : n));
+			// Svaret er hele noten. Rækken viser `preview`, så den skal med — ellers
+			// står linjen tom, indtil siden hentes igen.
+			const forList = { ...saved, preview: saved.body ?? '' };
+			notes = notes.map((n) => (n.id === id ? forList : n));
 			// Only if it is still the one on screen: switching notes mid-save must not
 			// drag the previous one's title back onto this one.
 			if (selected?.id === id) selected = saved;
@@ -295,22 +457,63 @@
 						<option value={o.key}>{t(o.label)}</option>
 					{/each}
 				</select>
+				<button
+					class="archive-toggle"
+					class:on={showArchive}
+					onclick={() => { showArchive = !showArchive; picked = new Set(); }}
+					aria-pressed={showArchive}
+					aria-label={t('notes.showArchive')}
+					title={t('notes.showArchive')}
+				>
+					<svg viewBox="0 0 24 24" aria-hidden="true">
+						<path d="M3 7h18v3H3zM5 10v9h14v-9M10 14h4" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round" />
+					</svg>
+				</button>
 				<button class="new" onclick={create} aria-label={t('notes.new')}>+</button>
 			</div>
 		</div>
 
-		<input
-			class="search"
-			type="search"
-			bind:value={query}
-			placeholder={t('notes.search')}
-			aria-label={t('notes.search')}
-		/>
+		<!-- Samme form som søgefeltet i toppen: samme flade, samme kant, samme
+		     radius. Det var en pille med et forstørrelsesglas tegnet ind som et
+		     baggrundsbillede med farven skrevet i hånden — så det var det ene sted i
+		     programmet, der ikke fulgte temaet, og det kunne ses. -->
+		<div class="searchbox" class:busy={typing}>
+			<svg viewBox="0 0 24 24" aria-hidden="true">
+				<circle cx="11" cy="11" r="7" fill="none" stroke="currentColor" stroke-width="2" />
+				<path d="M20 20l-3.5-3.5" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" />
+			</svg>
+			<input
+				type="search"
+				value={draftQuery}
+				oninput={(e) => search(e.currentTarget.value)}
+				placeholder={t('notes.search')}
+				aria-label={t('notes.search')}
+			/>
+			{#if draftQuery}
+				<button class="clear" onclick={() => search('')} aria-label={t('notes.clearSearch')}>×</button>
+			{/if}
+		</div>
+		{#if picked.size}
+			<!-- Kun mens der er markeret noget. En bjælke, der altid står der, er en
+			     bjælke, der tager plads fra listen hver dag for at gøre gavn sjældent. -->
+			<div class="picked-bar">
+				<span>{t('notes.picked', { count: picked.size })}</span>
+				<button onclick={() => bulk({ archived: !showArchive })}>
+					{showArchive ? t('notes.unarchive') : t('notes.archive')}
+				</button>
+				<button class="danger" onclick={() => bulk({ delete: true })}>{t('notes.delete')}</button>
+				<button onclick={() => (picked = new Set())}>{t('notes.clearPick')}</button>
+			</div>
+		{:else if query && status === 'ready'}
+			<p class="found">{t('notes.found', { count: notes.length })}</p>
+		{/if}
 
 		{#if status === 'loading'}
 			<p class="hint">{t('history.loading')}</p>
 		{:else if !notes.length}
-			<p class="hint">{query ? t('notes.noneFound') : t('notes.noneYet')}</p>
+			<p class="hint">
+				{query ? t('notes.noneFound') : showArchive ? t('notes.emptyArchive') : t('notes.noneYet')}
+			</p>
 		{:else}
 			<ul>
 				{#each ordered as note (note.id)}
@@ -318,8 +521,9 @@
 						<div class="rowline">
 							<button
 								class="row"
-								class:on={selected?.id === note.id}
-								onclick={() => open(note)}
+								class:on={selectedId === note.id}
+								class:picked={picked.has(note.id)}
+								onclick={(e) => rowClick(e, note)}
 								draggable="true"
 								ondragstart={(e) => onDragStart(e, note)}
 								ondragend={() => (dragging = null)}
@@ -329,13 +533,36 @@
 								     linjer pr. note frem for tre, og datoen er dét, man skanner
 								     efter, når man leder efter noget, man skrev i tirsdags. -->
 								<span class="under">
-									<span class="when">{when(note.updated_at)}</span>
-									<span class="preview">{plain(note.body)}</span>
+									<!-- Datoen, der svarer til den rækkefølge, listen står i.
+									     Den viste altid `updated_at`, og for tolv hundrede
+									     importerede noter er det i aftes — så en note fra 2017
+									     stod som "i går", og den dato, man sorterede efter, var
+									     ingen steder at se. -->
+									<span class="when" title={stamp(note)}>{when(shownDate(note))}</span>
+									<span class="preview">{plain(note.preview ?? note.body)}</span>
 								</span>
 								{#if note.project_id}
 									<span class="filed">{projectName(note.project_id)}</span>
 								{/if}
 							</button>
+							<!-- De to knapper står oven på hinanden i en smal søjle.
+							     Ved siden af hinanden tog de toogfyrre pixels af en liste,
+							     der er tre hundrede bred — og de bruges sjældent, mens
+							     titlen og uddraget læses hele tiden. -->
+							<div class="rowactions">
+							<!-- Én note lagt væk, uden at markere den først. Markeringen er
+							     til flere; det her er til den ene, man står med — og i
+							     arkivet er det vejen tilbage. -->
+							<button
+								class="archive-one"
+								onclick={() => archiveOne(note)}
+								aria-label={note.archived_at ? t('notes.unarchive') : t('notes.archiveOne')}
+								title={note.archived_at ? t('notes.unarchive') : t('notes.archiveOne')}
+							>
+								<svg viewBox="0 0 24 24" aria-hidden="true">
+									<path d="M3 7h18v3H3zM5 10v9h14v-9M10 14h4" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round" />
+								</svg>
+							</button>
 							<button
 								class="star"
 								class:on={note.pinned}
@@ -346,6 +573,7 @@
 							>
 								{note.pinned ? '★' : '☆'}
 							</button>
+							</div>
 						</div>
 					</li>
 				{/each}
@@ -474,21 +702,164 @@
 	   — og skifter til det almindelige, så snart feltet får fokus: ikonet forsvandt
 	   og formen blev firkantet midt i et klik. Med appearance: none er der kun én
 	   udgave, og den ser ens ud hele tiden. */
-	.search {
-		width: 100%;
-		appearance: none;
-		-webkit-appearance: none;
-		padding-left: 30px;
-		border-radius: 999px;
-		background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%238b918d' stroke-width='2' stroke-linecap='round'%3E%3Ccircle cx='11' cy='11' r='7'/%3E%3Cpath d='M20 20l-3.5-3.5'/%3E%3C/svg%3E");
-		background-repeat: no-repeat;
-		background-position: 9px center;
-		background-size: 15px 15px;
+	/* Formet som søgefeltet i toppen — samme flade, kant og radius — så de to
+	   søgefelter på skærmen ligner hinanden i stedet for at være to beslutninger.
+	   Ikonet er en rigtig SVG med `currentColor`, ikke et baggrundsbillede med en
+	   farve skrevet ind: den gamle var #8b918d uanset tema. */
+	.searchbox {
+		display: flex;
+		align-items: center;
+		gap: var(--s2);
+		padding: var(--s2) var(--s3);
+		background: var(--surface);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		color: var(--ink-faint);
+		transition: border-color var(--fast) var(--ease);
 	}
 
-	/* Safaris egen ryd-knap ville sidde oven i vores egen form. */
-	.search::-webkit-search-decoration,
-	.search::-webkit-search-cancel-button {
+	.searchbox:focus-within {
+		border-color: var(--line-strong);
+	}
+
+	/* Mens det tastede endnu ikke er søgt efter. Et hint om at der kommer noget,
+	   frem for en liste, der ser forkert ud i en kvart sekund. */
+	.searchbox.busy {
+		border-color: var(--accent);
+	}
+
+	.searchbox svg {
+		width: 15px;
+		height: 15px;
+		flex: none;
+	}
+
+	.searchbox input {
+		flex: 1;
+		min-width: 0;
+		appearance: none;
+		-webkit-appearance: none;
+		border: 0;
+		background: none;
+		color: var(--ink);
+		font-size: var(--text-sm);
+		outline: none;
+	}
+
+	.clear {
+		flex: none;
+		width: 18px;
+		height: 18px;
+		border-radius: var(--radius-full);
+		color: var(--ink-faint);
+		font-size: 15px;
+		line-height: 1;
+	}
+
+	.clear:hover {
+		background: var(--surface-sunken);
+		color: var(--ink);
+	}
+
+	/* Bjælken over listen, mens der er markeret noget. Den erstatter antallet af
+	   fundne frem for at lægge sig oven i det: kun ét af de to er relevant ad
+	   gangen. */
+	.picked-bar {
+		display: flex;
+		align-items: center;
+		gap: var(--s2);
+		flex-wrap: wrap;
+		padding: var(--s2) var(--s1);
+		font-size: var(--text-xs);
+		color: var(--ink-muted);
+	}
+
+	.picked-bar button {
+		font-size: var(--text-xs);
+		color: var(--ink);
+		padding: 2px var(--s2);
+		border-radius: var(--radius-sm);
+		border: 1px solid var(--line);
+	}
+
+	.picked-bar button:hover {
+		background: var(--surface);
+	}
+
+	.picked-bar button.danger {
+		color: var(--danger);
+		border-color: var(--danger-sunken);
+	}
+
+	/* En markeret række.
+	 *
+	 * En kant og en tone, ikke en tone alene: `--accent-sunken` er meget lys i lyst
+	 * tema, og tre markerede rækker var næsten ikke til at skelne fra tre, der ikke
+	 * var — hvilket er en dårlig ting at være i tvivl om, lige inden man trykker
+	 * Slet. Kanten kan ses uanset tema og uanset hvor lys tonen er. */
+	.row.picked {
+		background: var(--accent-sunken);
+		box-shadow: inset 3px 0 0 var(--accent);
+	}
+
+	/* Vises som stjernen: usynlig, indtil rækken er under musen, så listen er
+	   rolig at skanne. */
+	.archive-one {
+		flex: none;
+		width: 22px;
+		height: 22px;
+		color: var(--ink-faint);
+		border-radius: var(--radius-sm);
+		opacity: 0;
+		transition: opacity var(--fast) var(--ease);
+	}
+
+	.archive-one svg {
+		width: 14px;
+		height: 14px;
+	}
+
+	.rowline:hover .archive-one,
+	.archive-one:focus-visible {
+		opacity: 1;
+	}
+
+	.archive-one:hover {
+		color: var(--ink);
+		background: var(--surface);
+	}
+
+	.archive-toggle {
+		width: 24px;
+		height: 24px;
+		color: var(--ink-faint);
+		border-radius: var(--radius-sm);
+	}
+
+	.archive-toggle svg {
+		width: 15px;
+		height: 15px;
+	}
+
+	.archive-toggle:hover {
+		color: var(--ink);
+		background: var(--surface);
+	}
+
+	.archive-toggle.on {
+		color: var(--accent);
+		background: var(--accent-sunken);
+	}
+
+	.found {
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+		padding: 0 var(--s1);
+	}
+
+	/* Safaris egen ryd-knap ville sidde oven i vores egen. */
+	.searchbox input::-webkit-search-decoration,
+	.searchbox input::-webkit-search-cancel-button {
 		-webkit-appearance: none;
 	}
 
@@ -500,15 +871,45 @@
 		min-height: 0;
 	}
 
+	/* Rækker uden for skærmen koster ingenting.
+	 *
+	 * Listen tegner alle noterne. Med ti var det ligegyldigt; med tolv hundrede tog
+	 * første tegning to sekunder, og browseren gik i knæ — for hver eneste række
+	 * blev der lavet layout og malet, også de tusind, ingen kan se.
+	 *
+	 * `content-visibility: auto` lader browseren springe netop det over for det,
+	 * der er uden for billedet, og tage det, når man ruller derhen. Ingen JavaScript,
+	 * ingen rullematematik, ingen liste, der kan komme ud af trit med sig selv —
+	 * hvilket er hele grunden til at prøve det her før en vinduesvisning.
+	 *
+	 * `contain-intrinsic-size` er gættet på, hvor høj en uset række er. Uden det
+	 * ville rullebjælken tro, at listen er tom, og hoppe, mens man ruller. Tallet er
+	 * målt på en rigtig række: titel plus én linje uddrag. */
+	li {
+		content-visibility: auto;
+		contain-intrinsic-size: auto 54px;
+	}
+
 	.rowline {
 		display: flex;
 		align-items: center;
 		gap: var(--s1);
 	}
 
+	/* De sjældne handlinger i en søjle, ikke en række. To knapper ved siden af
+	   hinanden er toogfyrre pixels taget fra en liste på tre hundrede — og de er
+	   det, man rører en gang imellem, mens titlen er det, man læser hele tiden. */
+	.rowactions {
+		display: flex;
+		flex-direction: column;
+		gap: 1px;
+		flex: none;
+	}
+
 	.star {
 		flex: none;
-		width: 24px;
+		width: 22px;
+		height: 22px;
 		color: var(--ink-faint);
 		opacity: 0;
 		font-size: var(--text-sm);

web/src/routes/projekt/[id]/+page.svelte

@@ -134,6 +134,27 @@
 		}
 	}
 
+	/**
+	 * En ny note, der allerede hører til dette projekt.
+	 *
+	 * Noten oprettes med `project_id` sat, hvilket er præcis det, deling betyder
+	 * her: en note i et projekt kan læses af alle, der kan læse projektet. Så det
+	 * er én handling og ikke to — man skulle før oprette noten under Noter og
+	 * bagefter finde projektet frem i "Del i".
+	 *
+	 * Tom, og så videre til den. Der er ikke noget at spørge om: titlen er notens
+	 * første linje, så et navnefelt ville være et felt, der lover noget, programmet
+	 * ikke holder.
+	 */
+	async function createNote() {
+		try {
+			const note = await api.createNote({ body: '', project_id: id });
+			goto(`/noter?note=${note.id}`);
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
 	let canEdit = $derived(project?.role === 'owner' || project?.role === 'editor');
 	let isOwner = $derived(project?.role === 'owner');
 
@@ -826,15 +847,30 @@
 		<!-- What has been written about this project, which is the payoff for a #tag
 		     in a note being the same tag a task carries: nobody files anything here,
 		     it turns up because somebody mentioned the project while writing. -->
-		{#if notes.length}
+		{#if notes.length || canEdit}
 			<section class="notes">
-				<h2>{t('notes.title')}</h2>
+				<div class="noteshead">
+					<h2>{t('notes.title')}</h2>
+					{#if canEdit}
+						<!-- En note skrevet herfra hører til projektet med det samme.
+						     At ligge i et projekt *er* måden en note deles på, så det er
+						     den samme handling som at oprette den og dele den — og det er
+						     her, man står, når man opdager at der skal skrives noget ned
+						     om netop dette projekt. -->
+						<button class="newnote" onclick={createNote}>{t('notes.newHere')}</button>
+					{/if}
+				</div>
+				{#if !notes.length}
+					<p class="hint">{t('notes.noneInProject')}</p>
+				{/if}
 				<ul>
 					{#each notes as note (note.id)}
 						<li>
 							<a href="/noter?note={note.id}">
 								<strong>{note.title || t('notes.untitled')}</strong>
-								<span>{note.body.slice(0, 90)}</span>
+								<!-- `preview` når listen bærer det, `body` når noten kom
+								     fra et sted, der sender den hel. -->
+								<span>{(note.preview ?? note.body ?? '').slice(0, 90)}</span>
 							</a>
 						</li>
 					{/each}
@@ -863,6 +899,25 @@
 		border-top: 1px solid var(--line);
 	}
 
+	.noteshead {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		gap: var(--s2);
+	}
+
+	.newnote {
+		font-size: var(--text-sm);
+		color: var(--ink-muted);
+		padding: 2px var(--s2);
+		border-radius: var(--radius-sm);
+	}
+
+	.newnote:hover {
+		background: var(--surface);
+		color: var(--ink);
+	}
+
 	.notes h2 {
 		font-size: var(--text-xs);
 		text-transform: uppercase;