Merge pull request #104 from kristianwind/billedvisning-stoerre

fix(noter): et åbnet billede fylder skærmen og kan ses i fuld størrelse

.gitea/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,46 @@
+name: Bug
+# Gitea kalder feltet `about`, hvor GitHub kalder det `description`, og Gitea
+# *kræver* det: en skabelon uden bliver afvist frem for at blive vist. Derfor
+# ligger skabelonerne her for sig frem for at være delt med `.github/`.
+about: Something does not work
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: And what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: How to reproduce it
+      placeholder: |
+        1. …
+        2. …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The image tag, or the commit you built from.
+    validations:
+      required: true
+  - type: dropdown
+    id: how
+    attributes:
+      label: How are you running it
+      options:
+        - As a Rune in Yggdrasil Panel
+        - Docker directly
+        - From source
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Anything in the logs
+      description: Please remove tokens and email addresses first.
+      render: text

.gitea/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issue
+    url: https://gitea.nolimit.dk/kw/verdande/src/branch/main/SECURITY.md
+    about: Please report vulnerabilities by email, not as a public issue.

.gitea/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,24 @@
+name: Feature
+about: Suggest something
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      # Absolut adresse, ikke GitHubs `../../blob/main/…`: Gitea lægger en fil
+      # under `/src/branch/<gren>/`, så den relative form peger ingen steder her.
+      value: |
+        Please check the [non-goals](https://gitea.nolimit.dk/kw/verdande/src/branch/main/README.md#non-goals)
+        first — some things are deliberately not being built.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do
+      description: The problem, not the solution. What does the current version make hard?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you had in mind
+    validations:
+      required: false

.gitea/workflows/ci.yml

@@ -0,0 +1,293 @@
+name: CI
+
+# Gitea-tvillingen til .github/workflows/ci.yml. Den prøver at nå samme resultat
+# ad en anden vej, og forskellen er hele pointen med filen:
+#
+# INGEN `uses:`. Gitea Actions kan læse GitHubs format, men `DEFAULT_ACTIONS_URL`
+# står ikke i app.ini på gitea.nolimit.dk, og standarden er github.com — så et
+# `uses: actions/checkout@v4` her ville blive hentet FRA GitHub, hver gang, også
+# selvom både koden, runneren og registret er vores egne. Et workflow, der bruger
+# markedspladsen, er derfor ikke uafhængigt af GitHub; det ser bare sådan ud.
+#
+# Prisen er, at værktøjskæden skal komme et sted fra. Den kommer fra jobbets
+# container, hvilket er billigere end det lyder: `container: golang:1.26` er
+# nøjagtig det, setup-go ellers ville bruge et trin på at installere.
+#
+# Alternativerne, hvis nogen senere vil skrive filen om: sæt DEFAULT_ACTIONS_URL
+# til gitea.com, som spejler de gængse handlinger — men det flytter kun
+# afhængigheden fra én andens server til en andens, og det er en indstilling for
+# HELE instansen, altså også for alt andet, der bygger der. Denne fil rører kun
+# dette repo.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # Så en kørsel kan udløses uden at skulle opfinde en commit. Det er ikke
+  # bekvemmelighed: uden den er den eneste måde at få CI til at køre igen mod
+  # uændret kode at skubbe noget tomt, og en tom commit i historikken er en
+  # løgn om, at der skete noget.
+  workflow_dispatch:
+
+# Ingen `concurrency:`-blok. GitHub-udgaven aflyser en kørsel, når en nyere
+# kommer, og det er stadig det rigtige at gøre — men understøttelsen kom sent til
+# Gitea Actions, og et felt, runneren ikke kender, er en fejl ved oversættelsen
+# frem for en ignoreret linje. Den kan sættes på, når instansen er en version,
+# der kan.
+
+jobs:
+  go:
+    name: Go
+    runs-on: ubuntu-latest
+    # Containeren ER værktøjskæden. `-race` kræver en C-oversætter, og den er med
+    # i det officielle golang-image — et slankere ville koste et apt-trin.
+    container:
+      image: golang:1.26
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          # Håndrullet, fordi actions/checkout ville blive hentet fra GitHub.
+          # Det er de samme fire greb, den handling tager: init, remote, en
+          # fetch af præcis den commit, der udløste kørslen, og et checkout.
+          #
+          # Legitimationen sættes med -c på selve fetch-kommandoen frem for i
+          # remotens adresse. En adresse med token i havner i .git/config, i
+          # `git remote -v` og i enhver fejlbesked, der citerer den; en header
+          # gør ikke.
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "These files are not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # -race is the whole point of running tests in CI for a server with a
+      # WebSocket fan-out: a data race is exactly the bug that passes locally.
+      - name: Test
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
+
+      - name: Build
+        run: CGO_ENABLED=0 go build ./...
+
+  spec:
+    name: OpenAPI is valid
+    runs-on: ubuntu-latest
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Structural validity only. That the spec matches the *router* is checked by
+      # a Go test, which is the half that actually goes stale.
+      - run: npx --yes @redocly/cli@latest lint docs/openapi.yaml
+
+  e2e:
+    name: End-to-end
+    runs-on: ubuntu-latest
+    # node frem for golang her: Playwrights browsere trækker et lag
+    # Debian-pakker, som npm-imaget er vant til at have, mens Go til gengæld er
+    # fire linjer at hælde ind. Den anden vej rundt er den dyre.
+    container:
+      image: node:22
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      - name: Go
+        run: |
+          set -eu
+          # Versionen læses ud af go.mod frem for at stå her. To steder at rette
+          # er ét for mange, og den slags glemmes lige indtil CI bygger med en
+          # anden Go end udviklerne.
+          version=$(awk '/^go /{print $2; exit}' go.mod)
+          arch=$(dpkg --print-architecture)
+          curl -fsSL "https://go.dev/dl/go${version}.linux-${arch}.tar.gz" | tar -xz -C /usr/local
+          echo /usr/local/go/bin >> "$GITHUB_PATH"
+
+      - name: Install
+        working-directory: web
+        run: npm ci --no-audit --no-fund
+
+      # Chromium for the suite, WebKit for one test.
+      #
+      # A smoke test exists to catch a build that does not work at all, and running
+      # the whole thing in three engines finds the same breakage three times for
+      # three times the cost. Focus is the exception, and it took a real report to
+      # learn it: Safari ignores `autofocus` on anything inserted after the page has
+      # loaded, so every inline form in the app opened with no cursor in it. WebKit
+      # here is the same engine Safari is, and `webkit-forms` in the Playwright
+      # config greps a single test out of the suite to run in it.
+      - name: Install browsers
+        working-directory: web
+        run: npx playwright install --with-deps chromium webkit
+
+      # The suite builds the frontend, embeds it and starts the real binary — see
+      # playwright.config.js. There is nothing to build here first.
+      - name: Test
+        working-directory: web
+        run: npm run test:e2e
+
+      # Ingen rapport at hente ned bagefter. GitHub-udgaven lægger
+      # web/playwright-report/ op som et artefakt, og det trin ER en handling fra
+      # markedspladsen — der er ikke en `run:`-form af det. Går suiten i stykker
+      # her, står grunden i loggen frem for i en zip. Skal rapporten tilbage, er
+      # det upload-artifact spejlet ind lokalt, ikke en linje mere i denne fil.
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    # Ingen `container:` her: jobbet skal bruge docker-klienten og buildx, og dem
+    # har runnerens eget ubuntu-image. En golang- eller node-container ville have
+    # sproget og mangle værktøjet.
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # Build only — publishing happens on a tag, in release.yml. This job exists
+      # so a Dockerfile that no longer builds fails on the pull request rather
+      # than at release time.
+      #
+      # `type=cacheonly` frem for `--load`: resultatet skal ingen steder hen, og
+      # at hente et image ind i daemonen for straks at glemme det er et halvt
+      # minut hver kørsel. Én arkitektur er nok til at fange en Dockerfile, der
+      # ikke bygger; de to rigtige bygges på et mærkat.
+      - name: Build
+        run: |
+          set -eu
+          docker buildx create --use --name ci-verdande 2>/dev/null || docker buildx use ci-verdande
+          docker buildx build --platform linux/amd64 --output type=cacheonly .
+          # Begge udgaver, fordi EDITION rører den sidste stage: en Dockerfile, der
+          # ikke længere bygger med den, skal fejle her og ikke på et mærkat.
+          docker buildx build --platform linux/amd64 --build-arg EDITION=notes --output type=cacheonly .
+
+      # Hvad der IKKE er her, og hvorfor, så den næste læser ikke tror det er glemt:
+      # GitHubs ci.yml har et trin, der henter begge images ind i daemonen og
+      # påstår, at de deler alle lag — altså at verdande og urd bærer samme binær.
+      # Det kræver `--load` to gange, og det er et halvt minut per image på en
+      # runner, der deles med Yggdrasils produktionscontainere og allerede har
+      # dræbt en kørsel på hukommelse (exit 137). Påstanden er den samme kode
+      # begge steder, så det er nok at evaluere den ét sted — og GitHub er
+      # autoritativ for de offentlige projekter.
+      #
+      # Det, der SKAL være her, er ovenstående: at begge varianter kan bygges.

.gitea/workflows/release.yml

@@ -0,0 +1,126 @@
+name: Release
+
+# Samme udløser som GitHub-workflowet: et semver-tag, og ikke andet.
+#
+# Gitea Actions læser samme format som GitHub Actions, men det er *ikke* det
+# samme sted. Filen ligger derfor for sig frem for at være delt: der er intet
+# `secrets.GITHUB_TOKEN`, registret er et andet, og der er ingen Releases-side at
+# skrive til. En delt fil ville være fire betingede led, der hver kun gælder ét
+# af de to steder.
+#
+# Og som i ci.yml: ingen `uses:`. Handlinger hentes fra github.com, så længe
+# DEFAULT_ACTIONS_URL ikke er sat — se den lange forklaring der.
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
+
+jobs:
+  image:
+    name: Build and publish image
+    # `ubuntu-latest` er runnerens egen etiket (`ovh-1`, docker-mode). Ingen
+    # `container:`: jobbet skal bruge docker-klienten og buildx, og dem har
+    # runnerens image.
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: gitea.nolimit.dk
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -eu
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          # To former for basic auth, fordi kun en kørende runner kan svare på,
+          # hvilken Gitea tager imod. actions/checkout bruger x-access-token, og
+          # det er den, økosystemet beviser virker; $GITHUB_ACTOR er reserven.
+          # Løkken skriver, hvilken der blev godkendt — så ÉN kørsel besvarer
+          # spørgsmålet, uanset om den ender grøn eller rød. Feedback-sløjfen her
+          # går gennem en kø og et andet menneske; at bruge en hel runde på at få
+          # ét bit at vide er for dyrt.
+          godkendt=
+          for bruger in x-access-token "$GITHUB_ACTOR"; do
+            header="Authorization: Basic $(printf '%s:%s' "$bruger" "$TOKEN" | base64 | tr -d '\n')"
+            if git -c http.extraheader="$header" fetch -q --depth=1 origin "$GITHUB_SHA"; then
+              godkendt=$bruger
+              break
+            fi
+          done
+          if [ -z "$godkendt" ]; then
+            echo "checkout: hverken x-access-token eller $GITHUB_ACTOR blev accepteret"
+            exit 1
+          fi
+          echo "checkout: godkendt som $godkendt"
+          git checkout -q FETCH_HEAD
+
+      # setup-qemu-action i rå form. Uden den bygger buildx kun værtens egen
+      # arkitektur, og arm64 er ikke valgfrit: et hjemmelab er lige så tit en
+      # Raspberry Pi eller en Apple silicon-VM som en x86-kasse.
+      - name: Emulation for the other architecture
+        run: docker run --privileged --rm tonistiigi/binfmt --install arm64,amd64
+
+      - name: Builder
+        run: docker buildx create --use --name release-verdande 2>/dev/null || docker buildx use release-verdande
+
+      # `GITEA_TOKEN` er automatisk til stede i et Actions-job og har lov at
+      # skrive pakker for den, der ejer repoet. Ingen hemmelighed at sætte op.
+      # --password-stdin frem for --password: det sidste ville stå i processens
+      # kommandolinje, som enhver på maskinen kan læse.
+      - name: Log in to the registry
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: printf '%s' "$TOKEN" | docker login "$REGISTRY" -u "$GITHUB_ACTOR" --password-stdin
+
+      # metadata-action i rå form.
+      #
+      # v1.4.2 udgiver 1.4.2, 1.4, 1 og latest — så en rune, der er bundet til
+      # :1, får rettelser uden nogensinde at krydse et hovedversionsskifte.
+      #
+      # En forudgivelse (v1.4.2-rc1) får KUN sit eget nøjagtige mærkat. At lade
+      # en rc overskrive :latest eller :1 ville sende den ud til alle, der troede
+      # de fulgte det stabile spor — og mærkatmønsteret ovenfor lukker dem ind.
+      - name: Work out the tags
+        id: tags
+        run: |
+          set -eu
+          version=${GITHUB_REF_NAME#v}
+          image="$REGISTRY/$GITHUB_REPOSITORY"
+          args="--tag $image:$version"
+          case "$version" in
+            *-*) echo "Forudgivelse: kun $version." ;;
+            *)
+              minor=${version%.*}
+              major=${version%%.*}
+              args="$args --tag $image:$minor --tag $image:$major --tag $image:latest"
+              ;;
+          esac
+          echo "args=$args" >> "$GITHUB_OUTPUT"
+          echo "Mærkater: $args"
+
+      - name: Build and push
+        run: |
+          set -eu
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            ${{ steps.tags.outputs.args }} \
+            --build-arg "VERSION=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --label "org.opencontainers.image.version=$GITHUB_REF_NAME" \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            .
+          # Ingen `cache-from: type=gha`. act_runner har en cache-tjeneste, der
+          # svarer på det navn, men den er ikke prøvet her, og en kold bygning,
+          # der tager nogle minutter længere, er billigere end en udgivelse, der
+          # fejler på noget, som ikke har med bygningen at gøre.
+
+    # Ingen Release oprettes.
+    #
+    # GitHub-workflowet laver en Release, fordi opdateringsnotitsen i appen læser
+    # `releases/latest` derfra. Gitea har sit eget Releases-begreb, men notitsen
+    # peger på GitHub — så en release her ville ingen læse. Skal notitsen flyttes
+    # med, er det `internal/update`, der skal have en ny adresse, og det er en
+    # ændring for sig. (Bemærk også, at GitHub-udgavens softprops-handling taler
+    # mod api.github.com og ikke kan genbruges her.)

.github/workflows/ci.yml

@@ -40,7 +40,13 @@ jobs:
       # -race is the whole point of running tests in CI for a server with a
       # WebSocket fan-out: a data race is exactly the bug that passes locally.
       - name: Test
-        run: go test -race -count=1 ./...
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
 
       - name: Build
         run: CGO_ENABLED=0 go build ./...
@@ -79,12 +85,18 @@ jobs:
         working-directory: web
         run: npm ci --no-audit --no-fund
 
-      # Chromium only. A smoke test exists to catch a build that does not work at
-      # all; running it three times in three engines finds the same breakage three
-      # times and costs three times as much.
-      - name: Install Chromium
+      # Chromium for the suite, WebKit for one test.
+      #
+      # A smoke test exists to catch a build that does not work at all, and running
+      # the whole thing in three engines finds the same breakage three times for
+      # three times the cost. Focus is the exception, and it took a real report to
+      # learn it: Safari ignores `autofocus` on anything inserted after the page has
+      # loaded, so every inline form in the app opened with no cursor in it. WebKit
+      # here is the same engine Safari is, and `webkit-forms` in the Playwright
+      # config greps a single test out of the suite to run in it.
+      - name: Install browsers
         working-directory: web
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install --with-deps chromium webkit
 
       # The suite builds the frontend, embeds it and starts the real binary — see
       # playwright.config.js. There is nothing to build here first.
@@ -111,9 +123,59 @@ jobs:
       # Build only — publishing happens on a tag, in release.yml. This job exists
       # so a Dockerfile that no longer builds fails on the pull request rather
       # than at release time.
+      #
+      # Loaded into the local daemon rather than discarded, because the step below
+      # has to inspect what came out.
       - uses: docker/build-push-action@v6
         with:
           context: .
           push: false
+          load: true
+          tags: verdande:ci
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: urd:ci
+          build-args: EDITION=notes
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # The claim this repository makes about urd is that it is the same program,
+      # not a fork — and that claim is checkable rather than a sentence in a README.
+      #
+      # Stages 1 and 2 are identical for both builds, and the edition is set with
+      # ENV, which is image *config* rather than a layer. So the two images must
+      # have the same layer digests and differ only in that one variable. A change
+      # that made them diverge — a second COPY, a conditional RUN, a separate build
+      # of the binary — would quietly turn "one source" into two, and the only
+      # symptom would be a bug fixed in one product and not the other.
+      #
+      # This was impossible until the frontend build became deterministic: SvelteKit
+      # put Date.now() in version.json, so no two builds ever matched. See the note
+      # in web/svelte.config.js.
+      - name: The two images are one build
+        run: |
+          set -eu
+          layers() { docker image inspect "$1" --format '{{json .RootFS.Layers}}'; }
+          if [ "$(layers verdande:ci)" != "$(layers urd:ci)" ]; then
+            echo "The verdande and urd images do not share their layers:"
+            layers verdande:ci
+            layers urd:ci
+            echo "They are built from one source, so this is either a Dockerfile that"
+            echo "now builds the binary twice, or a stage that is no longer shared."
+            exit 1
+          fi
+          echo "Shared layers: $(layers verdande:ci | tr ',' '\n' | wc -l)"
+
+          # And the half that stops the check above from passing over two identical
+          # images: they must actually differ in the one way they are supposed to.
+          edition() { docker image inspect "$1" --format '{{json .Config.Env}}' | tr ',' '\n' | grep VERDANDE_EDITION; }
+          echo "verdande: $(edition verdande:ci)"
+          echo "urd:      $(edition urd:ci)"
+          edition verdande:ci | grep -q 'VERDANDE_EDITION=full'
+          edition urd:ci | grep -q 'VERDANDE_EDITION=notes'

.github/workflows/docs.yml

@@ -1,8 +1,21 @@
 name: Documentation
 
-# The docs are built on every push so a broken build is caught immediately, but
-# only published once GitHub Pages has been enabled for the repository. Until the
-# owner decides to publish, this job builds and stops.
+# Built on every push, and published from main.
+#
+# The publishing used to wait for a manual dispatch, with a note saying it would
+# run "once Pages is enabled". Pages was enabled — and the condition was never
+# changed, so the site was built forty times and published none of them. What it
+# showed was a Verdande from before v0.43: /links/, /beacon/ and /notifications/
+# all answered 404, months after they were written. Nothing failed, because
+# building *is* what the job was asked to do.
+#
+# The lesson is not about this line. It is that "publish later" needs something
+# that fails when later arrives — a switch that is off and silent looks exactly
+# like a switch that is on.
+#
+# Pull requests still build and never publish: `mkdocs build --strict` fails on a
+# link to a page that does not exist, and building only after the merge means
+# finding that out on `main`.
 on:
   push:
     branches: [main]
@@ -10,6 +23,11 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - '.github/workflows/docs.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
   workflow_dispatch:
 
 permissions:
@@ -44,9 +62,9 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
-    # Only runs once Pages is enabled. Until then the build above still guards
-    # against a broken docs tree.
-    if: github.event_name == 'workflow_dispatch'
+    # From main, and by hand. Never from a pull request — a fork could otherwise
+    # publish over the site by opening one.
+    if: github.event_name != 'pull_request'
     environment:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}

.github/workflows/release.yml

@@ -6,7 +6,9 @@ on:
     tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
 
 permissions:
-  contents: read
+  # write rather than read: the job creates the GitHub Release the update notice
+  # reads. packages: write is for pushing the image.
+  contents: write
   packages: write
 
 jobs:
@@ -15,6 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Taggen selv, ikke kun den commit den peger på: udgivelsesteksten
+          # nedenfor står i tagbeskeden, og en overfladisk checkout henter
+          # commit'en uden den.
+          fetch-depth: 0
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -50,3 +57,67 @@ jobs:
             VERSION=${{ github.ref_name }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      # A tag is not a release. The in-app update notice reads GitHub's
+      # releases/latest, which answers 404 for a repository that only has tags —
+      # so without this step the check can never find anything, however correctly
+      # it is switched on.
+      #
+      # Created after the image, so a release never announces a version that
+      # failed to build.
+      # Tagbeskeden ER annonceringen. Den skrives, når der tagges, på produktets
+      # eget sprog og til dem, der bruger det — og indtil nu nåede den aldrig
+      # frem: udgivelsen på GitHub blev fyldt med en autogenereret liste over
+      # commit-overskrifter, som er skrevet til dem, der læser koden.
+      #
+      # Den sidste linje er et link til udgivelsen selv, og den tages af: en
+      # side, der linker til sig selv, hjælper ingen.
+      #
+      # Og `fetch-depth: 0` er ikke nok, hvilket kostede to udgivelser at opdage.
+      # actions/checkout henter først alle tags korrekt — og overskriver derefter
+      # netop den ene, der udløste kørslen:
+      #
+      #   git rev-parse refs/tags/v0.46.0
+      #   git fetch --no-tags origin +0dc4c2f9b8…:refs/tags/v0.46.0
+      #
+      # Den henter commit-SHA'en ind i tag-refen, så den annoterede tag bliver til
+      # en letvægtstag, der peger direkte på commit'en. `%(contents)` giver så
+      # commitbeskeden, og det var flettecommittens overskrift, der stod som
+      # udgivelsestekst på v0.45.0 og v0.46.0 — uden at noget fejlede.
+      #
+      # Derfor hentes tagget som *ref* igen her, før det læses.
+      - id: notes
+        run: |
+          git fetch --force origin \
+            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+
+          body=$(git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" \
+            | sed '\#^https://github.com/.*/releases/tag/#d' \
+            | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}')
+
+          # Hver tagbesked begynder med sin egen version. Holder det ikke, læser vi
+          # noget andet end tagget — og en forkert udgivelsestekst skal fejle her
+          # frem for at blive opdaget på siden bagefter.
+          case "$body" in
+            "${GITHUB_REF_NAME}"*) ;;
+            *)
+              echo "::error::Tagbeskeden begynder ikke med ${GITHUB_REF_NAME}." \
+                   "Læste vi en letvægtstag? Første linje: $(printf '%s' "$body" | head -1)"
+              exit 1
+              ;;
+          esac
+
+          {
+            echo 'body<<VERDANDE_EOF'
+            printf '%s\n' "$body"
+            echo VERDANDE_EOF
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          body: ${{ steps.notes.outputs.body }}
+          # Stadig sat: den autogenererede liste lægges *under* teksten ovenfor,
+          # så både den, der vil vide hvad der er nyt, og den, der vil se hvilke
+          # ændringer det var, kan læse det samme sted.
+          generate_release_notes: true
+          make_latest: true

.gitignore

@@ -11,6 +11,16 @@
 
 # Frontend
 node_modules/
+# iCloud syncs ~/Documents, and it evicts what it thinks is cold — which for a
+# dependency tree is nearly all of it. An evicted file blocks on read until it is
+# downloaded again, and a download that stalls hangs the build for good: 0 % CPU,
+# no output, forever. macOS never syncs anything ending in .nosync, so the tree
+# lives there and `node_modules` is a symlink to it. Redo it after a fresh clone:
+#
+#     mv node_modules node_modules.nosync && ln -s node_modules.nosync node_modules
+#
+# The real fix is a repo path outside a synced folder.
+node_modules.nosync/
 /web/.svelte-kit/
 /web/build/
 
@@ -34,6 +44,11 @@ node_modules/
 # End-to-end runs: the throwaway instance the suite starts, the saved session it
 # signs in with, and whatever a failure left behind.
 /web/.playwright-data/
+# Noter-udgavens egen instans i prøvekørslen. Den har sin egen database OG sin
+# egen secret.key, og den nåede at blive committet én gang: et mønster, der
+# nævner den ene mappe ved navn, dækker ikke den anden, selv om de er to kopier
+# af det samme.
+/web/.playwright-data-notes/
 /web/e2e/.auth/
 /web/test-results/
 /web/playwright-report/
@@ -45,3 +60,21 @@ node_modules/
 # the process is killed, which during a hung build is exactly what happens. One
 # was committed by accident.
 /web/vite.config.js.timestamp-*.mjs
+
+# A compiled `go build ./tools/shots` in the repo root. It was committed once by
+# accident — 8.9 MB of macOS binary — and `go build ./tools/shots` without -o puts
+# it right back.
+/shots
+
+# The working handover. It names the panel, the server id and the production
+# address — a map of one person's setup, which does not belong in a public repo.
+# Kept on disk because it is how a session hands over to the next one.
+HANDOFF.md
+NOTES-PLAN.md
+
+# Samme grund: instruktionen til flytningen navngiver kassen, runneren, registret
+# og hvordan man kommer til dem. Arbejdspapir, ikke produktdokumentation.
+GITEA-FLYTNING.md
+
+# Agenternes arbejdstræer. Et git-repo inde i et git-repo, som ikke hører til her.
+.claude/worktrees/

Dockerfile

@@ -5,11 +5,29 @@
 # manager and no libc — the attack surface of the running container is the binary.
 
 # --- 1. the web interface ----------------------------------------------------
-FROM node:22-alpine AS web
+#
+# Pinned to the *build* platform, not the target. What this stage produces is
+# HTML, CSS and JavaScript, which are the same bytes whatever the image will run
+# on — so building it once and copying it into both architectures is not an
+# optimisation, it is the correct thing.
+#
+# Without the pin, buildx runs this stage once per target, which means running
+# Node and esbuild under QEMU for arm64. That crashes: exit 132, SIGILL, an
+# instruction the emulator does not implement, roughly one release in three. It
+# looks like a broken build and is a broken emulator.
+FROM --platform=$BUILDPLATFORM node:22-alpine AS web
 
 WORKDIR /src
 COPY web/ ./
 
+# Passed into the frontend build, because SvelteKit's default build version is
+# `Date.now()` — a millisecond that landed in version.json, in index.html and in
+# the service worker, changed the content hash of every chunk referencing them, and
+# so changed those chunks' filenames. Every build of one commit produced different
+# bytes. See the long note in web/svelte.config.js.
+ARG VERSION=dev
+ENV VERDANDE_VERSION=${VERSION}
+
 # The frontend is built when it is present. During backend-only development it is
 # not, and the build must still produce a working image rather than failing on a
 # missing directory — so this stage falls back to a placeholder page. The Go stage
@@ -24,7 +42,12 @@ RUN if [ -f package.json ]; then \
     fi
 
 # --- 2. the binary -----------------------------------------------------------
-FROM golang:1.26-alpine AS build
+#
+# Also pinned to the build platform, and cross-compiled instead. Go does that
+# natively and CGO is already off, so there is nothing to emulate — where
+# building *in* the target architecture means running the whole Go toolchain
+# under QEMU for one of the two.
+FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
 
 WORKDIR /src
 
@@ -37,19 +60,46 @@ COPY . .
 COPY --from=web /src/build ./cmd/verdande/webbuild
 
 ARG VERSION=dev
+# Supplied by buildx per target. The default keeps a plain `docker build` working.
+ARG TARGETARCH=amd64
 
 # CGO off is what makes this binary static, and it is only possible because the
 # SQLite driver is pure Go. -trimpath and the empty buildid keep the output
 # reproducible; -s -w drop the symbol and DWARF tables, which is most of the size.
-RUN CGO_ENABLED=0 GOOS=linux go build \
+#
+# "Reproducible" was false for a year and nobody read the sentence that said it:
+# the flags above do their job, and the frontend embedded below carried a
+# millisecond timestamp, so every build of one commit produced a different binary.
+# Fixed in web/svelte.config.js, and CI now asserts that the two images' layers
+# match rather than trusting this comment.
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
         -tags embedweb \
         -trimpath \
         -ldflags="-s -w -buildid= -X main.version=${VERSION}" \
         -o /verdande ./cmd/verdande
 
 # --- 3. what actually ships --------------------------------------------------
+#
+# Two images come out of this stage, and the only difference between them is one
+# environment variable:
+#
+#     docker build .                          → verdande
+#     docker build --build-arg EDITION=notes  → urd
+#
+# Stages 1 and 2 are byte-identical for both, so the binary in the two images is
+# the same build rather than a rebuild that happens to match. That is the point:
+# urd is not a fork, and "built from the same source" is a property of the layers
+# instead of a sentence in a README. ENV is image *config* rather than a layer, so
+# the two images share every layer digest and differ only in that config — which CI
+# asserts on every pull request.
 FROM gcr.io/distroless/static-debian12:nonroot
 
+# Declared here as well as used here: an ARG is scoped to the stage it appears in,
+# so one above the FROM above would be invisible down here. `full` by default,
+# because that is what this program has always been and an unqualified build must
+# not quietly produce the other product.
+ARG EDITION=full
+
 # SQLite writes timestamps and verdande resolves due dates in the user's timezone,
 # so the container needs a tz database and CA certificates for outbound SMTP.
 COPY --from=build /usr/local/go/lib/time/zoneinfo.zip /zoneinfo.zip
@@ -61,7 +111,8 @@ COPY --from=build /verdande /verdande
 # nightly backups.
 VOLUME ["/data"]
 ENV VERDANDE_DATA_DIR=/data \
-    VERDANDE_ADDR=:8080
+    VERDANDE_ADDR=:8080 \
+    VERDANDE_EDITION=${EDITION}
 
 EXPOSE 8080
 USER nonroot:nonroot

NOTES-SPEC.md

@@ -0,0 +1,437 @@
+# Notes, as verdande builds them
+
+A description of one working notes system: the data model, the syntax, the search,
+the rendering contract, the import and export formats, and — more useful than any
+of it — the decisions that look arbitrary until you know what they cost.
+
+It is written to be lifted into another program. Nothing here depends on Go,
+SQLite or Svelte except where it says so; where an answer was forced by the tool,
+that is called out so you can pick a different one on purpose rather than by
+accident.
+
+---
+
+## Read this part first: what to ask before you build
+
+**This document is not a drop-in. It describes a notes system that lives inside a
+task app with projects, roles, a trash and a search box, and about a third of its
+design is inherited from that.** Lifting it into a program with different
+surroundings without deciding which parts to keep produces something that works
+for a week and then fights you.
+
+**If you are an assistant working from this file: ask these questions and get
+answers before writing code.** Do not guess a default. Each one changes what you
+build, not just how you build it.
+
+### About the surroundings
+
+1. **Does the host app already have a place to file things** — projects, folders,
+   notebooks, tags? verdande deliberately gave notes no hierarchy of their own and
+   filed them under the projects that already existed. If your app has nothing,
+   you need an answer for where a note lives, and "a folder tree" is the expensive
+   one.
+2. **Is there more than one person?** Sharing, roles and "who wrote this" run
+   through the whole model below. Single-user changes the schema and removes about
+   half the permission surface.
+3. **Is there already a trash, and does it expire?** Notes lean on one. Without
+   it, deleting is either permanent or you are building a trash.
+4. **Is there an existing full-text index?** The search here is FTS5-shaped. On
+   Postgres it is `tsvector`, on a client-side app it is probably a scan, and the
+   ranking section below changes accordingly.
+
+### About the notes themselves
+
+5. **Markdown, rich text, or blocks?** verdande stores Markdown and renders it.
+   That decision is defended below; it is also the one that most constrains
+   everything else.
+6. **Is the first line the title, or is there a title field?** Both work. Deriving
+   it means one less thing to keep in step and one less thing a person can leave
+   blank, and it forces the rule "the first line is a heading" on the editor.
+7. **What links to what?** `#project`, `[[note]]` and task references exist here
+   because the app has projects and tasks. Yours may have none of them, or others.
+8. **Do notes carry files?** Attachments bring content-type handling, a store, an
+   authorisation path and an XSS surface. Skipping them is a legitimate answer.
+
+### About scale and language
+
+9. **How many notes, realistically?** Several choices below flip at around ten
+   thousand: the list payload, the search fallback, rendering the whole list.
+10. **Which languages?** The folding described under *Search* is Danish. Every
+    language has its own version of that problem and the generic answer (strip
+    diacritics) is wrong for several of them.
+11. **Where does the text end up besides the screen?** Search indexes, AI
+    features, exports and backups each read it. Plaintext makes all of them cheap
+    and makes a stolen backup expensive — see *What is still open*.
+
+### About integration, specifically
+
+12. **Who owns the note's identity — you or the other system?** If notes will sync
+    with something else, ids and timestamps are the whole problem, and the
+    `updated_at` rule below becomes the first thing you have to change.
+13. **Is this a read of somebody else's notes, or the store of record?** A copy
+    needs conflict rules; a store of record needs export.
+14. **What happens to a note whose project, task or link target is deleted?**
+    Answered here as "the link goes dead and the note is untouched". If your host
+    app cascades instead, say so before the first delete.
+
+---
+
+## The shape of a note
+
+```
+id           an opaque string, unique
+project_id   nullable — where it is filed, or loose
+title        derived, never set by a caller
+body         Markdown, the whole note
+created_by   nullable — survives the account being deleted
+pinned       favourite; the list puts these first
+archived_at  nullable timestamp — put away, not thrown away
+deleted_at   nullable timestamp — the trash
+created_at
+updated_at
+```
+
+### Markdown in a column
+
+Not rich text, and not a format of our own.
+
+Export was a requirement before a line was written, and **if the stored form is
+the exported form there is no conversion left to lose anything in.** A note stays
+readable by any editor on the day the program is gone. It is also what makes
+search and anything an AI does over notes cheap: both read text.
+
+The cost is real and you should know it before choosing: everything the editor can
+do has to survive a round trip through Markdown, and anything Markdown cannot say,
+the editor must not offer. There is no place to hide a feature.
+
+### The title is the first line
+
+Always, and re-derived on every save — not "when it is empty".
+
+Derived once and then left alone, a title goes stale the moment somebody rewrites
+the opening of a note, and the list ends up calling a note by a name that is
+nowhere in it. **The column is a cache of the body, not a field beside it**, and no
+caller can set it, so every caller gets the same answer.
+
+This forces one editor rule: a new note opens on its title, and the first line is
+styled as a heading. Otherwise a note whose first line is a sentence is a note
+named by its first sentence.
+
+### Archive and trash are two different bits
+
+The trash says *this was a mistake, and in thirty days it is gone*. The archive
+says *this is finished, and I do not want to read past it.*
+
+A twelve-hundred-note import is exactly the case where most notes are worth
+keeping and almost none are worth looking at. Without an archive, the list is the
+whole archive forever, and finding this week's note means reading past a decade.
+
+Both are nullable timestamps rather than booleans: *when was this put away* answers
+questions a flag cannot, and it costs the same byte.
+
+---
+
+## Filing: no hierarchy of its own
+
+A note belongs to a project, or to nobody.
+
+The reasoning is worth repeating because it is easy to talk yourself out of:
+projects already exist, are already shared, already have roles, already have a
+trash. **A second hierarchy to file things in is one too many**, and a note filed
+under a project inherits every one of those answers instead of needing its own.
+
+- A note with a project: everybody who can read the project can read the note; an
+  editor can change it.
+- A note without one: the author's, and nobody else's.
+
+Sharing a note *is* filing it in a project. There is no access list of its own —
+a second way to give somebody access is a second place to get it wrong, and the
+two would disagree the day one of them changed.
+
+---
+
+## Links: three kinds, parsed out of the text
+
+The body is the truth. Links are an index over it, rebuilt on every save.
+
+| Syntax | Means | Notes |
+|---|---|---|
+| `#project` | a project | Same characters the task quick-add parser uses, on purpose |
+| `[[a note]]` | another note, by title | The spelling every note app has settled on |
+| `/opgave/<uuid>` or `task:<uuid>` | a task | What a link pasted out of the app carries |
+
+Patterns as used here:
+
+```
+project   (?:^|\s)#([\p{L}\p{N}_-]{1,64})
+note      \[\[([^\]\n]{1,200})\]\]
+task      (?:/opgave/|task:)([0-9a-fA-F-]{36})
+```
+
+Three decisions inside that table:
+
+- **`#Firma` in a note means the same project as `#Firma` in the task box.** Not a
+  second kind of tag that happens to look alike. That is the whole of "tag a note
+  and see it in the project".
+- **The link table is torn down and rebuilt on save, not diffed.** A body is small
+  and the set is small; a diff is a second description of the same fact, and it
+  can disagree with the text. That is the one thing this must never do.
+- **The target is not a foreign key.** A link to something deleted is a fact about
+  the note. It should read as a dead link rather than vanish, and it must not
+  block the delete.
+
+The index exists so the question can be asked **backwards**: *what has been written
+about this task?* Answering that by searching every note's prose would be too slow
+to leave a panel open on.
+
+---
+
+## Search
+
+Three layers, in the order they answer.
+
+### 1. Full-text, ranked
+
+FTS5 over `title`, `body` and a folded copy, with `unicode61 remove_diacritics 2`.
+
+Ranking is bm25 with **the title weighted ten times the body**. A word in the title
+is what the note is *about*; the same word once in a long body is a mention.
+
+This matters more than it sounds. Ordering by "last touched" is invisible with ten
+notes and useless with twelve hundred imported the same evening: searching "Tesla"
+answered with a note about nginx first and the note actually called "Tesla Model Y"
+second — which reads as a search that does not work, because from where the person
+is sitting it is one.
+
+### 2. Folding, for the language you are in
+
+`remove_diacritics` does not touch `ø`, `æ` or `å` — Unicode considers them
+letters in their own right, not accented forms. So a Dane cannot find "grøn" by
+typing "gron", which is how people type when the keyboard is not theirs.
+
+The answer here is a generated column carrying a transliterated copy:
+
+```
+ø,Ø → o     æ,Æ → ae     å,Å → aa
+```
+
+indexed alongside the body and **weighted the same as the body** — otherwise a
+folded match outranks an exact one.
+
+> **Ask, do not copy.** This mapping is Danish. German wants `ü → ue`, Swedish
+> disagrees with Danish about `ä`, and Turkish has a dotless `ı` that breaks
+> naive lowercasing entirely. Get the mapping from somebody who types the
+> language.
+
+### 3. A word inside a word
+
+An index is built of tokens, and a token is whatever the tokenizer decided was a
+word. `gamerule keepInventory true` is three of them, and the middle one is
+`keepinventory` — so a search for "keep inventory" asks for two words that are
+nowhere and gets nothing, while the note sits right there.
+
+A prefix query gets half of it: `keep*` matches, `inventory*` cannot, and the two
+are ANDed, so the half that works is thrown away by the half that cannot.
+
+**This is not exotic in a notes app.** A decade of notes is full of commands,
+identifiers and file names, and every one of them is several words the index
+thinks is one.
+
+So: the index answers first; when it has nothing, the text is read, and every term
+must appear somewhere in the note, in any word. A `LIKE '%term%'` over the folded
+column covers title, body and language folding at once.
+
+What it costs: a leading `%` cannot use an index, so it scans. At twelve hundred
+notes that is a few megabytes and a millisecond or two, and it only runs when the
+fast path already came back empty — which is exactly the search that was about to
+disappoint somebody. **At a hundred thousand notes it is the wrong shape**, and the
+answer then is a trigram index, not a bigger scan.
+
+It does not rank. There is no match to rank — that is the whole situation.
+
+---
+
+## The list, and why the body is empty in it
+
+A list showing a title and ninety characters of preview must not fetch whole
+notes. Twelve hundred notes came to 3.9 MB, of which 98 % was body nobody could
+see.
+
+The important half is *how* it is trimmed: **the body is emptied, not shortened.**
+
+A field called `body` holding a *piece* of the body is a trap. The editor opens
+it, the autosave pause writes it back, and the note is now cut down to its own
+excerpt — destroyed by nothing more than having been looked at. Send `preview` as
+its own field and leave `body` empty; the client sees the empty body and fetches
+the whole note.
+
+That costs one more separation, and it is not optional:
+
+> **Which row is selected and which note is loaded are two different things.**
+
+The editor loads its text when the note's id changes. Hand it the excerpt first
+and the whole note second and the id is the same both times — so the second one
+never renders, and somebody sits looking at a note that had a title a moment ago.
+
+Highlight the row immediately from the list; give the editor the note only when it
+is whole.
+
+Rendering cost, separately: with twelve hundred rows, first paint took 2.1 s. CSS
+`content-visibility: auto` with an intrinsic-size guess took it to 0.95 s with no
+virtual list, no scroll maths, and no list that can fall out of step with itself.
+Try that before building windowing.
+
+---
+
+## The editor contract
+
+Rich text on top, Markdown underneath, and a source view that shows the file.
+
+The supported subset — deliberately small, because everything in it has to survive
+the round trip:
+
+| Block | Markdown |
+|---|---|
+| Title | `# ` |
+| Heading | `## ` |
+| Subheading | `### ` |
+| Quote | `> ` |
+| Code block | ```` ``` ```` with an optional language |
+| Bullet and numbered lists | `- `, `1. `, nested |
+
+Inline: `**bold**`, `*italic*`, `~~strikethrough~~`, `` `code` ``, `<u>underline</u>`,
+and images as `![alt](url)`.
+
+Five rules that were each learned the hard way:
+
+1. **Every line becomes exactly one block.** Markdown normally joins consecutive
+   lines into a paragraph. Here it must not: the person typed a line and expects
+   to get it back, and an editor that silently reflows what somebody wrote is an
+   editor they stop trusting.
+2. **Load on id change, never while typing.** Writing to the editor's HTML puts
+   the caret back at the start, which mid-sentence is unusable.
+3. **One definition of what a code block contains.** A copy button inside the
+   `<pre>` and a syntax highlighter reading `textContent` will disagree, and the
+   difference ends up in the file — a click on "Copy" wrote the word *Copied* into
+   the code and the next save put it on disk. Have one function that says what a
+   block holds, used by the highlighter and the Markdown serialiser both.
+4. **A note that cannot be rendered must not take the pane with it.** One note
+   arriving in an unexpected shape threw inside the editor's reactive effect, and
+   from then on *no* note would open — the previous one just stayed on screen. Put
+   a guard around the render, fall back to showing the raw text, and let the rest
+   of the pane keep working.
+5. **Escaping between tags and escaping inside an attribute are different jobs.**
+   An escaper written for text between two tags handles `&`, `<`, `>` — and not
+   quotes, because between tags they are harmless. Inside an attribute they close
+   it. `![" onerror="alert(1)](…)` is the whole exploit.
+
+---
+
+## Attachments
+
+Images pasted or dragged into a note, stored content-addressed by hash, referenced
+from the body as ordinary Markdown images.
+
+The security shape, which is the part worth copying:
+
+- **Served as `application/octet-stream` with `nosniff` by default.** Attachments
+  are the one place a user supplies content another user opens. An uploaded SVG or
+  HTML file rendered inline runs its own script on your origin with the session
+  cookie attached.
+- **One exception, as a named allowlist:** a short list of raster image types
+  served inline as their exact type — `png`, `jpeg`, `gif`, `webp`, `avif`, `heic`.
+  A note carries its pictures in the text, and served as octet-stream every one of
+  them is a broken image.
+- **The list is named one type at a time, never matched on an `image/` prefix.**
+  The prefix lets `image/svg+xml` through, and an SVG is a document that can run
+  script.
+- **The stored path is checked against the files directory again at read time.** A
+  traversal that somehow got into the database must not become one that reads
+  `/etc/passwd`.
+- **Reaching an attachment follows the note, which follows its project.** Same
+  chain as everything else. Do not let a client hand you the parent id and take it
+  on trust.
+
+---
+
+## Import and export
+
+The same format both ways: **a zip of Markdown files**, one per note, with a YAML
+front matter block.
+
+```markdown
+---
+created: 2019-04-02T10:15:00Z
+modified: 2024-11-30T21:04:00Z
+---
+
+# Møde med Anders
+
+Han vil gerne have kaffe hver uge.
+```
+
+- `created` / `created_at` / `date` and `modified` / `updated` / `updated_at` are
+  all accepted on the way in. Obsidian and Bear write this block; so should you.
+- Images travel in the zip beside the notes, and the links in the text are
+  relative — **a note and its pictures must end up in the same archive**, which
+  matters the moment an export is split into parts.
+- File names collide: two notes called "Møde" are two notes, and a zip with one
+  entry twice is a zip that loses one.
+
+Limits that a real import taught, all of them cheap to add and expensive to omit:
+
+- A ceiling on the upload, on the number of entries, and on the **unpacked** size.
+  64 MB of zip expanded to 66 GB is a normal shape for an attack.
+- A per-file limit as well as a whole-archive budget: one enormous photograph and
+  ten thousand small ones are different attacks with the same ending.
+- The entry name is never used as a path. Store by hash; the name is only a key
+  for rewriting links.
+- **Count what you skip, and say so.** A note whose name contained an ellipsis was
+  dropped silently by a filter looking for `..` — one out of 1141, found only by
+  counting at both ends.
+
+### Timestamps on the way in
+
+An importer needs to write `created_at` and `updated_at` from the file, and the
+normal save path must refuse to let it.
+
+`updated_at` means *when did this program last write this note*. Let any caller set
+it and the column means whatever the last writer felt like. Give the importer its
+own narrow entry point instead, and say in the comment why it exists.
+
+Without those dates, a move of twelve hundred notes is a pile that was all written
+the same evening — and the order they were written in is half of what an archive
+is.
+
+---
+
+## What is still open here
+
+Written down because a specification that only lists what works is a specification
+that lies by omission.
+
+- **Note bodies are plaintext at rest.** They hold API keys and passwords, and
+  they are in every backup anybody can download. Encrypting them is bigger than it
+  sounds: the body is in the full-text index and the folded column is generated
+  from it, so both are a second plaintext copy in the same database. Encrypt and
+  both have to go, and search has to be rewritten to decrypt in application code —
+  fine at a thousand notes, a full scan per keystroke at ten thousand, at which
+  point the answer is a keyed index (an HMAC per word).
+- **Import never merges.** Every run creates new notes. Say so out loud in the UI.
+- **There is no sync.** Export and the API are the way out.
+
+---
+
+## A short list of the traps, for the person in a hurry
+
+1. A `body` field holding an excerpt will be saved over the real one.
+2. Selected row and loaded note are two different pieces of state.
+3. The title must be re-derived on every save or it goes stale.
+4. Diacritic stripping is not folding, and folding is language-specific.
+5. A tokenizer cannot see a word inside a word; decide what you do about it.
+6. An attachment served inline is a script on your origin unless you allowlist by
+   exact type and send `nosniff`.
+7. Escaping for text and escaping for attributes are different functions.
+8. One render failure must not be allowed to freeze the whole pane.
+9. An unpacked-size limit is not optional on an archive import.
+10. Let the importer set timestamps; let nobody else.

README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <img src="site/screenshots/today.png" alt="The Today view: projects, filters and labels in the sidebar, beside the tasks due today." width="900">
+  <img src="docs/screenshots/today.png" alt="The Today view: projects, filters and labels in the sidebar, beside the tasks due today." width="900">
 </p>
 
 ---
@@ -15,18 +15,37 @@
 Not what has been, and not what is fated to be: the thing you are in the middle of.
 Which is what a to-do list is.
 
+## Two editions: verdande and urd
+
+This repository builds one program with two faces. Start it with
+`VERDANDE_EDITION=notes` and it is **urd** — notes and nothing else: the task
+routes are not mounted, the sidebar has no way to them, and the program calls
+itself urd in its tab, its wordmark and its web manifest.
+
+Urðr is Verðandi's sister in Völuspá, and the poem has the Norns cutting marks into
+wood. Verdande is what is becoming; urd is what has become and was kept.
+
+Not a fork, because the two share everything that is hard — accounts, sharing,
+passkeys, the realtime socket, search, backups, migrations — and notes are about a
+twentieth of the Go here. A test walks both routers and fails in either direction,
+so "the task routes are not there" is measured rather than promised — 63 routes and
+five of nine MCP tools. See
+[Two editions](docs/editions.md).
+
 ## Status
 
 All six phases are built. See [What works today](#what-works-today) for what is
 tested and what is not.
 
-Documentation: [`docs/`](docs/), built with Material for MkDocs.
+Documentation: **<https://kristianwind.github.io/verdande/>** — the source is in
+[`docs/`](docs/), built with Material for MkDocs and published from `main`.
 
 ## Why this exists
 
-Todoist Pro, self-hosted, on your own hardware, with your own data — and with the
-integrations that a hosted product will not build for you: a real CalDAV server, a
-mail-to-task address, and an MCP endpoint so Claude can work your task list directly.
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data, and with the integrations that a
+hosted product will not build for you: a real CalDAV server, a mail-to-task address,
+and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
@@ -34,10 +53,38 @@ mail-to-task address, and an MCP endpoint so Claude can work your task list dire
   @regnskab` becomes a task called "betal moms", due tomorrow at 10:00, priority 1,
   in Firma, labelled regnskab. Danish and English, mixed freely in one line.
 - **Projects, sections, sub-tasks, labels, saved filters.** List, board and calendar
-  views.
-- **Sharing.** Internal users are created by an admin; anyone else joins through an
-  invite link sent to their email. Owner, editor and viewer roles.
+  views, and foldable groups over the projects in the sidebar.
+- **Notes, beside the work.** Rich text that is Markdown underneath — headings,
+  lists, quotes, fenced code. A note is shared by filing it in a project, by
+  handing it to one person — including somebody who has no account yet, who gets an
+  invitation that becomes the share when they sign up — or by writing `@Sofie` in
+  the text, which shares it with her and tells her. `#project` and
+  `[[another note]]` are links, and a task shows the notes that mention it. A zip of Markdown goes in — Obsidian, Bear, or Apple Notes through
+  the exporter in [`tools/`](tools/) — and comes back out the same shape.
+- **Notes are sealed at rest.** Title and body are encrypted in the database under
+  a key in a file beside it — the title too, because a title beside a sealed body
+  leaves the beginning of every note in the open. A copy of the file is not a copy
+  of the notes.
+- **Drag where it means something.** Reorder a list or a board, file a project under
+  a group, drop a task on another project, or drop it on another day.
+- **Sharing.** Owner, editor and viewer roles. There is no open registration:
+  everybody arrives through an invite link — to a project, to a single note, or
+  from **Settings → Brugere** to the instance itself. Nobody's password is ever
+  chosen by somebody else.
 - **Live sync.** A change made by somebody else appears without a refresh.
+- **Notifications that are worth reading.** A bell for what other people did to what
+  you share — folded, so one person typing for five minutes is one line — pushed to
+  your devices and counted on the app's icon in the Dock.
+- **AI that suggests and never writes.** Optional, off by default, your own key and
+  your own model if you want. It tidies the inbox, pulls the tasks out of a meeting
+  note, writes a morning plan, turns *"SV: SV: Vedr. levering uge 12"* into the
+  action the mail asks for, and answers questions about your own notes with links to
+  what the answer rests on. Every one of them arrives as a line you accept, edit or
+  refuse — a model that edits your tasks directly has to be right every time to be
+  worth having.
+- **Anything can put a task in the inbox.** A mail to your own forwarding address,
+  or a POST of one line of text from a shortcut on your phone, a script or any
+  service that can call a URL.
 - **Recurring tasks** as RRULE (RFC 5545), reminders, comments and attachments.
 - **Standards, not homegrown formats.** iCalendar and CalDAV, ICS feeds, OAuth2 with
   PKCE, OpenAPI 3.1, MCP, Web Push, Argon2id.
@@ -60,12 +107,24 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | Project roles and permission checks | Done, tested |
 | REST API: projects, sections, tasks, sub-tasks, ordering | Done, tested |
 | Today, Upcoming, search, activity log | Done, tested |
+| Waiting on others: what you have delegated, by person | Done, tested |
+| Assignee shown on every task that is somebody else's | Done, smoke-tested |
+| Activity log, visible per project | Done, smoke-tested |
+| Change a member's role without removing them | Done, tested |
 | Sharing: invites, roles, members | Done, tested |
 | Live sync over WebSocket | Done |
 | Web interface: sign-in, views, quick add, ⌘K, shortcuts | Done |
 | Task detail: description, sub-tasks, comments, files, reminders | Done |
 | Settings: account, notifications, integrations, AI, tokens, data | Done |
+| Device list: where you are signed in, and signing one out | Done, tested |
+| User administration: invite to the instance, promote, remove | Done, tested |
+| Server errors kept in the database, readable after a restart | Done, tested |
+| PWA icons: PNG for launchers, apple-touch-icon for iOS | Done, smoke-tested |
+| Invite and password-reset links that open the right page | Done, smoke-tested |
 | Drag to reorder, in both the list and the board | Done |
+| Drag a task to another project or another day | Done, smoke-tested |
+| Foldable project groups in the sidebar | Done, tested |
+| Month view on Upcoming, not only per project | Done, smoke-tested |
 | Recurring tasks (RRULE, Danish + English) | Done, tested |
 | Reminders, absolute and relative | Done, tested |
 | Saved filters with a query language | Done, tested |
@@ -74,21 +133,41 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | Project templates | Done, tested |
 | Nightly backups with rotation | Done, tested |
 | Comments, attachments, notifications, Web Push | Built |
+| Notes: rich text, Markdown on disk, links to projects, notes and tasks | Done, tested |
+| Notes in and out: a zip of Markdown, both directions | Done, tested |
 | Todoist CSV import and export, account export | Done, tested |
 | MCP server for Claude | Done, tested |
 | CalDAV server (two-way VTODO) | Done, tested |
 | Mail-to-task | Done, tested |
 | AI layer (Anthropic/OpenAI/Google/local) | Built, degrades when unconfigured |
-| Gmail: OAuth2 with PKCE, polling, one-way to tasks | Done, tested |
+| Gmail: OAuth2 with PKCE, polling to tasks, unstars what it imports | Done, tested |
+| Google Calendar: read-only, laid over the task calendar | Built, never run against Google |
+| Calendar subscriptions: ICS and webcal, several per person | Done, tested |
+| Times on tasks, set by dragging in the week grid | Done, tested |
+| Notes: archive, grouped list, images, source view | Done, tested |
 | Update notice for administrators | Done, tested |
 | Personal API tokens | Done, tested |
 | OpenAPI 3.1 spec, checked against the router | Done, tested |
 | End-to-end smoke tests (Playwright) | Done |
 | Documentation, landing page, licence | Done |
+| Notes sealed at rest: title and body encrypted in the database | Done, tested |
+| `@name` in a note shares it with that person, and tells them | Done, tested |
+| Share a project with somebody who already has an account, by name | Done, tested |
+| Invitations that have not been taken up stay visible, and can be withdrawn | Done, tested |
+| Told when a project is shared with you — and able to leave it | Done, tested |
+| Push from other programs: a webhook address per person | Done, tested |
+| Today's plan as a card on **I dag**, not only as a notification | Done, tested |
+| Search the settings, from the page or from ⌘K | Done, tested |
+| Choose which browser a link opens in | Done, tested |
+| Images in notes: open full size, copy to the clipboard | Done, tested |
+| Install count: two values, once a day, one click to stop | Done, tested |
 
-**Not finished:** Web Push, the AI providers and the Gmail API calls are
+**Not finished:** Web Push, the AI providers and the Google Calendar API calls are
 implemented against their specifications and have only ever been exercised there,
-not against live services. Everything else has an interface: opening a task shows
+not against live services. Gmail is no longer in that list — it runs in production,
+including the flagging and de-duplication that took a day to get right. Calendar
+subscriptions over ICS and webcal are proven; the Google half of the calendar is
+not. Everything else has an interface: opening a task shows
 its description, sub-tasks, comments, files and reminders, and the settings pages
 cover the account, notifications, integrations, AI, API tokens, import, export and
 templates.
@@ -100,10 +179,20 @@ accented `o` and a Danish-first app that cannot do this is broken for its own us
 
 | | |
 |---|---|
-| ![Board view](site/screenshots/board.png) | ![Light theme](site/screenshots/today-light.png) |
+| ![Board view](docs/screenshots/board.png) | ![Light theme](docs/screenshots/today-light.png) |
 | Board view — one column per section. | The light theme. |
+| ![A week on Upcoming](docs/screenshots/week.png) | ![A task, opened](docs/screenshots/detail.png) |
+| A week at a time, so a task can be dragged across a month boundary. | A task, opened: description, priority, labels, sub-tasks and its files. |
+| ![Notes](docs/screenshots/notes.png) | ![The same note as Markdown](docs/screenshots/notes-source.png) |
+| Notes, filed in a project to share them. | The same note as its source — which is what the export writes to disk. |
+| ![Themes and looks](docs/screenshots/themes.png) | ![Instance history](docs/screenshots/history.png) |
+| Five themes and four looks: how bright, and how it reads. | What has been done on the server. |
 
-Regenerate these with `go run ./tools/shots` against a running instance.
+Regenerate these with `node scripts/generate-screenshots.js` from `web/`. It starts
+the real binary, creates its own account and a second one to share with, fills them
+with demo data and photographs fourteen surfaces — nothing to set up and nothing to
+remember. (`go run ./tools/shots` still works, and is the way to photograph an
+instance that is already running.)
 
 ## Running it
 
@@ -174,6 +263,9 @@ to put one that the operator would ever see.
 | `VERDANDE_GMAIL_CLIENT_ID` | — | OAuth client from Google Cloud, if anyone will connect a mailbox. |
 | `VERDANDE_GMAIL_CLIENT_SECRET` | — | |
 | `VERDANDE_UPDATE_CHECK` | `false` | Ask GitHub whether a newer release exists. Sends nothing about your instance. |
+| `VERDANDE_PANEL_URL` | — | The Yggdrasil panel this instance runs under, so it can ask to be restarted from its own settings. |
+| `VERDANDE_PANEL_TOKEN` | — | An API token from that panel, belonging to somebody with control of this server. |
+| `VERDANDE_PANEL_SERVER_ID` | — | Which server to restart — the id in the panel's URL. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level. |
 
 ## What lives in `/data`

SECURITY.md

@@ -10,13 +10,28 @@ reply within a week.
 
 - **Passwords** are Argon2id with the parameters recorded in the hash, so they can
   be raised later without locking anyone out.
-- **Every token** — session, invite, reset, API, calendar feed, mail address — is
-  stored only as a SHA-256 hash. A database dump contains nothing that can be
-  presented.
+- **Session, invite, reset and API tokens** are stored only as a SHA-256 hash. A
+  database dump contains nothing that can be presented.
+- **The calendar feed address and the mail-to-task address are not hashed.** They
+  are looked up by their exact value, and they are shown in the interface more
+  than once, which a hash cannot do. Anybody holding a backup file therefore holds
+  those two URLs: the feed reads that person's tasks without a login, and the mail
+  address files tasks into their inbox. Rotating either from **Settings →
+  Integrations** invalidates the old one. This is written down rather than fixed
+  because fixing it means the address can only ever be shown once, which is a
+  decision about how the feature works and not only about how it is stored.
+- **Mailbox passwords, OAuth tokens, TOTP secrets and AI keys** are sealed with
+  AES-GCM under a key kept outside the database — see `internal/secret`. That is
+  what makes a stray copy of the database less than a stray copy of everything:
+  the backup does not carry the key.
 - **Sessions** are `httpOnly`, `SameSite=Lax`, and `__Host-` prefixed over HTTPS.
-- **Uploads** are stored content-addressed by hash and always served as
-  `application/octet-stream` with `nosniff`, so an uploaded SVG cannot run script
-  on this origin.
+- **Uploads** are stored content-addressed by hash and served as
+  `application/octet-stream` with `nosniff` — with one exception, added so that a
+  note can show the pictures in it: a short allowlist of raster image types is
+  served inline as its own type. The list is named one format at a time rather
+  than matched on an `image/` prefix, because the prefix would let `image/svg+xml`
+  through, and an SVG is a document that can run script. `nosniff` stays, so the
+  browser must read the file as that image or not at all.
 - **The filter language** compiles to parameterised SQL. No typed text is ever
   concatenated into a statement.
 - **Permission checks** are route middleware, and anything you may not see answers
@@ -24,8 +39,28 @@ reply within a week.
 - **The CSP** is computed at startup by hashing the inline scripts in the built
   page, rather than allowing `unsafe-inline`.
 
+- **Note titles and bodies are sealed** under the same key, since 0027. Both, not
+  only the body: a note's title *is* its first line, so a readable title beside a
+  sealed body would leave the beginning of every note in the clear.
+
+  The two plaintext copies went with it. `notes_fts` indexed the body and the
+  generated `fold` column held a transliterated copy of it — sealing the body while
+  leaving those would have been theatre, since a stolen file could be read straight
+  out of the index. Search opens the text in Go instead, which costs 33–43 ms
+  across twelve hundred notes and is the wrong shape somewhere around ten thousand.
+- **Task titles, descriptions and comments are still in the clear**, and so is
+  `note_links` — ids derived from a note's body, so a stolen file still shows which
+  projects and tasks a note points at, though not what it says.
+
 ## What it does not do
 
-verdande has no rate limiting beyond the login and password-reset endpoints, and
-no audit log of reads. It is built to be run behind something — a Cloudflare
-Tunnel, a reverse proxy, a VPN — by somebody who knows what they exposed.
+Rate limiting covers the endpoints a stranger can reach: signing in, resetting a
+password, the second factor, the installation beacon, and inbound mail. **Nothing
+else is limited** — an authenticated caller can ask as often as they like, and a
+signed-in account that wanted to be a nuisance can be one.
+
+There is no audit log of reads. Who *changed* something is recorded per project;
+who looked at it is not.
+
+It is built to be run behind something — a Cloudflare Tunnel, a reverse proxy, a
+VPN — by somebody who knows what they exposed.

cmd/verdande/main.go

@@ -17,6 +17,7 @@ import (
 	"github.com/kristianwind/verdande/internal/config"
 	"github.com/kristianwind/verdande/internal/httpapi"
 	"github.com/kristianwind/verdande/internal/jobs"
+	"github.com/kristianwind/verdande/internal/secret"
 	"github.com/kristianwind/verdande/internal/store"
 )
 
@@ -25,6 +26,9 @@ var version = "dev"
 
 func main() {
 	if err := run(); err != nil {
+		// Not the edition's name: this fires before the configuration is read, so
+		// the edition is not known yet — and one of the things it reports is a
+		// VERDANDE_EDITION the program refused.
 		fmt.Fprintf(os.Stderr, "verdande: %v\n", err)
 		os.Exit(1)
 	}
@@ -36,7 +40,9 @@ func run() error {
 		return err
 	}
 	log := httpapi.NewLogger(cfg.Dev)
-	log.Info("starting verdande", "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL)
+	// The edition's own name, so an urd instance's log says urd. The full edition
+	// still logs "starting verdande", which is what the release check reads.
+	log.Info("starting "+cfg.ProductSlug(), "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL, "edition", cfg.Edition)
 
 	// The data volume is the only state that matters; create the whole layout up
 	// front so a failure here is a startup error rather than a surprise at the
@@ -54,6 +60,41 @@ func run() error {
 	defer db.Close()
 	log.Info("database ready", "path", db.Path())
 
+	// Before anything reads a setting. The key lives outside the database on
+	// purpose: backups can be downloaded through the interface, so a token stored
+	// in the clear leaves with every copy anyone takes.
+	box, err := secret.Open(cfg.SecretKey, cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	db.UseSecrets(box)
+
+	// Noter, der stadig ligger åbne, lukkes nu.
+	//
+	// Ved opstart og ikke efterhånden som de skrives: et arkiv på tolv hundrede
+	// importerede noter, som ingen redigerer igen, ville ellers aldrig blive
+	// forseglet — og det er præcis dét arkiv, der er værd at forsegle. Idempotent,
+	// så den koster et gennemløb af id'er hver anden gang.
+	//
+	// En fejl her stopper opstarten. Halvdelen af noterne lukket er ikke i stykker,
+	// men en instans, der starter og lader som om den beskytter noget, den ikke gør,
+	// er værre end en, der siger fra.
+	if sealed, err := db.SealNotes(context.Background()); err != nil {
+		return fmt.Errorf("seal notes: %w", err)
+	} else if sealed > 0 {
+		log.Info("notes sealed", "count", sealed)
+	}
+
+	// Names created before the app capitalised them on the way in — "andreas"
+	// rather than "Andreas". Idempotent, so it is a cheap pass of names once it has
+	// caught up. A failure here does not stop the start: a lower-case first name is
+	// a blemish, not a broken instance.
+	if fixed, err := db.NormalizeUserNames(context.Background()); err != nil {
+		log.Error("normalize user names", "err", err)
+	} else if fixed > 0 {
+		log.Info("user names normalized", "count", fixed)
+	}
+
 	httpapi.Version = version
 	api := httpapi.New(cfg, db, log, webAssets(log))
 
@@ -64,6 +105,12 @@ func run() error {
 	defer stopJobs()
 	runner := jobs.New(cfg, db, log, api.Mail(), api.Hub())
 	runner.SyncGmail = api.SyncGmail
+	runner.SyncMailbox = api.SyncMailbox
+	runner.SyncCalendars = api.SyncCalendars
+	runner.Push = api.PushToUser
+	runner.SendBeacon = api.SendBeacon
+	runner.DailyPlans = api.DailyPlans
+	runner.NotifyOfUpdates = api.NotifyOfUpdates
 	runner.Start(jobCtx)
 
 	srv := &http.Server{
@@ -77,7 +124,11 @@ func run() error {
 
 	errc := make(chan error, 1)
 	go func() {
-		log.Info("listening", "addr", cfg.Addr)
+		// The version is repeated here rather than only on the "starting" line
+		// above: this is the line the Rune's done_regex matches, so it is the one
+		// sitting at the bottom of the panel console after a deploy — which is
+		// exactly when somebody wants to know what actually started.
+		log.Info("listening", "addr", cfg.Addr, "version", version)
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			errc <- err
 		}

docs/ai.md

@@ -43,23 +43,92 @@ The key is stored on your account and is **never sent back** to the settings pag
 a page that repopulates a password field is one that will eventually leak it into a
 screenshot.
 
+## The shape of all of it
+
+**The model proposes; you decide.** Nothing is written until you say yes, and the
+proposal is a line in the same syntax you type yourself — `Ring til Anders i morgen
+p1 #Firma` — sitting in a field you can edit before you accept it.
+
+That is not caution for its own sake. A model that edits your tasks directly has to
+be right *every* time to be worth having. One that suggests only has to be right
+often enough to save you some typing, and when it is wrong you have already seen it.
+
+It is also why the suggestion is a line rather than a set of fields: there is one
+reading of "i morgen" in this program, and a suggestion goes through the same
+[quick add](quick-add.md) parser as anything you type — including after you have
+edited it by hand.
+
+The model is given the names of the projects that exist and may name no others. A
+`#Projekt` it invented would create one by accident the first time you accepted it,
+and a guess must not be able to move a task somewhere you will not look for it.
+
 ## What it can do
 
-**Split a task into sub-tasks.** On any task: *Split with AI*. It suggests two to
-seven concrete actions and creates them as sub-tasks. Written in your language.
+**Tidy up the inbox.** In the Inbox, the menu → *Ryd op i indbakken*. For each loose
+line it suggests how you would have written it if you had finished it — project,
+date, priority — with one sentence on what it read out of the task. Accept, edit, or
+skip, one line at a time.
+
+**Find the tasks in a note.** Open a note → *Find opgaver i noten*. Only what
+somebody committed to or was asked to do; a heading is not a task and a topic that
+was discussed is not a task. Each suggestion quotes the words it came from, so a
+wrong one can be seen through rather than merely being wrong. The note itself is
+never edited — the task carries `[[the note's title]]` in its description instead.
+
+**Today's plan, in the morning.** **Settings → Beskeder → Dagens plan**, off by
+default; pick the hour yourself. One notification about what is due today and what
+has been missed, and what to start with — and the same text as a card at the top of
+**I dag**, where you are looking anyway when you start the day. The notification is
+the reminder; the card is where it stays.
+
+The card shows the plan *as it was sent*, with the time it was made, rather than a
+new one each time you look: a plan that says something different when you look at it
+than it said when it arrived is worse than either. **Forny planen** makes a new one
+when the day has moved, and it does not send a notification about something you are
+already looking at. With the morning notification off, the card offers to make one
+on the spot.
+
+The counts are done in the database and handed to the model as facts it may not
+recompute — a plan that says four tasks where there are three is worse than no plan.
+With no model configured the counts stand on their own, which is what you needed to
+know at seven in the morning anyway. Nothing due and nothing overdue sends nothing.
+
+**Mail that becomes a task you can act on.** Where a
+[mailbox](mailboxes.md) used to produce *"Anders Jensen: SV: SV: Vedr. levering uge
+12"*, the model writes the action the mail asks for — and leaves the mail alone if
+it asks for nothing. The subject stays in the description, so a mail it misread can
+still be read. If the model is unavailable the task is named sender and subject as
+before: a model that is down must not be able to stop the post.
+
+**Ask your own notes and tasks.** ⌘K, type the question, ⌘⏎. *"Hvad lovede jeg
+Anders i august?"* — search finds what contains the words, this answers the
+question, and the answer links to the notes and tasks it rests on. If nothing
+matches, it says so; a guess would be useless here, because you are asking precisely
+because you cannot remember.
+
+**Split a task into sub-tasks.** On any task: *Split with AI*. Two to seven concrete
+actions, created as sub-tasks.
 
 **A weekly summary.** A short note over what is outstanding: what looks urgent and
-what appears to be slipping. At most six lines — it is a prompt to think, not a
-report.
+what appears to be slipping. At most six lines — a prompt to think, not a report.
 
 ## What is sent
 
-Only what the feature needs: for a split, the task's title and notes; for a
-summary, the titles, dates and priorities of your open tasks. Never comments,
-attachments, or anything from a project the feature was not invoked on.
+Only what the feature needs, and only when you invoke it:
 
-Nothing is sent to anybody until you configure a provider. With a local model,
-nothing leaves your machine at all.
+| Feature | What leaves the instance |
+| --- | --- |
+| Tidy the inbox | The titles of the loose tasks in your inbox, the first words of their descriptions, and your project names |
+| Tasks in a note | That one note's text, and your project names |
+| Today's plan | The titles and dates of what is due or overdue today |
+| Mail to task | Sender, subject and the snippet of the mails in that sweep |
+| Ask | Your question, and the notes and tasks the search matched |
+| Split a task | That task's title and notes |
+| Weekly summary | The titles, dates and priorities of your open tasks |
+
+Never comments, never attachments, never a project the feature was not invoked on,
+and never anything belonging to somebody else. Nothing is sent to anybody until you
+configure a provider, and with a local model nothing leaves your machine at all.
 
 ## Turning it off
 

docs/api.md

@@ -52,6 +52,10 @@ what a person reads is decided by the client, which knows what language they are
 | `forbidden` | 403 | Cross-site request, or admin needed. |
 | `not_found` | 404 | Does not exist, or you cannot see it. |
 | `conflict` | 409 | Already exists, or the state does not allow it. |
+| `gmail_not_configured` | 409 | No Google OAuth client is registered on this server. |
+| `ai_not_configured` | 409 | No AI provider has been set up. |
+| `totp_not_enabled` | 409 | Two-factor is off, and the request needs it on. |
+| `inbox_protected` | 409 | The Inbox cannot be deleted. |
 | `validation_failed` | 422 | Check `fields`. |
 | `rate_limited` | 429 | Too many attempts. |
 | `internal_error` | 500 | Our fault. |
@@ -81,7 +85,7 @@ what a person reads is decided by the client, which knows what language they are
 curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
   -H "Authorization: Bearer vrd_..." \
   -H "Content-Type: application/json" \
-  -d '{"text": "betal moms i morgen kl 10 p1 #Firma @regnskab"}'
+  -d '{"text": "file the VAT return tomorrow at 10am p1 #Accounts @tax"}'
 ```
 
 ### Projects and sections
@@ -92,17 +96,20 @@ curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
 | `GET` `PATCH` `DELETE` | `/projects/{id}` | Read, change, trash. Owner only for the last two. |
 | `GET` `POST` | `/projects/{id}/sections` | |
 | `PATCH` `DELETE` | `/sections/{id}` | |
-| `GET` | `/projects/{id}/members` | |
-| `POST` | `/projects/{id}/invites` | Share it. `{"email": …, "role": "editor"\|"viewer"}` |
-| `DELETE` | `/projects/{id}/members/{userID}` | |
+| `GET` | `/projects/{id}/members` | Who is on it, who can be added (`candidates`), and who has been invited and not arrived (`pending`). |
+| `POST` | `/projects/{id}/invites` | Share it. `{"user_id": …}` for somebody who already has an account here, `{"email": …}` for anybody else — plus `"role": "editor"\|"viewer"`. An address that turns out to belong to an account is that account. |
+| `DELETE` | `/projects/{id}/invites/{inviteID}` | Withdraw an invitation before it is used. |
+| `PATCH` `DELETE` | `/projects/{id}/members/{userID}` | Change somebody's role, or take them off. |
 | `GET` | `/projects/{id}/activity` | |
+| `GET` | `/trash/projects` | What you have deleted and can still bring back, with how long is left. |
+| `POST` | `/trash/projects/{id}/restore` | Brings it back with the tasks that went with it. |
 
 ### Views, filters and labels
 
 | Method | Path | |
 |---|---|---|
 | `GET` | `/today` | Overdue and due today, in your timezone. |
-| `GET` | `/upcoming?days=7` | One entry per day, empty days included. |
+| `GET` | `/upcoming?days=7` | One entry per day, empty days included. Up to 31; over that is capped. |
 | `GET` | `/search?q=` | Across everything you can see. |
 | `GET` `POST` | `/filters` | |
 | `GET` | `/filters/{id}/tasks` | Run one. |

docs/beacon.md

@@ -0,0 +1,77 @@
+# The install count
+
+verdande reports that it exists — and so does urd, which is the same program in
+its [notes edition](editions.md). Two values, once a day:
+
+```json
+{
+  "instance_id": "01a0806d-3601-7000-ad76-057f1f684881",
+  "version": "v0.44.1"
+}
+```
+
+That is the whole message. No IP is stored by the collector, no hostname, no
+domain, no account, no counts of anything you have made, nothing about what you
+use it for — and not which of the two editions is running, so the count does not
+tell the two apart either. The payload is small enough to be printed in full on the settings page,
+and it is printed there — a promise about telemetry is worth exactly as much as
+your ability to check it.
+
+## On by default, off in one click
+
+The alternative that was considered first was compulsory, and the argument against
+it is practical rather than principled: it cannot be enforced. The domain can be
+blocked, the binary can be patched, and a fork removes it in its first commit. So
+mandatory buys nothing over on-by-default while costing the trust the rest of this
+program works for.
+
+Which is why the first administrator to sign in is **told, unprompted**, with the
+real id, the real version and the real address in front of them, and two buttons.
+On by default is only defensible if it is said out loud without being asked; a
+settings page where it is stated fully is not the same thing, because that page is
+opened by people who already suspect there is something to read.
+
+**Settings → Data** afterwards: one switch. An explicit "off" survives upgrades.
+
+!!! note "This disagrees with the update check, on purpose"
+
+    `VERDANDE_UPDATE_CHECK` is off unless you ask for it, and its reasoning is that
+    a self-hosted app reaching out unbidden has broken the deal its operator made by
+    self-hosting. That is the same situation as this one, and the two defaults do
+    not agree. The case for treating them differently: the update check reveals an
+    instance to a third party (GitHub) and returns something you can act on, while
+    this returns nothing and goes to the project. Whether that is a distinction or
+    an excuse is a judgement call, and it was made deliberately.
+
+## What the collector cannot see, and what it can
+
+A request has a source address whether or not anybody writes it down. The collector
+stores none and logs none, and the code is arranged so the address never reaches a
+function that could — the table has nowhere to put one. But the request passes
+through a reverse proxy and a tunnel on the way, and those keep their own logs.
+"We send no IP" would be a half-truth; what is true is that nothing here records
+one.
+
+The ping is not authenticated either, so anybody can post a made-up id and inflate
+the count. That is an accepted trade: a token would have to ship inside every
+install anyway.
+
+## Running your own count
+
+Somebody running a fleet points **Settings → Data → Modtagerens adresse** at their
+own instance, and ticks **Denne instans er tælleren** there. Until that is ticked,
+`POST /api/v1/beacon` answers **404** rather than accepting quietly — an instance
+nobody made a collector must not become a bucket anyone can post into.
+
+The collector's page then shows totals, active in 7 and 30 days, and a breakdown by
+version. Publishing that number at `/api/v1/beacon/count` is a second, separate
+opt-in, and it has a floor under it (25 by default): a number that *falls* cannot be
+published as a fact — a bad release, a DNS change that quietly stops the pings, or
+lost rows all look like "fewer people use this now" — and a small number mostly says
+how little it takes to move it.
+
+## When it cannot reach
+
+The reason is written down and shown on the settings page. A beacon that cannot
+reach its collector otherwise fails in complete silence: it tries again tomorrow,
+the page says "last sent" with a date that quietly gets older, and nobody notices.

docs/caldav.md

@@ -1,13 +1,15 @@
 # Calendar and CalDAV
 
-Two ways to get your tasks into a calendar, and they are not the same thing.
+Two ways to get your tasks into a calendar. Getting somebody else's calendar
+*into* verdande is the other direction and has its own page — see
+[Calendar](calendar.md).
 
-| | [Feed](#subscribing-to-a-feed) | [CalDAV](#connecting-a-caldav-client) |
-|---|---|---|
-| Direction | Read only | Two-way |
-| Works with | Anything that subscribes to a URL | Apple Reminders, Thunderbird, DAVx⁵ |
-| You can tick things off | No | Yes |
-| Setup | Paste a URL | Username and token |
+| | [Feed](#subscribing-to-a-feed) | [CalDAV](#connecting-a-caldav-client) | [Calendars in](calendar.md) |
+|---|---|---|---|
+| Direction | Tasks out, read only | Tasks out, two-way | Events **in**, read only |
+| Works with | Anything that subscribes to a URL | Apple Reminders, Thunderbird, DAVx⁵ | A Google account |
+| You can tick things off | No | Yes | No — an event is not a task |
+| Setup | Paste a URL | Username and token | Connect, then pick calendars |
 
 ## Subscribing to a feed
 
@@ -39,6 +41,13 @@ most people actually keep.
     **Settings → Calendar feed → Rotate** issues a new one and breaks the old
     immediately.
 
+## Showing a Google calendar in verdande
+
+Moved. Connecting a Google account, subscribing to an address, and what the grid
+does with either now live on their own page — see [Calendar](calendar.md).
+
+This page is the other direction: verdande's own tasks, read by something else.
+
 ## Connecting a CalDAV client
 
 This is the one where ticking something off in Apple Reminders ticks it off here.

docs/calendar.md

@@ -0,0 +1,91 @@
+# Calendar
+
+Your dated tasks as a grid, with other people's calendars laid under them.
+
+**Calendar** in the menu shows a month or a week. The week is a day: hours down the
+side, and everything with a time on it in its place. Two things at ten o'clock sit
+beside each other, because that is a clash you should be able to see rather than
+read.
+
+## What is in it
+
+- **Your tasks**, on the day they are due — and at the time, if they have one.
+- **Events from calendars you have connected**, read-only.
+
+Drag a task to another day to move it. Drop it on the hour column and it takes that
+time; drop it in the band across the top and it keeps the day and loses the time.
+Events cannot be dragged: verdande holds a copy of somebody else's calendar, and a
+chip that lets itself be moved is a promise the server cannot keep.
+
+A project's own calendar is under **Calendar** on the project page, with the same
+week and month.
+
+## Subscribing to a calendar
+
+**Settings → Integrations → Subscriptions.** Paste an address and it is fetched at
+once.
+
+This works with anything that publishes an `.ics` file: public holidays, a club's
+fixtures, a shared calendar from work, your own calendar's secret address from
+Google, Apple or Fastmail.
+
+- **`webcal://` addresses work.** They are the same URL over https with a scheme
+  that makes a desktop hand it to the calendar app; it is rewritten for you.
+- **Several at a time.** Unlike the Google connection, which is one account, a
+  subscription is one address and you can have as many as you like.
+- **Read-only, refreshed every fifteen minutes.**
+- The address is fetched once before it is stored, so a typo tells you now rather
+  than by silently never filling.
+
+!!! note "This is the way in for a private account"
+    If the instance's Google registration is *Internal*, Google refuses accounts
+    from outside the organisation with `org_internal` — no setting on your side
+    changes that. Your calendar's own secret ICS address goes through this panel
+    and works regardless.
+
+## Connecting Google Calendar
+
+**Settings → Integrations → Google Calendar.** It shares the OAuth client Gmail
+uses, so the instance needs that registration first — see
+[Configuration](configuration.md#google).
+
+Two things have to be true in Google Cloud, and only the owner of the registration
+can do them:
+
+1. **Google Calendar API** is enabled for the project.
+2. The calendar callback is listed as an authorised redirect URI. The exact string
+   is printed in the panel — copy it from there rather than typing it. Google
+   compares it exactly: scheme, host, path, no trailing slash. `redirect_uri_mismatch`
+   almost always means one of those four differs.
+
+Once connected, tick the calendars you want to see. The list is refreshed on every
+sync, so a calendar added or renamed since last time appears under its new name.
+
+!!! warning "Written to the specification, not yet proven against Google"
+    The Google Calendar half is implemented from Google's documentation and tested
+    against a stand-in server. It has not been exercised against Google itself.
+    The subscription route above and the outgoing feed below have.
+
+## Your own calendar, elsewhere
+
+Two ways out, for two different jobs:
+
+- **[The ICS feed](caldav.md#subscribing-to-a-feed)** — a read-only address for Apple Calendar,
+  Google or Thunderbird. Your tasks appear as dated entries.
+- **[CalDAV](caldav.md)** — two-way. Tick something off in Apple Reminders and it
+  is ticked off here.
+
+The feed address is a credential in itself: anybody holding it can read your tasks
+without logging in, because a calendar client cannot sign in. Rotate it from
+**Settings → Integrations** if it gets out.
+
+## What it does not do
+
+- **It does not write to a connected calendar.** Events are a copy.
+- **It does not expand repeating events** from a subscribed file. A weekly meeting
+  in somebody else's calendar is stored as its first occurrence.
+- **It does not resolve named time zones** from a subscribed file. An event carrying
+  `TZID=Europe/Copenhagen` shows the clock the file wrote, rather than one this
+  server has moved.
+- **Only Google, and only reading**, for account connections. Everything else goes
+  through a subscription.

docs/configuration.md

@@ -11,6 +11,26 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_ADDR` | `:8080` | Listen address. |
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
+| `VERDANDE_EDITION` | `full` | Which of the two editions this instance is. `full` is verdande — tasks, projects and notes. `notes` is urd: the task routes are not mounted at all, and the program calls itself urd. Any other value refuses to start, by name. See [Two editions](editions.md). |
+
+## Behind a proxy
+
+verdande keys its login rate limit and its audit log on the caller's address, so
+that address has to be one the caller cannot forge. A forwarded-for header is
+believed only when the machine that connected is a trusted proxy; a connection
+straight off the internet is keyed on the address it really came from.
+
+| Variable | Default | What it does |
+|---|---|---|
+| `VERDANDE_TRUSTED_PROXIES` | private networks | Whose `X-Forwarded-For` to believe, as comma-separated CIDRs. The default trusts loopback and the private ranges — the shape of a reverse proxy or tunnel sharing the host or the docker bridge. Set to `none` for an instance exposed directly with no proxy, so no forwarded header is ever believed. |
+| `VERDANDE_REAL_IP_HEADER` | `X-Forwarded-For` | The header the client address is read from, for a trusted proxy. |
+
+!!! warning "A proxy that does not overwrite the header"
+    The default is safe when your proxy replaces a client-supplied
+    `X-Forwarded-For` with the real address — nginx, Caddy and Cloudflare Tunnel all
+    do. If yours passes the client's own header through, narrow
+    `VERDANDE_TRUSTED_PROXIES` to just your proxy's address so a visitor cannot
+    choose the address they are rate-limited and logged as.
 
 ## Sessions and links
 
@@ -39,12 +59,24 @@ Any Go duration: `720h`, `30m`, `45s`.
     yourself, password resets are written to the log, and reminders arrive in the
     app and as Web Push rather than by email.
 
-## Gmail
+## Google
 
-Only needed if anyone will connect a mailbox. Register an OAuth client in Google
-Cloud (**APIs & Services → Credentials → OAuth client ID → Web application**) with
-the redirect URI `https://your-address/oauth/gmail/callback`, enable the Gmail API,
-and add the `gmail.readonly` scope.
+Only needed if anyone will connect a Gmail mailbox or a Google calendar. One
+registration covers both: register an OAuth client in Google Cloud
+(**APIs & Services → Credentials → OAuth client ID → Web application**) and add
+**both** redirect URIs:
+
+```
+https://your-address/oauth/gmail/callback
+https://your-address/oauth/calendar/callback
+```
+
+Then enable the APIs and scopes for whichever you want:
+
+| For | Enable | Scope |
+|---|---|---|
+| Mailboxes | Gmail API | `gmail.modify` |
+| Calendar | Google Calendar API | `calendar.readonly` |
 
 | Variable | What it does |
 |---|---|
@@ -52,14 +84,73 @@ and add the `gmail.readonly` scope.
 | `VERDANDE_GMAIL_CLIENT_SECRET` | The client secret. |
 
 One registration serves every user on the instance; each person authorises their
-own mailbox from **Settings → Gmail**. The redirect URI is derived from
-`VERDANDE_BASE_URL`, so it cannot drift out of step with what you registered.
+own mailbox from **Settings → Integrations → Gmail** and their own calendar from
+**Settings → Integrations → Google Calendar**. Both redirect URIs are derived from
+`VERDANDE_BASE_URL`, so they cannot drift out of step with what you registered.
+
+!!! note "Two connections, two grants"
+    Connecting a calendar does not disturb a working Gmail connection, and
+    disconnecting one does not take the other with it. Google issues a refresh
+    token per authorisation and keeps up to a hundred of them live per account,
+    each carrying only the scopes it was granted with.
+
+## Secrets
+
+| Variable | Default | What it does |
+|---|---|---|
+| `VERDANDE_SECRET_KEY` | — | Encrypts the mail tokens and mailbox passwords in the database. 32 bytes of base64. |
+
+Mail tokens and [mailbox](mailboxes.md) passwords are encrypted at rest, and the
+key does not live in the database. That is the whole point: **backups can be
+downloaded through the interface**, so a copy that ends up somewhere it should
+not would otherwise open your mail.
+
+Leave the variable empty and verdande writes a key to `secret.key` in the data
+directory on first start, mode `0600`. Backups are a `VACUUM INTO` of the
+database alone, so the key file is not in them.
+
+Generate one yourself if you would rather keep it out of the volume entirely:
+
+```
+openssl rand -base64 32
+```
+
+!!! warning "Lose the key and the mailboxes must be reconnected"
+    Nothing else is lost — tasks, projects, files and history are not encrypted —
+    but a token that cannot be decrypted cannot be used, and there is no way back
+    from a key that is gone. If you restore a database somewhere new, bring
+    `secret.key` with it, or set `VERDANDE_SECRET_KEY` to the same value.
+
+A database written before there was a key is read as it stands and encrypted the
+next time each value is written, so turning this on costs nobody a reconnection.
 
 ## Update checks
 
 | Variable | Default | What it does |
 |---|---|---|
-| `VERDANDE_UPDATE_CHECK` | `false` | Ask GitHub whether a newer release exists. |
+| `VERDANDE_UPDATE_CHECK` | `false` | Ask GitHub whether a newer release exists, and tell the administrators when one does. |
+| `VERDANDE_PANEL_URL` | — | The Yggdrasil panel this instance runs under. |
+| `VERDANDE_PANEL_TOKEN` | — | An API token from that panel, belonging to somebody with control of this server. |
+| `VERDANDE_PANEL_SERVER_ID` | — | Which server to restart — the id in the panel's URL. |
+
+With the check on, administrators are told **once per version** — in the bell, in
+push and on the app's badge — rather than having to open the settings page and
+look. The notification leads to the page where the restart button is. With the
+check off nothing is fetched and nothing is said; see
+[Notifications](notifications.md).
+
+All three together let **Settings → Notifications** restart this instance,
+which is also how it picks up a new version: a container cannot replace its own
+image, so the panel recreates it and pulls `:latest` on the way. The request asks
+the panel for a *scheduled* restart rather than an immediate one — an immediate
+one is carried out while the request is still open, and stopping the container
+kills the very process waiting for the answer, so the panel never gets to the
+half that starts it again. Any one of the
+three alone does nothing, and the page names the ones that are missing.
+
+The token is a panel credential with control over that server. Anybody who can
+read this environment can restart it — which is true of anybody with the host
+anyway — and it is never sent to a browser.
 
 Off unless you turn it on. When on, verdande asks the public GitHub releases API
 at most every six hours and sends nothing about your instance — no identifier, no

docs/editions.md

@@ -0,0 +1,205 @@
+# Two editions: verdande and urd
+
+One program, built once, with two faces.
+
+| | **verdande** | **urd** |
+|---|---|---|
+| What it is | Tasks, projects and notes | Notes |
+| `VERDANDE_EDITION` | `full` (the default) | `notes` |
+| Routes served | 200 | 137 |
+| Mark | ᚹ | ᚢ |
+
+Set `VERDANDE_EDITION=notes` and the instance is urd: the task routes are not
+mounted, the sidebar has no way to them, search answers with notes only, and the
+program calls itself urd in its tab, its wordmark and its web manifest.
+
+## Running the notes edition
+
+There is one image. The edition is an environment variable on the container:
+
+```
+docker run -e VERDANDE_EDITION=notes -v urd-data:/data -p 8080:8080 \
+    ghcr.io/kristianwind/verdande:latest
+```
+
+No second image and no rune of its own, deliberately.
+
+The edition is for an operator who wants an instance that genuinely has no task
+routes — the routes are absent from the router, not hidden in the interface. It is
+**not** how urd is normally reached. That is the second door, below.
+
+Two details that surprise people who look inside:
+
+- **The binary is called `/verdande`** and the database file is `verdande.db`, in
+  both editions. Not an oversight: it is the same binary, and renaming the file per
+  edition would be a migration hazard in exchange for nothing a user sees.
+- **The icons for both editions ship in the one image.** The server decides which
+  to serve at `/icon.svg`, because Safari looks for `apple-touch-icon.png` by name
+  and never reads the manifest, so renaming paths would have left iOS with the
+  wrong mark.
+
+## The second door: two apps, one instance
+
+urd is normally reached at **`/urd`** on an ordinary verdande. One instance, one
+database, one login, one set of links between notes and tasks — and two things you
+can install.
+
+| | verdande | urd |
+|---|---|---|
+| entry | `/` | `/urd` |
+| manifest | `/manifest.webmanifest` | `/urd.webmanifest` |
+| manifest `id` | `/` | `/urd` |
+| tab and mark | verdande, ᚹ | urd, ð |
+| database, account, login | the same | the same |
+
+An operating system does not install a URL, it installs a **manifest**, and the
+identity of an installed app is that manifest's `id`. Two manifests on one origin
+with different ids are two apps; two URLs sharing one manifest are one app with a
+bookmark. That is the whole mechanism.
+
+The shell is served per door rather than patched by JavaScript after the page
+loads, because iOS reads the page's `<head>` when somebody taps Add to Home Screen
+— and Safari looks for `apple-touch-icon` **by name**, having historically ignored
+the manifest's icons altogether.
+
+urd's manifest is built from verdande's rather than written beside it, so the
+fields the two genuinely share — the colours, the display mode, the language —
+come from one place and cannot drift. Six keys are changed: `id`, `start_url`,
+`scope`, the two names and the icons. An icon in the built manifest that urd has no
+file for stops the server rather than being passed through, because the symptom
+would otherwise be urd's install prompt quietly showing Verdande's mark.
+
+### The face is a preference, not a gate
+
+Entering at `/urd` makes that **window** wear urd's face: its mark, its name, its
+tab. It is kept strictly apart from the notes edition in the code, and the
+distinction is the one thing worth reading twice:
+
+| | what it means | what follows |
+|---|---|---|
+| `notesOnly` | the server has no task routes | a **guard** — the interface must not fetch them, they answer 404 |
+| `urdFace` | this window came in through the urd door | a **preference** — the routes are there, the data is yours, only the name differs |
+
+Conflate them and the urd face starts hiding data rather than chrome: a notebook
+would stop showing its tasks because somebody chose a different entrance. A test
+asserts the opposite directly — the urd window still gets 200 from
+`/api/v1/tasks`.
+
+The face lives in `sessionStorage`, not `localStorage`, and that is what lets the
+two apps be two apps: they share an origin, so they share localStorage, cookies and
+the service worker. `sessionStorage` is per window, and an installed PWA is its own
+window. It survives a reload, which it must — after the first navigation the
+address is `/noter` and nobody passes through `/urd` again.
+
+!!! note "One thing the two doors cannot have separately"
+    Theme, typeface and text size are shared, because they are in the localStorage
+    the origin shares. That was a deliberate choice: splitting them per face would
+    mean migrating everybody's stored settings for a difference few people want.
+
+## Moving between the two, measured
+
+A `/data` directory moves between the editions in **both directions, losslessly**.
+Same binary, same schema, same migrations — so this is not a feature that was built,
+it is a property that was checked:
+
+| step | result |
+|---|---|
+| verdande creates a notebook, a note in it, and a task | 1 note, 1 task |
+| the same directory, `VERDANDE_EDITION=notes` | `needs_setup: false` — same account. The note keeps its title, its body **and its `project_id`**. `/api/v1/tasks` → 404 |
+| the same directory, back to `full` | the task is still there; so is the note |
+
+The ownership stayed at the panel's service account through all three.
+
+So the way to move notes is to change the variable. `GET /export/notes.zip` is for
+getting notes **into other programs** — it writes one `.md` per note and carries the
+body and nothing else: no notebook, no sharing, no attachments, no pinned flag. That
+is the right division of labour, because the database already holds those.
+
+!!! note "The task rows stay"
+    An instance run as `notes` still has its tasks in the database; they are simply
+    not served. Harmless on a fresh instance, dead weight on a converted one — and
+    worth knowing before handing a converted instance to somebody else.
+
+## Why one codebase and not a fork
+
+The two share everything that is hard: accounts, sessions, passkeys, sharing,
+invitations, the realtime socket, search, the backup format, the migrations. Notes
+are about a twentieth of the Go in this repository and reference no task type;
+tasks reference no note type. A fork would have duplicated the other nineteen
+twentieths in order to separate the one — and then every security fix would have
+needed applying twice, by hand, forever.
+
+So the split is a configuration value read in one place, and the thing that keeps
+it honest is a test rather than a convention: `TestNotesEditionServesOnlyItsOwnRoutes`
+walks both routers, compares them against a written-down list of the 63 withheld
+routes, and fails in **both** directions — a route that appears in the notes
+edition and a route that stops being withheld are both a failure.
+
+## An unknown value refuses to start
+
+`VERDANDE_EDITION=note`, `Notes` and `none` are all rejected at startup, by name,
+rather than being treated as "not notes".
+
+The silent direction is the dangerous one here. An operator who sets up an instance
+for notes and mistypes the value would otherwise get every task route served on it,
+with no error anywhere and no way to tell from the outside.
+
+## What urd does not have
+
+The 63 withheld routes:
+
+| | what |
+|---|---|
+| 29 | tasks, sub-tasks, labels, saved filters, reminders, the upcoming and delegated views |
+| 8 | the CalDAV server — every route in it reads or writes a VTODO |
+| 1 | `/.well-known/caldav`, which is a claim that a CalDAV server is here |
+| 1 | the ICS calendar feed, plus 2 for the token it is reached with |
+| 4 | the task exports: `tasks.ics`, `projects.zip`, and a project's `.csv` and `.ics` |
+| 2 | the Todoist and CSV imports, which create tasks |
+| 4 | project templates — a template is a project plus sections plus tasks |
+| 5 | sections, which group tasks: `section_id` is a column on `tasks` and not on `notes` |
+| 6 | the AI task features: split, tidy the inbox, and the day's plan |
+| 1 | the inbox hook, which pushes a line of text in as a task |
+
+Plus five of the nine MCP tools — `search_tasks`, `create_task`, `update_task`,
+`complete_task` and `add_comment`. The endpoint is still there; the tool list is
+shorter. A tool a model can call is a surface, and one that answers "there are no
+tasks" is worse than one that does not exist: the model tries it, gets an empty
+answer, and tells the person there is nothing to do.
+
+Everything else is the same program:
+
+- accounts, invitations, passkeys and two-factor
+- projects — which in urd are what a note belongs to
+- per-note sharing with other people, independent of projects
+- search, over notes
+- export, of notes
+- the mail, calendar and MCP surfaces, minus their task routes and task tools
+- AI settings, `ask`, and the note actions
+
+!!! warning "Still being decided"
+    Four connectors are reachable in urd today and have not been settled either
+    way, because each has a plausible notes reading and withholding them would be
+    deciding what this product is rather than closing a hole: the mail-in address,
+    IMAP mailboxes, Gmail, and Google Calendar. They currently file what they
+    receive as **tasks**, so in urd they connect and then have nowhere to put
+    anything. The same applies to one handler rather than a route:
+    `POST /api/v1/ai/notes/{noteID}/actions/apply` creates tasks from a note.
+
+## The name
+
+Verðandi and Urðr are two of the three Norns in Völuspá, and the poem has them
+cutting marks into wood — the act of writing something down. Verdande is what is
+becoming; Urd is what has become and was kept.
+
+An instance started without the task routes is a different product to the person
+using it, so it says a different name. That name is read from the configuration in
+one place (`Config.ProductName`), which is why there is no build-time flag and no
+second frontend: the frontend is byte-identical in both editions, and the server
+renames the two files a browser reads before any JavaScript runs — the HTML shell's
+title and the web manifest.
+
+!!! note "The beacon counts them separately"
+    Both editions report the same two values once a day — instance id and version
+    — and nothing else; see [The install count](beacon.md). The edition is not in
+    the payload, so the count does not distinguish them.

docs/filters.md

@@ -1,7 +1,7 @@
 # Saved filters
 
-A filter is a small expression describing a slice of your tasks. The grammar is
-Todoist's, so if you are coming from there you already know it.
+A filter is a small expression describing a slice of your tasks. The grammar will
+feel familiar if you have used query-based filters in other task apps.
 
 ```
 today & p1

docs/index.md

@@ -11,23 +11,103 @@ of. Which is what a to-do list is.
 
 ## What it is for
 
-Todoist Pro, on your own hardware, with your own data. And with the integrations a
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data. And with the integrations a
 hosted product will not build for you: a real CalDAV server, an address you can
 forward mail to, and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
-- **[Quick add](quick-add.md) that reads what you type.** `betal moms i morgen kl
-  10 p1 #Firma @regnskab` becomes a task due tomorrow at 10:00, priority 1, in
-  Firma, labelled regnskab. Danish and English, mixed freely in one line.
+- **[Quick add](quick-add.md) that reads what you type.** `file the VAT return
+  tomorrow at 10am p1 #Accounts @tax` becomes a task due tomorrow at 10:00,
+  priority 1, in Accounts, labelled tax. Danish and English, mixed freely in one
+  line.
 - **Projects, sections, sub-tasks, labels, [saved filters](filters.md).** List,
-  board and calendar views.
-- **Sharing** with owner, editor and viewer roles. Anyone outside your instance
-  joins through an invite link.
+  board and calendar views, and foldable groups over the projects in the sidebar.
+  The calendar draws each task to its length — drag the foot to resize, the body
+  to move it.
+- **Find it by searching for it.** ⌘K searches tasks, notes and projects — and the
+  settings themselves, by what they *do* rather than only by what they are called,
+  so `webhook` finds *Push from other programs* and `2fa` finds *Two-factor*. The
+  settings pages carry the same field at the top of their own list.
+- **Notes, beside the work.** Rich text to write in, Markdown on disk. Share a
+  single note with a person — by name, by email address, or by writing `@Sofie` in
+  the text — or file it in a project; `#project` and `[[another note]]` are links,
+  and a task shows what has been written about it.
+- **Delegate, and snooze.** Hand a task to somebody and it is marked with an
+  arrow to them, gathered on a *Waiting on others* page. Snooze one to park it,
+  greyed, at the foot of the list until a moment you pick — without touching when
+  it is due.
+- **Drag where it means something** — reorder a list or a board, file a project
+  under a group, drop a task on another project, or drop it on another day.
+- **Sharing** with owner, editor and viewer roles. Somebody who already has an
+  account here you pick by name — the accounts on an instance are a closed,
+  invited set, so they are an address book rather than a directory to protect.
+  Anyone outside your instance joins through an invite link, and the invitation
+  stays visible until they arrive, so it does not get sent twice.
 - **Live sync** — a change made by somebody else appears without a refresh.
-- **Repeating tasks** as RRULE, reminders, comments and attachments.
-- **[Calendar](caldav.md), [mail](mail.md) and [Claude](mcp.md)** connected over
-  open standards rather than private formats.
+- **[Told when it matters](notifications.md).** A bell for what other people did to
+  what you share, pushed to your devices and counted on the app's icon in the Dock.
+- **[AI that suggests and never writes](ai.md).** Optional, your own key. It tidies
+  the inbox, pulls the tasks out of a meeting note, writes a morning plan, turns
+  *"SV: SV: Vedr. levering uge 12"* into what the mail actually asks for, and
+  answers questions about your own notes with links to what the answer rests on —
+  every one of them as a line you accept, edit or refuse.
+- **Repeating tasks** as RRULE, comments and attachments, and reminders that go
+  out as Web Push to an iPhone or a Mac.
+- **[Anything can put a task in your inbox](mail.md)** — a mail to your own
+  address, or a POST from a shortcut on your phone, a script, or any service that
+  can call a URL.
+- **[Your mail as an inbox](mailboxes.md).** Star a mail in Gmail, or flag one
+  over IMAP in iCloud or Fastmail, and it becomes a task — and the star or flag
+  comes off once it has, so a starred inbox empties as the tasks are made instead
+  of only filling up.
+- **[Calendar](caldav.md) and [Claude](mcp.md)** connected over open standards
+  rather than private formats.
+- **Six themes**, three dark and three light — including *Charcoal*, a warm
+  near-black after Apple Notes — and a size and typeface chosen apart from them.
+- **Holds through a short network drop.** A save rides out a few seconds of no
+  signal and goes through when it comes back; a reload opens from what it last saw
+  rather than the browser's offline page. It installs as a PWA.
+
+## What it looks like
+
+![Upcoming as a month](screenshots/upcoming.png)
+
+*Upcoming, as a month. A week and a plain list are the other two, and a task can be
+dragged from one day onto another.*
+
+![A project as a list](screenshots/sections.png)
+
+*The same project as a list, where sections read as bands. As a board they are
+columns.*
+
+![Waiting on others](screenshots/delegated.png)
+
+*What you have handed to somebody else, grouped by whoever has it — and each row
+marked with an arrow to them, so a delegated task reads as delegated wherever you
+meet it.*
+
+![Notes in the Charcoal theme](screenshots/notes-charcoal.png)
+
+*Charcoal, the newest of six themes — a warm near-black after Apple Notes, with
+amber where the accent green usually is.*
+
+![The six themes as swatches](screenshots/themes.png)
+
+*Six themes — three dark, three light — chosen on the settings page, with the
+typeface and how tightly it sits set apart from them.*
+
+![Settings, integrations](screenshots/settings.png)
+
+*Where [Gmail](mailboxes.md), the [calendar feed](caldav.md) and the
+[mail-to-task address](mail.md) are connected.*
+
+![Settings, people](screenshots/admin.png)
+
+*Inviting somebody to the instance. There is no open registration — everybody
+arrives through a link, and picks their own password. See
+[signing in](signing-in.md).*
 
 ## Getting it running
 

docs/links.md

@@ -0,0 +1,52 @@
+# Opening links
+
+A link in a task or a note opens in whichever browser your system opens links in.
+**Settings → Links** can try to change that — and the honest description of what it
+does is *try*.
+
+## What a web page cannot do
+
+Two things, and they set the limits of this feature:
+
+- **It cannot see which browsers are installed.** The list is deliberately closed:
+  it would be a fingerprint, distinctive enough to follow somebody from site to
+  site.
+- **It cannot ask the system to use a particular one.** A link goes to the default
+  browser, and there is no API that says otherwise.
+
+The only handle that exists is the URL schemes browsers register for themselves —
+`firefox://open-url?url=…`, `googlechrome://…`, `microsoft-edge:…` — and there is no
+way to ask whether one exists. You can only try it.
+
+## So the setting is an attempt
+
+Pick Safari, Chrome, Firefox or Edge, or write your own scheme. When you click a
+link, that scheme is tried first; if nothing has happened within about half a
+second, the link opens the ordinary way.
+
+The fallback is the whole reason this is safe to turn on. Without it, a setting
+that works on your phone would leave links doing nothing on your desktop.
+
+In practice: **it works on a phone**, where browsers register these schemes, and
+**rarely on a Mac or a PC**, where Chrome and Firefox do not. Edge on Windows is
+the usual exception. There is a **Prøv det** button for exactly this reason — you
+cannot ask whether a scheme exists, so it is better to find out on example.dk than
+on a link you meant to follow.
+
+## Writing your own
+
+Three placeholders, because browsers disagree about the shape they want the address
+in:
+
+| | |
+| --- | --- |
+| `{url}` | The address as it is — `x-safari-https://example.dk` |
+| `{encoded}` | The address as a parameter value — `firefox://open-url?url=https%3A%2F%2F…` |
+| `{stripped}` | The address without the `https://` — `googlechrome://example.dk` |
+
+## It belongs to the machine, not the account
+
+The choice is kept in the browser you are sitting at, not on your account — the
+same rule the sidebar's width follows. `firefox://` works on the phone and does
+nothing on the Mac, so a choice that followed the account would be wrong in one of
+the two places every time.

docs/mail.md

@@ -67,3 +67,36 @@ immediately.
 
 !!! tip "Keep the address to yourself"
     Treat it like a secret. If you publish it somewhere, rotate it.
+
+## Pushing from another program
+
+The address above needs a mail server. When what you want is a shortcut on your
+phone, a script, or any service that can call a URL, there is a second way in:
+**Settings → Integrationer → Skub fra andre programmer** gives you an address to
+POST a line of text to.
+
+```bash
+curl -X POST https://todo.example.dk/inbound/hook/<token> \
+  -H "Content-Type: text/plain" \
+  -d "Ring til Anders i morgen p1 #Firma"
+```
+
+The body is read three ways, because those are the three you meet: plain text from
+a shortcut that just sends what was selected, JSON with a `text` field from a
+service, or a form field from a webhook form. The first line becomes the task and
+the rest sits underneath it, and the line goes through the [quick add](quick-add.md)
+parser — so "i morgen", "p1" and "#Firma" mean here what they mean in the box at the
+top of the app.
+
+**The address is a key.** It has its own token rather than sharing the mail one:
+the two are the same kind of secret but they leak separately, and a URL that has
+been sitting in a shortcut on a lost phone has to be replaceable without changing
+the address other people have in their address books. A token here can do one
+thing — put a task in your inbox — which is why it is not an
+[API token](api.md), which can do everything. Change it under the same setting; the
+old one stops working at once.
+
+**POST only.** A GET would be easier to call, and that is exactly the problem: a
+browser prefetch, a link check in a chat, and a revisited history entry would all
+create tasks nobody asked for.
+

docs/mailboxes.md

@@ -0,0 +1,87 @@
+# Mailboxes
+
+Star a mail and it becomes a task.
+
+This is the other direction from [mail to task](mail.md): instead of forwarding
+something, Verdande reads a mailbox you connect and makes a task out of anything
+you have flagged. Nothing else in the mailbox is touched, and nothing is ever
+sent.
+
+Each mailbox belongs to the person who connected it. Two people on one instance
+connect their own and see only their own — there is no shared inbox and no
+administrator who can read yours.
+
+## Gmail
+
+**Settings → Integrations → Gmail → Connect.**
+
+Gmail needs an OAuth client, which is the instance's registration with Google
+rather than anybody's account — see [Configuration](configuration.md#google).
+Once it is set up, each person connects their own mailbox through it.
+
+Choose what makes a task:
+
+| Trigger | What it reads |
+|---|---|
+| Starred | Anything you have starred |
+| Label | Anything carrying a label you name |
+
+!!! note "The app stays Internal if your client is Internal"
+    An OAuth client registered as *Internal* in a Google Workspace can only be
+    used by accounts in that workspace. A personal `@gmail.com` address will be
+    refused with `org_internal`, and that is the client working as configured.
+    Switching to *External* means refresh tokens that expire every seven days
+    until Google has verified the app — for one personal account, forwarding to
+    your [mail-to-task address](mail.md) is the shorter road.
+
+## iCloud, Fastmail and anything else over IMAP
+
+**Settings → Integrations → Mailboxes → Add a mailbox.**
+
+You need three things:
+
+| Field | Example |
+|---|---|
+| IMAP server | `imap.mail.me.com:993` |
+| Username | your address |
+| App password | not your ordinary password — see below |
+
+The connection is tested before it is saved. A mailbox that cannot be read is
+refused while you are still looking at the form, rather than accepted and then
+failing quietly every ten minutes.
+
+Flag a message — the flag, not unread — and it becomes a task on the next sweep.
+Unread is a state you are still using yourself, and a sync that consumed it would
+be taking something away.
+
+### App passwords
+
+Every host worth naming issues a separate password for applications, which you
+can withdraw on its own without changing the one you sign in with. Use that.
+
+- **iCloud** — [appleid.apple.com](https://appleid.apple.com) → Sign-In and
+  Security → App-Specific Passwords
+- **Fastmail** — Settings → Privacy & Security → Integrations → New app password
+
+The password is [encrypted at rest](configuration.md#secrets), and it is never
+returned by the API once saved.
+
+### Office 365 does not work here
+
+Microsoft has closed IMAP to passwords; it wants its own OAuth flow. There is no
+app password that will get you in, and a mailbox pointed at `outlook.office365.com`
+will be refused. Forward to your [mail-to-task address](mail.md) instead.
+
+## How often
+
+Every ten minutes, in the background. **Fetch now** does it immediately, which is
+for when you have just connected something and want to see it work.
+
+A run reads at most twenty-five messages, so a mailbox with years of flagged mail
+in it fills up over several sweeps rather than in one.
+
+## Disconnecting
+
+**Disconnect** on the mailbox. The tasks it made stay — they are your work now,
+not the mailbox's. Nothing is read after that, and the stored credential is
+deleted rather than merely disabled.

docs/mcp.md

@@ -57,9 +57,9 @@ Both endpoints run the same server and reach the same things.
 | `complete_task` | Tick one off. |
 | `add_comment` | Comment on a task. |
 
-`create_task` prefers natural language, so *"add betal moms i morgen kl 10 p1
-#Firma"* goes through the same parser the app uses — dates, priorities, projects,
-labels and recurrence in either language.
+`create_task` prefers natural language, so *"add file the VAT return tomorrow at
+10am p1 #Accounts"* goes through the same parser the app uses — dates, priorities,
+projects, labels and recurrence in either language.
 
 ## What it can reach
 

docs/notes.md

@@ -0,0 +1,212 @@
+# Notes
+
+Markdown in, Markdown out. Nothing in between.
+
+A note is written as rich text — headings, lists, quotations, code — and stored as
+the Markdown it looks like. That is not a detail about the database: it is what
+makes a note yours. Export gives you the same text you were looking at, and on the
+day this program is gone, every note opens in any editor.
+
+## Writing
+
+Start typing. **The first line is the title** — always, and re-derived every time
+you save, so a note you rewrite the top of is called by what it now says rather
+than by what it once did.
+
+| Style | Written as | Shortcut |
+|---|---|---|
+| Title | `# ` at the start of the line | pick it in **Aa** |
+| Heading | `## ` | |
+| Subheading | `### ` | |
+| Quote | `> ` | |
+| Code block | three backticks, with an optional language | |
+| Bullet and numbered lists | `- ` and `1. `, nested with Tab | |
+| Bold | two asterisks around the words | ⌘B |
+| Italic | one asterisk around the words | ⌘I |
+| Underline | a `u` tag around the words | ⌘U |
+| Strikethrough | two tildes around the words | |
+| Code | one backtick around the words | |
+
+Every line becomes exactly one block. Markdown would normally join consecutive
+lines into a paragraph; here it does not, because you typed a line and expect to
+get it back.
+
+Press the source button in the toolbar to see the note as the file it is. Edits there are edits to the
+note.
+
+### Pictures
+
+Paste one, or drag it onto the note. It is stored with the note and travels with
+it in an export. Every raster format works; SVG is stored but not shown inline —
+it is a document that can run script, and a note is not a place to run somebody
+else's.
+
+**Click one to see it whole.** In the note it is scaled down to the width of the
+column — a photo off a phone is four thousand pixels across — so what you are
+looking at is a thumbnail that does not look like one. The full-size view has a
+button that copies the picture to the clipboard, and a link that opens it in its
+own tab. Escape closes it and puts the cursor back where it was.
+
+Copying converts to PNG on the way out when it has to. Clipboards take PNG and
+little else, and a photo off a phone is a JPEG — without the conversion the copy
+either fails or succeeds with something nothing will paste.
+
+### Code blocks
+
+A fenced block is coloured for the language it names, and guesses when it does not.
+Each one carries a **Copy** button in its corner.
+
+## Linking
+
+Three kinds of reference, parsed out of the text as you write it:
+
+| You type | It means |
+|---|---|
+| `#Firma` | The project — the same `#Firma` quick add understands, not a second kind of tag |
+| `[[Møde med Anders]]` | Another note, by its title |
+| A pasted task link | That task |
+
+Links are an index over the text, rebuilt every time the note is saved. The text
+stays the truth.
+
+**The interesting direction is backwards.** A task shows what has been written
+about it, and a project shows the notes filed in it — without anybody having to
+remember to attach anything. Write `#Firma` in a note and it appears on that
+project's page.
+
+A link to something that has been deleted reads as a dead link. It is a fact about
+the note, and it should not vanish because something it mentioned did.
+
+## Filing and sharing
+
+A note belongs to a project, or to nobody.
+
+- **In a project:** everybody who can read the project can read the note, and an
+  editor can change it. Choose it under **Share in** at the foot of the note.
+- **In no project:** yours, and nobody else's.
+
+There is no folder tree. Projects, groups and labels already exist, are already
+shared and already have roles — a second hierarchy to file things in is one too
+many, and a note in a project inherits every one of those answers.
+
+### Sharing one note with one person
+
+Filing a note in a project is the right tool when the note belongs with a body of
+work, and the wrong one when it is just *let Sofie see this*. **Del med personer**
+at the foot of the note does the second: this note, this person, as reader or
+editor. Only the note's owner can share it.
+
+Type an **email address** rather than picking a name, and one of two things
+happens. An address that already has an account is shared with straight away. One
+that does not gets an invitation — a link that creates the account and the share
+together, so the note is theirs the moment they sign up. Invitations wait in the
+panel under the note, where they can be withdrawn; that is the only way back, since
+only the token's hash is stored and a link sent to the wrong address cannot be
+looked up.
+
+### Naming somebody in a note
+
+Writing `@Sofie` in a note shares it with her and tells her. Naming somebody in a
+note *is* wanting them to read it, and doing it as two acts — write the name, then
+open the panel and find the person — meant the second was forgotten, and the note
+sat there addressing somebody who could not see it. The editor suggests names after
+`@`, the same way `#` suggests projects.
+
+- **Only the owner's mentions share.** An editor may write the name; giving
+  somebody else's note away is the owner's alone.
+- **As a reader**, which is the least that satisfies "look at this". A role you
+  have raised in the panel is never lowered by a mention.
+- **Only a name that has just appeared** counts. A note is saved on every typing
+  pause, so without that every save would be another share and another notification
+  about the same name.
+
+## Finding
+
+The list groups itself: favourites first, then **Today**, **Yesterday**, **This
+week**, and then by month. Sort by created, last touched or name, and the grouping
+follows — sorted by name it groups by first letter instead.
+
+Search finds a word wherever it is:
+
+- **`gron` finds `grøn`.** Unicode does not consider `ø` an accented `o`, so
+  stripping diacritics is not enough for Danish. A folded copy of every note is
+  indexed beside the original.
+- **`inventory` finds `keepInventory`.** An index is built of whole words, and a
+  decade of notes is full of commands and identifiers that are several words in
+  one. When the index has nothing, the text itself is read.
+- Results are ranked by how well they match, with the title weighted ten times the
+  body. A word in the title is what the note is about; the same word once in a long
+  body is a mention.
+
+Two places to search from, and they now agree. The field above the list filters it
+in place. **⌘K** searches everything at once — tasks, projects, notes and the
+settings — and picking a note from it opens that note *with the rest of the matches
+still in the list beside it*. It used to drop you on the ordinary list, so the
+other results existed only in the popup you had just closed. The address carries
+the search, which also means a search worth keeping can be bookmarked or sent to
+somebody.
+
+## Putting notes away
+
+Two different things, and the difference matters:
+
+- **Archive** — this is finished and I do not want to read past it. It stays
+  findable and comes back whenever you ask.
+- **Trash** — this was a mistake. It is gone in thirty days.
+
+Select several with ⌘-click and shift-click to archive or delete them together.
+
+## In and out
+
+**Export** gives you a zip of Markdown files, one per note, with the dates in a
+YAML front matter block that Obsidian and Bear also read:
+
+```markdown
+---
+created: 2019-04-02T10:15:00Z
+modified: 2024-11-30T21:04:00Z
+---
+
+# Møde med Anders
+
+Han vil gerne have kaffe hver uge.
+```
+
+**Import** takes the same shape back. Pictures travel in the zip beside the notes,
+and the links in the text are relative — so a note and its pictures must be in the
+same archive, which matters when a large export is split into parts.
+
+Two things to know before importing:
+
+- **Nothing is merged.** Every run creates new notes. Importing the same archive
+  twice gives you two of everything.
+- **The dates are read from the front matter.** Without them, a move of a thousand
+  notes is a pile that was all written the same evening — and the order they were
+  written in is half of what an archive is.
+
+### From Apple Notes
+
+`tools/apple-notes-til-markdown.py` in the repository exports Apple Notes to
+exactly this shape, front matter and pictures included. It is macOS-only, because
+Apple Notes is.
+
+For a large library, `tools/pak-noter-i-portioner.py` splits the export into
+uploadable parts, keeping each note with its own pictures.
+
+## What is encrypted, and what is not
+
+**A note's title and body are sealed** in the database, under a key kept in a file
+beside it rather than inside it. A backup you download does not carry the key, so
+it does not carry your notes.
+
+Both halves, not only the body: a note's title is its first line, so a readable
+title beside a sealed body would leave the beginning of every note in the open.
+
+**What is still in the clear:** task titles, descriptions and comments — and the
+list of what a note links to, so a stolen file shows which projects and tasks a
+note points at, though not what it says.
+
+Sealing the notes cost the search its index — a full-text index over a note's body
+is another copy of that body — so search reads the notes themselves now. At twelve
+hundred notes that is about forty milliseconds, and the box waits a quarter of a
+second after you stop typing, so you will not see it.

docs/notifications.md

@@ -0,0 +1,52 @@
+# Notifications
+
+What other people did that you need to know about, and what the day has in it.
+Verdande tells you in three places at once, and they are the same thing said three
+ways: the **bell** in the header, a **push** to your devices, and the **badge** on
+the app's icon.
+
+## What causes one
+
+| | |
+| --- | --- |
+| Somebody edited a note shared with you | Repeat edits fold into one line while it is unread |
+| Somebody shared a note with you | Once, when it happens |
+| Somebody shared a project with you | Once, when it happens — the entry opens the project, and its share panel has a *Leave the project* button |
+| Somebody named you in a note with `@` | Instead of "edited a note" — one act, one message |
+| Somebody gave you a task | Only on the change, and only to the person who got it |
+| Somebody commented | |
+| [Today's plan](ai.md), if you turned it on | In the morning, at the hour you chose — it opens the card on **I dag** |
+| A new version is out | Administrators only, once per version |
+
+Not your own actions: the server does not tell anybody what they just did
+themselves. And not everything that happens — a bell that rings at every change in
+a shared project is a bell people stop looking at.
+
+**Repeat edits are folded.** A note is saved on every typing pause, so one person
+writing for five minutes would otherwise be twenty identical lines. While the
+message is unread, a further edit moves it back to the top and says who touched it
+last. Once you have read it, the next edit is a new thing to be told.
+
+## Push, and the badge
+
+**Settings → Beskeder** turns on Web Push for the device you are sitting at, per
+device: the phone in your pocket and the laptop you have open are different
+answers, and a permission granted on one is not the other's.
+
+The **badge** — the number on the icon in the Dock on a Mac, on the taskbar on a
+PC — needs the app to be installed (added to the Dock, or installed as an app in
+Chrome or Edge). Half the point of being told is being told while you are doing
+something else, and the icon is the only place the app can say anything then. It
+counts unread messages and goes down by itself as you read them. Firefox does not
+support it; nothing else changes there.
+
+The sentence you see is written in your browser from *what happened* and *who did
+it*, so an English interface gets an English bell. The server's own wording is
+Danish and is used only for push, which has no dictionary to look a phrase up in.
+
+## Telling you about a new version
+
+If the [update check](configuration.md) is on, administrators get one notification
+per version — never one a day about the same one — and it leads to
+**Settings → Beskeder**, where the button that restarts the instance to update it
+sits. With the check off, nothing is fetched and nothing is said.

docs/quick-add.md

@@ -3,11 +3,11 @@
 One line in, a fully-formed task out.
 
 ```
-betal moms i morgen kl 10 p1 #Firma @regnskab
+file the VAT return tomorrow at 10am p1 #Accounts @tax
 ```
 
-becomes a task called **betal moms**, due tomorrow at 10:00, priority 1, in the
-Firma project, labelled regnskab.
+becomes a task called **file the VAT return**, due tomorrow at 10:00, priority 1,
+in the Accounts project, labelled tax.
 
 The parts it understands are tinted underneath the text as you type, so you can see
 it being read before you commit to it.
@@ -16,8 +16,8 @@ it being read before you commit to it.
 
 | You type | It means |
 |---|---|
-| `#Firma` | Put it in that project. `#"Q3 rapport"` for a name with spaces. |
-| `@regnskab` | Add that label. As many as you like. |
+| `#Accounts` | Put it in that project. `#"Q3 report"` for a name with spaces. |
+| `@tax` | Add that label. As many as you like. |
 | `p1` … `p4` | Priority. `!!!`, `!!` and `!` also work. |
 | `i dag`, `i morgen`, `i overmorgen` | Today, tomorrow, the day after. |
 | `mandag`, `på fredag` | The next such weekday. |
@@ -70,7 +70,22 @@ an error message and a lost thought.
     write it, and guessing month-first would silently move a date by months rather
     than failing visibly.
 
-## The shortcuts
+## Just start typing
 
-Press ++q++ to jump to the quick-add box from anywhere, ++t++ for Today, ++u++ for
-Upcoming, ++cmd+k++ to search, and ++question++ for the full list.
+There is no shortcut to remember. Press a letter anywhere in the app and you are
+writing a task, with the letter you pressed already in the field. The thought does
+not have to survive a journey to find somewhere to put it.
+
+It only fires when nothing else has focus — a key pressed at a field, a button or
+a link belongs to that thing.
+
+Under the field is a line saying what the parser reads: `#` project, `/` section,
+`@` label, `p1` priority, and an example date. It appears while you are typing,
+which is the one moment a placeholder cannot help you.
+
+++cmd+k++ opens the palette — search, and navigation to anywhere in the app.
+
+!!! note "The single letters used to navigate"
+    ++t++ for Today and ++u++ for Upcoming are gone. One keyboard cannot both
+    spell *tal med Anders* and jump to Today on the same ++t++, and capturing is
+    the thing done fifty times a day. The palette does the rest.

docs/rune.md

@@ -7,14 +7,14 @@ verdande ships with a Rune manifest for
 
 ```
 create container: Error response from daemon:
-No such image: ghcr.io/kristianwind/verdande:latest
+No such image: gitea.nolimit.dk/kw/verdande:latest
 ```
 
 This message is a liar. It does not mean the tag is missing from the registry —
 it means the image is not on the host, and the panel's attempt to fetch it failed
 without saying so.
 
-The usual cause is a **private** GHCR package. Yggdrasil pulls anonymously: its
+The usual cause is a **private** package. Yggdrasil pulls anonymously: its
 `PullImage` calls the Docker SDK with no `RegistryAuth`, so a private image comes
 back 401. The pull error is discarded, and `ContainerCreate` — which only ever
 looks locally — then reports the image as missing.
@@ -24,10 +24,28 @@ looks locally — then reports the image as missing.
     sends them itself with each request. Yggdrasil is a different client and
     sends none, so logging in changes nothing for the panel.
 
-**Make the package public.** Under
-[Packages → verdande → Package settings](https://github.com/users/kristianwind/packages/container/package/verdande)
-→ *Change visibility*. The repository stays private; only the built image becomes
-readable, which is what the manifest and these pages have always assumed.
+**The package has to be readable without credentials**, and the only way to know
+is to ask the registry for a token as a stranger:
+
+```bash
+curl -s "https://ghcr.io/token?scope=repository:kristianwind/verdande:pull&service=ghcr.io"
+```
+
+A 200 with a `token` in it means anyone can pull, which means the panel can. A
+401 means it cannot, whatever the package page says.
+
+!!! danger "Do not test this with `docker --config /tmp/empty pull`"
+    It looks like the honest test and is not. An empty config directory does not
+    stop the machine's credential helper, so the pull is quietly authenticated
+    with credentials you forgot you had — and reports success for an image no
+    stranger can fetch. This cost a production instance an hour of downtime: the
+    image was declared public on that evidence, the rune was pointed at it, and
+    the host — which had never logged in — could not pull a thing.
+
+    A self-hosted Gitea is where this bites. An instance with `REQUIRE_SIGNIN_VIEW`
+    turned on refuses anonymous tokens for its registry too, and no per-package
+    setting overrides it. Making the source repository public does not change it
+    either; that was tried.
 
 Once it is public, press **Start** on the server you already have. There is no
 need to delete it and make another: the image reference is read from the rune at
@@ -37,8 +55,8 @@ To keep the package private you have to put the image on the host yourself,
 before creating the server, and again after every release:
 
 ```bash
-sudo docker login ghcr.io -u kristianwind
-sudo docker pull ghcr.io/kristianwind/verdande:latest
+sudo docker login gitea.nolimit.dk -u kw
+sudo docker pull gitea.nolimit.dk/kw/verdande:latest
 ```
 
 Run it as the user the Docker daemon runs as — `sudo` if the panel does. The

docs/self-hosting.md

@@ -1,14 +1,16 @@
-# Self-hosting
+# With Docker
 
-verdande is one static binary and one directory. There is no database server, no
-cache, no queue and no second process.
+Running it yourself outside a panel: one static binary and one directory. There is
+no database server, no cache, no queue and no second process. (Yggdrasil is
+self-hosting too — for that route see [As a Rune](rune.md).)
 
 ## Docker
 
 !!! note "If the pull is refused"
-    The GHCR package is public, so this needs no credentials. If it is ever set
-    back to private, `docker login ghcr.io` with a token carrying the
-    `read:packages` scope before pulling — and see
+    The image is published from a self-hosted Gitea and is readable without
+    credentials — the package is not linked to a repository, so its visibility
+    follows the account rather than the (private) source repo. If it is ever set
+    back to private, `docker login gitea.nolimit.dk` before pulling — and see
     [the Rune page](rune.md#if-the-image-will-not-pull), because a private image
     fails differently and much more confusingly under Yggdrasil.
 

docs/signing-in.md

@@ -0,0 +1,71 @@
+# Signing in
+
+Three ways in, and you can have all of them at once.
+
+## A password
+
+What the first account is created with. Nothing is emailed, nothing is registered
+anywhere: the first person to open a fresh instance creates the administrator
+account, and after that people arrive by invite link.
+
+## Being let into a project
+
+Two different situations, one panel — **the project's ⋯ menu → Share**.
+
+Somebody who **already has an account here** you pick from a list by name. You do
+not need to know their email address to share a project with a colleague whose
+name you know. The accounts on an instance are a closed set — there is no open
+signup, every one of them was invited — so listing them to each other is the
+address book the feature needs, not a disclosure.
+
+Somebody who is **not here yet** you invite by email. If the address turns out to
+belong to an account it becomes an ordinary share straight away; otherwise it
+becomes a link that creates their account and their membership at once. With no
+mail server configured the link is shown in the panel instead of being sent, which
+is the correct behaviour on a one-person instance rather than an error.
+
+**You are told, and you can leave.** Being added to a project is not something
+that happens to you quietly: the bell says who shared what, and the entry takes
+you to the project. In the share panel, anybody who is not the owner has a *Leave
+the project* button. That is deliberate rather than an approval step — an
+invitation waiting on a yes means the person who shared thinks it is done while
+the work sits still. What was wrong was the other three-quarters of it: you were
+added without being asked, without being told, and with no way out except asking
+the owner. The owner cannot leave their own project; that is a transfer of
+ownership, and there is no transfer yet.
+
+An invitation that has not been taken up stays listed under the members, greyed,
+with a × to withdraw it. Without that it is invisible — the person has no account,
+so they are neither a member nor somebody you can pick — and the usual next move
+is to send it a second time. The second link works exactly as well as the first,
+and then there are two to keep track of.
+
+## A code on top of it
+
+**Settings → Account → Two-factor.** An ordinary TOTP secret — any authenticator
+app reads the QR code. Once it is on, the password alone is not enough.
+
+Recovery codes are shown once, when you turn it on. They are the way back if the
+phone is gone, and they are not shown again.
+
+## A passkey
+
+**Settings → Account → Passkeys → Add a passkey.**
+
+A key on a device instead of a secret in your head. The private half never leaves
+the device — a phone's secure element, a laptop's keychain, a hardware key — and
+the signature is bound to the address it was made for, so a convincing copy of the
+sign-in page at a different address gets nothing.
+
+Give each one a name you will recognise later. *min bærbare* is what makes a list
+of keys reviewable, and a list nobody can read is a list nobody revokes from.
+
+Passkeys need the address in `VERDANDE_BASE_URL` to be a hostname. Browsers refuse
+to make one for a bare IP address, so an instance reached at `http://192.168.1.10:8080`
+will show the passkey section as unavailable rather than failing at the moment
+somebody tries.
+
+!!! note "One is enough, two is better"
+    Lose the only device holding your only passkey and you are back to the
+    password. Keep the password, or register a second key — a phone as well as a
+    laptop.

go.mod

@@ -3,21 +3,33 @@ module github.com/kristianwind/verdande
 go 1.26.3
 
 require (
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc
+	github.com/coder/websocket v1.8.15
+	github.com/emersion/go-imap/v2 v2.0.0-beta.8
+	github.com/emersion/go-message v0.18.2
 	github.com/go-chi/chi/v5 v5.3.1
+	github.com/go-webauthn/webauthn v0.17.4
 	github.com/pquerna/otp v1.5.0
+	github.com/teambition/rrule-go v1.8.2
 	golang.org/x/crypto v0.55.0
 	modernc.org/sqlite v1.56.0
 )
 
 require (
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
-	github.com/coder/websocket v1.8.15 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-webauthn/x v0.2.6 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/teambition/rrule-go v1.8.2 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	modernc.org/libc v1.74.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect

go.sum

@@ -2,12 +2,33 @@ github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
 github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
-github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emersion/go-imap/v2 v2.0.0-beta.8 h1:5IXZK1E33DyeP526320J3RS7eFlCYGFgtbrfapqDPug=
+github.com/emersion/go-imap/v2 v2.0.0-beta.8/go.mod h1:dhoFe2Q0PwLrMD7oZw8ODuaD0vLYPe5uj2wcOMnvh48=
+github.com/emersion/go-message v0.18.2 h1:rl55SQdjd9oJcIoQNhubD2Acs1E6IzlZISRTK7x/Lpg=
+github.com/emersion/go-message v0.18.2/go.mod h1:XpJyL70LwRvq2a8rVbHXikPgKj8+aI0kGdHlg16ibYA=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
+github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
 github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk=
+github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8=
+github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk=
+github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -18,6 +39,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
@@ -25,20 +48,60 @@ github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/teambition/rrule-go v1.8.2 h1:lIjpjvWTj9fFUZCmuoVDrKVOtdiyzbzc93qTmRVe/J8=
 github.com/teambition/rrule-go v1.8.2/go.mod h1:Ieq5AbrKGciP1V//Wq8ktsTXwSwJHDD5mD/wLBGl3p4=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
 golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
 modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
 modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=

internal/ai/ai.go

@@ -19,6 +19,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+
+	"github.com/kristianwind/verdande/internal/safedial"
 	"strings"
 	"time"
 )
@@ -45,6 +47,12 @@ type Config struct {
 	// ProviderCompatible and useful for a proxy in front of the others.
 	BaseURL string
 	Model   string
+	// AllowPrivate lets BaseURL be on this machine or its private network.
+	//
+	// Set by the caller from who is asking, never read from storage: it is the
+	// answer to "may this person reach the LAN", and that answer can change after
+	// the address was saved. See the handler for who gets it and why.
+	AllowPrivate bool
 }
 
 func (c Config) Configured() bool {
@@ -71,12 +79,31 @@ type Client struct {
 }
 
 func New(cfg Config) *Client {
+	dial := safedial.Client
+	if cfg.AllowPrivate {
+		dial = safedial.AllowPrivate
+	}
 	return &Client{
 		cfg: cfg,
 		// Generous: a local model on modest hardware can take a while to produce
 		// its first token, and the alternative is a timeout that only ever fires
 		// for the people running their own.
-		http: &http.Client{Timeout: 120 * time.Second},
+		// safedial by default. `base_url` is typed into a field in the interface,
+		// so it is a user-supplied address — and a server that fetches a
+		// user-supplied address is a way to ask it to reach things the caller
+		// cannot: the panel next door, a database on the same bridge, the cloud
+		// metadata endpoint. On a homelab that is most of what is worth reaching.
+		//
+		// The check is on the resolved address rather than on the URL, because a
+		// name answers whatever its owner says — and can answer differently the
+		// second time, after a parse-time check has passed.
+		//
+		// And then the exception, which is the whole reason this provider exists:
+		// a model you run yourself IS on that network. Blocking it made the two
+		// lines above true and the feature useless — the comment about a local
+		// model being slow to its first token was written for a case the dialler
+		// refused to reach. AllowPrivate is granted per request, not per address.
+		http: dial(120 * time.Second),
 	}
 }
 
@@ -268,11 +295,35 @@ func (c *Client) do(req *http.Request, out any) error {
 		// The provider's own message is included: for a local model it is usually
 		// the actual problem ("model not found"), and hiding it would leave the
 		// operator with nothing to go on.
-		return fmt.Errorf("ai: %s said %s: %s", req.URL.Host, resp.Status, truncate(string(raw), 300))
+		// The provider's body is no longer passed back to the caller.
+		//
+		// It was, and combined with a free-text base URL that made a working
+		// internal scanner: point it at a host, read the first three hundred bytes
+		// of whatever answered. The operator still needs the message — for a local
+		// model it is usually the actual problem — so it goes to the log, where it
+		// is available to the person running the instance and to nobody else.
+		return &upstreamError{Host: req.URL.Host, Status: resp.Status, Body: truncate(string(raw), 300)}
 	}
 	return json.Unmarshal(raw, out)
 }
 
+// upstreamError keeps the provider's own words for the log and away from the
+// response. Error() is what reaches a caller; Detail() is what is written down.
+type upstreamError struct {
+	Host   string
+	Status string
+	Body   string
+}
+
+func (e *upstreamError) Error() string {
+	return fmt.Sprintf("ai: %s said %s", e.Host, e.Status)
+}
+
+// Detail is the whole of it, for the instance's own error log.
+func (e *upstreamError) Detail() string {
+	return fmt.Sprintf("ai: %s said %s: %s", e.Host, e.Status, e.Body)
+}
+
 func truncate(s string, max int) string {
 	if len(s) <= max {
 		return s
@@ -344,22 +395,266 @@ back, do not congratulate, and do not offer productivity advice.`, language)
 	return c.Complete(ctx, system, []Message{{Role: "user", Content: prompt}})
 }
 
+// Suggestion er én foreslået opgave, skrevet som en linje, man selv kunne have
+// tastet.
+//
+// `line` er quick-add-syntaks — "Ring til Anders i morgen p1 #Firma" — og ikke et
+// felt pr. egenskab. To grunde, og den anden er den vigtige. Parseren findes
+// allerede og er den samme, uanset hvor teksten kom fra, så der er ingen anden
+// fortolkning at holde i takt med den. Og et forslag, der er skrevet i det sprog,
+// man selv skriver i, kan læses og rettes af den, det bliver stillet til — hvor
+// et sæt felter, en model har udfyldt, er noget, man skal tage eller lade være.
+//
+// `why` er én sætning om, hvorfor den ser sådan ud. Den står ved siden af
+// forslaget, så et forkert gæt kan gennemskues frem for bare at være forkert.
+type Suggestion struct {
+	Line string `json:"line"`
+	Why  string `json:"why,omitempty"`
+}
+
+// TidyInbox foreslår, hvordan løse opgaver i indbakken kunne skrives færdig.
+//
+// Modellen får de projekter, der findes, og må kun bruge dem: et `#Nyt Projekt`,
+// den fandt på, ville lave et projekt ved et uheld, første gang nogen sagde ja.
+func (c *Client) TidyInbox(ctx context.Context, tasks, projects []string, today, locale string) ([]Suggestion, error) {
+	language := languageOf(locale)
+
+	known := "none"
+	if len(projects) > 0 {
+		known = "#" + strings.Join(projects, ", #")
+	}
+
+	system := fmt.Sprintf(`You tidy up a task inbox.
+
+For each task you are given, write the line the person would have typed if they
+had filed it properly. Keep their own words for what the task is — you are filing
+it, not rewriting it.
+
+The line may carry, in this syntax and no other:
+  #Project   one of these existing projects, and never one that is not: %s
+  p1..p4     priority, where p1 is most urgent
+  a date in plain %s, such as "i morgen", "on friday", "15/3"
+
+Leave out anything the task does not tell you. A guessed deadline is worse than
+none: the person can add one, but they cannot see a wrong one you invented.
+Today is %s.
+
+Reply with a JSON array and nothing else — no prose, no code fence. Each element
+is {"line": "...", "why": "..."} where why is at most one short sentence in %s
+saying what you read out of the task. Give one element per task, in the order you
+were given them, and leave a task out entirely if it is already filed well.`,
+		known, language, today, language)
+
+	prompt := "Tasks:\n" + strings.Join(tasks, "\n")
+	return c.suggestions(ctx, system, prompt)
+}
+
+// ActionsInNote trækker det, nogen har lovet, ud af en note.
+//
+// Beskrivelsen er stram med vilje. En model, der får lov at "finde opgaver" i en
+// tekst, finder også emner, overskrifter og gode idéer — og så er resultatet en
+// liste, man skal luge i, hvilket er dyrere end at skrive de tre punkter selv.
+func (c *Client) ActionsInNote(ctx context.Context, note string, projects []string, today, locale string) ([]Suggestion, error) {
+	language := languageOf(locale)
+
+	known := "none"
+	if len(projects) > 0 {
+		known = "#" + strings.Join(projects, ", #")
+	}
+
+	system := fmt.Sprintf(`You read a note and pull out what somebody has to do.
+
+Only things somebody committed to or was asked to do. A heading is not a task, a
+topic that was discussed is not a task, and an idea nobody agreed to is not a
+task. If the note contains none, reply with an empty array — that is a useful
+answer and a made-up list is not.
+
+Write each one as the line the person would have typed, in %s, in this syntax and
+no other:
+  #Project   one of these existing projects, and never one that is not: %s
+  p1..p4     priority, where p1 is most urgent
+  a date in plain %s, only when the note actually gives one
+
+Today is %s.
+
+Reply with a JSON array and nothing else — no prose, no code fence. Each element
+is {"line": "...", "why": "..."} where why quotes the few words in the note that
+the task came from, so it can be checked.`, language, known, language, today)
+
+	return c.suggestions(ctx, system, "Note:\n"+note)
+}
+
+// DailyPlan skriver morgenens to-tre linjer.
+//
+// Tallene er talt i basen og gives med som kendsgerninger, modellen ikke må regne
+// om. En plan, der siger fire opgaver, hvor der er tre, er værre end ingen plan —
+// og en model, der tæller en liste, tæller den forkert af og til.
+//
+// Det ene sted, den må mene noget, er hvad man skulle begynde med, og hvad der
+// kunne vente. Det er dét, der gør det til en plan frem for en optælling.
+func (c *Client) DailyPlan(ctx context.Context, tasks []string, due, overdue int, locale string) (string, error) {
+	language := languageOf(locale)
+
+	system := fmt.Sprintf(`You write somebody's morning note about their own day.
+
+Write in %s. At most three short lines, no greeting, no sign-off, no
+encouragement. Say what to start with and why. Name at most one thing that could
+wait or be dropped, and only if something obviously can.
+
+These numbers are counted for you and are facts: %d due today, %d overdue. Do not
+recount them, do not contradict them, and do not list every task back.`,
+		language, due, overdue)
+
+	return c.Complete(ctx, system, []Message{
+		{Role: "user", Content: "The tasks:\n" + strings.Join(tasks, "\n")},
+	})
+}
+
+// Ask svarer på et spørgsmål ud fra de tekststykker, den får med — og kun dem.
+//
+// Svaret skal bære sine kilder, og det er derfor svaret er JSON og ikke prosa: en
+// model, der skriver "[3]" midt i en sætning, gør det af og til, og en, der
+// afleverer nummeret i et felt, gør det hver gang. Fladen skal kunne lave et link,
+// ikke lede efter kantede parenteser i en tekst.
+//
+// "Det står der ikke" er et rigtigt svar. En model, der hellere gætter end
+// skuffer, er ubrugelig til netop det her: man spørger om sine egne noter, fordi
+// man ikke selv kan huske det, og har derfor ingen mulighed for at se, at svaret
+// var opfundet.
+func (c *Client) Ask(ctx context.Context, question string, passages []string, locale string) (string, []int, error) {
+	language := languageOf(locale)
+
+	system := fmt.Sprintf(`You answer a question from somebody's own notes and tasks.
+
+Use only the passages given. If they do not answer the question, say so plainly —
+that is a useful answer, and a guess is not: the person is asking because they
+cannot remember, so they cannot tell an invented answer from a real one.
+
+Write in %s, at most four short lines. Reply with a JSON object and nothing else:
+{"answer": "...", "sources": [1, 3]} where sources are the numbers of the
+passages the answer actually rests on, and nothing else.`, language)
+
+	prompt := "Question: " + question + "\n\nPassages:\n" + strings.Join(passages, "\n\n")
+
+	reply, err := c.Complete(ctx, system, []Message{{Role: "user", Content: prompt}})
+	if err != nil {
+		return "", nil, err
+	}
+
+	var out struct {
+		Answer  string `json:"answer"`
+		Sources []int  `json:"sources"`
+	}
+	if err := json.Unmarshal([]byte(extractObject(reply)), &out); err != nil {
+		// Et svar, der ikke er JSON, er stadig et svar. Teksten er det, personen
+		// spurgte om; henvisningerne er det, der går tabt, og det er en dårligere
+		// dag end en fejlmeddelelse ville være.
+		return strings.TrimSpace(reply), nil, nil
+	}
+	return strings.TrimSpace(out.Answer), out.Sources, nil
+}
+
+// TasksFromMail skriver én opgavelinje pr. mail.
+//
+// Emnefeltet er skrevet til at blive genkendt i en indbakke, ikke til at blive
+// gjort noget ved: "SV: SV: Vedr. levering uge 12" siger, hvilken tråd det er, og
+// intet om, hvad man skal. Modellen skriver den handling, mailen beder om — og
+// lader være, hvis den ikke beder om nogen.
+func (c *Client) TasksFromMail(ctx context.Context, mails []string, today, locale string) ([]Suggestion, error) {
+	language := languageOf(locale)
+
+	system := fmt.Sprintf(`You turn emails into the tasks they ask for.
+
+For each numbered email, write the line the recipient would have typed for
+themselves — what they have to DO, in %s, starting with a verb. Keep the sender's
+name in it when it matters who it is about. Not a summary of the email: the
+action it asks for.
+
+The line may carry a date in plain %s, and p1..p4 for priority, but only when the
+email itself says so — "before friday" in the text is a date, an email that merely
+sounds urgent is not. Today is %s.
+
+Reply with a JSON array and nothing else — no prose, no code fence. Each element
+is {"line": "N. ..."} keeping the number the email was given, so the line can be
+put back on the right one. Leave an email out entirely if it asks for nothing.`,
+		language, language, today)
+
+	return c.suggestions(ctx, system, "Emails:\n"+strings.Join(mails, "\n"))
+}
+
+// suggestions er den fælles halvdel: spørg, læs svaret som JSON, og smid det væk,
+// der ikke er en linje.
+//
+// Et tomt svar er ikke en fejl. "Der er ikke noget at foreslå" er et rigtigt svar
+// på begge spørgsmål, og en fejlmeddelelse ville lære folk, at funktionen er i
+// stykker, når den i virkeligheden var enig med dem.
+func (c *Client) suggestions(ctx context.Context, system, prompt string) ([]Suggestion, error) {
+	reply, err := c.Complete(ctx, system, []Message{{Role: "user", Content: prompt}})
+	if err != nil {
+		return nil, err
+	}
+
+	var out []Suggestion
+	if err := json.Unmarshal([]byte(extractJSON(reply)), &out); err != nil {
+		return nil, fmt.Errorf("ai: the model did not return a list: %s", truncate(reply, 200))
+	}
+
+	clean := make([]Suggestion, 0, len(out))
+	for _, s := range out {
+		s.Line = strings.TrimSpace(s.Line)
+		s.Why = strings.TrimSpace(s.Why)
+		if s.Line != "" {
+			clean = append(clean, s)
+		}
+	}
+	return clean, nil
+}
+
+// languageOf er det sprog, svaret skal skrives i. Ét sted, fordi det ellers er
+// den slags, der bliver rettet ét sted ud af fire.
+func languageOf(locale string) string {
+	if strings.HasPrefix(strings.ToLower(locale), "en") {
+		return "English"
+	}
+	return "Danish"
+}
+
+// unfence tager svaret ud af den kodeblok, modeller pakker det ind i, uanset hvor
+// omhyggeligt de bliver bedt om at lade være.
+func unfence(reply string) string {
+	reply = strings.TrimSpace(reply)
+	fence := strings.Index(reply, "```")
+	if fence < 0 {
+		return reply
+	}
+	rest := reply[fence+3:]
+	if newline := strings.IndexByte(rest, '\n'); newline >= 0 {
+		rest = rest[newline+1:]
+	}
+	if end := strings.Index(rest, "```"); end >= 0 {
+		return strings.TrimSpace(rest[:end])
+	}
+	return reply
+}
+
+// extractObject er extractJSON for et objekt frem for en liste. Samme problem,
+// samme løsning: modeller pakker svar ind i en kodeblok, hvor omhyggeligt de end
+// bliver bedt om at lade være.
+func extractObject(reply string) string {
+	reply = unfence(reply)
+	start := strings.IndexByte(reply, '{')
+	end := strings.LastIndexByte(reply, '}')
+	if start >= 0 && end > start {
+		return reply[start : end+1]
+	}
+	return reply
+}
+
 // extractJSON pulls an array out of a reply that may have been wrapped in a code
 // fence or preceded by a sentence, which models do however firmly they are asked
 // not to.
 func extractJSON(reply string) string {
-	reply = strings.TrimSpace(reply)
-
-	if fence := strings.Index(reply, "```"); fence >= 0 {
-		rest := reply[fence+3:]
-		if newline := strings.IndexByte(rest, '\n'); newline >= 0 {
-			rest = rest[newline+1:]
-		}
-		if end := strings.Index(rest, "```"); end >= 0 {
-			reply = strings.TrimSpace(rest[:end])
-		}
-	}
-
+	reply = unfence(reply)
 	start := strings.IndexByte(reply, '[')
 	end := strings.LastIndexByte(reply, ']')
 	if start >= 0 && end > start {

internal/auth/auth_test.go

@@ -265,6 +265,39 @@ func TestRecoveryCodes(t *testing.T) {
 	}
 }
 
+// TOTPStep returns the step a code matched, and it must be the same step across
+// the tolerance window — that number is what makes a code single-use, so a code
+// entered a little early or late has to spend the same step, not a new one.
+func TestTOTPStepIsStableAcrossTheWindow(t *testing.T) {
+	secret, _, err := NewTOTPSecret("verdande", "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 3, 10, 10, 0, 15, 0, time.UTC)
+	code := codeAt(t, secret, now)
+
+	want, err := TOTPStep(secret, code, now)
+	if err != nil {
+		t.Fatalf("the current code did not match: %v", err)
+	}
+	// Verified one step late — the code is still valid, and must report the step it
+	// was issued at, not the step it was checked at.
+	got, err := TOTPStep(secret, code, now.Add(30*time.Second))
+	if err != nil {
+		t.Fatalf("code rejected one step late: %v", err)
+	}
+	if got != want {
+		t.Errorf("same code reported step %d then %d; a replay check keyed on that would not catch it", want, got)
+	}
+
+	if _, err := TOTPStep(secret, "000000", now); err == nil {
+		t.Error("a wrong code returned a step")
+	}
+	if _, err := TOTPStep("", code, now); err != ErrNoTOTPSecret {
+		t.Errorf("empty secret: %v, want ErrNoTOTPSecret", err)
+	}
+}
+
 // codeAt produces the code an authenticator app would display at that moment,
 // using the same settings VerifyTOTP checks against.
 func codeAt(t *testing.T, secret string, now time.Time) string {
@@ -280,3 +313,33 @@ func codeAt(t *testing.T, secret string, now time.Time) string {
 	}
 	return code
 }
+
+// The relying party is derived from the instance's own base URL, and the two ways
+// that goes wrong are both silent until a browser refuses.
+func TestPasskeysRefuseAnAddressNoBrowserWillAccept(t *testing.T) {
+	for _, c := range []struct {
+		base string
+		ok   bool
+		why  string
+	}{
+		{"https://verdande.example.dk", true, "a real domain"},
+		{"http://localhost:5173", true, "localhost, which every browser excepts"},
+		{"https://verdande.example.dk:8443", true, "a port is dropped from the RP ID"},
+
+		// An IP address is not a domain. The browser throws SecurityError long
+		// after the server has happily issued a challenge, so it is refused here
+		// and the endpoints answer 503 instead.
+		{"http://127.0.0.1:8080", false, "an IPv4 literal"},
+		{"http://[::1]:8080", false, "an IPv6 literal"},
+		{"", false, "no address at all"},
+		{"not a url", false, "not an address"},
+	} {
+		_, err := NewWebAuthn(c.base, "verdande")
+		if c.ok && err != nil {
+			t.Errorf("NewWebAuthn(%q) refused %s: %v", c.base, c.why, err)
+		}
+		if !c.ok && err == nil {
+			t.Errorf("NewWebAuthn(%q) accepted %s, which a browser will not", c.base, c.why)
+		}
+	}
+}

internal/auth/totp.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base32"
 	"errors"
 	"fmt"
@@ -9,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/boombuler/barcode/qr"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
 )
@@ -49,6 +51,41 @@ func NewTOTPSecret(issuer, account string) (secret, uri string, err error) {
 	return key.Secret(), key.URL(), nil
 }
 
+// TOTPQRSVG renders the otpauth:// URI as a QR code, as an SVG a phone camera can
+// read. SVG rather than a PNG data URI so it stays crisp at any size and adds no
+// base64 blob to the page — one dark path on a white square, which is what a scanner
+// needs whatever theme the page is in.
+//
+// The barcode encoder is already in the module graph (pquerna/otp draws on it), so
+// this borrows a dependency rather than adding one.
+func TOTPQRSVG(uri string) (string, error) {
+	code, err := qr.Encode(uri, qr.M, qr.Auto)
+	if err != nil {
+		return "", fmt.Errorf("auth: encode totp qr: %w", err)
+	}
+	b := code.Bounds()
+	n := b.Dx()
+	// A four-module quiet zone all round, which the spec requires and scanners rely
+	// on — without it the code runs to the edge and a reader cannot find its border.
+	const quiet = 4
+	size := n + quiet*2
+
+	var sb strings.Builder
+	fmt.Fprintf(&sb, `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 %d %d" shape-rendering="crispEdges">`, size, size)
+	sb.WriteString(`<rect width="100%" height="100%" fill="#ffffff"/><path fill="#111312" d="`)
+	for y := 0; y < n; y++ {
+		for x := 0; x < n; x++ {
+			// Dark modules are black; the red channel is 0 for those and full for the
+			// light ones. One 1×1 rect per dark module, merged into a single path.
+			if r, _, _, _ := code.At(b.Min.X+x, b.Min.Y+y).RGBA(); r == 0 {
+				fmt.Fprintf(&sb, "M%d %dh1v1h-1z", x+quiet, y+quiet)
+			}
+		}
+	}
+	sb.WriteString(`"/></svg>`)
+	return sb.String(), nil
+}
+
 // TOTPURI rebuilds the otpauth:// URI for an existing secret, for showing the QR
 // code again before enrolment is confirmed.
 func TOTPURI(secret, issuer, account string) string {
@@ -82,6 +119,40 @@ func VerifyTOTP(secret, code string, now time.Time) error {
 	return nil
 }
 
+// TOTPStep verifies a code and returns the counter of the step it matched, so the
+// caller can refuse to accept the same step twice.
+//
+// ValidateCustom answers only yes or no, and "yes" for a code inside the skew
+// window is not enough to stop a replay: a code seen in flight stays valid for the
+// rest of its period, and the fix is to record which step was spent and never
+// accept that step or an earlier one again. That needs the number, so this walks
+// the same window ValidateCustom would — one step either side — and reports the
+// counter of the match. The comparison is constant time for the same reason the
+// password check is: a code is a secret being checked against a computed value.
+func TOTPStep(secret, code string, now time.Time) (int64, error) {
+	if secret == "" {
+		return 0, ErrNoTOTPSecret
+	}
+	code = strings.ReplaceAll(strings.TrimSpace(code), " ", "")
+
+	for offset := -int64(totpSkew); offset <= int64(totpSkew); offset++ {
+		at := now.Add(time.Duration(offset) * totpPeriod * time.Second)
+		want, err := totp.GenerateCodeCustom(secret, at, totp.ValidateOpts{
+			Period:    totpPeriod,
+			Skew:      0,
+			Digits:    totpDigits,
+			Algorithm: otp.AlgorithmSHA1,
+		})
+		if err != nil {
+			return 0, ErrInvalidCode
+		}
+		if subtle.ConstantTimeCompare([]byte(want), []byte(code)) == 1 {
+			return at.Unix() / totpPeriod, nil
+		}
+	}
+	return 0, ErrInvalidCode
+}
+
 // NewRecoveryCodes returns single-use codes for someone who has lost their phone,
 // and the hashes to store. Without these, losing a device means losing the account,
 // and the only fix left is editing the database by hand.

internal/auth/webauthn.go

@@ -0,0 +1,98 @@
+package auth
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+
+	"github.com/go-webauthn/webauthn/webauthn"
+)
+
+// Passkeys, wrapped so the rest of the app never touches the protocol types.
+//
+// A password and a TOTP code are both shared secrets: the server keeps something
+// that can be stolen from it, and the person keeps something that can be talked
+// out of them. A passkey is neither. The private half never leaves the device, and
+// the signature is bound to the origin that asked for it — so a convincing copy of
+// the sign-in page at another address gets a signature it cannot use.
+//
+// That binding is also the one thing that can be got wrong here, and it is
+// invisible when it is: the RP ID has to be the registrable domain of the address
+// people actually visit. Get it wrong and registration works, login works on your
+// machine, and everybody behind a different hostname is quietly locked out.
+
+// WebAuthn is the relying party — this instance, as an authenticator sees it.
+type WebAuthn struct{ *webauthn.WebAuthn }
+
+// NewWebAuthn derives the relying party from the instance's own base URL.
+//
+// Derived rather than configured, because a second setting that has to agree with
+// VERDANDE_BASE_URL is a second setting that will one day disagree with it — and
+// the failure is a login that cannot be completed, reported as "the button does
+// nothing".
+func NewWebAuthn(baseURL, displayName string) (*WebAuthn, error) {
+	parsed, err := url.Parse(strings.TrimSpace(baseURL))
+	if err != nil || parsed.Host == "" {
+		return nil, fmt.Errorf("auth: %q is not a usable base URL for passkeys", baseURL)
+	}
+
+	// The RP ID is the host without the port. A port in it is rejected by every
+	// browser, and localhost:5173 during development is exactly where somebody
+	// would first put one.
+	rpID := parsed.Hostname()
+
+	// An IP address is not a domain, and no browser will accept one as an RP ID —
+	// `SecurityError: This is an invalid domain`, thrown in the browser, long after
+	// the server has happily issued a challenge. Refused here instead, so the
+	// endpoints answer 503 and the interface never offers a button that cannot
+	// work. `localhost` is the exception every browser makes, and it is what
+	// development runs on.
+	if ip := net.ParseIP(rpID); ip != nil {
+		return nil, fmt.Errorf(
+			"auth: passkeys need a domain name, and %q is an IP address — "+
+				"set VERDANDE_BASE_URL to the address people actually visit", rpID)
+	}
+
+	w, err := webauthn.New(&webauthn.Config{
+		RPID:          rpID,
+		RPDisplayName: displayName,
+		// The origin is the full scheme://host:port, which is what the browser
+		// sends and what the signature is checked against.
+		RPOrigins: []string{strings.TrimSuffix(parsed.Scheme+"://"+parsed.Host, "/")},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("auth: passkeys: %w", err)
+	}
+	return &WebAuthn{w}, nil
+}
+
+// A PasskeyUser is what the library needs to know about an account.
+//
+// The handle is the account id rather than anything a person chose. It is written
+// into the credential on the device and cannot be changed afterwards, so it must
+// not be an email address: changing your email would orphan every key you own.
+type PasskeyUser struct {
+	ID          string
+	Email       string
+	Name        string
+	Credentials []webauthn.Credential
+}
+
+func (u *PasskeyUser) WebAuthnID() []byte                         { return []byte(u.ID) }
+func (u *PasskeyUser) WebAuthnName() string                       { return u.Email }
+func (u *PasskeyUser) WebAuthnDisplayName() string                { return u.Name }
+func (u *PasskeyUser) WebAuthnCredentials() []webauthn.Credential { return u.Credentials }
+
+// EncodeCredentialID renders a credential id for storage and for a URL. Raw bytes
+// go in a BLOB well enough, but the id is also compared against what the browser
+// sends back as base64url, and one encoding on both sides is one thing to be
+// wrong about.
+func EncodeCredentialID(raw []byte) string {
+	return base64.RawURLEncoding.EncodeToString(raw)
+}
+
+func DecodeCredentialID(encoded string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(encoded)
+}

internal/beacon/beacon.go

@@ -0,0 +1,139 @@
+// Package beacon answers one question for the project, and refuses to answer any
+// other: how many installations are out there.
+//
+// It sends two values once a day — an anonymous id the installation made up for
+// itself, and the version it is running — and nothing else. No IP is stored by
+// the collector, no hostname, no domain, no account, no usage. The payload is
+// small enough to be printed in full on the settings page, and it is, because a
+// promise about telemetry is worth exactly as much as the reader's ability to
+// check it.
+//
+// # On by default, and off in one click
+//
+// The alternative that was asked for first was mandatory, and the argument
+// against it is practical rather than principled: it cannot be enforced. The
+// domain can be blocked, the binary can be patched, and a fork removes it in its
+// first commit — so mandatory buys nothing over on-by-default, while costing the
+// trust the rest of this program works for. Secrets are sealed here, the key is
+// kept out of the database, and the backup page warns you what a copy contains.
+// Telemetry you are not allowed to refuse is the one sentence in that story that
+// does not fit.
+//
+// So: on by default, said plainly, one switch to turn it off. That collects
+// essentially the same number and leaves nobody feeling tricked.
+//
+// # Where this disagrees with the rest of the program
+//
+// `config.UpdateCheck` is off unless asked for, and its comment gives the reason:
+// "a self-hosted app that reaches out without being told to has broken the deal
+// its operator made by self-hosting." That is the same situation as this one, and
+// the two defaults do not agree.
+//
+// The disagreement is written down here rather than smoothed over, because it is
+// a real one and the reader deserves to see both halves. The case for treating
+// them differently is that the update check reveals an instance to a third party
+// (GitHub) and returns something the operator can act on, while this returns
+// nothing and goes to the project itself — and that a count nobody sends is a
+// count that does not exist, whereas an update nobody checks for is one you can
+// still go and look up. Whether that is a distinction or an excuse is a judgement
+// call, and it was made deliberately by the person whose instance this is.
+//
+// If it is ever decided the other way, the change is one word: the default in
+// `beaconSettings`. Nothing else in this package assumes which way it points.
+//
+// # What the collector can still see
+//
+// A request has a source address whether or not anybody writes it down. The
+// collector does not store or log it, and the code is arranged so that it never
+// reaches a function that could — but it passes through a reverse proxy and a
+// tunnel on the way, and those keep their own logs. Saying "we send no IP" would
+// be a half-truth; what is true is that nothing here records one.
+package beacon
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"time"
+)
+
+// DefaultCollector is where a fresh installation reports, unless it is told
+// otherwise. Somebody running their own fleet points it at their own instance;
+// the field is on the settings page for exactly that.
+const DefaultCollector = "https://verdande.yggdrasilpanel.com/api/v1/beacon"
+
+// Payload is the entire message. Two fields, and adding a third is a change to
+// what this program promises, not a change to a struct.
+type Payload struct {
+	InstanceID string `json:"instance_id"`
+	Version    string `json:"version"`
+}
+
+// InstanceID and Version are checked on the way in as well as written on the way
+// out, because the collector's endpoint is unauthenticated: anything that reaches
+// it is a stranger's bytes, and it should be able to store only the two shapes it
+// expects.
+var (
+	idShape      = regexp.MustCompile(`^[0-9a-fA-F-]{16,64}$`)
+	versionShape = regexp.MustCompile(`^v?[0-9]{1,4}(\.[0-9]{1,5}){0,3}(-[0-9A-Za-z.]{1,20})?$`)
+)
+
+// ValidID reports whether an id is the shape this program writes.
+func ValidID(s string) bool { return idShape.MatchString(s) }
+
+// ValidVersion allows a version number and the word this binary uses when it was
+// built outside a release.
+func ValidVersion(s string) bool { return s == "dev" || versionShape.MatchString(s) }
+
+// Send delivers one ping. It is deliberately dull: a short timeout, no retry, no
+// queue, and a failure that is returned rather than made anybody's problem.
+//
+// No retry, because the next pass is tomorrow and a missed day changes a count of
+// installations by nothing. A telemetry ping that retries is a telemetry ping
+// that can hammer somebody's server on the day it is down.
+func Send(ctx context.Context, client *http.Client, collector string, p Payload) error {
+	if !ValidID(p.InstanceID) {
+		return fmt.Errorf("beacon: refusing to send a malformed id")
+	}
+	// Versionen kontrolleres også her, ikke kun hos modtageren. Kommentaren ved
+	// mønstrene lovede begge veje, og gjorde det ikke — og en installation, der
+	// sender noget mærkeligt, skal opdage det hos sig selv frem for at være noget,
+	// en fremmed collector skal filtrere fra.
+	if !ValidVersion(p.Version) {
+		return fmt.Errorf("beacon: refusing to send a malformed version")
+	}
+	body, err := json.Marshal(p)
+	if err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, collector, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	// A plain user agent with the version already in the payload. Nothing is
+	// learned from it that the body does not already say, and it makes the request
+	// legible in a log rather than anonymous-looking.
+	req.Header.Set("User-Agent", "verdande-beacon/1")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	// Read and discard, so the connection can be reused rather than dropped.
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4<<10))
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("beacon: collector answered %d", resp.StatusCode)
+	}
+	return nil
+}

internal/beacon/beacon_test.go

@@ -0,0 +1,114 @@
+package beacon
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// Hvad der bliver sendt, tegn for tegn.
+//
+// Prøven er skrevet imod *hele* kroppen og ikke imod enkelte felter, fordi det er
+// den, der er løftet: siden siger "præcis det her og ikke mere", og et felt lagt
+// til senere skal vælte noget. En prøve, der kun så efter, at instance_id var med,
+// ville lade en ny nøgle glide igennem uden at nogen opdagede det.
+func TestSendsExactlyTwoFields(t *testing.T) {
+	var got map[string]any
+	var contentType string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		contentType = r.Header.Get("Content-Type")
+		body, _ := io.ReadAll(r.Body)
+		if err := json.Unmarshal(body, &got); err != nil {
+			t.Errorf("kroppen er ikke JSON: %v", err)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "01a01b16-4e54-7000-9eaa-2f8eb0629c3a",
+		Version:    "v0.26.3",
+	})
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	if contentType != "application/json" {
+		t.Errorf("Content-Type = %q", contentType)
+	}
+	if len(got) != 2 {
+		t.Fatalf("der blev sendt %d felter, ikke to: %v", len(got), got)
+	}
+	if got["instance_id"] != "01a01b16-4e54-7000-9eaa-2f8eb0629c3a" {
+		t.Errorf("instance_id = %v", got["instance_id"])
+	}
+	if got["version"] != "v0.26.3" {
+		t.Errorf("version = %v", got["version"])
+	}
+}
+
+// En collector, der er nede, er ikke denne installations problem.
+func TestSendReportsAFailureRatherThanRetrying(t *testing.T) {
+	calls := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "01a01b16-4e54-7000-9eaa-2f8eb0629c3a", Version: "v1.0.0",
+	})
+	if err == nil {
+		t.Fatal("en 500 skal give en fejl")
+	}
+	if calls != 1 {
+		t.Errorf("der blev prøvet %d gange; en telemetri-ping må ikke hamre på en server, der er nede", calls)
+	}
+}
+
+// Et id, der ikke er id-formet, sendes slet ikke — så en fejl her ikke bliver til
+// noget, en fremmed collector skal filtrere fra.
+func TestSendRefusesAMalformedID(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("der blev sendt noget, som ikke skulle sendes")
+	}))
+	defer srv.Close()
+
+	if err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "; DROP TABLE beacon_installs", Version: "v1.0.0",
+	}); err == nil {
+		t.Fatal("et misformet id skal afvises før det forlader maskinen")
+	}
+}
+
+func TestShapes(t *testing.T) {
+	ok := []string{"01a01b16-4e54-7000-9eaa-2f8eb0629c3a", "89df44d7-3742-4611-9a43-db0b07733c6d"}
+	for _, s := range ok {
+		if !ValidID(s) {
+			t.Errorf("ValidID(%q) = false", s)
+		}
+	}
+	bad := []string{"", "kort", "../../etc/passwd", "01a01b16-4e54-7000-9eaa-2f8eb0629c3a'; --",
+		"<script>alert(1)</script>"}
+	for _, s := range bad {
+		if ValidID(s) {
+			t.Errorf("ValidID(%q) = true", s)
+		}
+	}
+
+	for _, s := range []string{"v0.26.3", "0.26.3", "v1.2.3-rc.1", "dev"} {
+		if !ValidVersion(s) {
+			t.Errorf("ValidVersion(%q) = false", s)
+		}
+	}
+	for _, s := range []string{"", "v<script>", "v" + string(make([]byte, 200))} {
+		if ValidVersion(s) {
+			t.Errorf("ValidVersion(%q) = true", s)
+		}
+	}
+}

internal/config/config.go

@@ -7,6 +7,7 @@ package config
 
 import (
 	"fmt"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -33,14 +34,95 @@ type Config struct {
 	GmailClientID     string
 	GmailClientSecret string
 
+	// SecretKey seals the tokens and passwords in the database, 32 bytes of base64.
+	// Empty means a key file beside the data — see internal/secret.
+	SecretKey string
+
+	// Edition decides which half of the program this instance serves.
+	//
+	// "full" is tasks, projects and notes together — what Verdande has always
+	// been. "notes" mounts the notes half and the base underneath it, and leaves
+	// the task routes unmounted: not hidden in the interface, absent from the
+	// router, so an instance that is not a task manager cannot be asked to be one
+	// through its API.
+	//
+	// Notes already stand nearly alone — they reference no task type anywhere in
+	// the store, and the one link between the halves is a `note_links` row whose
+	// kind happens to be "task". What is NOT separable is everything underneath
+	// both: accounts, sessions, invites, sharing, notifications, attachments,
+	// search. Hence one program with two faces rather than two programs: the
+	// alternative is two copies of the base, and two copies of a thing is how the
+	// copies start to disagree.
+	//
+	// Projects stay mounted in both. In the notes edition a project is a
+	// notebook — the same column, the same sharing, a different word — because a
+	// second grouping concept beside `note_shares` would be a second thing to keep
+	// in step for a difference nobody can see.
+	Edition string
+
 	// UpdateCheck asks GitHub whether a newer release exists. Off unless asked
 	// for: a self-hosted app that reaches out without being told to has broken
 	// the deal its operator made by self-hosting.
 	UpdateCheck bool
 
+	// The Yggdrasil panel this instance runs under, so it can ask to be restarted
+	// from its own interface rather than from another browser tab.
+	//
+	// A container cannot replace its own image from the inside. Restarting is the
+	// panel's job — it recreates the container and pulls `:latest` on the way — so
+	// what this needs is a way to ask. All three are required together; any one
+	// alone cannot do anything.
+	//
+	// The token is a panel credential with control over that server. Anybody who
+	// can read this environment can restart it, which is true of anybody with the
+	// host anyway. It is never sent to a browser: the settings page is told only
+	// whether it is set.
+	// GmailSyncBudget bounds one "fetch now", well under whatever proxy sits in
+	// front of this server. Configurable so a test can prove the budget is applied
+	// without spending the real one on every run.
+	GmailSyncBudget time.Duration
+
+	// CalendarSyncBudget is the same bound for one calendar refresh, and exists for
+	// the same reason: a slow Google held the request open past what Cloudflare is
+	// willing to wait, and the browser got Cloudflare's HTML instead of an error
+	// this server could explain.
+	CalendarSyncBudget time.Duration
+
+	// Where Google is. Empty in production; a test points them at a server it
+	// controls, which is the only way to exercise a Google that is slow or refuses.
+	// The token endpoint is shared — Gmail and Calendar sign in through the same
+	// registration — and the two APIs are not.
+	GoogleTokenURL string
+	GmailAPIURL    string
+	CalendarAPIURL string
+
+	PanelURL      string
+	PanelToken    string
+	PanelServerID string
+
 	// TrashRetention is how long a soft-deleted task or project stays recoverable.
 	TrashRetention time.Duration
 
+	// TrustedProxies are the peers whose forwarded-for header may be believed.
+	//
+	// The rate limiter and the audit log key on the caller's address, and that
+	// address is only as honest as wherever it was read. Read it from a header that
+	// anybody can set, and an attacker rotates it to get a fresh guess-bucket for
+	// every request and to write someone else's IP into the log. So the header is
+	// believed only when the machine that *connected* is one of these — a reverse
+	// proxy or tunnel the operator put there — and ignored when the connection came
+	// straight off the internet.
+	//
+	// The default is "the peer is on a private network", which is exactly the shape
+	// of a homelab behind Caddy, nginx or a Cloudflare Tunnel: the proxy shares the
+	// host or the docker bridge, so its address is loopback or RFC1918. A directly
+	// exposed instance sees a public peer, trusts nothing, and keys on the real
+	// connection. Override with VERDANDE_TRUSTED_PROXIES (comma-separated CIDRs),
+	// or "none" to trust no proxy at all.
+	TrustedProxies []netip.Prefix
+	// RealIPHeader is where the client address is read from, for a trusted peer.
+	RealIPHeader string
+
 	Dev bool
 }
 
@@ -68,9 +150,16 @@ func Load() (*Config, error) {
 		TrashRetention: 30 * 24 * time.Hour,
 		Dev:            envBool("VERDANDE_DEV", false),
 
-		GmailClientID:     env("VERDANDE_GMAIL_CLIENT_ID", ""),
-		GmailClientSecret: env("VERDANDE_GMAIL_CLIENT_SECRET", ""),
-		UpdateCheck:       envBool("VERDANDE_UPDATE_CHECK", false),
+		GmailClientID:      env("VERDANDE_GMAIL_CLIENT_ID", ""),
+		GmailSyncBudget:    25 * time.Second,
+		CalendarSyncBudget: 25 * time.Second,
+		PanelURL:           strings.TrimSuffix(env("VERDANDE_PANEL_URL", ""), "/"),
+		PanelToken:         env("VERDANDE_PANEL_TOKEN", ""),
+		PanelServerID:      env("VERDANDE_PANEL_SERVER_ID", ""),
+		GmailClientSecret:  env("VERDANDE_GMAIL_CLIENT_SECRET", ""),
+		SecretKey:          env("VERDANDE_SECRET_KEY", ""),
+		Edition:            env("VERDANDE_EDITION", EditionFull),
+		UpdateCheck:        envBool("VERDANDE_UPDATE_CHECK", false),
 	}
 
 	var err error
@@ -104,9 +193,83 @@ func Load() (*Config, error) {
 	if c.DataDir, err = filepath.Abs(c.DataDir); err != nil {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
+
+	// Afvist frem for gætte. En stavefejl — "note", "Notes" — ville ellers falde
+	// tilbage til den fulde udgave og servere opgaveruterne på en instans, der
+	// blev sat op for ikke at have dem. Det er den stille retning af fejlen, og
+	// den eneste måde at opdage den på ville være at bemærke, at noget virker,
+	// som ikke burde.
+	switch c.Edition {
+	case EditionFull, EditionNotes:
+	case "":
+		c.Edition = EditionFull
+	default:
+		return nil, fmt.Errorf("VERDANDE_EDITION: %q is not %q or %q", c.Edition, EditionFull, EditionNotes)
+	}
+
+	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
+	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
+		return nil, err
+	}
 	return c, nil
 }
 
+// defaultTrustedProxies is "the peer is not on the public internet": loopback,
+// the three RFC1918 ranges, Tailscale's CGNAT borrow, IPv6 unique-local and both
+// families' link-local. A proxy an operator stands up in front of this server is
+// on one of these; a stranger connecting directly is on none.
+var defaultTrustedProxies = mustPrefixes(
+	"127.0.0.0/8", "::1/128",
+	"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+	"100.64.0.0/10",
+	"fc00::/7",
+	"169.254.0.0/16", "fe80::/10",
+)
+
+// parseTrustedProxies reads the override. Empty keeps the private-network default;
+// the literal "none" trusts no proxy at all, for an instance that is exposed
+// directly and must never believe a forwarded header.
+func parseTrustedProxies(raw string) ([]netip.Prefix, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return defaultTrustedProxies, nil
+	}
+	if strings.EqualFold(raw, "none") {
+		return nil, nil
+	}
+	var out []netip.Prefix
+	for _, part := range strings.Split(raw, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		// A bare address is a host route: 10.0.0.5 means 10.0.0.5/32, so an operator
+		// naming one proxy does not have to know CIDR notation to do it.
+		if !strings.Contains(part, "/") {
+			addr, err := netip.ParseAddr(part)
+			if err != nil {
+				return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not an address or CIDR", part)
+			}
+			out = append(out, netip.PrefixFrom(addr, addr.BitLen()))
+			continue
+		}
+		p, err := netip.ParsePrefix(part)
+		if err != nil {
+			return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not a CIDR", part)
+		}
+		out = append(out, p.Masked())
+	}
+	return out, nil
+}
+
+func mustPrefixes(cidrs ...string) []netip.Prefix {
+	out := make([]netip.Prefix, 0, len(cidrs))
+	for _, c := range cidrs {
+		out = append(out, netip.MustParsePrefix(c))
+	}
+	return out
+}
+
 // DBPath, FilesDir and BackupsDir are the three things that live on the /data volume.
 func (c *Config) DBPath() string     { return filepath.Join(c.DataDir, "verdande.db") }
 func (c *Config) FilesDir() string   { return filepath.Join(c.DataDir, "files") }
@@ -117,6 +280,15 @@ func (c *Config) BackupsDir() string { return filepath.Join(c.DataDir, "backups"
 // configured separately and left to drift out of step with it.
 func (c *Config) GmailRedirectURL() string { return c.BaseURL + "/oauth/gmail/callback" }
 
+// CalendarRedirectURL is a second registered URI rather than a reuse of Gmail's.
+//
+// One callback that decided from server-side state which of the two flows had come
+// back would save the operator one line in Google Cloud, and would put the choice
+// of *which token store to write* behind a lookup. When that goes wrong it goes
+// wrong by overwriting a working Gmail connection with calendar tokens — a failure
+// nobody would think to look for. Two paths cannot do that.
+func (c *Config) CalendarRedirectURL() string { return c.BaseURL + "/oauth/calendar/callback" }
+
 func env(key, def string) string {
 	if v, ok := os.LookupEnv(key); ok && v != "" {
 		return v

internal/config/edition.go

@@ -0,0 +1,46 @@
+package config
+
+// The two faces of the program. Strings rather than a bool, because a bool named
+// `NotesOnly` answers one question and this one will be asked again — and a
+// third edition would mean changing every reading of it rather than adding a case.
+const (
+	EditionFull  = "full"
+	EditionNotes = "notes"
+)
+
+// NotesOnly is the one question the router asks. Written as a method so the
+// comparison lives in one place: `cfg.Edition == "notes"` spelled out at twenty
+// call sites is twenty chances to typo a string the compiler does not check.
+func (c *Config) NotesOnly() bool { return c.Edition == EditionNotes }
+
+// ProductName and ProductSlug are the two forms of the name the running instance
+// calls itself: "Urd" in a sentence, "urd" in a window title, a wordmark and a
+// manifest.
+//
+// Two editions of one program, two names — which is the whole reason the name is
+// read from the configuration rather than written into the templates. Verdande is
+// what is happening now; Urd, its sister in Völuspá, is what was cut into the wood
+// and kept. An instance started without the task routes is a different product to
+// whoever uses it, and a product that calls itself by its sibling's name is not a
+// product, it is a flag somebody set.
+//
+// The lowercase form is deliberate and not a styling accident: the wordmark, the
+// repository and the window title are all lowercase, so the slug is the name and
+// ProductName is the one that gets a capital because it stands in prose.
+func (c *Config) ProductName() string {
+	if c.NotesOnly() {
+		return "Urd"
+	}
+	return "Verdande"
+}
+
+// ProductSlug is ProductName lowercased, kept as its own method rather than as
+// strings.ToLower at the call sites: the two are the same transformation today and
+// a name that does not lowercase cleanly would otherwise be a bug in every caller
+// at once.
+func (c *Config) ProductSlug() string {
+	if c.NotesOnly() {
+		return "urd"
+	}
+	return "verdande"
+}

internal/config/edition_test.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"testing"
+)
+
+// A typo in VERDANDE_EDITION must stop the program, not fall through to the full
+// edition. That is the silent direction of this fault: an instance set up to be a
+// notes program would serve every task route, and the only way to notice would be
+// to spot that something works which should not.
+func TestUnknownEditionIsRefused(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  string // the edition we expect, or "" when Load must fail
+	}{
+		{"", EditionFull}, // unset is the full program, as it has always been
+		{EditionFull, EditionFull},
+		{EditionNotes, EditionNotes},
+		{"note", ""},  // a letter short
+		{"Notes", ""}, // the right word, the wrong case
+		{"none", ""},  // plausible and meaning nothing
+	} {
+		t.Setenv("VERDANDE_EDITION", tc.value)
+		t.Setenv("VERDANDE_DATA_DIR", t.TempDir())
+
+		got, err := Load()
+		if tc.want == "" {
+			if err == nil {
+				t.Errorf("VERDANDE_EDITION=%q was accepted and gave %q", tc.value, got.Edition)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("VERDANDE_EDITION=%q: %v", tc.value, err)
+			continue
+		}
+		if got.Edition != tc.want {
+			t.Errorf("VERDANDE_EDITION=%q gave %q, want %q", tc.value, got.Edition, tc.want)
+		}
+		if notes := got.NotesOnly(); notes != (tc.want == EditionNotes) {
+			t.Errorf("VERDANDE_EDITION=%q: NotesOnly() = %v", tc.value, notes)
+		}
+	}
+}

internal/filterquery/filterquery.go

@@ -60,6 +60,20 @@ func Parse(query string, ctx Context) (Compiled, error) {
 	if len(p.tokens) == 0 {
 		return Compiled{}, fmt.Errorf("filteret er tomt")
 	}
+	// Refused before it is parsed, not while.
+	//
+	// `combine` rebuilds the whole accumulated SQL string and re-copies the
+	// argument slice per operator, so the cost is quadratic in the number of
+	// terms: fifty thousand of them — three hundred kilobytes, which fits in a
+	// query string — took seven seconds of CPU and forty-six gigabytes of
+	// allocation in one request. The preview endpoint runs this on whatever is
+	// typed, and there is no write timeout on the server to cut it off.
+	//
+	// Two hundred terms is a filter nobody has ever written and far below where it
+	// costs anything.
+	if len(p.tokens) > maxTokens {
+		return Compiled{}, fmt.Errorf("filteret er for langt")
+	}
 
 	node, err := p.parseExpression()
 	if err != nil {
@@ -140,10 +154,19 @@ func isOperator(r rune) bool {
 
 // --- parser -------------------------------------------------------------------
 
+// The ceilings on one filter. See Parse for why.
+const (
+	maxTokens = 200
+	maxDepth  = 32
+)
+
 type parser struct {
 	tokens []token
 	pos    int
 	ctx    Context
+	// depth guards against a filter that is only parentheses. Each level is a
+	// stack frame, and nothing else stops somebody sending a megabyte of them.
+	depth int
 }
 
 func (p *parser) done() bool  { return p.pos >= len(p.tokens) }
@@ -187,6 +210,13 @@ func (p *parser) parseTerm() (Compiled, error) {
 	if p.done() {
 		return Compiled{}, fmt.Errorf("filteret slutter midt i et udtryk")
 	}
+	// Nesting is stack depth. A filter made of half a million opening parentheses
+	// is a megabyte of text and a stack frame for each.
+	p.depth++
+	defer func() { p.depth-- }()
+	if p.depth > maxDepth {
+		return Compiled{}, fmt.Errorf("filteret har for mange niveauer")
+	}
 
 	switch t := p.peek(); t.kind {
 	case tokNot:

internal/gcal/gcal.go

@@ -0,0 +1,339 @@
+// Package gcal reads a Google Calendar. It never writes one.
+//
+// The scope is calendar.readonly, and that is the whole of the decision: verdande
+// already is a CalDAV server, so a Google event shown here is a second calendar
+// laid over the first, not a copy Google and verdande now both have to agree
+// about. Writing needs `calendar.events`, and it needs an answer to what happens
+// when both sides moved the same meeting — which is a synchronisation model, not a
+// scope. Read first; write later and to one calendar at a time.
+//
+// What the API gives back and what this returns are deliberately different shapes.
+// Google answers with RFC 3339 instants for a timed event and bare dates for an
+// all-day one, and with an *exclusive* end date for the second. A calendar grid
+// asks one question — "which cells does this event cover" — so that is what an
+// Event answers, in days, worked out once here rather than in every caller.
+package gcal
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/google"
+)
+
+// Scope is read-only, and only the calendar.
+//
+// Google also offers calendar.calendarlist.readonly and calendar.events.readonly,
+// which together are strictly less than this — they leave out access rules and
+// account settings, which verdande has no use for. They are the tighter pair and
+// worth moving to; they are also newer, and this one has been documented and
+// accepted unchanged for a decade. A consent screen that fails with `invalid_scope`
+// is not a place to be adventurous on somebody else's Google account.
+const Scope = "https://www.googleapis.com/auth/calendar.readonly"
+
+const defaultAPIBase = "https://www.googleapis.com/calendar/v3"
+
+// The OAuth flow, which is Google's rather than the calendar's — the same one
+// Gmail signs in through, asking for the scope above. Aliased so a caller reads
+// one package for one feature.
+type (
+	Config = google.Config
+	PKCE   = google.PKCE
+	Token  = google.Token
+)
+
+var NewPKCE = google.NewPKCE
+
+// ErrUnauthorized means the tokens are no longer good — access was revoked, or the
+// password changed. Re-exported so a caller need not know the flow lives elsewhere.
+var ErrUnauthorized = google.ErrUnauthorized
+
+type Client struct {
+	accessToken string
+	// base is where the Calendar API is. A field rather than a constant so a test
+	// can point it at a server it controls; empty is Google. There is no other way
+	// to exercise a calendar that is slow, empty, or refuses.
+	base string
+	http *http.Client
+}
+
+func NewClient(accessToken string) *Client {
+	return &Client{accessToken: accessToken, http: &http.Client{Timeout: 30 * time.Second}}
+}
+
+// At points the client at another server. Tests only; the zero value is Google.
+func (c *Client) At(base string) *Client {
+	c.base = base
+	return c
+}
+
+func (c *Client) api() string {
+	if c.base != "" {
+		return c.base
+	}
+	return defaultAPIBase
+}
+
+// Calendar is one entry in the person's calendar list.
+type Calendar struct {
+	ID string
+	// Name is the summary Google holds. A calendar somebody renamed for themselves
+	// carries summaryOverride instead, and that is the name they will look for.
+	Name string
+	// Colour is Google's own hex value for the calendar, which is what makes two
+	// calendars in one grid tellable apart. Their own colour rather than one picked
+	// here: it is the colour they already know the calendar by.
+	Colour   string
+	TimeZone string
+	Primary  bool
+	// Owner means the connected account can write to it. Nothing writes today —
+	// it is stored so the day something does, the interface knows which calendars
+	// could even be offered.
+	Owner bool
+}
+
+// Calendars lists what the connected account can see.
+func (c *Client) Calendars(ctx context.Context) ([]Calendar, error) {
+	var out []Calendar
+	page := ""
+	// Bounded rather than "until Google stops": a page token that never empties is
+	// a loop that never ends, and the difference between a bug at Google and a
+	// hung sync should not be this server hanging.
+	for range 10 {
+		v := url.Values{}
+		v.Set("minAccessRole", "reader")
+		v.Set("maxResults", "250")
+		if page != "" {
+			v.Set("pageToken", page)
+		}
+
+		var parsed struct {
+			Items []struct {
+				ID              string `json:"id"`
+				Summary         string `json:"summary"`
+				SummaryOverride string `json:"summaryOverride"`
+				BackgroundColor string `json:"backgroundColor"`
+				TimeZone        string `json:"timeZone"`
+				Primary         bool   `json:"primary"`
+				AccessRole      string `json:"accessRole"`
+				Deleted         bool   `json:"deleted"`
+			} `json:"items"`
+			NextPageToken string `json:"nextPageToken"`
+		}
+		if err := c.get(ctx, c.api()+"/users/me/calendarList?"+v.Encode(), &parsed); err != nil {
+			return nil, err
+		}
+
+		for _, item := range parsed.Items {
+			if item.Deleted {
+				continue
+			}
+			name := item.SummaryOverride
+			if name == "" {
+				name = item.Summary
+			}
+			out = append(out, Calendar{
+				ID: item.ID, Name: name, Colour: item.BackgroundColor,
+				TimeZone: item.TimeZone, Primary: item.Primary,
+				Owner: item.AccessRole == "owner" || item.AccessRole == "writer",
+			})
+		}
+		if parsed.NextPageToken == "" {
+			break
+		}
+		page = parsed.NextPageToken
+	}
+	return out, nil
+}
+
+// Event is one occurrence, in the shape a calendar grid asks about.
+type Event struct {
+	ID      string
+	Summary string
+	// StartsAt and EndsAt are RFC 3339 for a timed event and empty for an all-day
+	// one — an all-day event has no instant, only a day, and inventing midnight for
+	// it is how an event moves a day every time a server changes time zone.
+	StartsAt string
+	EndsAt   string
+	// StartDay and EndDay are the first and last day the event covers, inclusive at
+	// both ends. Google's all-day end date is exclusive; that is corrected here,
+	// once, rather than in every reader.
+	StartDay string
+	EndDay   string
+	AllDay   bool
+	Location string
+	// URL opens the event in Google's own interface. Same reasoning as the Gmail
+	// link on a task made from a mail: what verdande shows is a pointer to the
+	// event, not a second copy of it that somebody could try to edit.
+	URL string
+}
+
+// Events lists what falls inside a window, one calendar at a time.
+//
+// `singleEvents` expands a recurrence into its occurrences, which is the only form
+// a grid can draw: an RRULE is an instruction, and a Tuesday cell needs the Tuesday
+// it produced. It also means verdande does not have to grow a second recurrence
+// engine that agrees with Google's about Danish summer time.
+//
+// from and to are dates, inclusive. The window is the caller's business; this
+// turns it into the half-open interval Google wants.
+func (c *Client) Events(ctx context.Context, calendarID, from, to string) ([]Event, error) {
+	start, err := time.Parse(dateLayout, from)
+	if err != nil {
+		return nil, fmt.Errorf("gcal: from: %w", err)
+	}
+	end, err := time.Parse(dateLayout, to)
+	if err != nil {
+		return nil, fmt.Errorf("gcal: to: %w", err)
+	}
+
+	var out []Event
+	page := ""
+	for range 20 {
+		v := url.Values{}
+		v.Set("singleEvents", "true")
+		v.Set("orderBy", "startTime")
+		v.Set("maxResults", "2500")
+		// UTC, and a day of slack at each end. An event at 23:30 on the last day in
+		// Copenhagen is 21:30 UTC that day, but one at 00:30 on the first day is
+		// 22:30 UTC the day *before* — so a window cut exactly at the requested
+		// dates loses the events at both edges. The extra day is thrown away again
+		// by the day fields below, which are computed from the event's own offset.
+		v.Set("timeMin", start.AddDate(0, 0, -1).Format(time.RFC3339))
+		v.Set("timeMax", end.AddDate(0, 0, 2).Format(time.RFC3339))
+		if page != "" {
+			v.Set("pageToken", page)
+		}
+
+		var parsed struct {
+			Items         []rawEvent `json:"items"`
+			NextPageToken string     `json:"nextPageToken"`
+		}
+		url := c.api() + "/calendars/" + url.PathEscape(calendarID) + "/events?" + v.Encode()
+		if err := c.get(ctx, url, &parsed); err != nil {
+			return nil, err
+		}
+
+		for _, item := range parsed.Items {
+			// A cancelled occurrence of a recurring event still comes back, so that
+			// a client keeping its own copy knows to drop it. verdande replaces the
+			// window wholesale, so it only has to not add it.
+			if item.Status == "cancelled" {
+				continue
+			}
+			event, ok := item.event()
+			if !ok {
+				continue
+			}
+			if event.EndDay < from || event.StartDay > to {
+				continue // the slack above, thrown away
+			}
+			out = append(out, event)
+		}
+		if parsed.NextPageToken == "" {
+			break
+		}
+		page = parsed.NextPageToken
+	}
+	return out, nil
+}
+
+const dateLayout = "2006-01-02"
+
+type rawEvent struct {
+	ID       string `json:"id"`
+	Status   string `json:"status"`
+	Summary  string `json:"summary"`
+	Location string `json:"location"`
+	HTMLLink string `json:"htmlLink"`
+	Start    when   `json:"start"`
+	End      when   `json:"end"`
+}
+
+type when struct {
+	Date     string `json:"date"`
+	DateTime string `json:"dateTime"`
+}
+
+// event turns Google's two shapes into the one a grid can read.
+//
+// The second return is false for an event with neither a date nor a dateTime —
+// which Google does return, for an event somebody is still being asked about. It
+// belongs on no day, so there is no cell to draw it in.
+func (r rawEvent) event() (Event, bool) {
+	e := Event{
+		ID: r.ID, Summary: strings.TrimSpace(r.Summary),
+		Location: r.Location, URL: r.HTMLLink,
+	}
+	if e.Summary == "" {
+		// Google's own interface says this for an event with no title, and a blank
+		// chip in a grid reads as a rendering fault rather than as an empty title.
+		e.Summary = "(uden titel)"
+	}
+
+	switch {
+	case r.Start.Date != "":
+		e.AllDay = true
+		e.StartDay = r.Start.Date
+		// Google's all-day end is the day *after* the last one, so a one-day event
+		// ends tomorrow. Subtracting a day is what makes "covers this cell" a
+		// comparison rather than a special case at every call site.
+		e.EndDay = r.Start.Date
+		if day, err := time.Parse(dateLayout, r.End.Date); err == nil {
+			if last := day.AddDate(0, 0, -1); !last.Before(mustDay(r.Start.Date)) {
+				e.EndDay = last.Format(dateLayout)
+			}
+		}
+	case r.Start.DateTime != "":
+		e.StartsAt = r.Start.DateTime
+		e.EndsAt = r.End.DateTime
+		// The day is the date part of the timestamp Google returned, which carries
+		// the event's own offset. Parsing it into a time.Time and formatting it
+		// back would ask *this process* what day it is — and a container running in
+		// UTC would then move a 23:30 meeting in Copenhagen to the day before.
+		e.StartDay = dayOf(r.Start.DateTime)
+		e.EndDay = dayOf(r.End.DateTime)
+		if e.EndDay == "" {
+			e.EndDay = e.StartDay
+		}
+		// An event ending at midnight ends the evening before, as far as a grid is
+		// concerned. Without this, every meeting that runs to 24:00 puts a chip in
+		// the following day as well.
+		if e.EndDay > e.StartDay && strings.Contains(r.End.DateTime, "T00:00:00") {
+			if day, err := time.Parse(dateLayout, e.EndDay); err == nil {
+				e.EndDay = day.AddDate(0, 0, -1).Format(dateLayout)
+			}
+		}
+	default:
+		return Event{}, false
+	}
+	if e.EndDay < e.StartDay {
+		e.EndDay = e.StartDay
+	}
+	return e, true
+}
+
+// dayOf takes the date out of an RFC 3339 timestamp without interpreting it.
+func dayOf(stamp string) string {
+	if len(stamp) < len(dateLayout) {
+		return ""
+	}
+	day := stamp[:len(dateLayout)]
+	if _, err := time.Parse(dateLayout, day); err != nil {
+		return ""
+	}
+	return day
+}
+
+func mustDay(s string) time.Time {
+	day, _ := time.Parse(dateLayout, s)
+	return day
+}
+
+func (c *Client) get(ctx context.Context, url string, out any) error {
+	return google.Get(ctx, c.http, c.accessToken, url, out)
+}

internal/gcal/gcal_test.go

@@ -0,0 +1,255 @@
+package gcal
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// fakeGoogle answers the two calls this package makes, out of whatever the test
+// hands it. There is no other way to exercise this: the real Calendar needs an
+// account, a registered client and somebody's consent, and none of the three can be
+// had inside a test — so the shapes Google returns are written down here and the
+// parsing is checked against them.
+func fakeGoogle(t *testing.T, calendarList any, events map[string]any) *Client {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch {
+		case strings.HasPrefix(r.URL.Path, "/users/me/calendarList"):
+			_ = json.NewEncoder(w).Encode(calendarList)
+		case strings.HasPrefix(r.URL.Path, "/calendars/"):
+			id := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/calendars/"), "/events")
+			body, ok := events[id]
+			if !ok {
+				http.Error(w, `{"error":"not found"}`, http.StatusNotFound)
+				return
+			}
+			_ = json.NewEncoder(w).Encode(body)
+		default:
+			http.Error(w, "unexpected path "+r.URL.Path, http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return NewClient("token").At(srv.URL)
+}
+
+func TestCalendarsPrefersTheNameThePersonGaveIt(t *testing.T) {
+	client := fakeGoogle(t, map[string]any{
+		"items": []map[string]any{
+			{"id": "primary", "summary": "[email protected]", "backgroundColor": "#3f51b5",
+				"timeZone": "Europe/Copenhagen", "primary": true, "accessRole": "owner"},
+			{"id": "fam", "summary": "Family", "summaryOverride": "Familien",
+				"backgroundColor": "#0b8043", "accessRole": "reader"},
+			// A calendar removed from the list still arrives, flagged.
+			{"id": "gone", "summary": "Væk", "deleted": true, "accessRole": "reader"},
+		},
+	}, nil)
+
+	got, err := client.Calendars(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d calendars, want 2 — a deleted one is not one you can show", len(got))
+	}
+	if got[1].Name != "Familien" {
+		t.Errorf("name = %q; summaryOverride is the name the person will look for", got[1].Name)
+	}
+	if !got[0].Primary || !got[0].Owner {
+		t.Errorf("the primary calendar came back as %+v", got[0])
+	}
+	if got[1].Owner {
+		t.Error("a reader was reported as an owner; nothing may offer to write to it")
+	}
+	if got[0].Colour != "#3f51b5" {
+		t.Errorf("colour = %q; two calendars in one grid are told apart by it", got[0].Colour)
+	}
+}
+
+// The three shapes an event arrives in, and the one shape a grid can read.
+func TestEventsBecomeDaysAGridCanAskAbout(t *testing.T) {
+	client := fakeGoogle(t, nil, map[string]any{
+		"primary": map[string]any{
+			"items": []map[string]any{
+				{
+					"id": "timed", "summary": "Bestyrelsesmøde", "htmlLink": "https://cal/1",
+					"start": map[string]string{"dateTime": "2026-08-20T14:00:00+02:00"},
+					"end":   map[string]string{"dateTime": "2026-08-20T15:30:00+02:00"},
+				},
+				{
+					// All-day, one day. Google's end is the day after.
+					"id": "allday", "summary": "Fridag",
+					"start": map[string]string{"date": "2026-08-21"},
+					"end":   map[string]string{"date": "2026-08-22"},
+				},
+				{
+					// All-day, three days.
+					"id": "trip", "summary": "Aarhus",
+					"start": map[string]string{"date": "2026-08-24"},
+					"end":   map[string]string{"date": "2026-08-27"},
+				},
+				{
+					// Runs to midnight, which is the evening before as far as a
+					// grid is concerned.
+					"id": "late", "summary": "Nattevagt",
+					"start": map[string]string{"dateTime": "2026-08-22T20:00:00+02:00"},
+					"end":   map[string]string{"dateTime": "2026-08-23T00:00:00+02:00"},
+				},
+				{
+					// A cancelled occurrence of a recurring event.
+					"id": "off", "status": "cancelled", "summary": "Aflyst",
+					"start": map[string]string{"date": "2026-08-25"},
+					"end":   map[string]string{"date": "2026-08-26"},
+				},
+				{
+					// Neither a date nor a dateTime: belongs on no day at all.
+					"id": "nowhere", "summary": "Uden tid",
+				},
+			},
+		},
+	})
+
+	got, err := client.Events(t.Context(), "primary", "2026-08-01", "2026-08-31")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	byID := map[string]Event{}
+	for _, e := range got {
+		byID[e.ID] = e
+	}
+	if len(got) != 4 {
+		t.Fatalf("got %d events, want 4: %+v", len(got), got)
+	}
+	if _, ok := byID["off"]; ok {
+		t.Error("a cancelled occurrence was kept; it is an event that is not happening")
+	}
+	if _, ok := byID["nowhere"]; ok {
+		t.Error("an event with no time was kept; there is no cell to draw it in")
+	}
+
+	timed := byID["timed"]
+	if timed.AllDay || timed.StartDay != "2026-08-20" || timed.EndDay != "2026-08-20" {
+		t.Errorf("timed = %+v", timed)
+	}
+	if timed.StartsAt != "2026-08-20T14:00:00+02:00" {
+		t.Errorf("the instant was rewritten: %q", timed.StartsAt)
+	}
+
+	allday := byID["allday"]
+	if !allday.AllDay || allday.StartDay != "2026-08-21" || allday.EndDay != "2026-08-21" {
+		t.Errorf("allday = %+v; Google's end date is exclusive and has to be corrected here",
+			allday)
+	}
+	if allday.StartsAt != "" {
+		t.Errorf("an all-day event was given an instant: %q — it has a day, not a moment",
+			allday.StartsAt)
+	}
+
+	if trip := byID["trip"]; trip.StartDay != "2026-08-24" || trip.EndDay != "2026-08-26" {
+		t.Errorf("trip = %+v, want 24th to 26th inclusive", trip)
+	}
+	if late := byID["late"]; late.EndDay != "2026-08-22" {
+		t.Errorf("late ends on %q; an event running to midnight ends the evening before, "+
+			"or every one of them puts a chip in the following day", late.EndDay)
+	}
+}
+
+// An event with no title has to say so. A blank chip in a grid reads as a
+// rendering fault rather than as an empty title.
+func TestAnEventWithNoTitleStillSaysSomething(t *testing.T) {
+	client := fakeGoogle(t, nil, map[string]any{
+		"c": map[string]any{"items": []map[string]any{{
+			"id":    "x",
+			"start": map[string]string{"date": "2026-08-20"},
+			"end":   map[string]string{"date": "2026-08-21"},
+		}}},
+	})
+	got, err := client.Events(t.Context(), "c", "2026-08-01", "2026-08-31")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].Summary == "" {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+// The window is asked for with a day of slack at each end, because an event late
+// in the evening in Copenhagen is the next day in UTC. The slack must not leak
+// out: an event on the day before the window is not in the window.
+func TestTheSlackAtTheEdgesIsThrownAwayAgain(t *testing.T) {
+	client := fakeGoogle(t, nil, map[string]any{
+		"c": map[string]any{"items": []map[string]any{
+			{"id": "before", "summary": "For tidligt",
+				"start": map[string]string{"date": "2026-08-09"},
+				"end":   map[string]string{"date": "2026-08-10"}},
+			{"id": "inside", "summary": "Med",
+				"start": map[string]string{"date": "2026-08-10"},
+				"end":   map[string]string{"date": "2026-08-11"}},
+			{"id": "after", "summary": "For sent",
+				"start": map[string]string{"date": "2026-08-21"},
+				"end":   map[string]string{"date": "2026-08-22"}},
+		}},
+	})
+	got, err := client.Events(t.Context(), "c", "2026-08-10", "2026-08-20")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].ID != "inside" {
+		t.Fatalf("got %+v, want only the one inside the window", got)
+	}
+}
+
+// A page token has to be followed, or a busy calendar silently shows its first
+// page and nothing else — which is a calendar that lies about a day being clear.
+func TestEveryPageIsRead(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		body := map[string]any{
+			"items": []map[string]any{{"id": "a", "summary": "Første",
+				"start": map[string]string{"date": "2026-08-11"},
+				"end":   map[string]string{"date": "2026-08-12"}}},
+			"nextPageToken": "more",
+		}
+		if r.URL.Query().Get("pageToken") == "more" {
+			body = map[string]any{"items": []map[string]any{{"id": "b", "summary": "Anden",
+				"start": map[string]string{"date": "2026-08-12"},
+				"end":   map[string]string{"date": "2026-08-13"}}}}
+		}
+		_ = json.NewEncoder(w).Encode(body)
+	}))
+	defer srv.Close()
+
+	got, err := NewClient("t").At(srv.URL).Events(t.Context(), "c", "2026-08-01", "2026-08-31")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d events, want both pages: %+v", len(got), got)
+	}
+}
+
+// A 401 is not a failure to retry; it is a connection that has ended. Telling the
+// two apart is what stops a revoked account being polled every ten minutes for ever.
+func TestARefusedTokenIsItsOwnError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, `{"error":"invalid_credentials"}`, http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	_, err := NewClient("spent").At(srv.URL).Calendars(t.Context())
+	if err != ErrUnauthorized {
+		t.Fatalf("err = %v, want ErrUnauthorized", err)
+	}
+}
+
+// Read-only, and only the calendar. The consent screen is what somebody agrees to,
+// and a scope that quietly grew is a promise quietly broken.
+func TestTheScopeIsReadOnly(t *testing.T) {
+	if !strings.HasSuffix(Scope, "calendar.readonly") {
+		t.Errorf("scope = %q; nothing here writes a calendar", Scope)
+	}
+}

internal/gmail/gmail.go

@@ -1,183 +1,86 @@
-// Package gmail implements the OAuth2 authorisation-code flow with PKCE against
-// Google, and the small slice of the Gmail API verdande needs.
+// Package gmail is the small slice of the Gmail API verdande needs, and the scope
+// it asks for.
 //
-// The connection is one-way on purpose: a starred or labelled message becomes a
-// task, and nothing verdande does afterwards touches the mailbox. Unstarring the
-// message does not delete the task, completing the task does not unstar the
-// message. Two-way would mean deciding what to do when both sides changed, and the
-// only honest answer to that is a synchronisation model far bigger than the feature.
+// The one thing verdande writes back is the star. A starred message becomes a
+// task, and once it has, the star comes off — exactly as the IMAP side takes the
+// flag off a mail it has imported, and for the same reason: the star meant "turn
+// this into a task", the task now exists, so the star is no longer true. Nothing
+// else is touched. Completing the task does not reach back to the mail; the mail
+// is a pointer the task was made from, not a copy the two have to be kept in step.
 //
-// Scope is gmail.readonly. verdande never needs to send, modify or delete, and
-// asking for less is what makes the consent screen something a person can agree to.
+// That one write is why the scope is gmail.modify rather than gmail.readonly.
+// Removing the STARRED label is a modify, and Gmail offers no narrower scope that
+// can do it — so the consent screen asks for more than it used to, and the trade
+// is deliberate: a starred inbox that empties itself as the tasks are made, rather
+// than one that fills with stars nothing ever clears. Still not send, still not
+// delete — modify is labels, and the only label verdande removes is the one that
+// triggered the task.
+//
+// The OAuth flow itself moved to internal/google when Calendar needed the same one.
+// The names below are aliases so that every call site — and this package's own
+// tests — still read as Gmail's, which is what they are: one registration, one
+// flow, one scope each.
 package gmail
 
 import (
 	"context"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
 	"time"
+
+	"github.com/kristianwind/verdande/internal/google"
 )
 
-const (
-	authEndpoint  = "https://accounts.google.com/o/oauth2/v2/auth"
-	tokenEndpoint = "https://oauth2.googleapis.com/token"
-	apiBase       = "https://gmail.googleapis.com/gmail/v1"
+// Read mail and change its labels, and only mail. Not profile, not contacts, not
+// send, not delete. The single write is removing the STARRED label from a message
+// that has become a task; see the package comment for why that costs modify.
+const Scope = "https://www.googleapis.com/auth/gmail.modify"
 
-	// Read-only, and only mail. Not profile, not contacts, not send.
-	Scope = "https://www.googleapis.com/auth/gmail.readonly"
+const defaultAPIBase = "https://gmail.googleapis.com/gmail/v1"
+
+// The OAuth flow, which is Google's rather than Gmail's.
+type (
+	Config = google.Config
+	PKCE   = google.PKCE
+	Token  = google.Token
 )
 
-// Config is the OAuth client the operator registered in Google Cloud. It belongs to
-// the instance rather than to a person: one registration, any number of users.
-type Config struct {
-	ClientID     string
-	ClientSecret string
-	RedirectURL  string
-}
-
-func (c Config) Configured() bool {
-	return c.ClientID != "" && c.ClientSecret != "" && c.RedirectURL != ""
-}
-
-// PKCE is the proof-key pair for one authorisation attempt.
-//
-// PKCE on a server-side client is not strictly required — the client secret already
-// authenticates the token exchange — but it costs nothing and closes the window in
-// which an authorisation code intercepted from the redirect could be replayed
-// before verdande gets to it.
-type PKCE struct {
-	Verifier  string
-	Challenge string
-	State     string
-}
-
-func NewPKCE() (PKCE, error) {
-	verifier, err := randomString(64)
-	if err != nil {
-		return PKCE{}, err
-	}
-	state, err := randomString(32)
-	if err != nil {
-		return PKCE{}, err
-	}
-	sum := sha256.Sum256([]byte(verifier))
-	return PKCE{
-		Verifier:  verifier,
-		Challenge: base64.RawURLEncoding.EncodeToString(sum[:]),
-		State:     state,
-	}, nil
-}
-
-// AuthURL is where the browser is sent to ask the person for consent.
-func (c Config) AuthURL(p PKCE) string {
-	v := url.Values{}
-	v.Set("client_id", c.ClientID)
-	v.Set("redirect_uri", c.RedirectURL)
-	v.Set("response_type", "code")
-	v.Set("scope", Scope)
-	v.Set("state", p.State)
-	v.Set("code_challenge", p.Challenge)
-	v.Set("code_challenge_method", "S256")
-	// Without both of these Google returns no refresh token on a re-authorisation,
-	// and the connection silently stops working an hour later.
-	v.Set("access_type", "offline")
-	v.Set("prompt", "consent")
-	return authEndpoint + "?" + v.Encode()
-}
-
-type Token struct {
-	AccessToken  string
-	RefreshToken string
-	ExpiresAt    time.Time
-}
-
-// Exchange trades the authorisation code for tokens.
-func (c Config) Exchange(ctx context.Context, code string, p PKCE) (Token, error) {
-	form := url.Values{}
-	form.Set("code", code)
-	form.Set("client_id", c.ClientID)
-	form.Set("client_secret", c.ClientSecret)
-	form.Set("redirect_uri", c.RedirectURL)
-	form.Set("grant_type", "authorization_code")
-	form.Set("code_verifier", p.Verifier)
-
-	return c.token(ctx, form)
-}
-
-// Refresh gets a fresh access token. Google does not return a new refresh token
-// here, so the caller keeps the one it has.
-func (c Config) Refresh(ctx context.Context, refreshToken string) (Token, error) {
-	form := url.Values{}
-	form.Set("refresh_token", refreshToken)
-	form.Set("client_id", c.ClientID)
-	form.Set("client_secret", c.ClientSecret)
-	form.Set("grant_type", "refresh_token")
-
-	token, err := c.token(ctx, form)
-	if err != nil {
-		return Token{}, err
-	}
-	token.RefreshToken = refreshToken
-	return token, nil
-}
-
-func (c Config) token(ctx context.Context, form url.Values) (Token, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenEndpoint,
-		strings.NewReader(form.Encode()))
-	if err != nil {
-		return Token{}, err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	resp, err := (&http.Client{Timeout: 30 * time.Second}).Do(req)
-	if err != nil {
-		return Token{}, err
-	}
-	defer resp.Body.Close()
-
-	var parsed struct {
-		AccessToken      string `json:"access_token"`
-		RefreshToken     string `json:"refresh_token"`
-		ExpiresIn        int    `json:"expires_in"`
-		Error            string `json:"error"`
-		ErrorDescription string `json:"error_description"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&parsed); err != nil {
-		return Token{}, fmt.Errorf("gmail: reading token response: %w", err)
-	}
-	if parsed.Error != "" {
-		return Token{}, fmt.Errorf("gmail: %s: %s", parsed.Error, parsed.ErrorDescription)
-	}
-	if resp.StatusCode != http.StatusOK || parsed.AccessToken == "" {
-		return Token{}, fmt.Errorf("gmail: token exchange failed with %s", resp.Status)
-	}
-
-	return Token{
-		AccessToken:  parsed.AccessToken,
-		RefreshToken: parsed.RefreshToken,
-		// A minute of slack, so a token that is about to expire is refreshed
-		// rather than used and rejected.
-		ExpiresAt: time.Now().Add(time.Duration(parsed.ExpiresIn-60) * time.Second),
-	}, nil
-}
+var (
+	NewPKCE         = google.NewPKCE
+	ErrUnauthorized = google.ErrUnauthorized
+)
 
 // --- the API ---------------------------------------------------------------------
 
 type Client struct {
 	accessToken string
-	http        *http.Client
+	// base is where the Gmail API is. A field rather than a constant so a test can
+	// point it at a server it controls — and "the sync comes back before whatever
+	// sits in front of this server gives up on it" is exactly the kind of promise
+	// worth a test and impossible to make against the real thing. Empty is Google.
+	base string
+	http *http.Client
 }
 
 func NewClient(accessToken string) *Client {
 	return &Client{accessToken: accessToken, http: &http.Client{Timeout: 30 * time.Second}}
 }
 
+// At points the client at another server. Tests only; the zero value is Google.
+func (c *Client) At(base string) *Client {
+	c.base = base
+	return c
+}
+
+func (c *Client) api() string {
+	if c.base != "" {
+		return c.base
+	}
+	return defaultAPIBase
+}
+
 // Message is the part of a Gmail message a task is made from.
 type Message struct {
 	ID       string
@@ -196,7 +99,7 @@ func (c *Client) Profile(ctx context.Context) (string, error) {
 	var parsed struct {
 		EmailAddress string `json:"emailAddress"`
 	}
-	if err := c.get(ctx, apiBase+"/users/me/profile", &parsed); err != nil {
+	if err := c.get(ctx, c.api()+"/users/me/profile", &parsed); err != nil {
 		return "", err
 	}
 	return parsed.EmailAddress, nil
@@ -220,7 +123,7 @@ func (c *Client) List(ctx context.Context, query string, max int) ([]string, err
 			ID string `json:"id"`
 		} `json:"messages"`
 	}
-	if err := c.get(ctx, apiBase+"/users/me/messages?"+v.Encode(), &parsed); err != nil {
+	if err := c.get(ctx, c.api()+"/users/me/messages?"+v.Encode(), &parsed); err != nil {
 		return nil, err
 	}
 
@@ -251,7 +154,7 @@ func (c *Client) Get(ctx context.Context, id string) (Message, error) {
 			} `json:"headers"`
 		} `json:"payload"`
 	}
-	if err := c.get(ctx, apiBase+"/users/me/messages/"+url.PathEscape(id)+"?"+v.Encode(), &parsed); err != nil {
+	if err := c.get(ctx, c.api()+"/users/me/messages/"+url.PathEscape(id)+"?"+v.Encode(), &parsed); err != nil {
 		return Message{}, err
 	}
 
@@ -271,30 +174,27 @@ func (c *Client) Get(ctx context.Context, id string) (Message, error) {
 }
 
 func (c *Client) get(ctx context.Context, url string, out any) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Authorization", "Bearer "+c.accessToken)
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusUnauthorized {
-		return ErrUnauthorized
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("gmail: %s", resp.Status)
-	}
-	return json.NewDecoder(resp.Body).Decode(out)
+	return google.Get(ctx, c.http, c.accessToken, url, out)
 }
 
-// ErrUnauthorized means the tokens are no longer good — the person revoked access,
-// or changed their password. The caller disconnects rather than retrying.
-var ErrUnauthorized = fmt.Errorf("gmail: authorisation was refused")
+// Unstar takes the star off the given messages — one call for all of them, the way
+// the IMAP side unflags a batch, so a sweep that made ten tasks is one write and
+// not ten.
+//
+// STARRED is a system label whose id is its name, so no lookup is needed; a custom
+// label would need one, and verdande removes none. batchModify answers 204 with no
+// body on success. An empty list is a no-op, not a call: batchModify with no ids is
+// an error on Google's side and nothing worth making a round trip to hear.
+func (c *Client) Unstar(ctx context.Context, ids []string) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	body := struct {
+		IDs            []string `json:"ids"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
+	}{IDs: ids, RemoveLabelIDs: []string{"STARRED"}}
+	return google.Post(ctx, c.http, c.accessToken, c.api()+"/users/me/messages/batchModify", body, nil)
+}
 
 // SenderName pulls "Anders Jensen" out of "Anders Jensen <[email protected]>",
 // falling back to the address when there is no display name.
@@ -338,11 +238,3 @@ func Query(trigger, label string) string {
 	terms = append(terms, "newer_than:30d")
 	return strings.Join(terms, " ")
 }
-
-func randomString(n int) (string, error) {
-	b := make([]byte, n)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(b)[:n], nil
-}

internal/gmail/gmail_test.go

@@ -1,110 +1,81 @@
 package gmail
 
 import (
-	"crypto/sha256"
-	"encoding/base64"
-	"net/url"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 )
 
-// The challenge has to be the SHA-256 of the verifier, base64url without padding.
-// Getting this wrong means Google refuses every exchange with a message that does
-// not say which end is at fault.
-func TestPKCEChallengeMatchesItsVerifier(t *testing.T) {
-	p, err := NewPKCE()
-	if err != nil {
-		t.Fatal(err)
+// The scope is the one thing verdande chooses about the connection, and it is the
+// one the person reads on the consent screen. The flow itself is exercised in
+// internal/google; what belongs here is that Gmail asks for modify — read plus the
+// one write it makes, taking the star off an imported message — and nothing wider.
+func TestTheScopeIsModifyMail(t *testing.T) {
+	if !strings.HasSuffix(Scope, "gmail.modify") {
+		t.Errorf("scope = %q; want gmail.modify — read, plus removing the star", Scope)
 	}
-
-	sum := sha256.Sum256([]byte(p.Verifier))
-	want := base64.RawURLEncoding.EncodeToString(sum[:])
-	if p.Challenge != want {
-		t.Errorf("challenge = %q, want %q", p.Challenge, want)
-	}
-
-	// RFC 7636 requires 43–128 characters, and no padding.
-	if n := len(p.Verifier); n < 43 || n > 128 {
-		t.Errorf("verifier is %d characters, outside the 43–128 the spec allows", n)
-	}
-	if strings.ContainsAny(p.Verifier, "=+/") {
-		t.Errorf("verifier %q contains characters that are not URL-safe", p.Verifier)
-	}
-	if p.State == "" {
-		t.Error("no state was generated")
-	}
-
-	// Two attempts must not share anything.
-	other, err := NewPKCE()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if other.Verifier == p.Verifier || other.State == p.State {
-		t.Error("two authorisation attempts produced the same secrets")
+	// Modify is the ceiling. Send, or the full account, would be a different promise
+	// to the person on the consent screen than the one this feature needs.
+	for _, wider := range []string{"gmail.send", "mail.google.com", "gmail.settings"} {
+		if strings.Contains(Scope, wider) {
+			t.Errorf("scope = %q; must not include %q", Scope, wider)
+		}
 	}
 }
 
-func TestAuthURL(t *testing.T) {
-	cfg := Config{
-		ClientID:     "client-123",
-		ClientSecret: "secret",
-		RedirectURL:  "https://todo.example.dk/oauth/gmail/callback",
+// Unstar removes the star from a batch in one call, and it addresses the messages
+// it was given and only the STARRED label.
+func TestUnstarRemovesOnlyTheStar(t *testing.T) {
+	var gotPath string
+	var gotBody struct {
+		IDs            []string `json:"ids"`
+		AddLabelIDs    []string `json:"addLabelIds"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
 	}
-	p, err := NewPKCE()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		raw, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(raw, &gotBody)
+		w.WriteHeader(http.StatusNoContent) // what batchModify answers on success
+	}))
+	defer srv.Close()
+
+	err := NewClient("token").At(srv.URL).Unstar(context.Background(), []string{"a", "b"})
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("Unstar: %v", err)
 	}
-
-	raw := cfg.AuthURL(p)
-	parsed, err := url.Parse(raw)
-	if err != nil {
-		t.Fatalf("the URL does not parse: %v", err)
+	if !strings.HasSuffix(gotPath, "/users/me/messages/batchModify") {
+		t.Errorf("path = %q, want the batchModify endpoint", gotPath)
 	}
-	q := parsed.Query()
-
-	checks := map[string]string{
-		"client_id":             cfg.ClientID,
-		"redirect_uri":          cfg.RedirectURL,
-		"response_type":         "code",
-		"scope":                 Scope,
-		"code_challenge":        p.Challenge,
-		"code_challenge_method": "S256",
-		"state":                 p.State,
-		// Without both of these Google returns no refresh token on a
-		// re-authorisation, and the connection dies silently an hour later.
-		"access_type": "offline",
-		"prompt":      "consent",
+	if strings.Join(gotBody.IDs, ",") != "a,b" {
+		t.Errorf("ids = %v, want [a b]", gotBody.IDs)
 	}
-	for key, want := range checks {
-		if got := q.Get(key); got != want {
-			t.Errorf("%s = %q, want %q", key, got, want)
-		}
+	if strings.Join(gotBody.RemoveLabelIDs, ",") != "STARRED" {
+		t.Errorf("removeLabelIds = %v, want [STARRED]", gotBody.RemoveLabelIDs)
 	}
-
-	// The verifier itself must never leave the server.
-	if strings.Contains(raw, p.Verifier) {
-		t.Error("the code verifier was put in the authorisation URL")
-	}
-	// Read-only, and only mail.
-	if !strings.HasSuffix(Scope, "gmail.readonly") {
-		t.Errorf("scope = %q; verdande never needs to send or modify", Scope)
+	if len(gotBody.AddLabelIDs) != 0 {
+		t.Errorf("addLabelIds = %v, want none — verdande adds no label", gotBody.AddLabelIDs)
 	}
 }
 
-func TestConfigured(t *testing.T) {
-	full := Config{ClientID: "a", ClientSecret: "b", RedirectURL: "c"}
-	if !full.Configured() {
-		t.Error("a complete config is not reported as configured")
+// An empty batch is not a request: Gmail rejects a batchModify with no ids, and
+// there is nothing to say to it anyway.
+func TestUnstarOfNothingMakesNoCall(t *testing.T) {
+	called := false
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		called = true
+	}))
+	defer srv.Close()
+
+	if err := NewClient("token").At(srv.URL).Unstar(context.Background(), nil); err != nil {
+		t.Fatalf("Unstar(nil): %v", err)
 	}
-	for _, partial := range []Config{
-		{},
-		{ClientID: "a"},
-		{ClientID: "a", ClientSecret: "b"},
-		{ClientSecret: "b", RedirectURL: "c"},
-	} {
-		if partial.Configured() {
-			t.Errorf("%+v was reported as configured", partial)
-		}
+	if called {
+		t.Error("Unstar(nil) made a request; it should make none")
 	}
 }
 

internal/google/google.go

@@ -0,0 +1,258 @@
+// Package google implements the OAuth2 authorisation-code flow with PKCE against
+// Google.
+//
+// It was written inside internal/gmail, because Gmail was the only thing that
+// needed it. Calendar needs the same flow — the same endpoints, the same PKCE, the
+// same refresh — and the only thing that differs between them is one string: the
+// scope. A second copy would be a second place for "access_type=offline" to be
+// forgotten, which is the mistake that makes a connection die silently an hour
+// after it was made.
+//
+// What is *not* here is the API calls. Those differ completely, so gmail and gcal
+// keep their own clients and share only the way in.
+package google
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	authEndpoint         = "https://accounts.google.com/o/oauth2/v2/auth"
+	defaultTokenEndpoint = "https://oauth2.googleapis.com/token"
+)
+
+// Config is the OAuth client the operator registered in Google Cloud, plus the
+// scope one feature is asking for.
+//
+// The client belongs to the instance rather than to a person: one registration,
+// any number of users. The scope belongs to the feature: Gmail and Calendar sign
+// in through the same registration and ask for different things, and Google issues
+// a refresh token per authorisation — so connecting one does not disturb the other.
+type Config struct {
+	ClientID     string
+	ClientSecret string
+	RedirectURL  string
+	Scope        string
+
+	// TokenURL is where Google is. A field rather than a constant so a test can
+	// point it at a server it controls: there is no other way to exercise what
+	// happens when the token endpoint is slow or refuses. Empty is Google, so
+	// nothing outside a test has to know it exists.
+	TokenURL string
+}
+
+func (c Config) Configured() bool {
+	return c.ClientID != "" && c.ClientSecret != "" && c.RedirectURL != ""
+}
+
+func (c Config) tokenURL() string {
+	if c.TokenURL != "" {
+		return c.TokenURL
+	}
+	return defaultTokenEndpoint
+}
+
+// PKCE is the proof-key pair for one authorisation attempt.
+//
+// PKCE on a server-side client is not strictly required — the client secret already
+// authenticates the token exchange — but it costs nothing and closes the window in
+// which an authorisation code intercepted from the redirect could be replayed
+// before verdande gets to it.
+type PKCE struct {
+	Verifier  string
+	Challenge string
+	State     string
+}
+
+func NewPKCE() (PKCE, error) {
+	verifier, err := randomString(64)
+	if err != nil {
+		return PKCE{}, err
+	}
+	state, err := randomString(32)
+	if err != nil {
+		return PKCE{}, err
+	}
+	sum := sha256.Sum256([]byte(verifier))
+	return PKCE{
+		Verifier:  verifier,
+		Challenge: base64.RawURLEncoding.EncodeToString(sum[:]),
+		State:     state,
+	}, nil
+}
+
+// AuthURL is where the browser is sent to ask the person for consent.
+func (c Config) AuthURL(p PKCE) string {
+	v := url.Values{}
+	v.Set("client_id", c.ClientID)
+	v.Set("redirect_uri", c.RedirectURL)
+	v.Set("response_type", "code")
+	v.Set("scope", c.Scope)
+	v.Set("state", p.State)
+	v.Set("code_challenge", p.Challenge)
+	v.Set("code_challenge_method", "S256")
+	// Without both of these Google returns no refresh token on a re-authorisation,
+	// and the connection silently stops working an hour later.
+	v.Set("access_type", "offline")
+	v.Set("prompt", "consent")
+	return authEndpoint + "?" + v.Encode()
+}
+
+type Token struct {
+	AccessToken  string
+	RefreshToken string
+	ExpiresAt    time.Time
+}
+
+// Exchange trades the authorisation code for tokens.
+func (c Config) Exchange(ctx context.Context, code string, p PKCE) (Token, error) {
+	form := url.Values{}
+	form.Set("code", code)
+	form.Set("client_id", c.ClientID)
+	form.Set("client_secret", c.ClientSecret)
+	form.Set("redirect_uri", c.RedirectURL)
+	form.Set("grant_type", "authorization_code")
+	form.Set("code_verifier", p.Verifier)
+
+	return c.token(ctx, form)
+}
+
+// Refresh gets a fresh access token. Google does not return a new refresh token
+// here, so the caller keeps the one it has.
+func (c Config) Refresh(ctx context.Context, refreshToken string) (Token, error) {
+	form := url.Values{}
+	form.Set("refresh_token", refreshToken)
+	form.Set("client_id", c.ClientID)
+	form.Set("client_secret", c.ClientSecret)
+	form.Set("grant_type", "refresh_token")
+
+	token, err := c.token(ctx, form)
+	if err != nil {
+		return Token{}, err
+	}
+	token.RefreshToken = refreshToken
+	return token, nil
+}
+
+func (c Config) token(ctx context.Context, form url.Values) (Token, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.tokenURL(),
+		strings.NewReader(form.Encode()))
+	if err != nil {
+		return Token{}, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := (&http.Client{Timeout: 30 * time.Second}).Do(req)
+	if err != nil {
+		return Token{}, err
+	}
+	defer resp.Body.Close()
+
+	var parsed struct {
+		AccessToken      string `json:"access_token"`
+		RefreshToken     string `json:"refresh_token"`
+		ExpiresIn        int    `json:"expires_in"`
+		Error            string `json:"error"`
+		ErrorDescription string `json:"error_description"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&parsed); err != nil {
+		return Token{}, fmt.Errorf("google: reading token response: %w", err)
+	}
+	if parsed.Error != "" {
+		return Token{}, fmt.Errorf("google: %s: %s", parsed.Error, parsed.ErrorDescription)
+	}
+	if resp.StatusCode != http.StatusOK || parsed.AccessToken == "" {
+		return Token{}, fmt.Errorf("google: token exchange failed with %s", resp.Status)
+	}
+
+	return Token{
+		AccessToken:  parsed.AccessToken,
+		RefreshToken: parsed.RefreshToken,
+		// A minute of slack, so a token that is about to expire is refreshed
+		// rather than used and rejected.
+		ExpiresAt: time.Now().Add(time.Duration(parsed.ExpiresIn-60) * time.Second),
+	}, nil
+}
+
+// ErrUnauthorized means the tokens are no longer good — the person revoked access,
+// or changed their password. The caller disconnects rather than retrying.
+var ErrUnauthorized = fmt.Errorf("google: authorisation was refused")
+
+// Get performs an authorised GET and decodes the JSON body into out.
+//
+// Shared by the two API clients because the interesting part is the same in both:
+// a 401 is not a failure to retry, it is a connection that has ended, and telling
+// those apart is what stops a revoked account being polled every ten minutes for
+// ever.
+func Get(ctx context.Context, client *http.Client, accessToken, url string, out any) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return ErrUnauthorized
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("google: %s", resp.Status)
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
+// Post sends a JSON body to a Google API and, unlike Get, does not insist on a
+// body coming back. A write call — modifying labels on a message — answers with
+// 204 No Content when it worked, so anything 2xx is success and only the body is
+// decoded, and only when the caller asked for one.
+func Post(ctx context.Context, client *http.Client, accessToken, url string, body, out any) error {
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(string(payload)))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return ErrUnauthorized
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("google: %s", resp.Status)
+	}
+	if out == nil || resp.StatusCode == http.StatusNoContent {
+		return nil
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
+func randomString(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(b)[:n], nil
+}

internal/google/google_test.go

@@ -0,0 +1,127 @@
+package google
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// The challenge has to be the SHA-256 of the verifier, base64url without padding.
+// Getting this wrong means Google refuses every exchange with a message that does
+// not say which end is at fault.
+func TestPKCEChallengeMatchesItsVerifier(t *testing.T) {
+	p, err := NewPKCE()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sum := sha256.Sum256([]byte(p.Verifier))
+	want := base64.RawURLEncoding.EncodeToString(sum[:])
+	if p.Challenge != want {
+		t.Errorf("challenge = %q, want %q", p.Challenge, want)
+	}
+
+	// RFC 7636 requires 43–128 characters, and no padding.
+	if n := len(p.Verifier); n < 43 || n > 128 {
+		t.Errorf("verifier is %d characters, outside the 43–128 the spec allows", n)
+	}
+	if strings.ContainsAny(p.Verifier, "=+/") {
+		t.Errorf("verifier %q contains characters that are not URL-safe", p.Verifier)
+	}
+	if p.State == "" {
+		t.Error("no state was generated")
+	}
+
+	// Two attempts must not share anything.
+	other, err := NewPKCE()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if other.Verifier == p.Verifier || other.State == p.State {
+		t.Error("two authorisation attempts produced the same secrets")
+	}
+}
+
+func TestAuthURL(t *testing.T) {
+	cfg := Config{
+		ClientID:     "client-123",
+		ClientSecret: "secret",
+		RedirectURL:  "https://todo.example.dk/oauth/gmail/callback",
+		Scope:        "https://www.googleapis.com/auth/gmail.readonly",
+	}
+	p, err := NewPKCE()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw := cfg.AuthURL(p)
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("the URL does not parse: %v", err)
+	}
+	q := parsed.Query()
+
+	checks := map[string]string{
+		"client_id":             cfg.ClientID,
+		"redirect_uri":          cfg.RedirectURL,
+		"response_type":         "code",
+		"scope":                 cfg.Scope,
+		"code_challenge":        p.Challenge,
+		"code_challenge_method": "S256",
+		"state":                 p.State,
+		// Without both of these Google returns no refresh token on a
+		// re-authorisation, and the connection dies silently an hour later.
+		"access_type": "offline",
+		"prompt":      "consent",
+	}
+	for key, want := range checks {
+		if got := q.Get(key); got != want {
+			t.Errorf("%s = %q, want %q", key, got, want)
+		}
+	}
+
+	// The verifier itself must never leave the server.
+	if strings.Contains(raw, p.Verifier) {
+		t.Error("the code verifier was put in the authorisation URL")
+	}
+}
+
+// The scope is the one thing that differs between the two features signing in
+// through this, so it has to come out of the config rather than out of a constant
+// somebody could forget to change.
+func TestTheScopeComesFromTheConfig(t *testing.T) {
+	p, err := NewPKCE()
+	if err != nil {
+		t.Fatal(err)
+	}
+	calendar := "https://www.googleapis.com/auth/calendar.readonly"
+	raw := Config{ClientID: "a", Scope: calendar}.AuthURL(p)
+
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := parsed.Query().Get("scope"); got != calendar {
+		t.Errorf("scope = %q, want %q — asking for the wrong one is a consent screen "+
+			"that grants the wrong thing", got, calendar)
+	}
+}
+
+func TestConfigured(t *testing.T) {
+	full := Config{ClientID: "a", ClientSecret: "b", RedirectURL: "c"}
+	if !full.Configured() {
+		t.Error("a complete config is not reported as configured")
+	}
+	for _, partial := range []Config{
+		{},
+		{ClientID: "a"},
+		{ClientID: "a", ClientSecret: "b"},
+		{ClientSecret: "b", RedirectURL: "c"},
+	} {
+		if partial.Configured() {
+			t.Errorf("%+v was reported as configured", partial)
+		}
+	}
+}

internal/httpapi/ai_ask_handlers.go

@@ -0,0 +1,203 @@
+package httpapi
+
+import (
+	"net/http"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// Spørg om sine egne noter og opgaver i almindeligt sprog.
+//
+// Søgningen finder det, der indeholder ordene. Det her svarer på spørgsmålet —
+// "hvad lovede jeg Anders i august?" — og det er ikke det samme: svaret står
+// spredt over tre noter og en opgave, og ingen af dem indeholder ordet "lovede".
+//
+// To halvdele, og rækkefølgen er hele sikkerheden i det. Basen finder kandidaterne
+// med den søgning, der allerede findes, og som allerede kun kan se det, personen
+// selv må se. Modellen får kun dem — den slår ikke selv noget op og kan ikke bede
+// om mere. Et svar, der ikke står i det udleverede, kan derfor ikke handle om
+// nogen andens noter.
+//
+// Og svaret bærer, hvad det er bygget på. En model, der svarer "det gjorde du den
+// 14.", er kun brugbar, hvis man kan slå op i den note, den læste det i.
+
+type askRequest struct {
+	Question string `json:"question"`
+}
+
+type askSourceJSON struct {
+	Kind  string `json:"kind"` // "note" eller "task"
+	ID    string `json:"id"`
+	Title string `json:"title"`
+}
+
+// handleAIAsk svarer på et spørgsmål ud fra personens egne noter og opgaver.
+func (s *Server) handleAIAsk(w http.ResponseWriter, r *http.Request) {
+	var req askRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	question := strings.TrimSpace(req.Question)
+	if question == "" {
+		writeFieldErrors(w, map[string]string{"question": "required"})
+		return
+	}
+	user := userFrom(r.Context())
+	client, ok := s.aiClientFor(w, r)
+	if !ok {
+		return
+	}
+
+	// Ord for ord, ikke hele spørgsmålet på én gang.
+	//
+	// Søgningen kræver, at *alle* ord optræder, og det er den rigtige regel for et
+	// søgefelt: skriver man to ord, mener man begge. Men et spørgsmål er ikke en
+	// søgning — "hvad lovede jeg Anders i august" indeholder ét ord, der står i
+	// noten, og fem, der ikke gør, så et krav om dem alle finder ingenting hver
+	// eneste gang.
+	//
+	// Så: et groft net her, og modellen læser fangsten. Alternativet — at lade
+	// modellen skrive søgningen — lægger et led mere ind, der kan tage fejl,
+	// mellem spørgsmålet og de noter, der faktisk findes.
+	notes, tasks, err := s.candidatesFor(r, user.ID, question)
+	if err != nil {
+		s.internal(w, r, "search for the question", err)
+		return
+	}
+	if len(notes) == 0 && len(tasks) == 0 {
+		writeJSON(w, http.StatusOK, map[string]any{
+			"answer": "", "sources": []askSourceJSON{},
+		})
+		return
+	}
+
+	// Nummereret, fordi svaret skal kunne pege tilbage. En henvisning til "noten
+	// om leveringen" er ikke noget, fladen kan lave et link ud af; et nummer er.
+	sources := make([]askSourceJSON, 0, len(notes)+len(tasks))
+	passages := make([]string, 0, len(notes)+len(tasks))
+	for _, n := range notes {
+		sources = append(sources, askSourceJSON{Kind: "note", ID: n.ID, Title: n.Title})
+		passages = append(passages, "["+itoaSource(len(sources))+"] Note: "+n.Title+"\n"+
+			firstWords(n.Body, 300))
+	}
+	for _, t := range tasks {
+		sources = append(sources, askSourceJSON{Kind: "task", ID: t.ID, Title: t.Content})
+		line := "[" + itoaSource(len(sources)) + "] Task: " + t.Content
+		if t.DueDate != "" {
+			line += " (" + t.DueDate + ")"
+		}
+		if t.Description != "" {
+			line += "\n" + firstWords(t.Description, 60)
+		}
+		passages = append(passages, line)
+	}
+
+	ctx, cancel := contextWithTimeout(r, 90*time.Second)
+	defer cancel()
+
+	answer, used, err := client.Ask(ctx, question, passages, user.Locale)
+	if err != nil {
+		s.log.Warn("ai ask", "err", err)
+		writeError(w, StatusUpstreamRefused, CodeInternal, err.Error())
+		return
+	}
+
+	// Kun de kilder, svaret faktisk brugte. Alle tolv ville gøre henvisningen
+	// værdiløs: en liste over alt, der blev kigget i, er ikke det samme som det,
+	// svaret står på.
+	cited := make([]askSourceJSON, 0, len(used))
+	for _, n := range used {
+		if n >= 1 && n <= len(sources) {
+			cited = append(cited, sources[n-1])
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"answer": answer, "sources": cited})
+}
+
+func itoaSource(n int) string {
+	if n < 10 {
+		return string(rune('0' + n))
+	}
+	return string(rune('0'+n/10)) + string(rune('0'+n%10))
+}
+
+// candidatesFor henter det, spørgsmålet kunne handle om.
+//
+// Ét opslag pr. ord, lagt sammen og med det, der rammes af flere ord, øverst: et
+// spørgsmål har ét eller to bærende ord og en håndfuld, der bare er dansk, og den
+// note, der indeholder begge de bærende, er den, det handler om.
+//
+// Korte ord springes over. "i", "på" og "the" står i alt, og en note, der blev
+// hentet, fordi den indeholder "i", fortrænger en, der faktisk svarer.
+func (s *Server) candidatesFor(r *http.Request, userID, question string) ([]store.Note, []store.Task, error) {
+	terms := store.SearchTerms(question)
+
+	type scored struct {
+		note store.Note
+		task store.Task
+		hits int
+	}
+	noteHits := map[string]*scored{}
+	taskHits := map[string]*scored{}
+
+	for _, term := range terms {
+		if len([]rune(term)) < 3 {
+			continue
+		}
+		found, err := s.db.SearchNotes(r.Context(), term, 10)
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, n := range found {
+			if at, ok := noteHits[n.ID]; ok {
+				at.hits++
+				continue
+			}
+			noteHits[n.ID] = &scored{note: n, hits: 1}
+		}
+
+		tasks, err := s.db.ListTasks(r.Context(), userID, store.TaskFilter{
+			Search: term, Limit: 10, IncludeCompleted: true,
+		})
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, t := range tasks {
+			if at, ok := taskHits[t.ID]; ok {
+				at.hits++
+				continue
+			}
+			taskHits[t.ID] = &scored{task: t, hits: 1}
+		}
+	}
+
+	notes := make([]store.Note, 0, len(noteHits))
+	for _, at := range noteHits {
+		notes = append(notes, at.note)
+	}
+	sort.SliceStable(notes, func(i, j int) bool {
+		return noteHits[notes[i].ID].hits > noteHits[notes[j].ID].hits
+	})
+
+	tasks := make([]store.Task, 0, len(taskHits))
+	for _, at := range taskHits {
+		tasks = append(tasks, at.task)
+	}
+	sort.SliceStable(tasks, func(i, j int) bool {
+		return taskHits[tasks[i].ID].hits > taskHits[tasks[j].ID].hits
+	})
+
+	// Loftet er, hvad der kan stå i én prompt uden at koste mere, end svaret er
+	// værd — og hvad et menneske ville have gidet læse igennem selv.
+	return capped(notes, 12), capped(tasks, 20), nil
+}
+
+func capped[T any](in []T, n int) []T {
+	if len(in) > n {
+		return in[:n]
+	}
+	return in
+}

internal/httpapi/ai_mail_handlers.go

@@ -0,0 +1,119 @@
+package httpapi
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/ai"
+	"github.com/kristianwind/verdande/internal/quickadd"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// En mail, der bliver til en brugbar opgave.
+//
+// Uden det her hedder opgaven, hvad mailen hed: "Anders Jensen: SV: SV: Vedr.
+// levering uge 12". Det er nok til at genkende den og ikke nok til at gøre noget
+// ved den — og en indbakke af den slags linjer er præcis den bunke, man havde
+// mail for at slippe for.
+//
+// Ét kald pr. gennemløb frem for ét pr. mail. Femogtyve mails er femogtyve gange
+// ventetid og femogtyve gange betaling for det samme spørgsmål, og et gennemløb,
+// der tager fem minutter, er et, der overlapper med det næste.
+//
+// Falder det ud, er der ikke sket noget: opgaven hedder afsender og emne, som den
+// altid har gjort. En model, der er nede, må ikke kunne stoppe posten.
+
+// mailForAI er én mail, som modellen får den at se.
+type mailForAI struct {
+	From    string
+	Subject string
+	Snippet string
+}
+
+// mailTaskLines beder modellen om én linje pr. mail, i quick-add-syntaks.
+//
+// Returnerer en tabel fra mailens plads i listen til linjen. Ikke en liste, fordi
+// en model, der springer en mail over, ellers ville flytte alle de følgende
+// linjer én plads — og så ville en opgave hedde noget, der stod i en anden mail.
+// Det er den samme forsigtighed som ved oprydningen i indbakken, og den samme
+// grund: en forskydning på én er den slags fejl, ingen opdager.
+func (s *Server) mailTaskLines(ctx context.Context, user *store.User, mails []mailForAI) map[int]string {
+	if len(mails) == 0 {
+		return nil
+	}
+	cfg, err := s.aiConfigFor(ctx, user)
+	if err != nil || !cfg.Configured() {
+		return nil
+	}
+
+	lines := make([]string, 0, len(mails))
+	for i, m := range mails {
+		line := strconv.Itoa(i+1) + ". " + m.From + " — " + m.Subject
+		if m.Snippet != "" {
+			line += "\n   " + firstWords(m.Snippet, 40)
+		}
+		lines = append(lines, line)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 90*time.Second)
+	defer cancel()
+
+	today := time.Now().In(userLocation(user.Timezone)).Format("2006-01-02")
+	out, err := ai.New(cfg).TasksFromMail(ctx, lines, today, user.Locale)
+	if err != nil {
+		s.log.Info("mail tasks without the model", "err", err, "user", user.ID)
+		return nil
+	}
+
+	byIndex := map[int]string{}
+	for i, sug := range out {
+		n, line := numberedLine(sug.Line)
+		if n == 0 {
+			n = i + 1
+		}
+		if n < 1 || n > len(mails) || strings.TrimSpace(line) == "" {
+			continue
+		}
+		byIndex[n-1] = line
+	}
+	return byIndex
+}
+
+// applyMailLine lægger modellens linje ind i opgaven, hvis der er en.
+//
+// Linjen går gennem quick-add-parseren som alt andet, så en mail, hvor der står
+// "inden fredag", får en dato — og "#Firma" i en linje, modellen fandt på, flytter
+// ingenting, for projektet slås op blandt dem, der findes.
+//
+// Emnet bliver stående i beskrivelsen. Modellen har skrevet en titel ud fra det,
+// og hvis den har misforstået mailen, skal det oprindelige stadig kunne læses ved
+// siden af — ellers er den eneste vej tilbage at finde mailen frem igen.
+func (s *Server) applyMailLine(ctx context.Context, user *store.User, task *store.Task, line, subject string) {
+	if strings.TrimSpace(line) == "" {
+		return
+	}
+	parsed := quickadd.Parse(line, time.Now().In(userLocation(user.Timezone)), user.Locale)
+	if strings.TrimSpace(parsed.Content) == "" {
+		return
+	}
+
+	task.Content = parsed.Content
+	if parsed.Priority != 0 {
+		task.Priority = parsed.Priority
+	}
+	if parsed.DueDate != "" {
+		task.DueDate = parsed.DueDate
+	}
+	if parsed.Project != "" {
+		if id, err := s.db.ProjectByName(ctx, user.ID, parsed.Project); err == nil {
+			if _, err := store.RequireProjectRole(ctx, s.db, id, user.ID, store.RoleEditor); err == nil {
+				task.ProjectID = id
+			}
+		}
+	}
+	if subject != "" {
+		task.Description = strings.TrimSpace(subject + "\n\n" + task.Description)
+	}
+}

internal/httpapi/ai_plan_handlers.go

@@ -0,0 +1,409 @@
+package httpapi
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/ai"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// Dagens plan: én besked om morgenen om det, der venter i dag.
+//
+// Klokken siger, hvad andre har gjort. Det her siger, hvad der ligger foran en —
+// og det er en anden slags besked: den kommer, fordi det er blevet morgen, ikke
+// fordi nogen har rørt noget. Uden den skal man selv åbne listen for at opdage,
+// at der lå tre ting og forfaldt i går.
+//
+// Sendt som en besked frem for en mail, fordi røret allerede findes: klokken,
+// push til telefonen og mærket på ikonet er ét kald, og en mail mere i indbakken
+// er præcis det, dette program findes for at slippe for.
+
+const planScope = "dailyplan"
+
+// planSettings er, hvad én person har bedt om.
+//
+// Slået fra som udgangspunkt. En besked, man ikke har bedt om, klokken syv om
+// morgenen, er ikke en hjælp — og modsat beaconet er der ingen, der har brug for,
+// at det her er tændt for at kunne gøre sit arbejde.
+type planSettings struct {
+	Enabled bool `json:"enabled"`
+	// Hour er lokal tid hos personen selv. Et tal og ikke et klokkeslæt: planen
+	// sendes på timen, og et minuttal ville love en præcision, en time-tikkende
+	// baggrundsjob ikke har.
+	Hour int `json:"hour"`
+	// LastSent er datoen, den sidst blev sendt, som "2006-01-02" i personens egen
+	// tidszone. En dato og ikke et tidsstempel, fordi spørgsmålet er "har de fået
+	// dagens plan i dag" — og det er et spørgsmål om dagen dér, hvor de er.
+	LastSent string `json:"last_sent,omitempty"`
+	// Plan er teksten, som den blev sendt, og PlanDate den dag den gælder.
+	//
+	// Gemt frem for regnet forfra, hver gang nogen kigger. To grunde, og den anden
+	// er den vigtige: en model pr. sidevisning er dyr, og en plan, der siger noget
+	// andet end den besked, man fik i morges, er værre end begge dele hver for
+	// sig. Det er den samme tekst — ellers er det ikke *dagens plan*, men et nyt
+	// gæt hver gang man kigger.
+	//
+	// PlanAt er klokkeslættet, den blev lavet, så kortet kan sige det: en plan fra
+	// klokken syv er en anden slags oplysning klokken fire end klokken otte.
+	Plan     string `json:"plan,omitempty"`
+	PlanDate string `json:"plan_date,omitempty"`
+	PlanAt   int64  `json:"plan_at,omitempty"`
+}
+
+func (s *Server) planSettings(ctx context.Context, userID string) (planSettings, error) {
+	out := planSettings{Hour: 7}
+	stored, err := s.db.UserSettings(ctx, userID, planScope)
+	if err != nil {
+		return out, err
+	}
+	if v, ok := stored["enabled"].(bool); ok {
+		out.Enabled = v
+	}
+	if v, ok := stored["hour"].(float64); ok && v >= 0 && v <= 23 {
+		out.Hour = int(v)
+	}
+	if v, ok := stored["last_sent"].(string); ok {
+		out.LastSent = v
+	}
+	if v, ok := stored["plan"].(string); ok {
+		out.Plan = v
+	}
+	if v, ok := stored["plan_date"].(string); ok {
+		out.PlanDate = v
+	}
+	if v, ok := stored["plan_at"].(float64); ok {
+		out.PlanAt = int64(v)
+	}
+	return out, nil
+}
+
+func (s *Server) savePlanSettings(ctx context.Context, userID string, p planSettings) error {
+	return s.db.SetUserSettings(ctx, userID, planScope, map[string]any{
+		"enabled": p.Enabled, "hour": p.Hour, "last_sent": p.LastSent,
+		"plan": p.Plan, "plan_date": p.PlanDate, "plan_at": p.PlanAt,
+	})
+}
+
+// handleGetPlanSettings er både indstillingen og dagens plan.
+//
+// Ét endepunkt, fordi det er én ting: planen *er* ressourcen, og indstillingen er,
+// hvornår den bliver lavet. To ville betyde to kald fra siden, der viser den, og
+// to steder at huske at rydde en plan fra i går.
+//
+// En plan fra i går sendes ikke med. Den er ikke forkert, den er bare ikke dagens
+// — og et kort, der viser gårsdagens plan under overskriften "i dag", er værre end
+// et tomt kort.
+func (s *Server) handleGetPlanSettings(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	p, err := s.planSettings(r.Context(), user.ID)
+	if err != nil {
+		s.internal(w, r, "plan settings", err)
+		return
+	}
+	if p.PlanDate != time.Now().In(userLocation(user.Timezone)).Format("2006-01-02") {
+		p.Plan, p.PlanDate, p.PlanAt = "", "", 0
+	}
+	writeJSON(w, http.StatusOK, p)
+}
+
+type planRequest struct {
+	Enabled *bool `json:"enabled"`
+	Hour    *int  `json:"hour"`
+}
+
+func (s *Server) handleSetPlanSettings(w http.ResponseWriter, r *http.Request) {
+	var req planRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	user := userFrom(r.Context())
+	p, err := s.planSettings(r.Context(), user.ID)
+	if err != nil {
+		s.internal(w, r, "plan settings", err)
+		return
+	}
+	if req.Enabled != nil {
+		p.Enabled = *req.Enabled
+	}
+	if req.Hour != nil {
+		if *req.Hour < 0 || *req.Hour > 23 {
+			writeFieldErrors(w, map[string]string{"hour": "must be between 0 and 23"})
+			return
+		}
+		p.Hour = *req.Hour
+		// Timen er flyttet, så dagens plan er ikke sendt på den nye tid endnu.
+		// Uden det her ville en, der flytter planen fra 07 til 16, først få den i
+		// morgen — hvilket ligner, at indstillingen ikke virkede.
+		p.LastSent = ""
+	}
+	if err := s.savePlanSettings(r.Context(), user.ID, p); err != nil {
+		s.internal(w, r, "save plan settings", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, p)
+}
+
+type planNowRequest struct {
+	// Silent er kortet på I dag, der beder om en plan, mens man kigger på den.
+	//
+	// En besked om noget, man står og ser på, er en besked, der lærer folk at
+	// ignorere klokken. Indstillingssidens knap sender derimod rigtigt — det er
+	// hele dens formål: at vise, at push virker på det her apparat.
+	Silent bool `json:"silent"`
+}
+
+// handlePlanNow laver dagens plan med det samme, til den der beder om det.
+//
+// Findes, fordi en indstilling, man skal vente til i morgen for at se virkningen
+// af, er en indstilling, ingen tør slå til — og fordi kortet på I dag skal kunne
+// lave en plan for den, der har beskeden slået fra.
+func (s *Server) handlePlanNow(w http.ResponseWriter, r *http.Request) {
+	var req planNowRequest
+	if r.ContentLength > 0 {
+		if err := decodeJSON(w, r, &req); err != nil {
+			return
+		}
+	}
+	user := userFrom(r.Context())
+
+	plan, err := s.buildPlan(r.Context(), user)
+	if err != nil {
+		s.internal(w, r, "build plan", err)
+		return
+	}
+	if plan == "" {
+		writeJSON(w, http.StatusOK, map[string]any{"plan": "", "sent": false})
+		return
+	}
+	if err := s.rememberPlan(r.Context(), user, plan); err != nil {
+		s.internal(w, r, "save plan", err)
+		return
+	}
+
+	sent := false
+	if !req.Silent {
+		s.notify(r, &store.Notification{
+			UserID: user.ID, Kind: "daily.plan",
+			Title: planTitle(user.Locale), Body: plan,
+		})
+		sent = true
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"plan": plan, "sent": sent,
+		"plan_at": time.Now().Unix(),
+	})
+}
+
+// rememberPlan gemmer dagens plan, så den kan ses igen uden at blive lavet igen.
+func (s *Server) rememberPlan(ctx context.Context, user *store.User, plan string) error {
+	p, err := s.planSettings(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+	now := time.Now()
+	p.Plan = plan
+	p.PlanDate = now.In(userLocation(user.Timezone)).Format("2006-01-02")
+	p.PlanAt = now.Unix()
+	return s.savePlanSettings(ctx, user.ID, p)
+}
+
+// DailyPlans er timeslaget: hvem er der morgen hos, og hvem har ikke fået planen
+// endnu i dag.
+//
+// Kaldt hver time frem for lagt på et klokkeslæt — samme form som backup og
+// beacon, og af samme grund: en instans, der sov klokken syv, ville ellers
+// springe dagen over. Og fordi klokken syv er syv forskellige steder: personens
+// egen tidszone afgør, hvornår det er morgen hos dem.
+func (s *Server) DailyPlans(ctx context.Context) error {
+	users, err := s.db.ListUsers(ctx)
+	if err != nil {
+		return err
+	}
+	for _, u := range users {
+		user, err := s.db.UserByID(ctx, u.ID)
+		if err != nil {
+			continue
+		}
+		p, err := s.planSettings(ctx, user.ID)
+		if err != nil || !p.Enabled {
+			continue
+		}
+
+		now := time.Now().In(userLocation(user.Timezone))
+		today := now.Format("2006-01-02")
+		if p.LastSent == today || now.Hour() < p.Hour {
+			continue
+		}
+		// Kun samme dag. En instans, der har været slukket i tre dage, skal ikke
+		// sende tre planer, når den kommer op — de to af dem er om dage, der er
+		// gået, og en plan for i forgårs er ikke en plan.
+		if now.Hour() > p.Hour+3 {
+			p.LastSent = today
+			_ = s.savePlanSettings(ctx, user.ID, p)
+			continue
+		}
+
+		plan, err := s.buildPlan(ctx, user)
+		if err != nil {
+			s.log.Warn("build daily plan", "err", err, "user", user.ID)
+			continue
+		}
+		// Ingen plan er ikke en besked. En morgen uden noget at gøre er en god
+		// morgen, og en besked, der siger "der er ingenting", lærer folk at lade
+		// være med at åbne beskeder.
+		if plan != "" {
+			s.notifyDirect(ctx, &store.Notification{
+				UserID: user.ID, Kind: "daily.plan",
+				Title: planTitle(user.Locale), Body: plan,
+			})
+			// Gemt, og gemt her frem for i rememberPlan: rækken er allerede
+			// læst ind i `p`, og to gemninger oven i hinanden ville lade den
+			// ene overskrive den andens `last_sent`.
+			p.Plan, p.PlanDate, p.PlanAt = plan, today, time.Now().Unix()
+		}
+		p.LastSent = today
+		if err := s.savePlanSettings(ctx, user.ID, p); err != nil {
+			s.log.Warn("save plan settings", "err", err, "user", user.ID)
+		}
+	}
+	return nil
+}
+
+// buildPlan skriver dagens plan.
+//
+// Tallene kommer fra basen og sætningen fra modellen — i den rækkefølge. En model,
+// der selv skulle tælle, ville af og til tælle forkert, og en plan, der siger fire
+// opgaver, hvor der er tre, er værre end ingen plan. Er der ingen model sat op,
+// står tallene alene, og det er stadig det, man havde brug for at vide.
+func (s *Server) buildPlan(ctx context.Context, user *store.User) (string, error) {
+	loc := userLocation(user.Timezone)
+	now := time.Now().In(loc)
+	today := now.Format("2006-01-02")
+	// I går, ikke i dag: grænserne i filteret er inklusive, så "før i dag" skrevet
+	// som DueBefore: today ville tælle dagens egne opgaver med som sprunget over —
+	// og en plan, der klokken syv om morgenen siger, at dagens opgaver allerede er
+	// overskredet, er en plan, man holder op med at læse.
+	yesterday := now.AddDate(0, 0, -1).Format("2006-01-02")
+
+	overdue, err := s.db.ListTasks(ctx, user.ID, store.TaskFilter{DueBefore: yesterday, Limit: 50})
+	if err != nil {
+		return "", err
+	}
+	due, err := s.db.ListTasks(ctx, user.ID, store.TaskFilter{
+		DueFrom: today, DueBefore: today, Limit: 50,
+	})
+	if err != nil {
+		return "", err
+	}
+	if len(overdue) == 0 && len(due) == 0 {
+		return "", nil
+	}
+
+	plain := plainPlan(len(due), len(overdue), user.Locale)
+
+	cfg, err := s.aiConfigFor(ctx, user)
+	if err != nil || !cfg.Configured() {
+		return plain, nil
+	}
+
+	lines := make([]string, 0, len(due)+len(overdue))
+	for _, t := range overdue {
+		lines = append(lines, "- "+t.Content+" ("+overdueWord(user.Locale)+" "+t.DueDate+")")
+	}
+	for _, t := range due {
+		lines = append(lines, "- "+t.Content)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+
+	written, err := ai.New(cfg).DailyPlan(ctx, lines, len(due), len(overdue), user.Locale)
+	if err != nil {
+		// Modellen er ikke det, planen står og falder med. Tallene er rigtige uden
+		// den, og en morgen uden besked, fordi en API-nøgle er udløbet, er en
+		// dårligere handel end en besked uden en velskrevet sætning.
+		s.log.Info("daily plan without the model", "err", err, "user", user.ID)
+		return plain, nil
+	}
+	return strings.TrimSpace(written), nil
+}
+
+// aiConfigFor er aiConfig uden en request bag sig — baggrundsjobbet har ingen.
+//
+// AllowPrivate er falsk her, og det er med vilje: retten til at nå det private
+// net blev givet til en administrator, der sad og skrev adressen ind, og et job,
+// der kører klokken syv om morgenen, er ikke nogen, der sidder og skriver. En
+// model på maskinen selv skal derfor bruges gennem fladen, ikke af planen.
+func (s *Server) aiConfigFor(ctx context.Context, user *store.User) (ai.Config, error) {
+	values, err := s.db.UserSettings(ctx, user.ID, "ai")
+	if err != nil {
+		return ai.Config{}, err
+	}
+	str := func(key string) string {
+		v, _ := values[key].(string)
+		return v
+	}
+	return ai.Config{
+		Provider: ai.Provider(str("provider")),
+		APIKey:   str("api_key"),
+		BaseURL:  str("base_url"),
+		Model:    str("model"),
+	}, nil
+}
+
+// notifyDirect er notify uden en request. Baggrundsjobbet har ingen bruger i
+// konteksten og ingen actor — planen er ikke noget, nogen har gjort ved en.
+func (s *Server) notifyDirect(ctx context.Context, n *store.Notification) {
+	if err := s.db.CreateNotification(ctx, n); err != nil {
+		s.log.Warn("create notification", "err", err)
+		return
+	}
+	s.hub.PublishToUser(n.UserID, "notification", notificationJSON{
+		ID: n.ID, Kind: n.Kind, Title: n.Title, Body: n.Body,
+		CreatedAt: n.CreatedAt.Format(time.RFC3339),
+	})
+	go s.pushToUser(n.UserID, n.Title, n.Body, "")
+}
+
+func planTitle(locale string) string {
+	if strings.HasPrefix(strings.ToLower(locale), "en") {
+		return "Today"
+	}
+	return "I dag"
+}
+
+func overdueWord(locale string) string {
+	if strings.HasPrefix(strings.ToLower(locale), "en") {
+		return "was due"
+	}
+	return "forfaldt"
+}
+
+// plainPlan er planen uden en model: to tal, og ikke et ord mere.
+//
+// Det er ikke en nødløsning, det er bunden. Det, man har brug for at vide klokken
+// syv, er om der er noget, der er sprunget over — og det tal er rigtigt, uanset
+// om nogen har lagt en API-nøgle ind.
+func plainPlan(due, overdue int, locale string) string {
+	english := strings.HasPrefix(strings.ToLower(locale), "en")
+	var parts []string
+	if due > 0 {
+		if english {
+			parts = append(parts, strconv.Itoa(due)+" due today")
+		} else {
+			parts = append(parts, strconv.Itoa(due)+" forfalder i dag")
+		}
+	}
+	if overdue > 0 {
+		if english {
+			parts = append(parts, strconv.Itoa(overdue)+" overdue")
+		} else {
+			parts = append(parts, strconv.Itoa(overdue)+" er sprunget over")
+		}
+	}
+	return strings.Join(parts, ", ")
+}

internal/httpapi/ai_plan_test.go

@@ -0,0 +1,157 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+	"time"
+)
+
+// Planen er tal fra basen, ikke fra modellen. En plan, der siger fire opgaver,
+// hvor der er tre, er værre end ingen plan — så tallene tælles her, og modellen
+// får dem udleveret som kendsgerninger.
+func TestTheDailyPlanCountsForItself(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "ring til anders i dag")
+	ts.quickTask(t, "køb mælk i dag")
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/plan/now", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("send planen: %d %v", resp.StatusCode, out)
+	}
+	if out["sent"] != true {
+		t.Fatalf("planen blev ikke sendt: %v", out)
+	}
+	// Uden en model står tallene alene, og det er stadig det, man havde brug for
+	// at vide klokken syv.
+	if plan, _ := out["plan"].(string); plan != "2 forfalder i dag" {
+		t.Errorf("plan = %q", plan)
+	}
+
+	// Og den lander i klokken som en besked.
+	list, unread := notifications(t, ts)
+	if len(list) != 1 || unread != 1 {
+		t.Fatalf("beskeder = %d (%v ulæste), want 1", len(list), unread)
+	}
+	if n := firstOf(t, list); n["kind"] != "daily.plan" {
+		t.Errorf("besked = %v", n)
+	}
+}
+
+// Ingen plan er ikke en besked. En morgen uden noget at gøre er en god morgen, og
+// en besked, der siger "der er ingenting", lærer folk at lade være med at åbne
+// beskeder.
+func TestAnEmptyDaySendsNoPlan(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/plan/now", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("send planen: %d", resp.StatusCode)
+	}
+	if out["sent"] != false {
+		t.Errorf("der blev sendt en plan om ingenting: %v", out)
+	}
+	if list, _ := notifications(t, ts); len(list) != 0 {
+		t.Errorf("beskeder = %d, want 0", len(list))
+	}
+}
+
+// Timen er flyttet, så dagens plan er ikke sendt på den nye tid endnu. Uden det
+// ville en, der flytter planen fra 07 til 16, først få den i morgen — hvilket
+// ligner, at indstillingen ikke virkede.
+func TestMovingThePlanHourClearsTodaysMark(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "noget i dag")
+
+	if resp, _ := ts.do(t, "PUT", "/api/v1/ai/plan", map[string]any{
+		"enabled": true, "hour": 7,
+	}); resp.StatusCode != http.StatusOK {
+		t.Fatal("slå planen til")
+	}
+	if _, out := ts.do(t, "POST", "/api/v1/ai/plan/now", nil); out["sent"] != true {
+		t.Fatalf("planen blev ikke sendt: %v", out)
+	}
+
+	resp, out := ts.do(t, "PUT", "/api/v1/ai/plan", map[string]any{"hour": 16})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("flyt timen: %d", resp.StatusCode)
+	}
+	if out["hour"] != float64(16) {
+		t.Errorf("time = %v", out["hour"])
+	}
+	if out["last_sent"] != nil && out["last_sent"] != "" {
+		t.Errorf("mærket for i dag blev stående: %v", out["last_sent"])
+	}
+}
+
+// En time, der ikke findes på et ur, er en fejl i feltet og ikke en 500.
+func TestAnImpossiblePlanHourIsRefused(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	if resp, _ := ts.do(t, "PUT", "/api/v1/ai/plan", map[string]any{"hour": 25}); resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Fatalf("time 25 gav %d, want 422", resp.StatusCode)
+	}
+}
+
+// Planen gemmes for dagen, så kortet på I dag kan vise nøjagtig den tekst,
+// beskeden bar — og ikke et nyt gæt, hver gang nogen kigger.
+func TestTodaysPlanIsKeptForTheDay(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "noget i dag")
+
+	// Ingen plan endnu: kortet viser en knap frem for gårsdagens tekst.
+	if _, before := ts.do(t, "GET", "/api/v1/ai/plan", nil); before["plan"] != nil && before["plan"] != "" {
+		t.Fatalf("der lå en plan, før nogen havde lavet en: %v", before["plan"])
+	}
+
+	resp, made := ts.do(t, "POST", "/api/v1/ai/plan/now", map[string]any{"silent": true})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("lav planen: %d", resp.StatusCode)
+	}
+	if made["sent"] != false {
+		t.Errorf("en stille plan sendte en besked: %v", made["sent"])
+	}
+	if list, _ := notifications(t, ts); len(list) != 0 {
+		t.Errorf("kortets egen plan gav %d beskeder, want 0", len(list))
+	}
+
+	_, after := ts.do(t, "GET", "/api/v1/ai/plan", nil)
+	if after["plan"] != made["plan"] {
+		t.Errorf("den gemte plan = %v, den lavede = %v", after["plan"], made["plan"])
+	}
+	if after["plan_at"] == nil {
+		t.Error("planen bærer ikke, hvornår den blev lavet")
+	}
+}
+
+// En plan fra i går er ikke dagens. Et kort, der viser gårsdagens plan under
+// overskriften "i dag", er værre end et tomt kort.
+func TestYesterdaysPlanIsNotTodays(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "noget i dag")
+
+	if resp, _ := ts.do(t, "POST", "/api/v1/ai/plan/now", map[string]any{"silent": true}); resp.StatusCode != http.StatusOK {
+		t.Fatal("lav planen")
+	}
+
+	// Sat en dag tilbage, som om den var lavet i går.
+	user := userID(t, ts, "[email protected]")
+	stored, err := ts.db.UserSettings(t.Context(), user, "dailyplan")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stored["plan_date"] = time.Now().AddDate(0, 0, -1).Format("2006-01-02")
+	if err := ts.db.SetUserSettings(t.Context(), user, "dailyplan", stored); err != nil {
+		t.Fatal(err)
+	}
+
+	_, out := ts.do(t, "GET", "/api/v1/ai/plan", nil)
+	if plan, _ := out["plan"].(string); plan != "" {
+		t.Errorf("gårsdagens plan blev vist som dagens: %q", plan)
+	}
+}

internal/httpapi/ai_suggest_handlers.go

@@ -0,0 +1,370 @@
+package httpapi
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/ai"
+	"github.com/kristianwind/verdande/internal/quickadd"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// AI'ens forslag, og hvad der sker med dem.
+//
+// Fælles for det hele: modellen skriver ikke noget. Den foreslår en *linje* i den
+// syntaks, man selv skriver i — "Ring til Anders i morgen p1 #Firma" — og
+// forslaget bliver til noget, når nogen siger ja til det. Det er ikke
+// forsigtighed for forsigtighedens skyld: en model, der retter i folks opgaver
+// direkte, skal have ret hver gang for at være til gavn, hvor en, der foreslår,
+// skal have ret tit nok til at spare et par tastetryk.
+//
+// Og linjen er quick-add-syntaks frem for et felt pr. egenskab, fordi parseren
+// findes: der er én fortolkning af "i morgen" i dette program, og forslaget går
+// gennem den samme som alt andet.
+
+// aiSuggestionJSON er ét forslag på vej til fladen.
+type aiSuggestionJSON struct {
+	// TaskID er sat, når forslaget handler om en opgave, der allerede findes —
+	// altså ved oprydningen i indbakken. Tomt, når forslaget er en ny opgave.
+	TaskID string `json:"task_id,omitempty"`
+	Line   string `json:"line"`
+	Why    string `json:"why,omitempty"`
+}
+
+// aiClientFor er de tre linjer, hver eneste AI-funktion ellers ville gentage:
+// hent opsætningen, og sig pænt fra, når der ikke er nogen.
+func (s *Server) aiClientFor(w http.ResponseWriter, r *http.Request) (*ai.Client, bool) {
+	cfg, err := s.aiConfig(r, userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "ai settings", err)
+		return nil, false
+	}
+	if !cfg.Configured() {
+		// Ikke en fejl, nogen har lavet: funktionen er slået fra, indtil man
+		// lægger sin egen nøgle ind.
+		writeError(w, http.StatusConflict, CodeAINotConfigured, "no AI provider is configured")
+		return nil, false
+	}
+	return ai.New(cfg), true
+}
+
+// projectNames er de projekter, modellen må nævne.
+//
+// Givet med frem for udeladt, fordi alternativet er, at den finder på et: et
+// `#Nyt projekt`, ingen har, ville lave et projekt ved et uheld, første gang
+// nogen sagde ja til forslaget.
+func (s *Server) projectNames(r *http.Request) []string {
+	projects, err := s.db.ListProjects(r.Context(), userFrom(r.Context()).ID, false)
+	if err != nil {
+		s.log.Warn("projects for ai", "err", err)
+		return nil
+	}
+	out := make([]string, 0, len(projects))
+	for _, p := range projects {
+		if p.IsInbox {
+			continue
+		}
+		out = append(out, p.Name)
+	}
+	return out
+}
+
+// handleAITidyInbox foreslår, hvordan det, der ligger løst i indbakken, kunne
+// skrives færdig.
+//
+// Indbakken er der, hvor ting lander, når man ikke havde tid til at skrive dem
+// ordentligt — og den er derfor også der, hvor de bliver liggende. At åbne hver
+// enkelt og sætte projekt, dato og prioritet er ti klik pr. linje; det her er ét
+// spørgsmål og et ja pr. linje.
+func (s *Server) handleAITidyInbox(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	client, ok := s.aiClientFor(w, r)
+	if !ok {
+		return
+	}
+
+	inbox, err := s.db.InboxID(r.Context(), user.ID)
+	if err != nil {
+		s.internal(w, r, "inbox", err)
+		return
+	}
+	tasks, err := s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
+		ProjectIDs: []string{inbox}, Limit: 50,
+	})
+	if err != nil {
+		s.internal(w, r, "list inbox", err)
+		return
+	}
+	if len(tasks) == 0 {
+		writeJSON(w, http.StatusOK, map[string]any{"suggestions": []aiSuggestionJSON{}})
+		return
+	}
+
+	// Nummereret, så svaret kan lægges tilbage på den rigtige opgave. Modellen
+	// bliver bedt om at svare i rækkefølge, men en model, der springer en over,
+	// må ikke kunne flytte alle de andres forslag én plads — derfor står
+	// nummeret i teksten og bliver læst tilbage.
+	lines := make([]string, 0, len(tasks))
+	for i, t := range tasks {
+		line := strconv.Itoa(i+1) + ". " + t.Content
+		if t.Description != "" {
+			line += " — " + firstWords(t.Description, 30)
+		}
+		lines = append(lines, line)
+	}
+
+	ctx, cancel := contextWithTimeout(r, 90*time.Second)
+	defer cancel()
+
+	today := time.Now().In(userLocation(user.Timezone)).Format("2006-01-02")
+	suggestions, err := client.TidyInbox(ctx, lines, s.projectNames(r), today, user.Locale)
+	if err != nil {
+		s.log.Warn("ai tidy inbox", "err", err)
+		writeError(w, StatusUpstreamRefused, CodeInternal, err.Error())
+		return
+	}
+
+	out := make([]aiSuggestionJSON, 0, len(suggestions))
+	for i, sug := range suggestions {
+		n, line := numberedLine(sug.Line)
+		// Uden et nummer falder vi tilbage på rækkefølgen, som er det, der blev
+		// bedt om. Med et nummer, der ikke findes, springes forslaget over —
+		// et forslag, der peger på en opgave, der ikke er der, er ikke et forslag.
+		if n == 0 {
+			n = i + 1
+		}
+		if n < 1 || n > len(tasks) {
+			continue
+		}
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		out = append(out, aiSuggestionJSON{TaskID: tasks[n-1].ID, Line: line, Why: sug.Why})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"suggestions": out})
+}
+
+type applyLineRequest struct {
+	TaskID string `json:"task_id"`
+	Line   string `json:"line"`
+}
+
+// handleAIApplyToTask skriver ét accepteret forslag ind i den opgave, det handler
+// om.
+//
+// Parsningen sker her og ikke i browseren, så "i morgen" betyder det samme, som
+// det gør alle andre steder i programmet — og så et forslag, der er blevet rettet
+// i hånden, inden det blev sagt ja til, bliver læst på nøjagtig samme måde som et,
+// der ikke blev rørt.
+func (s *Server) handleAIApplyToTask(w http.ResponseWriter, r *http.Request) {
+	var req applyLineRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	user := userFrom(r.Context())
+	if strings.TrimSpace(req.Line) == "" {
+		writeFieldErrors(w, map[string]string{"line": "required"})
+		return
+	}
+
+	task, err := s.db.GetTask(r.Context(), req.TaskID, user.ID)
+	if err != nil {
+		s.storeError(w, r, "get task", err)
+		return
+	}
+
+	loc := userLocation(user.Timezone)
+	parsed := quickadd.Parse(req.Line, time.Now().In(loc), user.Locale)
+	if strings.TrimSpace(parsed.Content) == "" {
+		writeFieldErrors(w, map[string]string{"line": "there is no task in that"})
+		return
+	}
+
+	// Kun det, linjen faktisk siger. En tom dato i et forslag betyder "der stod
+	// ikke noget om en dato" og ikke "fjern den, der er" — modellen er blevet bedt
+	// om at lade være med at gætte datoer, og så må et manglende gæt heller ikke
+	// slette noget.
+	update := store.TaskUpdate{Content: &parsed.Content}
+	if parsed.Priority != 0 {
+		update.Priority = &parsed.Priority
+	}
+	if parsed.DueDate != "" {
+		update.SetDue, update.DueDate = true, parsed.DueDate
+	}
+	if parsed.Recurrence != "" {
+		update.RecurrenceRule = &parsed.Recurrence
+	}
+	if len(parsed.Labels) > 0 {
+		update.Labels, update.SetLabels = parsed.Labels, true
+	}
+	if err := s.db.UpdateTask(r.Context(), task.ID, user.ID, update); err != nil {
+		s.storeError(w, r, "update task", err)
+		return
+	}
+
+	// Et projekt, modellen fandt på, flytter ingenting. Den fik listen over dem,
+	// der findes, og et navn uden for den er et gæt — og et gæt må ikke kunne
+	// lave et projekt eller flytte en opgave hen, hvor ejeren ikke leder.
+	if parsed.Project != "" {
+		if id, err := s.db.ProjectByName(r.Context(), user.ID, parsed.Project); err == nil && id != task.ProjectID {
+			if _, err := store.RequireProjectRole(r.Context(), s.db, id, user.ID, store.RoleEditor); err == nil {
+				if _, err := s.db.MoveTask(r.Context(), task.ID, id, "", "", ""); err != nil {
+					s.internal(w, r, "move task", err)
+					return
+				}
+			}
+		}
+	}
+
+	updated, err := s.db.GetTask(r.Context(), task.ID, user.ID)
+	if err != nil {
+		s.storeError(w, r, "get task", err)
+		return
+	}
+	s.publish(updated.ProjectID, "task.updated", toTaskJSON(*updated))
+	writeJSON(w, http.StatusOK, toTaskJSON(*updated))
+}
+
+// handleAINoteActions trækker det, nogen har lovet, ud af en note.
+//
+// Et referat er fuldt af sætninger, der ligner opgaver, og af tre, der er det.
+// Modellen bliver bedt om kun at tage dem, nogen har forpligtet sig på, og om at
+// citere de ord, den tog dem fra — så et forkert punkt kan gennemskues frem for
+// bare at være forkert.
+func (s *Server) handleAINoteActions(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	client, ok := s.aiClientFor(w, r)
+	if !ok {
+		return
+	}
+
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.mayTouchNote(r, n, store.RoleViewer) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+	if strings.TrimSpace(n.Body) == "" {
+		writeJSON(w, http.StatusOK, map[string]any{"suggestions": []aiSuggestionJSON{}})
+		return
+	}
+
+	ctx, cancel := contextWithTimeout(r, 90*time.Second)
+	defer cancel()
+
+	today := time.Now().In(userLocation(user.Timezone)).Format("2006-01-02")
+	suggestions, err := client.ActionsInNote(ctx, n.Body, s.projectNames(r), today, user.Locale)
+	if err != nil {
+		s.log.Warn("ai note actions", "err", err)
+		writeError(w, StatusUpstreamRefused, CodeInternal, err.Error())
+		return
+	}
+
+	out := make([]aiSuggestionJSON, 0, len(suggestions))
+	for _, sug := range suggestions {
+		out = append(out, aiSuggestionJSON{Line: sug.Line, Why: sug.Why})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"suggestions": out})
+}
+
+// handleAICreateFromNote laver én accepteret opgave fra en note.
+//
+// Noten bliver ikke rørt. Det er fristende at skrive linket ind i den, så de to
+// peger på hinanden, men en tekst, et program skriver i uden at blive bedt om
+// det, er en tekst, man holder op med at stole på. I stedet bærer opgaven, hvor
+// den kom fra — og noten kan findes på sin titel.
+func (s *Server) handleAICreateFromNote(w http.ResponseWriter, r *http.Request) {
+	var req applyLineRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	user := userFrom(r.Context())
+
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.mayTouchNote(r, n, store.RoleViewer) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+
+	loc := userLocation(user.Timezone)
+	parsed := quickadd.Parse(req.Line, time.Now().In(loc), user.Locale)
+	if strings.TrimSpace(parsed.Content) == "" {
+		writeFieldErrors(w, map[string]string{"line": "there is no task in that"})
+		return
+	}
+
+	// Notens eget projekt som udgangspunkt: står referatet i et projekt, hører
+	// det, der blev aftalt i det, som regel til samme sted. Et `#projekt` i
+	// linjen vinder, fordi det er valgt frem for arvet.
+	projectID := n.ProjectID
+	if parsed.Project != "" {
+		if id, err := s.db.ProjectByName(r.Context(), user.ID, parsed.Project); err == nil {
+			projectID = id
+		}
+	}
+	if projectID == "" {
+		if projectID, err = s.db.InboxID(r.Context(), user.ID); err != nil {
+			s.internal(w, r, "inbox", err)
+			return
+		}
+	}
+	if _, err := store.RequireProjectRole(r.Context(), s.db, projectID, user.ID, store.RoleEditor); err != nil {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+
+	task := &store.Task{
+		ProjectID: projectID, Content: parsed.Content, Priority: parsed.Priority,
+		DueDate: parsed.DueDate, RecurrenceRule: parsed.Recurrence,
+		Description: "[[" + n.Title + "]]", CreatedBy: user.ID,
+	}
+	if err := s.db.CreateTask(r.Context(), task, parsed.Labels); err != nil {
+		s.internal(w, r, "create task from note", err)
+		return
+	}
+	s.publish(projectID, "task.created", toTaskJSON(*task))
+	writeJSON(w, http.StatusCreated, toTaskJSON(*task))
+}
+
+// numberedLine skiller "3. Ring til Anders" ad i nummeret og linjen.
+//
+// Nummeret er, hvordan et forslag finder tilbage til den opgave, det handler om.
+// Rækkefølgen alene ville også kunne bruges, og gør det som reserve — men en
+// model, der springer en opgave over, ville så flytte alle de følgende forslag
+// én plads, og så bliver "sæt dato på den her" sat på en anden.
+func numberedLine(s string) (int, string) {
+	s = strings.TrimSpace(s)
+	dot := strings.IndexByte(s, '.')
+	if dot <= 0 || dot > 3 {
+		return 0, s
+	}
+	n := 0
+	for _, c := range s[:dot] {
+		if c < '0' || c > '9' {
+			return 0, s
+		}
+		n = n*10 + int(c-'0')
+	}
+	return n, strings.TrimSpace(s[dot+1:])
+}
+
+// firstWords klipper en beskrivelse ned til noget, der kan stå i en prompt uden at
+// fylde den med en hel note.
+func firstWords(s string, n int) string {
+	fields := strings.Fields(s)
+	if len(fields) <= n {
+		return strings.Join(fields, " ")
+	}
+	return strings.Join(fields[:n], " ") + " …"
+}

internal/httpapi/ai_suggest_test.go

@@ -0,0 +1,234 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// fakeModel er en OpenAI-formet endpoint, der svarer med det, prøven har brug for.
+//
+// Den rigtige vej hele vejen igennem: indstillingerne, prompten, parsningen af
+// svaret og skrivningen bagefter. Det, der er værd at prøve her, er ikke om en
+// model kan svare — det er, hvad der sker med svaret, når den har svaret noget.
+func fakeModel(t *testing.T, reply string) string {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"choices": []map[string]any{
+				{"message": map[string]string{"content": reply}},
+			},
+		})
+	}))
+	t.Cleanup(srv.Close)
+	return srv.URL
+}
+
+// useModel peger kontoen på den falske model. Kun en administrator må pege AI'en
+// på en adresse i det private net, og bootstrap-kontoen er en.
+func (ts *testServer) useModel(t *testing.T, url string) {
+	t.Helper()
+	resp, _ := ts.do(t, "PUT", "/api/v1/ai/settings", map[string]any{
+		"provider": "compatible", "base_url": url, "model": "prøvemodel",
+	})
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("gem ai-indstillinger: %d", resp.StatusCode)
+	}
+}
+
+// Forslaget peger tilbage på den opgave, det handler om — også når modellen
+// springer en over. Uden nummeret ville "sæt en dato på den her" lande på en
+// anden opgave end den, den blev skrevet om.
+func TestTidyingTheInboxSuggestsPerTask(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `[
+		{"line": "2. Ring til Anders i morgen p1", "why": "der står et navn og et telefonnummer"}
+	]`))
+
+	first := ts.quickTask(t, "noget som helst")
+	second := ts.quickTask(t, "anders 12345678")
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/inbox/tidy", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("ryd op: %d %v", resp.StatusCode, out)
+	}
+	list, _ := out["suggestions"].([]any)
+	if len(list) != 1 {
+		t.Fatalf("forslag = %v, want ét", list)
+	}
+	sug := list[0].(map[string]any)
+	if sug["task_id"] != second {
+		t.Errorf("forslaget peger på %v, want den anden opgave (%v)", sug["task_id"], second)
+	}
+	if sug["line"] != "Ring til Anders i morgen p1" {
+		t.Errorf("nummeret blev ikke taget af linjen: %v", sug["line"])
+	}
+	if sug["why"] == "" {
+		t.Error("forslaget siger ikke hvorfor")
+	}
+	_ = first
+}
+
+// Et ja skriver forslaget ind i opgaven — gennem den samme parser som alt andet,
+// så "i morgen" betyder det samme her som i feltet øverst i fladen.
+func TestAcceptingASuggestionWritesItIntoTheTask(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `[]`))
+	taskID := ts.quickTask(t, "anders")
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/inbox/tidy/apply", map[string]any{
+		"task_id": taskID, "line": "Ring til Anders i morgen p1",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("accepter: %d %v", resp.StatusCode, out)
+	}
+	if out["content"] != "Ring til Anders" {
+		t.Errorf("indhold = %v", out["content"])
+	}
+	if out["priority"] != float64(1) {
+		t.Errorf("prioritet = %v, want 1", out["priority"])
+	}
+	if out["due_date"] == nil || out["due_date"] == "" {
+		t.Errorf("datoen blev ikke sat: %v", out["due_date"])
+	}
+}
+
+// Et projekt, modellen har fundet på, flytter ingenting. Den fik listen over dem,
+// der findes, og et navn uden for den er et gæt — et gæt må ikke kunne flytte en
+// opgave hen, hvor ejeren ikke leder efter den.
+func TestAnInventedProjectDoesNotMoveTheTask(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `[]`))
+	taskID := ts.quickTask(t, "anders")
+
+	_, before := ts.do(t, "GET", "/api/v1/tasks/"+taskID, nil)
+	resp, after := ts.do(t, "POST", "/api/v1/ai/inbox/tidy/apply", map[string]any{
+		"task_id": taskID, "line": "Ring til Anders #EtProjektDerIkkeFindes",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("accepter: %d", resp.StatusCode)
+	}
+	if after["project_id"] != before["project_id"] {
+		t.Errorf("opgaven blev flyttet til %v (var %v)", after["project_id"], before["project_id"])
+	}
+}
+
+// En note bliver ikke rørt, når der bliver lavet opgaver ud af den. En tekst, et
+// program skriver i uden at blive bedt om det, er en tekst, man holder op med at
+// stole på.
+func TestTasksFromANoteLeaveTheNoteAlone(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `[
+		{"line": "Send prisliste til Anders på fredag", "why": "“jeg sender prislisten fredag”"}
+	]`))
+
+	body := "# Møde med Anders\njeg sender prislisten fredag"
+	noteID := ts.createNote(t, body)
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/notes/"+noteID+"/actions", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("find opgaver: %d %v", resp.StatusCode, out)
+	}
+	list, _ := out["suggestions"].([]any)
+	if len(list) != 1 {
+		t.Fatalf("forslag = %v, want ét", list)
+	}
+	line := list[0].(map[string]any)["line"].(string)
+
+	resp, task := ts.do(t, "POST", "/api/v1/ai/notes/"+noteID+"/actions/apply",
+		map[string]any{"line": line})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("accepter: %d %v", resp.StatusCode, task)
+	}
+	if task["content"] != "Send prisliste til Anders" {
+		t.Errorf("opgave = %v", task["content"])
+	}
+	// Opgaven bærer, hvor den kom fra, som et notelink.
+	if task["description"] != "[[Møde med Anders]]" {
+		t.Errorf("beskrivelse = %v, want et link til noten", task["description"])
+	}
+
+	_, note := ts.do(t, "GET", "/api/v1/notes/"+noteID, nil)
+	if note["body"] != body {
+		t.Errorf("noten blev rettet:\n%v", note["body"])
+	}
+}
+
+// Uden en model er funktionen slået fra — ikke i stykker. Svaret skal kunne
+// kendes fra en fejl, så fladen kan sige "læg din nøgle ind" frem for "der skete
+// noget".
+func TestSuggestionsAreOffWithoutAModel(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	for _, path := range []string{"/api/v1/ai/inbox/tidy"} {
+		if resp, _ := ts.do(t, "POST", path, nil); resp.StatusCode != http.StatusConflict {
+			t.Errorf("%s gav %d, want 409", path, resp.StatusCode)
+		}
+	}
+}
+
+// quickTask lægger en linje i indbakken gennem den samme vej som feltet øverst.
+func (ts *testServer) quickTask(t *testing.T, text string) string {
+	t.Helper()
+	resp, out := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{"text": text})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quickadd %q: %d %v", text, resp.StatusCode, out)
+	}
+	id, _ := out["id"].(string)
+	if id == "" {
+		t.Fatalf("quickadd gav intet id: %v", out)
+	}
+	return id
+}
+
+// Svaret på et spørgsmål bærer, hvad det står på — og kun det, det faktisk brugte.
+// En liste over alt, der blev kigget i, er ikke en henvisning.
+func TestAskingAnswersFromYourOwnNotes(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `{"answer": "Du lovede Anders prislisten fredag.", "sources": [1]}`))
+
+	ts.createNote(t, "# Møde med Anders\njeg sender prislisten fredag")
+	ts.createNote(t, "# Noget helt andet\nanders er ikke nævnt her")
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/ask", map[string]any{"question": "hvad lovede jeg Anders?"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("spørg: %d %v", resp.StatusCode, out)
+	}
+	if out["answer"] != "Du lovede Anders prislisten fredag." {
+		t.Errorf("svar = %v", out["answer"])
+	}
+	sources, _ := out["sources"].([]any)
+	if len(sources) != 1 {
+		t.Fatalf("kilder = %v, want én", sources)
+	}
+	src := sources[0].(map[string]any)
+	if src["kind"] != "note" || src["title"] != "Møde med Anders" {
+		t.Errorf("kilde = %v", src)
+	}
+}
+
+// Et spørgsmål, der ikke rammer noget, får ikke et opfundet svar. Man spørger om
+// sine egne noter, fordi man ikke selv kan huske det, og kan derfor ikke se, at
+// svaret var gættet.
+func TestAskingAboutNothingAnswersNothing(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.useModel(t, fakeModel(t, `{"answer": "det burde du huske", "sources": []}`))
+
+	resp, out := ts.do(t, "POST", "/api/v1/ai/ask",
+		map[string]any{"question": "kvadratrodenafenbanan"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("spørg: %d", resp.StatusCode)
+	}
+	if out["answer"] != "" {
+		t.Errorf("der blev svaret uden noget at svare ud fra: %v", out["answer"])
+	}
+}

internal/httpapi/audit_handlers.go

@@ -0,0 +1,111 @@
+package httpapi
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// What has happened on this server, across every project.
+//
+// The per-project history under /projects/{id}/activity is the same rows read by
+// the people who work in that project. This is the administrator's version of the
+// question, and it is a different one: an administrator is not necessarily a member
+// of the project they need to look into, and "which account did that" cannot be
+// asked one project at a time.
+//
+// It sits beside the error log for a reason. That one is the half about what broke;
+// this is the half about what was done, and an instance had only ever had the first.
+
+type auditEntryJSON struct {
+	ID          string `json:"id"`
+	At          string `json:"at"`
+	ProjectID   string `json:"project_id"`
+	ProjectName string `json:"project_name"`
+	TaskID      string `json:"task_id,omitempty"`
+	// UserID and UserName are absent when the account has been deleted. The row
+	// stays — an audit log that lost its rows when somebody left would be missing
+	// exactly the part worth keeping.
+	UserID   string         `json:"user_id,omitempty"`
+	UserName string         `json:"user_name,omitempty"`
+	Event    string         `json:"event"`
+	Payload  map[string]any `json:"payload,omitempty"`
+}
+
+func (s *Server) handleAuditLog(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	f := store.AuditFilter{
+		UserID:    q.Get("user_id"),
+		ProjectID: q.Get("project_id"),
+		Event:     q.Get("event"),
+		Limit:     parseLimit(q.Get("limit"), 100, 500),
+	}
+	if cursor := q.Get("before"); cursor != "" {
+		at, id, ok := parseAuditCursor(cursor)
+		if !ok {
+			writeError(w, http.StatusBadRequest, CodeBadRequest,
+				"before must be <unix>:<id>, as next_cursor returns it")
+			return
+		}
+		f.BeforeAt, f.BeforeID = at, id
+	}
+
+	entries, err := s.db.ListAuditLog(r.Context(), f)
+	if err != nil {
+		s.internal(w, r, "list audit log", err)
+		return
+	}
+
+	out := make([]auditEntryJSON, 0, len(entries))
+	for _, a := range entries {
+		out = append(out, auditEntryJSON{
+			ID: a.ID, At: a.CreatedAt.Format(time.RFC3339),
+			ProjectID: a.ProjectID, ProjectName: a.ProjectName, TaskID: a.TaskID,
+			UserID: a.UserID, UserName: a.UserName, Event: a.Event, Payload: a.Payload,
+		})
+	}
+
+	body := map[string]any{"activity": out}
+	// A cursor only when the page was full. A short page is the end of the log, and
+	// a cursor there invites one more request that can only come back empty.
+	if len(entries) == f.Limit && f.Limit > 0 {
+		last := entries[len(entries)-1]
+		body["next_cursor"] = strconv.FormatInt(last.CreatedAt.Unix(), 10) + ":" + last.ID
+	}
+	writeJSON(w, http.StatusOK, body)
+}
+
+// handleAuditEvents is what the event filter is drawn from: the names that occur,
+// with counts. Offered rather than typed — "member.role_changed" is an internal
+// vocabulary, and a text field for it is a field that returns nothing until you
+// have read the source.
+func (s *Server) handleAuditEvents(w http.ResponseWriter, r *http.Request) {
+	events, err := s.db.AuditEvents(r.Context())
+	if err != nil {
+		s.internal(w, r, "list audit events", err)
+		return
+	}
+	out := make([]map[string]any, 0, len(events))
+	for _, e := range events {
+		out = append(out, map[string]any{"event": e.Event, "count": e.Count})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"events": out})
+}
+
+// parseAuditCursor reads "<unix>:<id>" — the pair the keyset walk needs. Both
+// halves are required: a cursor carrying only a timestamp cannot separate two rows
+// written in the same second, which is the case it exists for.
+func parseAuditCursor(s string) (int64, string, bool) {
+	at, id, found := strings.Cut(s, ":")
+	if !found || id == "" {
+		return 0, "", false
+	}
+	unix, err := strconv.ParseInt(at, 10, 64)
+	if err != nil || unix <= 0 {
+		return 0, "", false
+	}
+	return unix, id, true
+}

internal/httpapi/audit_test.go

@@ -0,0 +1,264 @@
+package httpapi
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+// The point of the instance-wide log is that it crosses projects the caller is not
+// a member of. The per-project endpoint cannot answer this question, and an
+// administrator asking "what has happened on this server" was previously told to
+// go and look in each project they happen to belong to.
+func TestTheAuditLogCrossesProjectsTheAdminIsNotInAllOfThem(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+
+	// A project the administrator is not a member of.
+	_, theirs := other.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Deres eget"})
+	theirID := theirs["id"].(string)
+	other.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "noget i deres eget", "project_id": theirID,
+	})
+
+	// The administrator cannot read that project's own history at all.
+	if resp, _ := ts.do(t, "GET", "/api/v1/projects/"+theirID+"/activity", nil); resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("a project the admin is not in: status %d, want 404", resp.StatusCode)
+	}
+
+	// The instance log has it.
+	resp, body := ts.do(t, "GET", "/api/v1/activity", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("audit log: status %d", resp.StatusCode)
+	}
+	entries, _ := body["activity"].([]any)
+	var found map[string]any
+	for _, raw := range entries {
+		e := raw.(map[string]any)
+		if e["project_id"] == theirID && e["event"] == "task.created" {
+			found = e
+		}
+	}
+	if found == nil {
+		t.Fatalf("nothing from a project the admin is not in: %v", entries)
+	}
+	if found["project_name"] != "Deres eget" {
+		t.Errorf("project_name = %v — a row that does not name its project says nothing",
+			found["project_name"])
+	}
+	if found["user_name"] != "Anden" {
+		t.Errorf("user_name = %v", found["user_name"])
+	}
+}
+
+// Administrators only, and sessions only. An audit log readable with a bearer token
+// would let a stolen token read the record of the theft — and of everything else on
+// the instance.
+func TestTheAuditLogIsAdminsOnlyAndSessionsOnly(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+
+	for _, path := range []string{"/api/v1/activity", "/api/v1/activity/events"} {
+		if resp, _ := other.do(t, "GET", path, nil); resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s as an ordinary user: status %d, want 403", path, resp.StatusCode)
+		}
+	}
+
+	admin, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := ts.apiToken(t, admin.ID)
+	for _, path := range []string{"/api/v1/activity", "/api/v1/activity/events"} {
+		req, _ := http.NewRequest("GET", ts.URL+path, nil)
+		req.Header.Set("Authorization", "Bearer "+token)
+		resp, err := (&http.Client{}).Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s with an admin's API token: status %d, want 403", path, resp.StatusCode)
+		}
+	}
+}
+
+// The cursor is keyed on (created_at, id) because the log is written in whole
+// seconds. A page boundary that landed inside a busy second would, with a
+// timestamp-only cursor, either repeat those rows or skip them — and an audit log
+// that skips rows is worse than no audit log.
+func TestTheAuditLogPagesWithoutRepeatingOrSkipping(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, project := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Meget"})
+	projectID := project["id"].(string)
+	// Written as fast as the loop goes, so they share timestamps.
+	const written = 25
+	for i := range written {
+		ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+			"content": fmt.Sprintf("opgave %d", i), "project_id": projectID,
+		})
+	}
+
+	seen := map[string]bool{}
+	cursor := ""
+	for page := 0; page < 20; page++ {
+		path := "/api/v1/activity?limit=4"
+		if cursor != "" {
+			path += "&before=" + cursor
+		}
+		resp, body := ts.do(t, "GET", path, nil)
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("page %d: status %d", page, resp.StatusCode)
+		}
+		entries, _ := body["activity"].([]any)
+		for _, raw := range entries {
+			id := raw.(map[string]any)["id"].(string)
+			if seen[id] {
+				t.Fatalf("row %s came back on two pages", id)
+			}
+			seen[id] = true
+		}
+		next, _ := body["next_cursor"].(string)
+		if next == "" {
+			break
+		}
+		if next == cursor {
+			t.Fatalf("the cursor did not move: %s", next)
+		}
+		cursor = next
+	}
+
+	// Everything that was written is in the walk exactly once: the task creations,
+	// plus the project creation.
+	if len(seen) != written+1 {
+		t.Errorf("the walk saw %d rows, want %d — a page boundary lost some",
+			len(seen), written+1)
+	}
+}
+
+// The filters, and the list the event filter is drawn from.
+func TestTheAuditLogFiltersAndListsItsEvents(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+	otherUser, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, mine := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Mit"})
+	mineID := mine["id"].(string)
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "min", "project_id": mineID})
+
+	_, theirs := other.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Deres"})
+	theirID := theirs["id"].(string)
+	other.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "deres", "project_id": theirID})
+
+	_, byUser := ts.do(t, "GET", "/api/v1/activity?user_id="+otherUser.ID, nil)
+	for _, raw := range byUser["activity"].([]any) {
+		if got := raw.(map[string]any)["user_id"]; got != otherUser.ID {
+			t.Errorf("user_id filter returned a row by %v", got)
+		}
+	}
+	if len(byUser["activity"].([]any)) == 0 {
+		t.Error("the user filter returned nothing")
+	}
+
+	_, byProject := ts.do(t, "GET", "/api/v1/activity?project_id="+mineID, nil)
+	for _, raw := range byProject["activity"].([]any) {
+		if got := raw.(map[string]any)["project_id"]; got != mineID {
+			t.Errorf("project_id filter returned a row from %v", got)
+		}
+	}
+
+	_, byEvent := ts.do(t, "GET", "/api/v1/activity?event=project.created", nil)
+	rows := byEvent["activity"].([]any)
+	if len(rows) != 2 {
+		t.Errorf("event filter found %d project.created rows, want 2", len(rows))
+	}
+	for _, raw := range rows {
+		if got := raw.(map[string]any)["event"]; got != "project.created" {
+			t.Errorf("event filter returned %v", got)
+		}
+	}
+
+	// And the vocabulary the filter is built from.
+	_, events := ts.do(t, "GET", "/api/v1/activity/events", nil)
+	counts := map[string]float64{}
+	for _, raw := range events["events"].([]any) {
+		e := raw.(map[string]any)
+		counts[e["event"].(string)] = e["count"].(float64)
+	}
+	if counts["project.created"] != 2 || counts["task.created"] != 2 {
+		t.Errorf("event counts = %v", counts)
+	}
+
+	// A malformed cursor is a 400, not a silent first page: paging that quietly
+	// restarts is how an audit walk reads the same rows forever.
+	if resp, _ := ts.do(t, "GET", "/api/v1/activity?before=igår", nil); resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("a malformed cursor: status %d, want 400", resp.StatusCode)
+	}
+}
+
+// A deleted account leaves its trail behind. This is the reason migration 0009
+// exists: an audit log that lost its rows when somebody left would be missing
+// exactly the part worth keeping.
+func TestTheAuditLogOutlivesTheAccountItDescribes(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+	otherUser, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// In a project that outlives them, so the row is not carried off by the
+	// project cascade instead.
+	_, mine := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Fælles"})
+	sharedID := mine["id"].(string)
+	ts.do(t, "POST", "/api/v1/projects/"+sharedID+"/invites", map[string]any{
+		"email": "[email protected]", "role": "editor",
+	})
+	other.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "deres bidrag", "project_id": sharedID,
+	})
+
+	_, before := ts.do(t, "GET", "/api/v1/activity?user_id="+otherUser.ID+"&event=task.created", nil)
+	if len(before["activity"].([]any)) != 1 {
+		t.Fatalf("expected one row before the delete: %v", before["activity"])
+	}
+
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/users/"+otherUser.ID, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete: status %d", resp.StatusCode)
+	}
+
+	_, after := ts.do(t, "GET", "/api/v1/activity?project_id="+sharedID+"&event=task.created", nil)
+	rows := after["activity"].([]any)
+	if len(rows) != 1 {
+		t.Fatalf("the row went with the account: %v", rows)
+	}
+	row := rows[0].(map[string]any)
+	if _, ok := row["user_id"]; ok {
+		t.Errorf("user_id is still there after the account went: %v", row["user_id"])
+	}
+	if _, ok := row["user_name"]; ok {
+		t.Errorf("user_name is still there after the account went: %v", row["user_name"])
+	}
+
+	// And the project's own history still shows it, rather than dropping the row
+	// on an inner join to a user that is gone.
+	_, project := ts.do(t, "GET", "/api/v1/projects/"+sharedID+"/activity", nil)
+	var kept int
+	for _, raw := range project["activity"].([]any) {
+		if raw.(map[string]any)["event"] == "task.created" {
+			kept++
+		}
+	}
+	if kept != 1 {
+		t.Errorf("the project history dropped the authorless row: %d", kept)
+	}
+}

internal/httpapi/auth_handlers.go

@@ -8,6 +8,8 @@ import (
 	"time"
 	"unicode/utf8"
 
+	"github.com/go-chi/chi/v5/middleware"
+
 	"github.com/kristianwind/verdande/internal/auth"
 	"github.com/kristianwind/verdande/internal/store"
 )
@@ -25,17 +27,133 @@ type userJSON struct {
 	Locale      string `json:"locale"`
 	IsAdmin     bool   `json:"is_admin"`
 	TOTPEnabled bool   `json:"totp_enabled"`
-	CreatedAt   string `json:"created_at"`
+	// SidebarCollapsed is which sidebar headings this person has folded away. On
+	// the account rather than in the browser, because folding one is a statement
+	// about the work and not about the screen — the sidebar's width is the
+	// opposite case and stays in localStorage.
+	SidebarCollapsed []string `json:"sidebar_collapsed"`
+	NavOrder         []string `json:"nav_order"`
+	// DefaultReminderMin is the account's standing alarm on tasks that have a
+	// clock, as minutes relative to the due moment and negative for before it.
+	// Null is off, which is where every account starts.
+	//
+	// A pointer rather than a number with a sentinel, so that "off" and "at the
+	// due moment" stay different answers: zero is a real setting here.
+	DefaultReminderMin *int   `json:"default_reminder_min"`
+	CreatedAt          string `json:"created_at"`
 }
 
 func toUserJSON(u *store.User) userJSON {
+	collapsed := u.SidebarCollapsed
+	// Never null in the response: a client that has to check for both an absent
+	// array and an empty one will one day check for only one of them.
+	if collapsed == nil {
+		collapsed = []string{}
+	}
+	order := u.NavOrder
+	if order == nil {
+		order = []string{}
+	}
 	return userJSON{
 		ID: u.ID, Email: u.Email, Name: u.Name, AvatarColor: u.AvatarColor,
 		Timezone: u.Timezone, Locale: u.Locale, IsAdmin: u.IsAdmin,
-		TOTPEnabled: u.TOTPEnabled, CreatedAt: u.CreatedAt.Format(time.RFC3339),
+		TOTPEnabled: u.TOTPEnabled, SidebarCollapsed: collapsed, NavOrder: order,
+		DefaultReminderMin: u.DefaultReminderMin,
+		CreatedAt:          u.CreatedAt.Format(time.RFC3339),
 	}
 }
 
+// handleSetSidebarSections records which sidebar headings are folded away.
+//
+// Its own route rather than a field on the profile: that one backs a form with a
+// save button and validates three fields together, and this writes on every click
+// of a chevron. Sharing the path would mean a fold sending a name and a timezone
+// it was never asked to change — and a validation error on one of those failing a
+// fold.
+//
+// The keys are the sidebar's and are not checked here. An unknown one costs
+// nothing: the sidebar folds the headings it recognises and ignores the rest, so
+// a heading that is renamed or removed leaves a harmless entry rather than a
+// migration.
+func (s *Server) handleSetSidebarSections(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Sections []string `json:"sections"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	// A cap, because this is a list the client decides the length of. Twenty is far
+	// more headings than the sidebar has ever had.
+	if len(req.Sections) > 20 {
+		writeError(w, http.StatusBadRequest, CodeBadRequest, "too many sections")
+		return
+	}
+	user := userFrom(r.Context())
+	if err := s.db.SetSidebarCollapsed(r.Context(), user.ID, req.Sections); err != nil {
+		s.storeError(w, r, "set sidebar sections", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleSetNavOrder records the order of the fixed views in the sidebar.
+//
+// Its own route for the same reason as the folds: this writes on every drop, and
+// sharing the profile's path would make a reorder send a name and a timezone it
+// was never asked to change.
+func (s *Server) handleSetNavOrder(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Order []string `json:"order"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if len(req.Order) > 20 {
+		writeError(w, http.StatusBadRequest, CodeBadRequest, "too many entries")
+		return
+	}
+	user := userFrom(r.Context())
+	if err := s.db.SetNavOrder(r.Context(), user.ID, req.Order); err != nil {
+		s.storeError(w, r, "set nav order", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleSetDefaultReminder turns the account's standing alarm on or off.
+//
+// `minutes` is relative to the due moment and negative for before it, which is the
+// convention reminders.offset_min uses because that is the column it lands in. Null
+// is off. A positive number is refused: an alarm AFTER the thing it is warning
+// about is not a reminder, and allowing it here would make the one mistake this
+// value can make — a sign the wrong way round — look like a choice.
+func (s *Server) handleSetDefaultReminder(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Minutes *int `json:"minutes"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if req.Minutes != nil {
+		switch {
+		case *req.Minutes > 0:
+			writeFieldErrors(w, map[string]string{"minutes": "must be zero or negative — an alarm comes before"})
+			return
+		// A week is the outer edge of "remind me ahead of this"; beyond it the
+		// number is far more likely to be a unit mistake than an intention.
+		case *req.Minutes < -7*24*60:
+			writeFieldErrors(w, map[string]string{"minutes": "must be within a week of the due time"})
+			return
+		}
+	}
+	user := userFrom(r.Context())
+	if err := s.db.SetDefaultReminder(r.Context(), user.ID, req.Minutes); err != nil {
+		s.storeError(w, r, "set default reminder", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
 // --- sign in -----------------------------------------------------------------
 
 type loginRequest struct {
@@ -78,7 +196,21 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	s.loginLimiter.reset(clientIP(r))
+	// The bucket is cleared only when the login is *finished*.
+	//
+	// It used to be cleared here, on the strength of the password alone — before
+	// the second factor had been asked for at all. That handed somebody who
+	// already had the password an unlimited supply of ten-guess batches: log in,
+	// get a fresh bucket and a fresh pending session, spend ten guesses on the
+	// code, log in again. At three valid codes in any moment and twenty requests a
+	// second, that is even odds inside an afternoon — against the one control that
+	// exists precisely for when the password is already gone.
+	//
+	// So an account with a second factor clears nothing yet. handleLoginTOTP does
+	// it, once the code is right.
+	if !user.TOTPEnabled {
+		s.loginLimiter.reset(clientIP(r))
+	}
 
 	// A session that still needs a code gets a short life of its own: long enough
 	// to fetch a phone, not long enough to be worth stealing.
@@ -88,7 +220,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 	token, _, err := s.db.CreateSession(r.Context(), user.ID, r.UserAgent(), clientIP(r), ttl, user.TOTPEnabled)
 	if err != nil {
-		s.internal(w, "create session", err)
+		s.internal(w, r, "create session", err)
 		return
 	}
 	s.setSessionCookie(w, token, ttl)
@@ -115,13 +247,52 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 	user := userFrom(r.Context())
 	session := sessionFrom(r.Context())
 
-	err := auth.VerifyTOTP(user.TOTPSecret, req.Code, time.Now())
+	// Counted per account as well as per address.
+	//
+	// The address bucket alone is defeated by anybody with more than one, which is
+	// the ordinary case — a phone and a laptop is already two. A code is six
+	// digits: the only thing that makes it safe is that guesses are scarce, and
+	// scarcity has to be counted against the thing being attacked.
+	if ok, retry := s.totpLimiter.allow(user.ID); !ok {
+		w.Header().Set("Retry-After", retryAfterSeconds(retry))
+		writeError(w, http.StatusTooManyRequests, CodeRateLimited,
+			"too many verification codes; wait a moment and try again")
+		return
+	}
+
+	step, err := auth.TOTPStep(user.TOTPSecret, req.Code, time.Now())
+	if err == nil {
+		// The code is right; now it must also be unused. A TOTP code stays valid for
+		// its whole window, so one observed in flight — a phishing page, a proxy,
+		// over the shoulder — could otherwise be replayed until it expires. Spending
+		// the step here makes it single-use: a second presentation of the same code,
+		// or an earlier one, finds the step already gone.
+		fresh, cerr := s.db.ConsumeTOTPStep(r.Context(), user.ID, step)
+		if cerr != nil {
+			s.internal(w, r, "consume totp step", cerr)
+			return
+		}
+		if !fresh {
+			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
+				"that verification code has already been used")
+			return
+		}
+	}
 	if err != nil {
 		// A recovery code is accepted in the same field. Making somebody find a
 		// different form while locked out of their account is a poor time to
 		// introduce a second concept.
 		used, rerr := s.db.UseRecoveryCode(r.Context(), user.ID, req.Code)
 		if rerr != nil || !used {
+			// The pending session is left alive on purpose.
+			//
+			// Ending it on the first wrong digit was considered and rejected: it
+			// would make somebody who mistyped one number type their password again,
+			// and it buys almost nothing. What makes a six-digit code safe is that
+			// guesses are scarce, and the per-account bucket above is what makes
+			// them scarce — ten an hour, however many times the password is
+			// re-entered. The attack this closes was never "one session, many
+			// guesses"; it was "a fresh bucket for every password check".
 			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
 				"that verification code is not valid")
 			return
@@ -129,8 +300,13 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		s.log.Info("recovery code used", "user", user.ID)
 	}
 
+	// Finished. Now the buckets may be cleared — both of them, so somebody who
+	// fumbled the code twice is not still waiting once they get it right.
+	s.loginLimiter.reset(clientIP(r))
+	s.totpLimiter.reset(user.ID)
+
 	if err := s.db.PromoteSession(r.Context(), session.ID, s.cfg.SessionTTL); err != nil {
-		s.internal(w, "promote session", err)
+		s.internal(w, r, "promote session", err)
 		return
 	}
 	// The cookie is reissued so its lifetime matches the session's new one.
@@ -210,13 +386,13 @@ func (s *Server) handleUpdateProfile(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := s.db.UpdateProfile(r.Context(), user.ID, name, timezone, locale); err != nil {
-		s.storeError(w, "update profile", err)
+		s.storeError(w, r, "update profile", err)
 		return
 	}
 
 	updated, err := s.db.UserByID(r.Context(), user.ID)
 	if err != nil {
-		s.internal(w, "reload user", err)
+		s.internal(w, r, "reload user", err)
 		return
 	}
 	writeJSON(w, http.StatusOK, toUserJSON(updated))
@@ -263,7 +439,7 @@ func (s *Server) handleSignup(w http.ResponseWriter, r *http.Request) {
 
 	hash, err := auth.HashPassword(req.Password)
 	if err != nil {
-		s.internal(w, "hash password", err)
+		s.internal(w, r, "hash password", err)
 		return
 	}
 
@@ -277,14 +453,14 @@ func (s *Server) handleSignup(w http.ResponseWriter, r *http.Request) {
 				"an account already exists for that email address")
 			return
 		}
-		s.internal(w, "create user", err)
+		s.internal(w, r, "create user", err)
 		return
 	}
 
 	// Accepting the invite is what adds the membership and burns the token, in one
 	// transaction: a signup that half-succeeded would leave a usable invite behind.
 	if err := s.db.AcceptInvite(r.Context(), invite.ID, user.ID); err != nil {
-		s.internal(w, "accept invite", err)
+		s.internal(w, r, "accept invite", err)
 		return
 	}
 
@@ -328,7 +504,7 @@ func (s *Server) handleBootstrap(w http.ResponseWriter, r *http.Request) {
 
 	hash, err := auth.HashPassword(req.Password)
 	if err != nil {
-		s.internal(w, "hash password", err)
+		s.internal(w, r, "hash password", err)
 		return
 	}
 
@@ -341,7 +517,7 @@ func (s *Server) handleBootstrap(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusConflict, CodeConflict, "this instance is already set up")
 			return
 		}
-		s.internal(w, "create first admin", err)
+		s.internal(w, r, "create first admin", err)
 		return
 	}
 
@@ -355,16 +531,23 @@ func (s *Server) handleBootstrap(w http.ResponseWriter, r *http.Request) {
 func (s *Server) handleSetupState(w http.ResponseWriter, r *http.Request) {
 	n, err := s.db.UserCount(r.Context())
 	if err != nil {
-		s.internal(w, "count users", err)
+		s.internal(w, r, "count users", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]bool{"needs_setup": n == 0})
+	// Udgaven hører til her og ikke på /auth/me: den er en egenskab ved
+	// instansen, ikke ved den, der er logget ind, og fladen skal kende den, før
+	// nogen er. Det her er i forvejen kaldet, der spørger "hvad er det her for en
+	// instans", så den følger med uden en ekstra tur.
+	writeJSON(w, http.StatusOK, struct {
+		NeedsSetup bool   `json:"needs_setup"`
+		Edition    string `json:"edition"`
+	}{n == 0, s.edition()})
 }
 
 func (s *Server) startSession(w http.ResponseWriter, r *http.Request, user *store.User) {
 	token, _, err := s.db.CreateSession(r.Context(), user.ID, r.UserAgent(), clientIP(r), s.cfg.SessionTTL, false)
 	if err != nil {
-		s.internal(w, "create session", err)
+		s.internal(w, r, "create session", err)
 		return
 	}
 	s.setSessionCookie(w, token, s.cfg.SessionTTL)
@@ -393,7 +576,7 @@ func (s *Server) handleForgotPassword(w http.ResponseWriter, r *http.Request) {
 	if err == nil {
 		token, err := s.db.CreatePasswordReset(r.Context(), user.ID, s.cfg.ResetTTL)
 		if err != nil {
-			s.internal(w, "create password reset", err)
+			s.internal(w, r, "create password reset", err)
 			return
 		}
 		link := s.cfg.BaseURL + "/reset?token=" + token
@@ -431,13 +614,13 @@ func (s *Server) handleResetPassword(w http.ResponseWriter, r *http.Request) {
 
 	hash, err := auth.HashPassword(req.Password)
 	if err != nil {
-		s.internal(w, "hash password", err)
+		s.internal(w, r, "hash password", err)
 		return
 	}
 	// Every session ends: a password reset is what somebody does when they think
 	// another person has been in their account.
 	if err := s.db.UpdatePasswordHash(r.Context(), userID, hash, ""); err != nil {
-		s.internal(w, "update password", err)
+		s.internal(w, r, "update password", err)
 		return
 	}
 
@@ -469,7 +652,7 @@ func (s *Server) handleChangePassword(w http.ResponseWriter, r *http.Request) {
 
 	hash, err := auth.HashPassword(req.NewPassword)
 	if err != nil {
-		s.internal(w, "hash password", err)
+		s.internal(w, r, "hash password", err)
 		return
 	}
 	keep := ""
@@ -477,7 +660,7 @@ func (s *Server) handleChangePassword(w http.ResponseWriter, r *http.Request) {
 		keep = session.ID
 	}
 	if err := s.db.UpdatePasswordHash(r.Context(), user.ID, hash, keep); err != nil {
-		s.internal(w, "update password", err)
+		s.internal(w, r, "update password", err)
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -520,7 +703,64 @@ func inboxName(locale string) string {
 // internal logs the real error and tells the client nothing about it. The detail
 // belongs in the log, where the operator can see it; in the response it would be a
 // description of the server's internals handed to whoever asked.
-func (s *Server) internal(w http.ResponseWriter, what string, err error) {
+//
+// It is also written to the database. On a Rune the log is the container's, and
+// every restart begins a new one — so the panel reports "HTTP 5xx, twice, at
+// 11:49" long after the line explaining it has gone, which tells an operator that
+// something broke and gives them no way to find out what. The row outlives the
+// container; Indstillinger → Fejl is where it is read.
+// upstream reports a failure that came from somebody else's service.
+//
+// Separate from `internal` because the cause is different and so is the fix: a 500
+// is this server broken, and this is Google — or whoever — saying no. The status
+// says so (502), and the message is passed through rather than replaced, because
+// "invalid_grant" or "insufficient authentication scopes" is the whole diagnosis
+// and a generic sentence in its place throws it away.
+//
+// It is recorded like a 500 for exactly the reason the error log exists: a Gmail
+// sync that has been failing for a week is invisible otherwise. The background job
+// writes a log line the next restart erases, and nobody is watching the one screen
+// that would have said so.
+// StatusUpstreamRefused is what this server answers when a service it depends on
+// says no. Not 502, though that is what it means: a proxy is entitled to replace
+// the body of an origin 5xx with a page of its own, and Cloudflare does. That
+// swallowed every explanation this server produced — "gmail: 403 Forbidden",
+// "the panel refused: HTTP 401" — and left the interface with nothing to show but
+// "something went wrong". A 4xx passes through untouched, and the truth reaching
+// the person who has to act on it beats the tidier status code.
+const StatusUpstreamRefused = http.StatusUnprocessableEntity
+
+func (s *Server) upstream(w http.ResponseWriter, r *http.Request, code, what string, err error) {
+	s.log.Warn(what, "err", err)
+
+	userID := ""
+	if u := userFrom(r.Context()); u != nil {
+		userID = u.ID
+	}
+	s.db.RecordError(r.Context(), store.ServerError{
+		Method: r.Method, Path: r.URL.Path, Status: StatusUpstreamRefused,
+		What: what, Message: err.Error(), UserID: userID,
+		RequestID: middleware.GetReqID(r.Context()),
+	})
+
+	writeError(w, StatusUpstreamRefused, code, err.Error())
+}
+
+func (s *Server) internal(w http.ResponseWriter, r *http.Request, what string, err error) {
 	s.log.Error(what, "err", err)
+
+	userID := ""
+	if u := userFrom(r.Context()); u != nil {
+		userID = u.ID
+	}
+	// Best effort, and deliberately not checked: this is the path that is already
+	// reporting a failure, and a diagnostic that can fail the request would turn
+	// one broken screen into two.
+	s.db.RecordError(r.Context(), store.ServerError{
+		Method: r.Method, Path: r.URL.Path, Status: http.StatusInternalServerError,
+		What: what, Message: err.Error(), UserID: userID,
+		RequestID: middleware.GetReqID(r.Context()),
+	})
+
 	writeError(w, http.StatusInternalServerError, CodeInternal, "something went wrong")
 }

internal/httpapi/auth_test.go

@@ -27,6 +27,9 @@ type testServer struct {
 	*httptest.Server
 	db     *store.DB
 	client *http.Client
+	// api er den samme server, routeren hænger på. Et par prøver har brug for at
+	// nå ind i den — se `icsFetch` — og uden den her er der kun håndtaget udefra.
+	api *Server
 }
 
 func newTestServer(t *testing.T) *testServer {
@@ -46,7 +49,9 @@ func newTestServerWith(t *testing.T, configure func(*config.Config)) *testServer
 	t.Cleanup(func() { db.Close() })
 
 	cfg := &config.Config{
-		BaseURL:    "http://127.0.0.1",
+		// `localhost`, not a loopback IP: passkeys refuse an IP address as a relying
+		// party id, and every browser makes the same exception for localhost.
+		BaseURL:    "http://localhost",
 		DataDir:    t.TempDir(),
 		SessionTTL: 24 * time.Hour,
 		InviteTTL:  7 * 24 * time.Hour,
@@ -60,7 +65,8 @@ func newTestServerWith(t *testing.T, configure func(*config.Config)) *testServer
 	// Discard: a passing test should print nothing, and these handlers log freely.
 	log := slog.New(slog.NewTextHandler(io.Discard, nil))
 
-	srv := httptest.NewServer(New(cfg, db, log, nil))
+	api := New(cfg, db, log, nil)
+	srv := httptest.NewServer(api)
 	t.Cleanup(srv.Close)
 
 	jar, err := cookiejar.New(nil)
@@ -73,6 +79,7 @@ func newTestServerWith(t *testing.T, configure func(*config.Config)) *testServer
 		// The cookie jar is what makes this a session test rather than a
 		// sequence of unrelated requests.
 		client: &http.Client{Jar: jar, Timeout: 10 * time.Second},
+		api:    api,
 	}
 }
 
@@ -299,7 +306,11 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 
 	// Begin: a secret exists, but 2FA is not on yet — closing the tab here must
 	// not lock the account.
-	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", nil)
+	// Med adgangskoden: at slå andenfaktoren til er mindst lige så indgribende som
+	// at slå den fra, og den har altid spurgt.
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
 	if resp.StatusCode != http.StatusOK {
 		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
 	}
@@ -361,12 +372,58 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 	}
 }
 
+// A TOTP code works once. A code seen in flight and replayed inside its window
+// must be refused the second time, or the second factor is only as good as the
+// thirty seconds an attacker has to reuse what they captured.
+func TestTOTPCodeIsSingleUse(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
+	}
+	secret, _ := body["secret"].(string)
+	resp, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
+		"code": codeFor(t, secret),
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp confirm: %d %v", resp.StatusCode, body)
+	}
+
+	// One code, captured once and presented twice.
+	code := codeFor(t, secret)
+
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "[email protected]", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("first use of the code failed: %d %v", resp.StatusCode, body)
+	}
+
+	// A second login, same code, same window.
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "[email protected]", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("the same code was accepted twice: %d %v", resp.StatusCode, body)
+	}
+}
+
 // A recovery code is accepted in the same field as a TOTP code, and works once.
 func TestRecoveryCodeCompletesLoginOnce(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)
 
-	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", nil)
+	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
 	secret := body["secret"].(string)
 	_, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
 		"code": codeFor(t, secret),
@@ -761,3 +818,199 @@ func TestUnknownSessionTokenIsUnauthorized(t *testing.T) {
 		t.Errorf("status %d, want 401", resp.StatusCode)
 	}
 }
+
+// last_seen_at has been written on every request since sessions existed, for
+// exactly this list, and nothing read it. A session you cannot see is a session
+// you cannot end.
+func TestSessionsCanBeListedAndEnded(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// A second sign-in from "another device": same account, its own cookie jar.
+	other := &testServer{Server: ts.Server, db: ts.db, client: newJarClient(t)}
+	resp, _ := other.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "[email protected]", "password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("second login: status %d", resp.StatusCode)
+	}
+
+	resp, body := ts.do(t, "GET", "/api/v1/auth/sessions", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("list sessions: %d %v", resp.StatusCode, body)
+	}
+	sessions, _ := body["sessions"].([]any)
+	if len(sessions) != 2 {
+		t.Fatalf("want two sessions, got %v", sessions)
+	}
+
+	// Exactly one is this one, or the interface cannot tell somebody which row is
+	// the browser they are reading it in.
+	current := ""
+	for _, raw := range sessions {
+		s := raw.(map[string]any)
+		if s["current"] == true {
+			if current != "" {
+				t.Fatal("two sessions both claim to be the current one")
+			}
+			current = s["id"].(string)
+		}
+		if s["device"] == "" {
+			t.Errorf("no device summary: %v", s)
+		}
+		if s["last_seen_at"] == nil {
+			t.Errorf("no last_seen_at, which is the whole reason the column is written: %v", s)
+		}
+	}
+	if current == "" {
+		t.Fatal("none of the sessions is marked as the current one")
+	}
+
+	// End the other one.
+	var otherID string
+	for _, raw := range sessions {
+		if s := raw.(map[string]any); s["id"] != current {
+			otherID = s["id"].(string)
+		}
+	}
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/auth/sessions/"+otherID, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete session: status %d", resp.StatusCode)
+	}
+
+	// That device is signed out, and this one is not.
+	if r, _ := other.do(t, "GET", "/api/v1/auth/me", nil); r.StatusCode != http.StatusUnauthorized {
+		t.Errorf("the ended session still works: status %d", r.StatusCode)
+	}
+	if r, _ := ts.do(t, "GET", "/api/v1/auth/me", nil); r.StatusCode != http.StatusOK {
+		t.Errorf("ending another session logged this one out: status %d", r.StatusCode)
+	}
+}
+
+// Somebody else's session is not yours to end, even with its id in hand.
+func TestASessionCanOnlyBeEndedByItsOwner(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+
+	_, body := ts.do(t, "GET", "/api/v1/auth/sessions", nil)
+	mine := body["sessions"].([]any)[0].(map[string]any)["id"].(string)
+
+	if resp, _ := other.do(t, "DELETE", "/api/v1/auth/sessions/"+mine, nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status %d, want 404", resp.StatusCode)
+	}
+	// And it still works.
+	if r, _ := ts.do(t, "GET", "/api/v1/auth/me", nil); r.StatusCode != http.StatusOK {
+		t.Errorf("somebody else ended my session: status %d", r.StatusCode)
+	}
+}
+
+// An API token is accepted almost everywhere, and must not be accepted here: a
+// leaked token that could end its owner's sessions, or even list their devices,
+// turns a theft into a lockout.
+func TestSessionsAreNotReachableWithAToken(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	user, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := ts.apiToken(t, user.ID)
+
+	req, _ := http.NewRequest("GET", ts.URL+"/api/v1/auth/sessions", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := (&http.Client{}).Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("status %d, want 403", resp.StatusCode)
+	}
+}
+
+func TestUserAgentsAreSummarisedForAPerson(t *testing.T) {
+	cases := []struct {
+		ua   string
+		want string
+	}{
+		{"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0 Safari/537.36", "Chrome på macOS"},
+		// An iPhone's user agent says Mac OS X too, so the order of the tests is
+		// the whole correctness of this function.
+		{"Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1", "Safari på iPhone"},
+		// And Edge claims to be Chrome, which claims to be Safari.
+		{"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0 Safari/537.36 Edg/131.0", "Edge på Windows"},
+		{"Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0", "Firefox på Linux"},
+		{"", "Ukendt enhed"},
+		// Not a browser at all. Its own name beats a word that says the server
+		// gave up: a CalDAV client is a real session.
+		{"curl/8.4.0", "curl/8.4.0"},
+	}
+	for _, c := range cases {
+		if got := describeUserAgent(c.ua); got != c.want {
+			t.Errorf("describeUserAgent(%q) = %q, want %q", c.ua, got, c.want)
+		}
+	}
+}
+
+// Andenfaktoren kan ikke slås til uden adgangskoden.
+//
+// Døren åbnede før med et token og lukkede kun med et kodeord: `disable` har
+// altid spurgt, `setup` spurgte om ingenting. Et stjålet token kunne derfor hente
+// hemmeligheden, lægge den i sin egen godkender, bekræfte den og beholde den
+// eneste kopi af gendannelseskoderne — hvorefter ejerens næste login stoppede ved
+// en kode, de ikke havde, og de ikke kunne slå den fra uden at logge ind først.
+func TestTOTPCannotBeSwitchedOnWithoutThePassword(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, _ := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "det forkerte kodeord",
+	})
+	if resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Fatalf("status %d, ventede at en forkert adgangskode blev afvist", resp.StatusCode)
+	}
+
+	resp, _ = ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{})
+	if resp.StatusCode == http.StatusOK {
+		t.Fatal("en tom adgangskode blev accepteret")
+	}
+}
+
+// Ratebegrænseren må ikke nulstilles af adgangskoden alene.
+//
+// Den blev det, og det gav én, der havde kodeordet, ubegrænsede portioner på ti
+// gæt: log ind, få en frisk spand og en frisk ventende session, brug ti gæt på
+// koden, log ind igen. Andenfaktoren findes præcis til det tilfælde, hvor
+// kodeordet allerede er tabt, så den portion skal betales for hver gang.
+func TestAPasswordAloneDoesNotRefillTheCodeAttempts(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	secret := body["secret"].(string)
+	ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{"code": codeFor(t, secret)})
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+
+	// Kodeordet er rigtigt hver gang; kun koden er forkert. Uden loftet ville det
+	// her kunne blive ved i det uendelige.
+	refused := 0
+	for i := 0; i < 14; i++ {
+		resp, _ := ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+			"email": "[email protected]", "password": "et langt kodeord",
+		})
+		if resp.StatusCode == http.StatusTooManyRequests {
+			refused++
+			continue
+		}
+		resp, _ = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": "000000"})
+		if resp.StatusCode == http.StatusTooManyRequests {
+			refused++
+		}
+	}
+	if refused == 0 {
+		t.Fatal("fjorten runder med forkerte koder blev aldrig afvist; spanden fyldes stadig af adgangskoden")
+	}
+}

internal/httpapi/backup_handlers.go

@@ -0,0 +1,158 @@
+package httpapi
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/jobs"
+)
+
+// The nightly backup, made visible.
+//
+// It has run since the beginning and nothing showed it. A backup nobody can see is
+// a backup nobody knows has been failing — and the failure mode is quiet: a volume
+// that went read-only, a disk that filled, a container that has not been up at
+// midnight for a week. The first time anybody finds out is the day they need one.
+//
+// Administrators only, and behind a session as well as the admin check. A backup
+// file is a complete copy of the database, so downloading one is downloading
+// everybody's data; a leaked API token must not be able to.
+
+type backupRunJSON struct {
+	ID      string `json:"id"`
+	Started string `json:"started_at"`
+	// Finished is absent while a backup is still running, and on one that was
+	// interrupted — which is the same shape from outside and honestly so: a run
+	// the process died in the middle of never finished.
+	Finished string `json:"finished_at,omitempty"`
+	Size     int64  `json:"size_bytes"`
+	Error    string `json:"error,omitempty"`
+	// Present says the file is still on disk. Rotation keeps the most recent
+	// fourteen, so an older row is a true record of a backup that was made and a
+	// file that is no longer there — and a download link for it would 404.
+	Present bool `json:"present"`
+}
+
+func (s *Server) handleListBackups(w http.ResponseWriter, r *http.Request) {
+	runs, err := s.db.ListBackupRuns(r.Context(), parseLimit(r.URL.Query().Get("limit"), 30, 100))
+	if err != nil {
+		s.internal(w, r, "list backups", err)
+		return
+	}
+
+	out := make([]backupRunJSON, 0, len(runs))
+	for _, b := range runs {
+		j := backupRunJSON{
+			ID: b.ID, Started: b.StartedAt.Format(time.RFC3339),
+			Size: b.SizeBytes, Error: b.Error,
+		}
+		if b.FinishedAt != nil {
+			j.Finished = b.FinishedAt.Format(time.RFC3339)
+		}
+		if b.Path != "" {
+			if _, err := os.Stat(b.Path); err == nil {
+				j.Present = true
+			}
+		}
+		out = append(out, j)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"backups": out})
+}
+
+// handleRunBackup takes one now.
+//
+// The same function the nightly job runs, without the "has one run today" check.
+// Waiting until tonight to learn whether backups work at all is how somebody finds
+// out on the day they need one — and it is the only way to get a snapshot from
+// *before* something you are about to do.
+//
+// Synchronous. A backup of a homelab database is a second or two, and a button
+// that returns immediately and tells you nothing is a button you press twice.
+func (s *Server) handleRunBackup(w http.ResponseWriter, r *http.Request) {
+	if err := jobs.Backup(r.Context(), s.cfg, s.db, s.log); err != nil {
+		s.internal(w, r, "run backup", err)
+		return
+	}
+	runs, err := s.db.ListBackupRuns(r.Context(), 1)
+	if err != nil || len(runs) == 0 {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	b := runs[0]
+	j := backupRunJSON{
+		ID: b.ID, Started: b.StartedAt.Format(time.RFC3339),
+		Size: b.SizeBytes, Error: b.Error, Present: true,
+	}
+	if b.FinishedAt != nil {
+		j.Finished = b.FinishedAt.Format(time.RFC3339)
+	}
+	writeJSON(w, http.StatusCreated, j)
+}
+
+// handleDownloadBackup sends one backup file.
+//
+// The path comes from the row rather than from the request, and is then checked to
+// be inside the backups directory anyway. The row is written by this process and
+// should always be safe; the check is there because "should always" is how a path
+// traversal gets shipped, and the thing on the other side of it is every account's
+// data in one file.
+func (s *Server) handleDownloadBackup(w http.ResponseWriter, r *http.Request) {
+	runs, err := s.db.ListBackupRuns(r.Context(), 100)
+	if err != nil {
+		s.internal(w, r, "list backups", err)
+		return
+	}
+
+	id := chi.URLParam(r, "backupID")
+	var path string
+	for _, b := range runs {
+		if b.ID == id {
+			path = b.Path
+			break
+		}
+	}
+	if path == "" {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+
+	dir, err := filepath.Abs(s.cfg.BackupsDir())
+	if err != nil {
+		s.internal(w, r, "backups dir", err)
+		return
+	}
+	full, err := filepath.Abs(path)
+	if err != nil || !strings.HasPrefix(full, dir+string(os.PathSeparator)) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+	file, err := os.Open(full)
+	if err != nil {
+		// Rotation keeps the most recent fourteen, so a row older than that is a
+		// true record with no file behind it. Not an error — a 404 is the honest
+		// answer to "send me that one".
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+	defer file.Close()
+
+	info, err := file.Stat()
+	if err != nil {
+		s.internal(w, r, "stat backup", err)
+		return
+	}
+
+	// The same treatment attachments get, and for a stronger reason: this is a
+	// SQLite database, and nothing should ever be tempted to render it inline.
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Disposition",
+		fmt.Sprintf("attachment; filename=%q", filepath.Base(full)))
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	http.ServeContent(w, r, "", info.ModTime(), file)
+}

internal/httpapi/backup_test.go

@@ -0,0 +1,116 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// The backup panel exists because the job was invisible, so the thing to check is
+// that it can be seen and asked for — and that the file it hands out is guarded
+// like what it is, which is every account's data in one download.
+func TestABackupCanBeTakenListedAndDownloaded(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// Nothing yet, and that is a state the list has to survive rather than a case
+	// nobody hits: it is what a fresh instance looks like.
+	_, empty := ts.do(t, "GET", "/api/v1/backups", nil)
+	if got, _ := empty["backups"].([]any); len(got) != 0 {
+		t.Fatalf("a fresh instance has %d backups", len(got))
+	}
+
+	resp, made := ts.do(t, "POST", "/api/v1/backups", nil)
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("run backup: status %d, body %v", resp.StatusCode, made)
+	}
+	id, _ := made["id"].(string)
+	if id == "" {
+		t.Fatal("the new run has no id")
+	}
+	if size, _ := made["size_bytes"].(float64); size <= 0 {
+		t.Errorf("size_bytes = %v — a backup of a database with rows in it is not empty", made["size_bytes"])
+	}
+	if made["error"] != nil {
+		t.Errorf("the backup reported an error: %v", made["error"])
+	}
+
+	_, listed := ts.do(t, "GET", "/api/v1/backups", nil)
+	rows, _ := listed["backups"].([]any)
+	if len(rows) != 1 {
+		t.Fatalf("listed %d backups, want 1", len(rows))
+	}
+	row := rows[0].(map[string]any)
+	if row["id"] != id {
+		t.Errorf("the listed run is not the one that was made")
+	}
+	if row["present"] != true {
+		t.Error("present = false on a backup that was just written")
+	}
+
+	// And the file itself, which must arrive as a download rather than as
+	// something a browser might try to render.
+	req, _ := http.NewRequest("GET", ts.URL+"/api/v1/backups/"+id, nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	dl, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer dl.Body.Close()
+	if dl.StatusCode != http.StatusOK {
+		t.Fatalf("download: status %d", dl.StatusCode)
+	}
+	if ct := dl.Header.Get("Content-Type"); ct != "application/octet-stream" {
+		t.Errorf("Content-Type = %q, want application/octet-stream", ct)
+	}
+	if cd := dl.Header.Get("Content-Disposition"); cd == "" || cd[:10] != "attachment" {
+		t.Errorf("Content-Disposition = %q, want an attachment", cd)
+	}
+
+	// An id that is not a backup is a 404, not a path to try opening.
+	if resp, _ := ts.do(t, "GET", "/api/v1/backups/../../etc/passwd", nil); resp.StatusCode == http.StatusOK {
+		t.Error("a traversal in the id was served")
+	}
+	if resp, _ := ts.do(t, "GET", "/api/v1/backups/nogetsomhelst", nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("an unknown id: status %d, want 404", resp.StatusCode)
+	}
+}
+
+// Administrators only, and sessions only. A backup is a complete copy of the
+// database — a leaked token that could download one turns a stolen credential into
+// a copy of everybody's data.
+func TestBackupsAreAdminsOnlyAndSessionsOnly(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "[email protected]", "Anden")
+
+	for _, c := range []struct{ method, path string }{
+		{"GET", "/api/v1/backups"},
+		{"POST", "/api/v1/backups"},
+		{"GET", "/api/v1/backups/whichever"},
+	} {
+		if resp, _ := other.do(t, c.method, c.path, nil); resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s %s as an ordinary user: status %d, want 403", c.method, c.path, resp.StatusCode)
+		}
+	}
+
+	admin, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := ts.apiToken(t, admin.ID)
+	for _, c := range []struct{ method, path string }{
+		{"GET", "/api/v1/backups"},
+		{"POST", "/api/v1/backups"},
+	} {
+		req, _ := http.NewRequest(c.method, ts.URL+c.path, nil)
+		req.Header.Set("Authorization", "Bearer "+token)
+		resp, err := (&http.Client{}).Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+		if resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s %s with an admin's API token: status %d, want 403", c.method, c.path, resp.StatusCode)
+		}
+	}
+}

internal/httpapi/beacon_handlers.go

@@ -0,0 +1,475 @@
+package httpapi
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/beacon"
+	"github.com/kristianwind/verdande/internal/safedial"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// The beacon, from the instance's side.
+//
+// Two halves that happen to live in the same binary: the part that reports in,
+// which every installation runs, and the part that receives, which only the one
+// acting as collector turns on. See internal/beacon for what is sent and why it
+// is on by default rather than compulsory.
+
+const beaconScope = "beacon"
+
+// defaultPublishMin er, hvor mange installationer der skal være, før tallet
+// offentliggøres. Selve tallet er et skøn; det, gulvet køber, er det ikke: under
+// det fortæller et offentligt tal mest om, hvor lidt der skal til at flytte det.
+const defaultPublishMin = 25
+
+// beaconConfig is what this instance has been told to do. The zero value is what
+// a fresh installation gets, which is why Enabled defaults to true elsewhere and
+// not here — a zero struct must never mean "silently on".
+type beaconConfig struct {
+	Enabled      bool   `json:"enabled"`
+	Collector    string `json:"collector_url"`
+	InstanceID   string `json:"instance_id"`
+	IsCollector  bool   `json:"is_collector"`
+	PublishCount bool   `json:"publish_count"`
+	LastPingAt   int64  `json:"last_ping_at,omitempty"`
+	// LastVersion er den version, der sidst nåede frem. Gemt, fordi en
+	// installation, der opdaterer sig selv om natten, ellers står som gårsdagens
+	// version i op til et døgn — og en tælling efter version, der er en dag bagud,
+	// kan man ikke se en udrulning i.
+	LastVersion string `json:"last_version,omitempty"`
+	// LastError er grunden til, at det sidste forsøg ikke nåede frem.
+	//
+	// Skrevet ned, fordi alternativet er tavshed: et beacon, der ikke kan nå sin
+	// collector, prøver igen i morgen og siger ingenting, og det opdages først ved
+	// at tælle installationer i den anden ende og savne en. Det er ikke en fejl,
+	// der skal afbryde nogen — det er en linje på en side, der ellers påstår, at
+	// alt er sendt.
+	LastError   string `json:"last_error,omitempty"`
+	LastErrorAt int64  `json:"last_error_at,omitempty"`
+	// NoticeAck er sat, når nogen har set beskeden om, hvad der bliver sendt.
+	//
+	// Slået til som udgangspunkt kan kun forsvares, hvis det bliver sagt
+	// uopfordret — ikke på en indstillingsside, ingen åbner af sig selv. Feltet er
+	// det, der husker, at det er blevet sagt.
+	NoticeAck bool `json:"notice_ack"`
+	// PublishMin er gulvet under det offentliggjorte tal.
+	//
+	// Et tal, der *falder*, kan ikke offentliggøres som en kendsgerning: en dårlig
+	// udrulning, en DNS-ændring, der stille stopper meldingerne, eller rækker, der
+	// er væk, ser alle sammen ud som "færre bruger det nu". Under gulvet svares
+	// der ingenting frem for et lille tal, ingen kan tolke.
+	PublishMin int `json:"publish_min"`
+}
+
+// beaconSettings reads the configuration, filling in the defaults and minting the
+// anonymous id on first use.
+//
+// The id is generated here rather than derived from anything about the machine.
+// A hash of the hostname or the base URL would be stable and convenient and would
+// also be a value the collector could compare against a guess — which is the
+// difference between anonymous and pseudonymous, and it is the whole point.
+func (s *Server) beaconSettings(ctx context.Context) (beaconConfig, error) {
+	cfg := beaconConfig{
+		Enabled: true, Collector: beacon.DefaultCollector, PublishMin: defaultPublishMin,
+	}
+
+	stored, err := s.db.InstanceSettings(ctx, beaconScope)
+	if err != nil {
+		return cfg, err
+	}
+
+	if v, ok := stored["enabled"].(bool); ok {
+		cfg.Enabled = v
+	}
+	if v, ok := stored["collector_url"].(string); ok && strings.TrimSpace(v) != "" {
+		cfg.Collector = strings.TrimSpace(v)
+	}
+	if v, ok := stored["instance_id"].(string); ok && beacon.ValidID(v) {
+		cfg.InstanceID = v
+	}
+	if v, ok := stored["is_collector"].(bool); ok {
+		cfg.IsCollector = v
+	}
+	if v, ok := stored["publish_count"].(bool); ok {
+		cfg.PublishCount = v
+	}
+	if v, ok := stored["last_ping_at"].(float64); ok {
+		cfg.LastPingAt = int64(v)
+	}
+	if v, ok := stored["last_version"].(string); ok {
+		cfg.LastVersion = v
+	}
+	if v, ok := stored["last_error"].(string); ok {
+		cfg.LastError = v
+	}
+	if v, ok := stored["last_error_at"].(float64); ok {
+		cfg.LastErrorAt = int64(v)
+	}
+	if v, ok := stored["notice_ack"].(bool); ok {
+		cfg.NoticeAck = v
+	}
+	if v, ok := stored["publish_min"].(float64); ok && v >= 0 {
+		cfg.PublishMin = int(v)
+	}
+
+	if cfg.InstanceID == "" {
+		cfg.InstanceID = store.NewID()
+		if err := s.saveBeaconSettings(ctx, cfg); err != nil {
+			return cfg, err
+		}
+	}
+	return cfg, nil
+}
+
+func (s *Server) saveBeaconSettings(ctx context.Context, cfg beaconConfig) error {
+	return s.db.SetInstanceSettings(ctx, beaconScope, map[string]any{
+		"enabled":       cfg.Enabled,
+		"collector_url": cfg.Collector,
+		"instance_id":   cfg.InstanceID,
+		"is_collector":  cfg.IsCollector,
+		"publish_count": cfg.PublishCount,
+		"last_ping_at":  cfg.LastPingAt,
+		"last_version":  cfg.LastVersion,
+		"last_error":    cfg.LastError,
+		"last_error_at": cfg.LastErrorAt,
+		"notice_ack":    cfg.NoticeAck,
+		"publish_min":   cfg.PublishMin,
+	})
+}
+
+// --- what the settings page shows ------------------------------------------------
+
+type beaconStatusJSON struct {
+	Enabled      bool   `json:"enabled"`
+	Collector    string `json:"collector_url"`
+	InstanceID   string `json:"instance_id"`
+	Version      string `json:"version"`
+	IsCollector  bool   `json:"is_collector"`
+	PublishCount bool   `json:"publish_count"`
+	PublishMin   int    `json:"publish_min"`
+	LastPingAt   string `json:"last_ping_at,omitempty"`
+	// Sidste forsøg, der ikke nåede frem — tomt, når det sidste gik godt. Vist
+	// frem for talt: en dato under "sidst sendt", der bliver ældre og ældre, er
+	// det eneste spor, et tavst beacon ellers efterlader.
+	LastError   string             `json:"last_error,omitempty"`
+	LastErrorAt string             `json:"last_error_at,omitempty"`
+	Stats       *store.BeaconStats `json:"stats,omitempty"`
+}
+
+func (s *Server) handleBeaconStatus(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+
+	out := beaconStatusJSON{
+		Enabled: cfg.Enabled, Collector: cfg.Collector, InstanceID: cfg.InstanceID,
+		Version: Version, IsCollector: cfg.IsCollector, PublishCount: cfg.PublishCount,
+		PublishMin: cfg.PublishMin,
+	}
+	if cfg.LastPingAt > 0 {
+		out.LastPingAt = time.Unix(cfg.LastPingAt, 0).Format(time.RFC3339)
+	}
+	if cfg.LastError != "" {
+		out.LastError = cfg.LastError
+		out.LastErrorAt = time.Unix(cfg.LastErrorAt, 0).Format(time.RFC3339)
+	}
+	if cfg.IsCollector {
+		stats, err := s.db.BeaconSummary(r.Context())
+		if err != nil {
+			s.internal(w, r, "beacon summary", err)
+			return
+		}
+		out.Stats = &stats
+	}
+	writeJSON(w, http.StatusOK, out)
+}
+
+type beaconRequest struct {
+	Enabled      *bool   `json:"enabled"`
+	Collector    *string `json:"collector_url"`
+	IsCollector  *bool   `json:"is_collector"`
+	PublishCount *bool   `json:"publish_count"`
+	PublishMin   *int    `json:"publish_min"`
+}
+
+func (s *Server) handleSetBeacon(w http.ResponseWriter, r *http.Request) {
+	var req beaconRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+
+	if req.Enabled != nil {
+		cfg.Enabled = *req.Enabled
+	}
+	if req.IsCollector != nil {
+		cfg.IsCollector = *req.IsCollector
+	}
+	if req.PublishCount != nil {
+		cfg.PublishCount = *req.PublishCount
+	}
+	if req.PublishMin != nil {
+		if *req.PublishMin < 0 {
+			writeFieldErrors(w, map[string]string{"publish_min": "must not be negative"})
+			return
+		}
+		cfg.PublishMin = *req.PublishMin
+	}
+	if req.Collector != nil {
+		url := strings.TrimSpace(*req.Collector)
+		if url == "" {
+			url = beacon.DefaultCollector
+		}
+		// http and https only, and said as a field error rather than a 500: an
+		// operator pointing this at their own collector will mistype it, and the
+		// page should say which field is wrong.
+		if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
+			writeFieldErrors(w, map[string]string{"collector_url": "must start with http:// or https://"})
+			return
+		}
+		cfg.Collector = url
+	}
+
+	if err := s.saveBeaconSettings(r.Context(), cfg); err != nil {
+		s.internal(w, r, "save beacon settings", err)
+		return
+	}
+	s.handleBeaconStatus(w, r)
+}
+
+// --- the collector's side ---------------------------------------------------------
+
+// handleBeaconPing receives one report. Unauthenticated, because the whole point
+// is that a stranger's installation can reach it.
+//
+// Nothing about the request is recorded except the two values in the body. The
+// source address is not read here, and there is no code path from this function
+// to anything that could write one down — which is the only version of that
+// promise worth making.
+func (s *Server) handleBeaconPing(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	// An instance that is not a collector does not quietly accept and drop pings —
+	// it says there is nothing here. Otherwise every installation in the world is a
+	// spam sink that answers 200 to anything.
+	if !cfg.IsCollector {
+		writeError(w, http.StatusNotFound, CodeNotFound, "this instance is not a beacon collector")
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, 4<<10)
+	var p beacon.Payload
+	if err := decodeJSON(w, r, &p); err != nil {
+		return
+	}
+
+	// Checked, not trusted. This is the one endpoint anybody can post to, and the
+	// two columns behind it should only ever hold the two shapes this program
+	// writes — an id that is not id-shaped is somebody probing, not an install.
+	if !beacon.ValidID(p.InstanceID) {
+		writeFieldErrors(w, map[string]string{"instance_id": "malformed"})
+		return
+	}
+	if p.Version != "" && !beacon.ValidVersion(p.Version) {
+		writeFieldErrors(w, map[string]string{"version": "malformed"})
+		return
+	}
+
+	if err := s.db.RecordBeacon(r.Context(), p.InstanceID, p.Version); err != nil {
+		s.internal(w, r, "record beacon", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleBeaconCount publishes the number, when the collector has been told to.
+//
+// Thirty days rather than a running total: a total only climbs, so it stops
+// meaning "how many people use this" and starts meaning "how many ever tried it".
+func (s *Server) handleBeaconCount(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	if !cfg.IsCollector || !cfg.PublishCount {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not published")
+		return
+	}
+
+	n, err := s.db.BeaconCount(r.Context(), 30*24*time.Hour)
+	if err == nil && n < cfg.PublishMin {
+		// Ingenting frem for et lille tal. Et tal under gulvet fortæller mest om,
+		// hvor lidt der skal til at flytte det — og et, der falder, ville blive
+		// læst som "færre bruger det nu", også når det i virkeligheden var en
+		// udrulning, der gik galt, eller en adresse, der stille holdt op med at
+		// blive ramt.
+		w.Header().Set("Cache-Control", "public, max-age=60")
+		writeJSON(w, http.StatusOK, map[string]any{"installs": nil, "window_days": 30})
+		return
+	}
+	if err != nil {
+		s.internal(w, r, "beacon count", err)
+		return
+	}
+	w.Header().Set("Cache-Control", "public, max-age=60")
+	writeJSON(w, http.StatusOK, map[string]any{"installs": n, "window_days": 30})
+}
+
+// SendBeacon reports this installation, at most once a day.
+//
+// Exported and handed to the jobs runner the same way the mailbox syncs are: the
+// settings, the anonymous id and the version all live on this side, and the
+// runner should not have to know about any of them.
+//
+// The day is counted from the last successful send, not from a wall-clock hour.
+// A fleet of installations that all pinged at 03:00 would arrive in one spike;
+// counted this way they spread themselves out by when each was started.
+func (s *Server) SendBeacon(ctx context.Context) error {
+	cfg, err := s.beaconSettings(ctx)
+	if err != nil {
+		return err
+	}
+	if !cfg.Enabled {
+		return nil
+	}
+	// The collector does not report to itself over the network. It would work, and
+	// it would also mean the one instance whose count matters most depends on its
+	// own tunnel being up to be counted.
+	if cfg.IsCollector {
+		if err := s.db.RecordBeacon(ctx, cfg.InstanceID, Version); err != nil {
+			return err
+		}
+		return s.beaconSent(ctx, cfg)
+	}
+
+	// Undtagelsen fra døgnet er en version, der er skiftet. En installation, der
+	// opdaterer sig selv om natten og først melder ind igen et døgn senere, står
+	// som gårsdagens version hele dagen — og så kan man ikke se en udrulning i
+	// tallene. Målt hos Yggdrasil: to paneler rapporterede den forrige version i
+	// et døgn efter at være opdateret.
+	if time.Since(time.Unix(cfg.LastPingAt, 0)) < 24*time.Hour && cfg.LastVersion == Version {
+		return nil
+	}
+
+	// safedial, ikke http.DefaultClient. Adressen kan skrives i fladen, og en
+	// administrator, der peger den på 127.0.0.1 eller på 169.254.169.254, ville
+	// ellers have en maskine, der henter indefra på kommando — og svaret på om den
+	// svarede, er i sig selv det, sådan et forsøg leder efter.
+	if err := beacon.Send(ctx, safedial.Client(15*time.Second), cfg.Collector, beacon.Payload{
+		InstanceID: cfg.InstanceID,
+		Version:    Version,
+	}); err != nil {
+		// Logged at info, not error. The collector being unreachable is not this
+		// installation's problem and must never look like one — it is somebody
+		// else's server, and the only consequence is a number being one lower.
+		s.log.Info("beacon not delivered", "err", err)
+		// Men skrevet ned. Uden det her fejler et beacon, der ikke kan nå sin
+		// collector, i fuldstændig tavshed: det prøver igen i morgen, siden siger
+		// "sidst sendt" med en dato, der bare bliver ældre, og ingen opdager det.
+		// Fundet hos Yggdrasil ved at tælle installationer i den anden ende og
+		// savne en.
+		cfg.LastError, cfg.LastErrorAt = err.Error(), time.Now().Unix()
+		return s.saveBeaconSettings(ctx, cfg)
+	}
+
+	return s.beaconSent(ctx, cfg)
+}
+
+// beaconSent skriver, at det lykkedes: tidspunktet, versionen der nåede frem, og
+// en fejl, der ikke længere gælder. Ét sted, fordi de fire felter skal skrives
+// sammen — en gemning, der glemte at rydde fejlen, ville lade en linje stå på
+// siden om noget, der virker.
+func (s *Server) beaconSent(ctx context.Context, cfg beaconConfig) error {
+	cfg.LastPingAt = time.Now().Unix()
+	cfg.LastVersion = Version
+	cfg.LastError, cfg.LastErrorAt = "", 0
+	return s.saveBeaconSettings(ctx, cfg)
+}
+
+// --- beskeden, der bliver sagt uopfordret ------------------------------------------
+
+// handleBeaconNotice says whether the disclosure is still owed, and what it would
+// say.
+//
+// Slået til som udgangspunkt kan kun forsvares, hvis det bliver sagt uopfordret.
+// En indstillingsside, hvor det står rigtigt og fyldestgørende, er ikke det samme
+// som at sige det: den bliver åbnet af dem, der i forvejen har en mistanke om, at
+// der er noget at læse. Uden beskeden her er "du kan slå den fra" et tilbud til
+// dem, der ved, at der er noget at slå fra.
+//
+// De tre værdier står i svaret — det rigtige id, den rigtige version, den rigtige
+// adresse — så beskeden kan vise, hvad der bliver sendt, frem for at sige
+// "anonyme data" og bede om at blive troet på. Det er den eneste version af det
+// løfte, der er noget værd: en, læseren selv kan kontrollere.
+//
+// Panelbredt frem for pr. bruger: det er installationen, der melder ind, ikke
+// personen, og en besked pr. konto ville stille det samme spørgsmål til folk, der
+// ikke kan svare på det.
+func (s *Server) handleBeaconNotice(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"pending":       !cfg.NoticeAck,
+		"enabled":       cfg.Enabled,
+		"instance_id":   cfg.InstanceID,
+		"version":       Version,
+		"collector_url": cfg.Collector,
+	})
+}
+
+type beaconNoticeRequest struct {
+	// Keep er en peger og ikke en bool, og det er hele pointen.
+	//
+	// En tom krop ville ellers betyde "slå det fra", og det er den vej, en fejl
+	// aldrig må falde: et fravalg, ingen har truffet, er lige så meget et brudt
+	// løfte som et tilvalg, ingen har truffet. Yggdrasil har den fejl i sin
+	// tilsvarende ende og er blevet bidt af den.
+	Keep *bool `json:"keep"`
+}
+
+// handleAckBeaconNotice records that the notice has been seen, and turns the
+// beacon off if that was the answer.
+//
+// Ét kald til begge svar. "Behold den" og "slå den fra" er den samme handling —
+// nogen har taget stilling — og to endpoints ville betyde, at det ene kunne
+// glemme at skrive, at der var taget stilling, og beskeden dermed komme igen.
+func (s *Server) handleAckBeaconNotice(w http.ResponseWriter, r *http.Request) {
+	var req beaconNoticeRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if req.Keep == nil {
+		writeFieldErrors(w, map[string]string{"keep": "required"})
+		return
+	}
+
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	cfg.NoticeAck = true
+	cfg.Enabled = *req.Keep
+	if err := s.saveBeaconSettings(r.Context(), cfg); err != nil {
+		s.internal(w, r, "save beacon settings", err)
+		return
+	}
+	s.log.Info("beacon notice answered", "keep", *req.Keep, "user", userFrom(r.Context()).ID)
+	writeJSON(w, http.StatusOK, map[string]any{"enabled": cfg.Enabled})
+}

internal/httpapi/beacon_notice_test.go

@@ -0,0 +1,132 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// Beaconet er slået til som udgangspunkt, og det kan kun forsvares, hvis det
+// bliver sagt uopfordret. Beskeden venter, indtil nogen har taget stilling — og
+// den viser de rigtige værdier, så løftet kan efterprøves frem for tros på.
+func TestTheBeaconSaysWhatItSendsBeforeAnybodyAsks(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, notice := ts.do(t, "GET", "/api/v1/beacon/notice", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("hent besked: %d", resp.StatusCode)
+	}
+	if notice["pending"] != true {
+		t.Fatalf("beskeden er ikke i vente på en frisk installation: %v", notice)
+	}
+	if notice["enabled"] != true {
+		t.Errorf("beaconet er ikke slået til som udgangspunkt: %v", notice)
+	}
+	// De tre værdier, beskeden viser frem, er de rigtige — ikke et eksempel.
+	settings := beaconSettingsOf(t, ts)
+	if notice["instance_id"] != settings["instance_id"] {
+		t.Errorf("id i beskeden = %v, i indstillingerne = %v",
+			notice["instance_id"], settings["instance_id"])
+	}
+	if notice["collector_url"] != settings["collector_url"] {
+		t.Errorf("adressen i beskeden = %v, i indstillingerne = %v",
+			notice["collector_url"], settings["collector_url"])
+	}
+	if notice["version"] == "" || notice["version"] == nil {
+		t.Error("beskeden siger ikke, hvilken version der bliver sendt")
+	}
+}
+
+// "Behold den" er et svar, og det svar skal huskes: beskeden må ikke komme igen
+// ved næste login.
+func TestKeepingTheBeaconAnswersTheNoticeForGood(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, out := ts.do(t, "POST", "/api/v1/beacon/notice", map[string]any{"keep": true})
+	if resp.StatusCode != http.StatusOK || out["enabled"] != true {
+		t.Fatalf("behold: %d %v", resp.StatusCode, out)
+	}
+	if _, notice := ts.do(t, "GET", "/api/v1/beacon/notice", nil); notice["pending"] != false {
+		t.Errorf("beskeden kommer igen efter et svar: %v", notice)
+	}
+	if s := beaconSettingsOf(t, ts); s["enabled"] != true {
+		t.Errorf("beaconet blev slået fra af et ja: %v", s["enabled"])
+	}
+}
+
+// Og "slå den fra" slår den fra — ét kald, både svaret og virkningen.
+func TestTurningTheBeaconOffFromTheNoticeStopsIt(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, out := ts.do(t, "POST", "/api/v1/beacon/notice", map[string]any{"keep": false})
+	if resp.StatusCode != http.StatusOK || out["enabled"] != false {
+		t.Fatalf("slå fra: %d %v", resp.StatusCode, out)
+	}
+	s := beaconSettingsOf(t, ts)
+	if s["enabled"] != false {
+		t.Errorf("beaconet kører stadig efter et nej: %v", s["enabled"])
+	}
+	if _, notice := ts.do(t, "GET", "/api/v1/beacon/notice", nil); notice["pending"] != false {
+		t.Errorf("beskeden kommer igen efter et nej: %v", notice)
+	}
+}
+
+// En tom krop må ikke kunne betyde "slå det fra". Et fravalg, ingen har truffet,
+// er lige så meget et brudt løfte som et tilvalg, ingen har truffet.
+func TestAnEmptyAnswerToTheNoticeIsRefused(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, _ := ts.do(t, "POST", "/api/v1/beacon/notice", map[string]any{})
+	if resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Fatalf("tom krop gav %d, want 422", resp.StatusCode)
+	}
+	if s := beaconSettingsOf(t, ts); s["enabled"] != true {
+		t.Errorf("en tom krop slog beaconet fra: %v", s["enabled"])
+	}
+	if _, notice := ts.do(t, "GET", "/api/v1/beacon/notice", nil); notice["pending"] != true {
+		t.Errorf("en tom krop talte som et svar: %v", notice)
+	}
+}
+
+// Et tal, der falder, kan ikke offentliggøres som en kendsgerning. Under gulvet
+// svares der ingenting frem for et lille tal, ingen kan tolke.
+func TestThePublishedCountHasAFloorUnderIt(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	if resp, _ := ts.do(t, "PUT", "/api/v1/beacon/settings", map[string]any{
+		"is_collector": true, "publish_count": true,
+	}); resp.StatusCode != http.StatusOK {
+		t.Fatal("bliv collector")
+	}
+
+	// Instansen tæller sig selv, så der er én. Gulvet er højere.
+	resp, out := ts.do(t, "GET", "/api/v1/beacon/count", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("tælling: %d", resp.StatusCode)
+	}
+	if out["installs"] != nil {
+		t.Errorf("et tal under gulvet blev offentliggjort: %v", out["installs"])
+	}
+
+	// Sættes gulvet ned, står tallet der.
+	if resp, _ := ts.do(t, "PUT", "/api/v1/beacon/settings",
+		map[string]any{"publish_min": 0}); resp.StatusCode != http.StatusOK {
+		t.Fatal("sænk gulvet")
+	}
+	if _, out := ts.do(t, "GET", "/api/v1/beacon/count", nil); out["installs"] == nil {
+		t.Errorf("tallet blev holdt tilbage uden et gulv: %v", out)
+	}
+}
+
+func beaconSettingsOf(t *testing.T, ts *testServer) map[string]any {
+	t.Helper()
+	resp, out := ts.do(t, "GET", "/api/v1/beacon/settings", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("hent beacon-indstillinger: %d", resp.StatusCode)
+	}
+	return out
+}

internal/httpapi/caldav_handlers.go

@@ -85,7 +85,7 @@ func (s *Server) handleCalDAVHome(w http.ResponseWriter, r *http.Request) {
 
 	projects, err := s.db.ListProjects(r.Context(), user.ID, false)
 	if err != nil {
-		s.internal(w, "caldav home", err)
+		s.internal(w, r, "caldav home", err)
 		return
 	}
 
@@ -131,7 +131,7 @@ func (s *Server) handleCalDAVCalendar(w http.ResponseWriter, r *http.Request) {
 	if r.Header.Get("Depth") != "0" {
 		tasks, err := s.caldavTasks(r, user, projectID)
 		if err != nil {
-			s.internal(w, "caldav tasks", err)
+			s.internal(w, r, "caldav tasks", err)
 			return
 		}
 		for _, t := range tasks {
@@ -157,7 +157,7 @@ func (s *Server) handleCalDAVReport(w http.ResponseWriter, r *http.Request) {
 
 	tasks, err := s.caldavTasks(r, user, projectID)
 	if err != nil {
-		s.internal(w, "caldav report", err)
+		s.internal(w, r, "caldav report", err)
 		return
 	}
 	byID := map[string]store.Task{}
@@ -231,6 +231,33 @@ func (s *Server) handleCalDAVPut(w http.ResponseWriter, r *http.Request) {
 
 	existing, getErr := s.db.GetTask(r.Context(), taskID, user.ID)
 	if getErr == nil {
+		// The task decides, not the URL.
+		//
+		// The check above is about the project the *client named*, and a client
+		// names both halves of this address. Asking the project for permission and
+		// then taking the task id from the same string ties nothing together: a
+		// viewer on a shared project could name a project of their own — the Inbox,
+		// which everybody owns and may edit — and put the shared task's id in the
+		// filename. The project check passed on the Inbox and the write landed on a
+		// task they may only read.
+		//
+		// GetTask does not close it either: it answers "may this person see it",
+		// and a viewer may. `CanEdit` is the question, and it is the same one
+		// handleUpdateTask asks — the API door has always asked it.
+		role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
+		if err != nil || !role.CanEdit() {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		// And it has to live where the address says it does. Without this an editor
+		// on two projects can reach either through the other's URL — nothing is
+		// escalated by that on its own, but a URL allowed to lie about where a
+		// resource lives is how the case above got in.
+		if existing.ProjectID != projectID {
+			http.NotFound(w, r)
+			return
+		}
+
 		// An update. Only the fields a task client can express are touched;
 		// everything else the task carries stays as it is.
 		content := parsed.Summary
@@ -240,7 +267,7 @@ func (s *Server) handleCalDAVPut(w http.ResponseWriter, r *http.Request) {
 		update.DueDatetime = parsed.DueDatetime
 
 		if err := s.db.UpdateTask(r.Context(), taskID, user.ID, update); err != nil {
-			s.internal(w, "caldav update", err)
+			s.internal(w, r, "caldav update", err)
 			return
 		}
 		if parsed.Completed && !existing.Completed() {
@@ -275,7 +302,7 @@ func (s *Server) handleCalDAVPut(w http.ResponseWriter, r *http.Request) {
 		task.Content = "(uden titel)"
 	}
 	if err := s.db.CreateTask(r.Context(), task, nil); err != nil {
-		s.internal(w, "caldav create", err)
+		s.internal(w, r, "caldav create", err)
 		return
 	}
 	s.publish(projectID, "task.created", toTaskJSON(*task))
@@ -294,7 +321,7 @@ func (s *Server) handleCalDAVDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if err := s.db.DeleteTask(r.Context(), taskID); err != nil {
-		s.internal(w, "caldav delete", err)
+		s.internal(w, r, "caldav delete", err)
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)

internal/httpapi/calendar_handlers.go

@@ -0,0 +1,808 @@
+package httpapi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/gcal"
+	"github.com/kristianwind/verdande/internal/ics"
+	"github.com/kristianwind/verdande/internal/safedial"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// defaultCalendarSyncBudget bounds one "fetch now" when nothing else says
+// otherwise. Well under the hundred seconds a proxy is willing to wait, so this
+// server is the one that answers a slow Google rather than Cloudflare's own HTML
+// page — which is how a failure arrives with no code, no message and nothing in
+// the error log.
+const defaultCalendarSyncBudget = 25 * time.Second
+
+// The window verdande keeps a copy of.
+//
+// A month grid pages, so asking Google on every arrow press would mean a round trip
+// for a question answered ninety seconds ago — a calendar slower than the calendar
+// it is showing. A cached window is the alternative, and a window has to end
+// somewhere. Ninety days back is roughly "when was that", a year forward is past
+// anything anybody has booked; between them they cover every screen the grid can
+// reach without a person noticing an edge.
+//
+// The edge is still real, and the events endpoint says where it is rather than
+// answering an empty list for a month outside it. A calendar that quietly shows no
+// events is a calendar that lies about a day being clear.
+const (
+	calendarWindowBack   = 90
+	calendarWindowAhead  = 365
+	calendarDateLayout   = "2006-01-02"
+	calendarProviderName = "google"
+)
+
+func (s *Server) calendarClient(accessToken string) *gcal.Client {
+	return gcal.NewClient(accessToken).At(s.cfg.CalendarAPIURL)
+}
+
+// calendarConfig is the same registration Gmail signs in through, asking for a
+// different scope and coming back to a different URI.
+//
+// One OAuth client, two features. Google issues a refresh token per authorisation
+// and keeps up to a hundred of them live per account, each carrying the scopes it
+// was granted with — so connecting the calendar does not disturb a working Gmail,
+// and disconnecting one does not take the other with it.
+func (s *Server) calendarConfig(ctx context.Context) gcal.Config {
+	cfg := s.gmailConfig(ctx)
+	cfg.Scope = gcal.Scope
+	cfg.RedirectURL = s.cfg.CalendarRedirectURL()
+	return cfg
+}
+
+// --- connecting ------------------------------------------------------------------
+
+// handleCalendarAuthorize starts the flow. Same shape as Gmail's, and the same
+// reason for keeping the verifier server-side: the callback arrives as a top-level
+// navigation from Google, and a SameSite=Lax cookie is the kind of thing that works
+// until a browser tightens its defaults.
+func (s *Server) handleCalendarAuthorize(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	cfg := s.calendarConfig(r.Context())
+
+	if !cfg.Configured() {
+		writeError(w, http.StatusConflict, CodeGmailNotConfigured,
+			"no Google OAuth client is registered on this server")
+		return
+	}
+
+	pkce, err := gcal.NewPKCE()
+	if err != nil {
+		s.internal(w, r, "calendar pkce", err)
+		return
+	}
+
+	// Its own settings scope, not Gmail's. Two handshakes in one row would mean a
+	// person who started both flows had one verifier, and whichever came back
+	// second would be refused for a reason nothing on the screen could explain.
+	settings, err := s.db.UserSettings(r.Context(), user.ID, "calendar")
+	if err != nil {
+		s.internal(w, r, "calendar settings", err)
+		return
+	}
+	settings["pkce_verifier"] = pkce.Verifier
+	settings["pkce_state"] = pkce.State
+	// The attempt expires: a stored verifier that lives forever is a replay window
+	// that lives forever.
+	settings["pkce_expires"] = time.Now().Add(10 * time.Minute).Unix()
+
+	if err := s.db.SetUserSettings(r.Context(), user.ID, "calendar", settings); err != nil {
+		s.internal(w, r, "calendar settings", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"url": cfg.AuthURL(pkce)})
+}
+
+// handleCalendarCallback is where Google sends the browser back.
+//
+// It answers with a redirect into the app rather than with JSON: the person is
+// looking at a browser tab, not at a fetch response.
+func (s *Server) handleCalendarCallback(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	settingsURL := s.cfg.BaseURL + "/indstillinger/integrationer"
+
+	if errParam := r.URL.Query().Get("error"); errParam != "" {
+		// Somebody clicked "cancel" on the consent screen — or, on an Internal
+		// OAuth app, Google refused an account outside the organisation with
+		// `org_internal`. Both arrive here, and the page names what it was given.
+		http.Redirect(w, r, settingsURL+"?calendar="+errParam, http.StatusFound)
+		return
+	}
+
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	if code == "" || state == "" {
+		http.Redirect(w, r, settingsURL+"?calendar=invalid", http.StatusFound)
+		return
+	}
+
+	settings, err := s.db.UserSettings(r.Context(), user.ID, "calendar")
+	if err != nil {
+		s.internal(w, r, "calendar settings", err)
+		return
+	}
+	verifier, _ := settings["pkce_verifier"].(string)
+	expected, _ := settings["pkce_state"].(string)
+	expires, _ := settings["pkce_expires"].(float64)
+
+	// The state has to match, or this endpoint accepts a code from anywhere.
+	if verifier == "" || expected == "" || state != expected {
+		http.Redirect(w, r, settingsURL+"?calendar=state", http.StatusFound)
+		return
+	}
+	if int64(expires) < time.Now().Unix() {
+		http.Redirect(w, r, settingsURL+"?calendar=expired", http.StatusFound)
+		return
+	}
+
+	token, err := s.calendarConfig(r.Context()).Exchange(r.Context(), code,
+		gcal.PKCE{Verifier: verifier})
+	if err != nil {
+		s.log.Error("calendar exchange", "err", err, "user", user.ID)
+		http.Redirect(w, r, settingsURL+"?calendar=failed", http.StatusFound)
+		return
+	}
+	if token.RefreshToken == "" {
+		// Without one the connection dies in an hour. Google only withholds it when
+		// the consent prompt was skipped, which access_type and prompt are meant to
+		// prevent — so this means something is wrong with the client registration
+		// rather than with this request.
+		s.log.Error("calendar returned no refresh token", "user", user.ID)
+		http.Redirect(w, r, settingsURL+"?calendar=norefresh", http.StatusFound)
+		return
+	}
+
+	// The one-time values are cleared: keeping a spent verifier serves nothing and
+	// is one more secret at rest.
+	delete(settings, "pkce_verifier")
+	delete(settings, "pkce_state")
+	delete(settings, "pkce_expires")
+	if err := s.db.SetUserSettings(r.Context(), user.ID, "calendar", settings); err != nil {
+		s.internal(w, r, "clear calendar handshake", err)
+		return
+	}
+
+	account := &store.CalendarAccount{
+		UserID: user.ID, Provider: calendarProviderName,
+		RefreshToken: token.RefreshToken, AccessToken: token.AccessToken,
+		ExpiresAt: token.ExpiresAt,
+	}
+	if err := s.db.SaveCalendarAccount(r.Context(), account); err != nil {
+		s.internal(w, r, "save calendar tokens", err)
+		return
+	}
+
+	// The list of calendars, fetched now so the page that opens next has something
+	// to tick rather than an empty panel and a button. Best effort: an account that
+	// connects but cannot list itself is still connected, and the status endpoint
+	// asks again when it finds nothing.
+	if _, err := s.refreshCalendarList(r.Context(), account); err != nil {
+		s.log.Warn("calendar list", "err", err, "user", user.ID)
+	}
+
+	s.log.Info("calendar connected", "user", user.ID, "account", account.Account)
+	http.Redirect(w, r, settingsURL+"?calendar=connected", http.StatusFound)
+}
+
+// --- what the settings page reads --------------------------------------------------
+
+type calendarStatusJSON struct {
+	Connected bool             `json:"connected"`
+	Account   string           `json:"account,omitempty"`
+	Calendars []store.Calendar `json:"calendars"`
+	// RedirectURI is what has to be registered with Google, spelled out. Derived
+	// from VERDANDE_BASE_URL and matched exactly — the single most likely thing to
+	// be wrong, and the error Google gives for it names neither value.
+	RedirectURI string `json:"redirect_uri"`
+	// HasClient says whether there is an OAuth registration to connect through at
+	// all, so the page can explain rather than offer a button that answers 409.
+	HasClient  bool   `json:"has_client"`
+	LastSyncAt string `json:"last_sync_at,omitempty"`
+	// ReadOnly is stated rather than assumed. Nothing writes a Google calendar, and
+	// an interface that quietly looks editable is one somebody will try to edit.
+	ReadOnly bool `json:"read_only"`
+
+	// Abonnementer står ved siden af Google-kontoen og ikke inde i den: man kan
+	// have det ene uden det andet, og det er hele pointen med dem — en privat
+	// konto, der ikke kan bruge en Internal OAuth-klient, kan abonnere.
+	Subscriptions []store.CalendarAccount `json:"subscriptions"`
+}
+
+func (s *Server) handleGetCalendar(w http.ResponseWriter, r *http.Request) {
+	// Læst først, så de også kommer med, når der ingen Google-konto er.
+	subscriptions, err := s.db.Subscriptions(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "subscriptions", err)
+		return
+	}
+
+	user := userFrom(r.Context())
+
+	out := calendarStatusJSON{
+		Calendars:   []store.Calendar{},
+		RedirectURI: s.cfg.CalendarRedirectURL(),
+		HasClient:   s.calendarConfig(r.Context()).Configured(),
+		ReadOnly:    true,
+	}
+
+	account, err := s.db.CalendarAccountFor(r.Context(), user.ID, calendarProviderName)
+	if err != nil {
+		s.internal(w, r, "calendar account", err)
+		return
+	}
+	if account == nil || account.RefreshToken == "" {
+		out.Subscriptions = subscriptions
+		writeJSON(w, http.StatusOK, out)
+		return
+	}
+
+	out.Connected = true
+	out.Account = account.Account
+	if !account.LastSyncAt.IsZero() {
+		out.LastSyncAt = account.LastSyncAt.Format(time.RFC3339)
+	}
+
+	calendars, err := s.db.Calendars(r.Context(), account.ID)
+	if err != nil {
+		s.internal(w, r, "calendars", err)
+		return
+	}
+	// An account connected during a Google hiccup has no calendars and no way back:
+	// the person sees an empty list and nothing to press. Asking again here costs
+	// one request on a page nobody opens often, and means the wrong answer lasts
+	// until the next look rather than for ever. Same reasoning as the Gmail address.
+	if len(calendars) == 0 {
+		if fetched, err := s.refreshCalendarList(r.Context(), account); err == nil {
+			calendars = fetched
+			out.Account = account.Account
+		} else {
+			s.log.Warn("calendar list", "err", err, "user", user.ID)
+		}
+	}
+	if calendars != nil {
+		out.Calendars = calendars
+	}
+	out.Subscriptions = subscriptions
+	writeJSON(w, http.StatusOK, out)
+}
+
+type showCalendarsRequest struct {
+	// Shown is the whole set, not one flip. Same reasoning as the projects' order:
+	// a person has a handful of calendars, the question is "these ones", and a list
+	// that can only be built by several requests can land half applied.
+	Shown []string `json:"shown"`
+}
+
+func (s *Server) handleSetCalendars(w http.ResponseWriter, r *http.Request) {
+	var req showCalendarsRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	user := userFrom(r.Context())
+
+	account, err := s.db.CalendarAccountFor(r.Context(), user.ID, calendarProviderName)
+	if err != nil {
+		s.internal(w, r, "calendar account", err)
+		return
+	}
+	if account == nil {
+		// A 404 rather than a 409: everything the caller may not see answers 404,
+		// and "there is no such connection" is the true answer either way.
+		writeError(w, http.StatusNotFound, CodeNotFound, "no calendar is connected")
+		return
+	}
+	if err := s.db.ShowCalendars(r.Context(), account.ID, req.Shown); err != nil {
+		s.internal(w, r, "show calendars", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleDisconnectCalendar forgets the connection, and the copy of the calendars
+// with it. Unlike the tasks a mailbox made, none of this is the person's own work.
+func (s *Server) handleDisconnectCalendar(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	account, err := s.db.CalendarAccountFor(r.Context(), user.ID, calendarProviderName)
+	if err != nil {
+		s.internal(w, r, "calendar account", err)
+		return
+	}
+	if account != nil {
+		if err := s.db.DeleteCalendarAccount(r.Context(), user.ID, account.ID); err != nil {
+			s.internal(w, r, "disconnect calendar", err)
+			return
+		}
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// --- what the grid reads -----------------------------------------------------------
+
+type calendarEventsJSON struct {
+	Events []store.CalendarEvent `json:"events"`
+	// From and To are the window verdande holds a copy of, not the window that was
+	// asked for. A grid that has paged past it gets no events, and an empty answer
+	// with no explanation is a calendar quietly claiming a day is clear.
+	From string `json:"from"`
+	To   string `json:"to"`
+}
+
+func (s *Server) handleCalendarEvents(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	from := r.URL.Query().Get("from")
+	to := r.URL.Query().Get("to")
+
+	fields := map[string]string{}
+	if !validDay(from) {
+		fields["from"] = "must be a date, as 2026-08-20"
+	}
+	if !validDay(to) {
+		fields["to"] = "must be a date, as 2026-08-20"
+	}
+	if len(fields) > 0 {
+		writeFieldErrors(w, fields)
+		return
+	}
+
+	events, err := s.db.CalendarEvents(r.Context(), user.ID, from, to)
+	if err != nil {
+		s.internal(w, r, "calendar events", err)
+		return
+	}
+	if events == nil {
+		events = []store.CalendarEvent{}
+	}
+	windowFrom, windowTo := calendarWindow(time.Now())
+	writeJSON(w, http.StatusOK, calendarEventsJSON{
+		Events: events, From: windowFrom, To: windowTo,
+	})
+}
+
+// handleCalendarSyncNow refreshes immediately, so somebody who has just connected
+// can see it work rather than wondering whether it did.
+func (s *Server) handleCalendarSyncNow(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+
+	// A budget of its own, well under what sits in front of this server. An unset
+	// budget is not a budget of nothing: a zero here would expire the context
+	// before the first call and make every sync a silent no-op.
+	budget := s.cfg.CalendarSyncBudget
+	if budget <= 0 {
+		budget = defaultCalendarSyncBudget
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), budget)
+	defer cancel()
+
+	count, err := s.SyncCalendars(ctx, user)
+	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) {
+			// Not a failure: Google is slow or busy, some calendars were read, and
+			// the rest arrive on the next run. Every calendar is committed as it is
+			// read, so a short budget is a shorter run rather than a lost one.
+			writeJSON(w, http.StatusOK, map[string]any{"events": count, "partial": true})
+			return
+		}
+		s.upstream(w, r, CodeCalendarFailed, "sync calendar", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]int{"events": count})
+}
+
+// SyncCalendars refreshes every calendar this person has chosen to see.
+//
+// Returns how many events were written. Also used by the background job, which is
+// why it takes a context and a user rather than a request.
+func (s *Server) SyncCalendars(ctx context.Context, user *store.User) (int, error) {
+	// Abonnementer først, og deres fejl tæller ikke mod Google.
+	//
+	// De to har intet med hinanden at gøre ud over at ende samme sted: et
+	// abonnement er en adresse, der hentes, hvor Google er et token, der udløber.
+	// En kalender, hvis vært er nede, må ikke få det til at se ud som om
+	// Google-forbindelsen er væk — og omvendt.
+	written, err := s.syncSubscriptions(ctx, user)
+	if err != nil {
+		s.log.Warn("calendar subscriptions", "err", err, "user", user.ID)
+	}
+
+	account, err := s.db.CalendarAccountFor(ctx, user.ID, calendarProviderName)
+	if err != nil {
+		return written, err
+	}
+	if account == nil || account.RefreshToken == "" {
+		return written, nil // not connected; nothing to do and nothing to complain about
+	}
+
+	// The same guard the mailboxes have, for the same reason: a press of "fetch
+	// now" during the sweep would otherwise have two runs replacing the same window
+	// at once, and the loser's delete would land after the winner's insert.
+	unlock := s.lockSync("calendar:" + account.ID)
+	defer unlock()
+	if fresh, err := s.db.CalendarAccountFor(ctx, user.ID, calendarProviderName); err == nil && fresh != nil {
+		account = fresh
+	}
+
+	access, err := s.calendarAccessToken(ctx, account)
+	if err != nil {
+		return 0, err
+	}
+	client := s.calendarClient(access)
+
+	// The list first, so a calendar added or renamed since the last run is drawn
+	// under its new name and one that has gone stops being drawn at all.
+	calendars, err := s.calendarList(ctx, client, account)
+	if err != nil {
+		return 0, s.forgetIfRevoked(ctx, user, account, err)
+	}
+
+	from, to := calendarWindow(time.Now())
+	for _, calendar := range calendars {
+		if !calendar.Shown {
+			continue
+		}
+		// A spent budget ends the run rather than turning into a failed fetch per
+		// calendar, logged one at a time.
+		if ctx.Err() != nil {
+			return written, ctx.Err()
+		}
+		events, err := client.Events(ctx, calendar.RemoteID, from, to)
+		if err != nil {
+			if errors.Is(err, gcal.ErrUnauthorized) {
+				return written, s.forgetIfRevoked(ctx, user, account, err)
+			}
+			// One calendar somebody was unshared from must not stop the others.
+			s.log.Warn("calendar events", "err", err, "calendar", calendar.Name)
+			continue
+		}
+
+		rows := make([]store.CalendarEvent, 0, len(events))
+		for _, e := range events {
+			rows = append(rows, store.CalendarEvent{
+				RemoteID: e.ID, Summary: e.Summary,
+				StartsAt: e.StartsAt, EndsAt: e.EndsAt,
+				StartDay: e.StartDay, EndDay: e.EndDay,
+				AllDay: e.AllDay, Location: e.Location, URL: e.URL,
+			})
+		}
+		if err := s.db.ReplaceCalendarEvents(ctx, calendar.ID, from, to, rows); err != nil {
+			return written, err
+		}
+		written += len(rows)
+	}
+
+	if err := s.db.MarkCalendarSynced(ctx, account.ID, time.Now()); err != nil {
+		return written, err
+	}
+	return written, nil
+}
+
+// calendarAccessToken returns a usable access token, refreshing only when the one
+// held has actually expired.
+func (s *Server) calendarAccessToken(ctx context.Context, account *store.CalendarAccount) (string, error) {
+	if account.AccessToken != "" && account.ExpiresAt.After(time.Now()) {
+		return account.AccessToken, nil
+	}
+	token, err := s.calendarConfig(ctx).Refresh(ctx, account.RefreshToken)
+	if err != nil {
+		return "", err
+	}
+	account.AccessToken = token.AccessToken
+	account.ExpiresAt = token.ExpiresAt
+	if err := s.db.SaveCalendarAccount(ctx, account); err != nil {
+		return "", err
+	}
+	return account.AccessToken, nil
+}
+
+// refreshCalendarList fetches the calendar list with a token it obtains itself.
+// Used by the paths that have an account but no client yet — connecting, and the
+// status endpoint correcting an empty list.
+func (s *Server) refreshCalendarList(ctx context.Context, account *store.CalendarAccount) ([]store.Calendar, error) {
+	access, err := s.calendarAccessToken(ctx, account)
+	if err != nil {
+		return nil, err
+	}
+	return s.calendarList(ctx, s.calendarClient(access), account)
+}
+
+// calendarList writes what the provider says and returns what is stored, which is
+// not the same list: the provider says what exists, and only verdande knows which
+// of them somebody chose to look at.
+func (s *Server) calendarList(ctx context.Context, client *gcal.Client, account *store.CalendarAccount) ([]store.Calendar, error) {
+	remote, err := client.Calendars(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	list := make([]store.Calendar, 0, len(remote))
+	for _, c := range remote {
+		list = append(list, store.Calendar{
+			RemoteID: c.ID, Name: c.Name, Colour: c.Colour,
+			TimeZone: c.TimeZone, Primary: c.Primary, Writable: c.Owner,
+		})
+		// The primary calendar is the account, and its id is the address. It is the
+		// only place the connected account names itself without a second scope —
+		// asking for a profile scope to learn an address already in the answer would
+		// be one more thing on the consent screen for nothing.
+		if c.Primary && account.Account == "" {
+			account.Account = c.ID
+			if err := s.db.SaveCalendarAccount(ctx, account); err != nil {
+				return nil, err
+			}
+		}
+	}
+	if err := s.db.ReplaceCalendars(ctx, account.ID, list); err != nil {
+		return nil, err
+	}
+	return s.db.Calendars(ctx, account.ID)
+}
+
+// forgetIfRevoked disconnects when Google says the grant is gone, and passes every
+// other failure through untouched.
+//
+// The distinction is the point. A revoked account polled every ten minutes for ever
+// is a log line a week long and a connection the person believes they removed; a
+// Google that is merely down is one that will answer next time.
+func (s *Server) forgetIfRevoked(ctx context.Context, user *store.User, account *store.CalendarAccount, err error) error {
+	if errors.Is(err, gcal.ErrUnauthorized) {
+		s.log.Info("calendar access was revoked; disconnecting", "user", user.ID)
+		_ = s.db.DeleteCalendarAccount(ctx, user.ID, account.ID)
+	}
+	return err
+}
+
+// calendarWindow is the span verdande keeps a copy of, measured from today.
+//
+// Built from the calendar date rather than by truncating the instant: Truncate
+// rounds against the Unix epoch, which is midnight UTC, and in Copenhagen that is
+// two in the morning — so for two hours of every summer day the window would start
+// and end a day out.
+func calendarWindow(now time.Time) (string, string) {
+	day := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
+	return day.AddDate(0, 0, -calendarWindowBack).Format(calendarDateLayout),
+		day.AddDate(0, 0, calendarWindowAhead).Format(calendarDateLayout)
+}
+
+func validDay(s string) bool {
+	_, err := time.Parse(calendarDateLayout, s)
+	return err == nil
+}
+
+// --- abonnementer -----------------------------------------------------------------
+
+// maxICSBytes bounds one fetch. A published calendar of a decade of holidays is a
+// few hundred kilobytes; ten megabytes is not a calendar, and reading it into
+// memory on a schedule with nobody watching is how a homelab instance falls over
+// at three in the morning.
+const maxICSBytes = 10 << 20
+
+// normaliseCalendarURL turns what somebody pastes into something that can be
+// fetched.
+//
+// `webcal://` is not a scheme anything speaks. It is a convention — the same URL
+// over https, with a scheme that makes a desktop hand it to the calendar app
+// instead of the browser — and every publisher writes their links that way. A
+// person pasting one has pasted the right address; refusing it would be refusing
+// them on a technicality.
+func normaliseCalendarURL(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	if after, ok := strings.CutPrefix(raw, "webcal://"); ok {
+		raw = "https://" + after
+	}
+	if !strings.HasPrefix(raw, "https://") && !strings.HasPrefix(raw, "http://") {
+		return "", errors.New("must be an https:// or webcal:// address")
+	}
+	// The same wall the AI provider's base_url goes through, and for the same
+	// reason: this is an address a user typed, and the server is about to fetch it
+	// on a schedule of their choosing.
+	if reason := safedial.CheckURL(raw); reason != "" {
+		return "", errors.New(reason)
+	}
+	return raw, nil
+}
+
+// icsClient is the client a subscribed calendar is fetched with.
+//
+// safedial, checked on the *resolved* address at connect time and on every
+// redirect hop — because a name that passed the check when it was pasted can
+// answer 127.0.0.1 when the sweep runs at three in the morning.
+//
+// The field exists so a test can put an ordinary client here: httptest listens on
+// loopback, which is exactly what this refuses, so a test of the *format* cannot
+// otherwise reach its own server. It is never set outside a test, and the wall it
+// bypasses is tested where it belongs — `normaliseCalendarURL` refuses a private
+// address where it is written down, and `internal/push` proves the connect-time
+// half.
+func (s *Server) icsClient() *http.Client {
+	if s.icsFetch != nil {
+		return s.icsFetch
+	}
+	return safedial.Client(30 * time.Second)
+}
+
+// fetchICS reads a subscribed calendar.
+//
+// safedial, not a plain client — checked on the resolved address at connect time
+// and on every redirect hop, because a name that passed the check when it was
+// pasted can answer 127.0.0.1 when the sweep runs at three in the morning.
+func (s *Server) fetchICS(ctx context.Context, url string) (ics.Subscribed, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return ics.Subscribed{}, err
+	}
+	req.Header.Set("Accept", "text/calendar, text/plain;q=0.9, */*;q=0.5")
+	req.Header.Set("User-Agent", "verdande/"+Version)
+
+	resp, err := s.icsClient().Do(req)
+	if err != nil {
+		return ics.Subscribed{}, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return ics.Subscribed{}, fmt.Errorf("%s said %s", resp.Request.URL.Host, resp.Status)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxICSBytes+1))
+	if err != nil {
+		return ics.Subscribed{}, err
+	}
+	if len(body) > maxICSBytes {
+		return ics.Subscribed{}, errors.New("that calendar is too large")
+	}
+	return ics.ParseCalendar(string(body)), nil
+}
+
+// syncSubscriptions refreshes every calendar this person subscribes to by address.
+//
+// One failing address does not stop the others. A subscription is somebody else's
+// server, and the ordinary state of somebody else's server is that it is fine
+// until one morning it is not — a holiday feed that 404s must not take the
+// football club's fixtures down with it.
+func (s *Server) syncSubscriptions(ctx context.Context, user *store.User) (int, error) {
+	subs, err := s.db.Subscriptions(ctx, user.ID)
+	if err != nil || len(subs) == 0 {
+		return 0, err
+	}
+
+	from, to := calendarWindow(time.Now())
+	written := 0
+	var failures []string
+
+	for _, sub := range subs {
+		if ctx.Err() != nil {
+			return written, ctx.Err()
+		}
+		unlock := s.lockSync("calendar:" + sub.ID)
+
+		calendarID, err := s.db.SubscribedCalendarID(ctx, sub.ID)
+		if err != nil {
+			unlock()
+			failures = append(failures, sub.URL)
+			continue
+		}
+
+		cal, err := s.fetchICS(ctx, sub.URL)
+		if err != nil {
+			unlock()
+			s.log.Warn("subscribed calendar", "err", err, "url", sub.URL, "user", user.ID)
+			failures = append(failures, sub.URL)
+			continue
+		}
+
+		// The name the file calls itself, once. A subscription is added under its
+		// address because that is all there is to go on before it has been fetched.
+		if err := s.db.RenameSubscribedCalendar(ctx, sub.ID, cal.Name); err != nil {
+			s.log.Warn("name subscribed calendar", "err", err)
+		}
+
+		rows := make([]store.CalendarEvent, 0, len(cal.Events))
+		for _, e := range cal.Events {
+			// Outside the window is not stored. The grid asks about a window, the
+			// sweep replaces a window, and a decade of holidays in one file would
+			// otherwise be a decade of rows rewritten every fifteen minutes.
+			if e.EndDay < from || e.StartDay > to {
+				continue
+			}
+			rows = append(rows, store.CalendarEvent{
+				RemoteID: e.UID, Summary: e.Summary, Location: e.Location, URL: e.URL,
+				StartsAt: e.StartsAt, EndsAt: e.EndsAt,
+				StartDay: e.StartDay, EndDay: e.EndDay, AllDay: e.AllDay,
+			})
+		}
+		if err := s.db.ReplaceCalendarEvents(ctx, calendarID, from, to, rows); err != nil {
+			unlock()
+			return written, err
+		}
+		if err := s.db.MarkCalendarSynced(ctx, sub.ID, time.Now()); err != nil {
+			s.log.Warn("mark subscription synced", "err", err)
+		}
+		written += len(rows)
+		unlock()
+	}
+
+	if len(failures) == len(subs) {
+		return written, fmt.Errorf("none of the %d subscribed calendars could be read", len(subs))
+	}
+	return written, nil
+}
+
+// handleSubscribeCalendar adds a calendar somebody only has an address to.
+//
+// Fetched once, here, before it is stored. An address that cannot be read is a
+// typo far more often than it is a server that happens to be down, and telling
+// somebody now — while they are looking at the field they just pasted into — is
+// worth the two seconds. A subscription that silently never fills is the same
+// silence the notifications had.
+func (s *Server) handleSubscribeCalendar(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		URL  string `json:"url"`
+		Name string `json:"name"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+
+	url, err := normaliseCalendarURL(req.URL)
+	if err != nil {
+		writeFieldErrors(w, map[string]string{"url": err.Error()})
+		return
+	}
+
+	user := userFrom(r.Context())
+	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
+	defer cancel()
+
+	cal, err := s.fetchICS(ctx, url)
+	if err != nil {
+		s.log.Warn("subscribe calendar", "err", err, "user", user.ID)
+		writeFieldErrors(w, map[string]string{"url": "that address could not be read"})
+		return
+	}
+
+	name := strings.TrimSpace(req.Name)
+	if name == "" {
+		name = strings.TrimSpace(cal.Name)
+	}
+	if name == "" {
+		name = url
+	}
+
+	account, err := s.db.SubscribeCalendar(r.Context(), user.ID, url, name)
+	if err != nil {
+		// The unique index is the one refusal worth naming: subscribing twice to
+		// the same address is the same calendar fetched twice, with no way to say
+		// which one counts.
+		if errors.Is(err, store.ErrDuplicate) {
+			writeFieldErrors(w, map[string]string{"url": "that calendar is already subscribed"})
+			return
+		}
+		s.storeError(w, r, "subscribe calendar", err)
+		return
+	}
+
+	// The events it already fetched, rather than making the person wait fifteen
+	// minutes for the sweep to prove it worked.
+	if _, err := s.syncSubscriptions(r.Context(), user); err != nil {
+		s.log.Warn("first subscription sync", "err", err)
+	}
+	writeJSON(w, http.StatusCreated, account)
+}
+
+func (s *Server) handleUnsubscribeCalendar(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	if err := s.db.DeleteCalendarAccount(r.Context(), user.ID, chi.URLParam(r, "id")); err != nil {
+		s.storeError(w, r, "unsubscribe calendar", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}

internal/httpapi/calendar_test.go

@@ -0,0 +1,471 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// fakeCalendarGoogle stands in for the parts of Google this feature touches: the
+// token endpoint, the calendar list and one calendar's events.
+//
+// There is no other way to exercise any of it. The real thing needs a registered
+// OAuth client, an account and somebody's consent, and none of the three can be had
+// inside a test — so the shapes Google returns are written down and the behaviour
+// is checked against them, the way internal/imap is checked against go-imap's own
+// in-process server.
+type fakeCalendarGoogle struct {
+	*httptest.Server
+	// refreshes counts token refreshes, so a test can prove one is not made for a
+	// token that has not expired.
+	refreshes int
+	// refuse makes every API call answer 401, which is what a revoked grant does.
+	refuse bool
+	events map[string][]map[string]any
+}
+
+func newFakeCalendarGoogle(t *testing.T) *fakeCalendarGoogle {
+	t.Helper()
+	g := &fakeCalendarGoogle{events: map[string][]map[string]any{}}
+	g.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch {
+		case r.URL.Path == "/token":
+			g.refreshes++
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"access_token": "ya29.fresh", "refresh_token": "1//0-refresh",
+				"expires_in": 3600,
+			})
+		case g.refuse:
+			http.Error(w, `{"error":"invalid_credentials"}`, http.StatusUnauthorized)
+		case strings.HasPrefix(r.URL.Path, "/users/me/calendarList"):
+			_ = json.NewEncoder(w).Encode(map[string]any{"items": []map[string]any{
+				{"id": "[email protected]", "summary": "[email protected]", "primary": true,
+					"accessRole": "owner", "backgroundColor": "#3f51b5",
+					"timeZone": "Europe/Copenhagen"},
+				{"id": "fam", "summary": "Familien", "accessRole": "reader",
+					"backgroundColor": "#0b8043"},
+			}})
+		case strings.HasPrefix(r.URL.Path, "/calendars/"):
+			id := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/calendars/"), "/events")
+			items := g.events[id]
+			if items == nil {
+				items = []map[string]any{}
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"items": items})
+		default:
+			http.Error(w, "unexpected "+r.URL.Path, http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(g.Close)
+	return g
+}
+
+// connectedCalendar returns a server with a calendar account already connected —
+// the state the OAuth callback leaves behind, without the consent screen nothing
+// can automate.
+func connectedCalendar(t *testing.T, g *fakeCalendarGoogle, tune func(*config.Config)) (*testServer, *store.User) {
+	t.Helper()
+	ts := newTestServerWith(t, func(cfg *config.Config) {
+		cfg.GmailClientID = "test-client"
+		cfg.GmailClientSecret = "test-secret"
+		cfg.GoogleTokenURL = g.URL + "/token"
+		cfg.CalendarAPIURL = g.URL
+		if tune != nil {
+			tune(cfg)
+		}
+	})
+	ts.bootstrap(t)
+
+	user, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	account := &store.CalendarAccount{
+		UserID: user.ID, Provider: "google", RefreshToken: "1//0-refresh",
+	}
+	if err := ts.db.SaveCalendarAccount(t.Context(), account); err != nil {
+		t.Fatal(err)
+	}
+	return ts, user
+}
+
+// The scope on the consent screen is what somebody agrees to. It has to be the
+// read-only one, and the redirect has to be the calendar's own — sharing Gmail's
+// would put "which token store do I write" behind a lookup.
+func TestAuthorizeAsksForReadOnlyCalendar(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	ts, _ := connectedCalendar(t, g, nil)
+
+	resp, body := ts.do(t, "POST", "/api/v1/calendar/authorize", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+	url, _ := body["url"].(string)
+	for _, want := range []string{
+		"scope=" + "https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcalendar.readonly",
+		"%2Foauth%2Fcalendar%2Fcallback",
+		"access_type=offline",
+		"prompt=consent",
+	} {
+		if !strings.Contains(url, want) {
+			t.Errorf("the authorisation URL is missing %q:\n%s", want, url)
+		}
+	}
+	if strings.Contains(url, "calendar.events&") || strings.Contains(url, "auth%2Fcalendar&") {
+		t.Errorf("a writing scope was asked for:\n%s", url)
+	}
+}
+
+// Without a registered client there is nothing to connect through, and the answer
+// has to say that rather than "that already exists".
+func TestAuthorizeWithoutAClientSaysSo(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/calendar/authorize", nil)
+	if resp.StatusCode != http.StatusConflict {
+		t.Fatalf("status %d, want 409", resp.StatusCode)
+	}
+	if body["code"] != CodeGmailNotConfigured {
+		t.Errorf("code = %v, want %q", body["code"], CodeGmailNotConfigured)
+	}
+}
+
+// The whole path, minus the consent screen: sync fetches the list, refreshes the
+// events of what was chosen, and the grid endpoint answers with them.
+func TestSyncFetchesTheChosenCalendarsAndTheGridReadsThem(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	g.events["fam"] = []map[string]any{
+		{"id": "e1", "summary": "Bestyrelsesmøde", "htmlLink": "https://calendar.google.com/e1",
+			"start": map[string]string{"dateTime": "2026-08-20T14:00:00+02:00"},
+			"end":   map[string]string{"dateTime": "2026-08-20T15:30:00+02:00"}},
+	}
+	g.events["[email protected]"] = []map[string]any{
+		{"id": "e2", "summary": "Skal ikke med",
+			"start": map[string]string{"date": "2026-08-21"},
+			"end":   map[string]string{"date": "2026-08-22"}},
+	}
+	ts, user := connectedCalendar(t, g, nil)
+
+	// The list arrives on the first look at the settings page, which is what
+	// somebody would be doing at this point.
+	resp, body := ts.do(t, "GET", "/api/v1/calendar", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+	if body["connected"] != true {
+		t.Fatalf("not reported as connected: %v", body)
+	}
+	if body["read_only"] != true {
+		t.Error("the connection did not say it is read-only; an interface that looks " +
+			"editable is one somebody will try to edit")
+	}
+	// The primary calendar's id is the address, which is how the account names
+	// itself without asking for a profile scope as well.
+	if body["account"] != "[email protected]" {
+		t.Errorf("account = %v", body["account"])
+	}
+
+	list, _ := body["calendars"].([]any)
+	if len(list) != 2 {
+		t.Fatalf("got %d calendars, want 2: %v", len(list), body["calendars"])
+	}
+	var famID string
+	for _, raw := range list {
+		c := raw.(map[string]any)
+		if c["shown"] == true {
+			t.Errorf("%v was shown without anybody choosing it", c["name"])
+		}
+		if c["remote_id"] == "fam" {
+			famID = c["id"].(string)
+		}
+	}
+
+	// Nothing is chosen, so a sync writes nothing: an account with a dozen shared
+	// calendars must not fill somebody's grid the moment it is connected.
+	resp, body = ts.do(t, "POST", "/api/v1/calendar/sync", nil)
+	if resp.StatusCode != http.StatusOK || body["events"] != float64(0) {
+		t.Fatalf("an unchosen calendar was fetched: %d %v", resp.StatusCode, body)
+	}
+
+	resp, _ = ts.do(t, "PUT", "/api/v1/calendar/calendars",
+		map[string]any{"shown": []string{famID}})
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("choosing a calendar: status %d", resp.StatusCode)
+	}
+
+	resp, body = ts.do(t, "POST", "/api/v1/calendar/sync", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("sync: status %d, body %v", resp.StatusCode, body)
+	}
+	if body["events"] != float64(1) {
+		t.Fatalf("events = %v, want 1 — only the chosen calendar", body["events"])
+	}
+
+	resp, body = ts.do(t, "GET",
+		"/api/v1/calendar/events?from=2026-08-01&to=2026-08-31", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("events: status %d, body %v", resp.StatusCode, body)
+	}
+	events, _ := body["events"].([]any)
+	if len(events) != 1 {
+		t.Fatalf("got %d events, want 1: %v", len(events), body["events"])
+	}
+	event := events[0].(map[string]any)
+	if event["summary"] != "Bestyrelsesmøde" || event["start_day"] != "2026-08-20" {
+		t.Errorf("the event came back as %v", event)
+	}
+	// The calendar's colour rides along, or the chip has to ask for it per row.
+	if event["colour"] != "#0b8043" {
+		t.Errorf("colour = %v; two calendars in one grid are told apart by it", event["colour"])
+	}
+	// The window verdande holds is stated, so a grid paged past it can say so
+	// rather than showing an empty month it cannot explain.
+	if body["from"] == "" || body["to"] == "" {
+		t.Error("the answer does not say which window it covers")
+	}
+
+	// And it is one person's calendar. Somebody else on the same instance sees
+	// nothing of it.
+	other := ts.newUser(t, "[email protected]", "Andreas")
+	_, body = other.do(t, "GET", "/api/v1/calendar/events?from=2026-08-01&to=2026-08-31", nil)
+	if events, _ := body["events"].([]any); len(events) != 0 {
+		t.Errorf("somebody else's calendar was visible: %v", body["events"])
+	}
+	_ = user
+}
+
+// A token that has not expired must not be traded in for another. Refreshing on
+// every run burns the quota and makes the failure mode of a bad refresh token
+// arrive on every sweep rather than once an hour.
+func TestAFreshTokenIsNotRefreshed(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	ts, user := connectedCalendar(t, g, nil)
+
+	account, err := ts.db.CalendarAccountFor(t.Context(), user.ID, "google")
+	if err != nil {
+		t.Fatal(err)
+	}
+	account.AccessToken = "ya29.still-good"
+	account.ExpiresAt = time.Now().Add(time.Hour)
+	if err := ts.db.SaveCalendarAccount(t.Context(), account); err != nil {
+		t.Fatal(err)
+	}
+
+	if resp, body := ts.do(t, "POST", "/api/v1/calendar/sync", nil); resp.StatusCode != http.StatusOK {
+		t.Fatalf("sync: status %d, body %v", resp.StatusCode, body)
+	}
+	if g.refreshes != 0 {
+		t.Errorf("the token was refreshed %d times while it was still good", g.refreshes)
+	}
+
+	// And an expired one is.
+	account.ExpiresAt = time.Now().Add(-time.Minute)
+	if err := ts.db.SaveCalendarAccount(t.Context(), account); err != nil {
+		t.Fatal(err)
+	}
+	if resp, body := ts.do(t, "POST", "/api/v1/calendar/sync", nil); resp.StatusCode != http.StatusOK {
+		t.Fatalf("sync: status %d, body %v", resp.StatusCode, body)
+	}
+	if g.refreshes != 1 {
+		t.Errorf("an expired token was refreshed %d times, want 1", g.refreshes)
+	}
+}
+
+// Access revoked at Google's end is a connection that has ended, not a failure to
+// retry. Polling it every fifteen minutes for ever is a week of log lines and a
+// connection the person believes they removed.
+func TestRevokedAccessDisconnects(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	ts, user := connectedCalendar(t, g, nil)
+
+	account, _ := ts.db.CalendarAccountFor(t.Context(), user.ID, "google")
+	account.AccessToken = "ya29.revoked"
+	account.ExpiresAt = time.Now().Add(time.Hour)
+	if err := ts.db.SaveCalendarAccount(t.Context(), account); err != nil {
+		t.Fatal(err)
+	}
+	g.refuse = true
+
+	resp, body := ts.do(t, "POST", "/api/v1/calendar/sync", nil)
+	if resp.StatusCode != StatusUpstreamRefused {
+		t.Fatalf("status %d, want %d — Google saying no is not this server breaking",
+			resp.StatusCode, StatusUpstreamRefused)
+	}
+	if body["code"] != CodeCalendarFailed {
+		t.Errorf("code = %v, want %q — `internal_error` is shown as a generic sentence, "+
+			"which throws the diagnosis away", body["code"], CodeCalendarFailed)
+	}
+
+	gone, err := ts.db.CalendarAccountFor(t.Context(), user.ID, "google")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gone != nil {
+		t.Error("the connection is still there after Google refused the token")
+	}
+
+	// And the failure is in the error log, which is the point of having one: a
+	// sync that has been failing for a week is invisible otherwise.
+	_, logged := ts.do(t, "GET", "/api/v1/errors", nil)
+	rows, _ := logged["errors"].([]any)
+	if len(rows) == 0 {
+		t.Fatal("nothing was recorded")
+	}
+	if row := rows[0].(map[string]any); row["what"] != "sync calendar" {
+		t.Errorf("what = %v, want \"sync calendar\"", row["what"])
+	}
+}
+
+// Disconnecting takes the copy with it. None of it is the person's own work, and
+// a calendar left behind after the account is gone is a frozen lie about a day.
+func TestDisconnectingRemovesTheEvents(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	g.events["fam"] = []map[string]any{
+		{"id": "e1", "summary": "Møde",
+			"start": map[string]string{"date": "2026-08-20"},
+			"end":   map[string]string{"date": "2026-08-21"}},
+	}
+	ts, user := connectedCalendar(t, g, nil)
+
+	ts.do(t, "GET", "/api/v1/calendar", nil)
+	account, _ := ts.db.CalendarAccountFor(t.Context(), user.ID, "google")
+	calendars, _ := ts.db.Calendars(t.Context(), account.ID)
+	var famID string
+	for _, c := range calendars {
+		if c.RemoteID == "fam" {
+			famID = c.ID
+		}
+	}
+	ts.do(t, "PUT", "/api/v1/calendar/calendars", map[string]any{"shown": []string{famID}})
+	ts.do(t, "POST", "/api/v1/calendar/sync", nil)
+
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/calendar", nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("disconnect: status %d", resp.StatusCode)
+	}
+
+	_, body := ts.do(t, "GET", "/api/v1/calendar/events?from=2026-08-01&to=2026-08-31", nil)
+	if events, _ := body["events"].([]any); len(events) != 0 {
+		t.Errorf("events survived the disconnect: %v", body["events"])
+	}
+	_, body = ts.do(t, "GET", "/api/v1/calendar", nil)
+	if body["connected"] != false {
+		t.Error("still reported as connected")
+	}
+}
+
+// A range that is not a date has to be refused, not guessed at. An empty `from`
+// compared as a string matches everything before it, which is a grid quietly
+// answering a question nobody asked.
+func TestEventsRefuseARangeThatIsNotADate(t *testing.T) {
+	g := newFakeCalendarGoogle(t)
+	ts, _ := connectedCalendar(t, g, nil)
+
+	for _, query := range []string{
+		"", "?from=2026-08-01", "?from=&to=2026-08-31",
+		"?from=i+morgen&to=2026-08-31", "?from=2026-08-01&to=2026-13-40",
+	} {
+		resp, body := ts.do(t, "GET", "/api/v1/calendar/events"+query, nil)
+		if resp.StatusCode != http.StatusUnprocessableEntity {
+			t.Errorf("%q: status %d, want 422 (%v)", query, resp.StatusCode, body)
+		}
+	}
+}
+
+// A person with no calendar connected still opens the view. It has to answer, and
+// answer emptily, rather than fail — the grid is also verdande's own tasks, and
+// they must not disappear because Google is not set up.
+func TestTheGridAnswersWithNoCalendarConnected(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "GET", "/api/v1/calendar/events?from=2026-08-01&to=2026-08-31", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+	if events, ok := body["events"].([]any); !ok || len(events) != 0 {
+		t.Errorf("events = %v, want an empty list rather than null", body["events"])
+	}
+
+	resp, body = ts.do(t, "GET", "/api/v1/calendar", nil)
+	if resp.StatusCode != http.StatusOK || body["connected"] != false {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+	if body["has_client"] != false {
+		t.Error("an instance with no OAuth registration claimed to have one; the page " +
+			"would offer a button that answers 409")
+	}
+	// Spelled out even when nothing is connected: it is what has to be registered
+	// with Google, and it is the single most likely thing to be wrong.
+	if uri, _ := body["redirect_uri"].(string); !strings.HasSuffix(uri, "/oauth/calendar/callback") {
+		t.Errorf("redirect_uri = %q", uri)
+	}
+}
+
+// A slow Google must not hold the request open until something in front of this
+// server gives up on it and answers with its own HTML.
+func TestASlowCalendarDoesNotHangTheRequest(t *testing.T) {
+	blocked := make(chan struct{})
+	defer close(blocked)
+	slow := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case <-blocked:
+		case <-r.Context().Done():
+		}
+	}))
+	defer slow.Close()
+
+	ts := newTestServerWith(t, func(cfg *config.Config) {
+		cfg.GmailClientID = "test-client"
+		cfg.GmailClientSecret = "test-secret"
+		cfg.GoogleTokenURL = slow.URL + "/token"
+		cfg.CalendarAPIURL = slow.URL
+		// A second rather than the real twenty-five: what is being tested is that a
+		// budget is applied at all, and spending the production one on every run
+		// would put half a minute into the suite to learn the same thing.
+		cfg.CalendarSyncBudget = time.Second
+	})
+	ts.bootstrap(t)
+
+	user, err := ts.db.UserByEmail(t.Context(), "[email protected]")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ts.db.SaveCalendarAccount(t.Context(), &store.CalendarAccount{
+		UserID: user.ID, Provider: "google", RefreshToken: "r",
+		AccessToken: "a", ExpiresAt: time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Its own client, because the shared one gives up after ten seconds — which is
+	// shorter than the budget being tested and would prove nothing either way.
+	req, _ := http.NewRequest("POST", ts.URL+"/api/v1/calendar/sync", nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	for _, c := range ts.client.Jar.Cookies(mustParse(t, ts.URL)) {
+		req.AddCookie(c)
+	}
+
+	started := time.Now()
+	resp, err := (&http.Client{Timeout: 90 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("the request never came back (%v after %s); the sync has no budget of its "+
+			"own, and whatever sits in front of this server answers for it",
+			err, time.Since(started).Round(time.Second))
+	}
+	defer resp.Body.Close()
+
+	if took := time.Since(started); took > 10*time.Second {
+		t.Errorf("the sync took %s; the budget is not being applied", took.Round(time.Second))
+	}
+	if resp.StatusCode >= 500 {
+		t.Errorf("status %d — a slow Google is not this server breaking", resp.StatusCode)
+	}
+}

internal/httpapi/comments_handlers.go

@@ -68,7 +68,7 @@ func (s *Server) handleListComments(w http.ResponseWriter, r *http.Request) {
 
 	comments, err := s.db.ListComments(r.Context(), taskID)
 	if err != nil {
-		s.internal(w, "list comments", err)
+		s.internal(w, r, "list comments", err)
 		return
 	}
 	out := make([]commentJSON, 0, len(comments))
@@ -78,7 +78,7 @@ func (s *Server) handleListComments(w http.ResponseWriter, r *http.Request) {
 
 	files, err := s.db.ListTaskAttachments(r.Context(), taskID)
 	if err != nil {
-		s.internal(w, "list attachments", err)
+		s.internal(w, r, "list attachments", err)
 		return
 	}
 	direct := make([]attachmentJSON, 0, len(files))
@@ -119,7 +119,7 @@ func (s *Server) handleCreateComment(w http.ResponseWriter, r *http.Request) {
 
 	comment, err := s.db.CreateComment(r.Context(), taskID, user.ID, body)
 	if err != nil {
-		s.internal(w, "create comment", err)
+		s.internal(w, r, "create comment", err)
 		return
 	}
 	comment.UserName, comment.UserColor = user.Name, user.AvatarColor
@@ -149,7 +149,7 @@ func (s *Server) handleUpdateComment(w http.ResponseWriter, r *http.Request) {
 
 	err := s.db.UpdateComment(r.Context(), chi.URLParam(r, "commentID"), userFrom(r.Context()).ID, body)
 	if err != nil {
-		s.storeError(w, "update comment", err)
+		s.storeError(w, r, "update comment", err)
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -161,7 +161,7 @@ func (s *Server) handleDeleteComment(w http.ResponseWriter, r *http.Request) {
 
 	taskID, err := s.db.CommentTask(r.Context(), commentID)
 	if err != nil {
-		s.storeError(w, "comment task", err)
+		s.storeError(w, r, "comment task", err)
 		return
 	}
 	role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
@@ -171,7 +171,7 @@ func (s *Server) handleDeleteComment(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := s.db.DeleteComment(r.Context(), commentID, user.ID, role.CanManage()); err != nil {
-		s.storeError(w, "delete comment", err)
+		s.storeError(w, r, "delete comment", err)
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -219,28 +219,43 @@ func (s *Server) handleUploadAttachment(w http.ResponseWriter, r *http.Request)
 
 	stored, size, err := s.storeUpload(file)
 	if err != nil {
-		s.internal(w, "store upload", err)
+		s.internal(w, r, "store upload", err)
 		return
 	}
 
 	a := &store.Attachment{
 		TaskID:     taskID,
-		CommentID:  r.FormValue("comment_id"),
 		Filename:   safeFilename(header.Filename),
 		MimeType:   detectMime(header.Filename, header.Header.Get("Content-Type")),
 		Size:       size,
 		Path:       stored,
 		UploadedBy: user.ID,
 	}
+
 	// An attachment hangs on a task or on a comment, never both — the schema says
 	// so, and the form may have supplied a comment id.
-	if a.CommentID != "" {
-		a.TaskID = ""
+	//
+	// The comment is resolved and checked against the task in the URL. It was
+	// taken on trust, which meant the permission check above guarded the *task
+	// somebody named* while the file landed on *whatever comment they asked for*.
+	// A viewer on a shared project can list its comments, so she could read an id
+	// there and then post to a task in her own project with that id attached: the
+	// file appears under somebody else's comment, in a project she may only read,
+	// and is served to everyone in it from this origin under a name she chose.
+	// Somebody removed from a project could do the same with ids they kept.
+	if id := r.FormValue("comment_id"); id != "" {
+		owner, err := s.db.CommentTask(r.Context(), id)
+		if err != nil || owner != taskID {
+			os.Remove(filepath.Join(s.cfg.FilesDir(), stored))
+			writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+			return
+		}
+		a.CommentID, a.TaskID = id, ""
 	}
 
 	if err := s.db.CreateAttachment(r.Context(), a); err != nil {
 		os.Remove(filepath.Join(s.cfg.FilesDir(), stored))
-		s.internal(w, "record attachment", err)
+		s.internal(w, r, "record attachment", err)
 		return
 	}
 
@@ -300,23 +315,79 @@ func (s *Server) storeUpload(file io.Reader) (string, int64, error) {
 	return rel, size, nil
 }
 
-func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request) {
-	attachmentID := chi.URLParam(r, "attachmentID")
+// reachAttachment answers whether this person may see an attachment at all, and
+// whether they may change it.
+//
+// An attachment hangs on exactly one of three things, and each has its own idea of
+// who may reach it. A task's is governed by its project's roles, directly or
+// through the comment it hangs on. A group's is governed by nothing but ownership:
+// a group belongs to one person, is never shared, and a group that is not yours is
+// not found — the same rule the rest of the group routes use.
+//
+// Both callers below used to resolve straight to a task, so a group's attachment
+// answered 404 for its own owner.
+func (s *Server) reachAttachment(r *http.Request, attachmentID string) (canEdit bool, err error) {
 	user := userFrom(r.Context())
 
+	a, err := s.db.GetAttachment(r.Context(), attachmentID)
+	if err != nil {
+		return false, err
+	}
+
+	if a.GroupID != "" {
+		if _, err := s.db.GetProjectGroup(r.Context(), a.GroupID, user.ID); err != nil {
+			return false, err
+		}
+		// Nobody else can reach it, so whoever can, can change it.
+		return true, nil
+	}
+
+	// A file inside a note follows the note, which follows its project — the same
+	// chain everything else here follows. Without this a picture imported with a
+	// note answered 404 while sitting in the middle of the text that named it.
+	if a.NoteID != "" {
+		n, err := s.db.Note(r.Context(), a.NoteID)
+		if err != nil {
+			return false, err
+		}
+		if n == nil {
+			return false, store.ErrNotFound
+		}
+		if n.ProjectID == "" {
+			if n.CreatedBy != user.ID {
+				return false, store.ErrNotFound
+			}
+			return true, nil
+		}
+		role, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, store.RoleViewer)
+		if err != nil {
+			return false, err
+		}
+		return role.CanEdit(), nil
+	}
+
 	taskID, err := s.db.AttachmentTask(r.Context(), attachmentID)
 	if err != nil {
-		s.storeError(w, "attachment task", err)
-		return
+		return false, err
 	}
-	if _, err := store.TaskRole(r.Context(), s.db, taskID, user.ID); err != nil {
+	role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
+	if err != nil {
+		return false, err
+	}
+	return role.CanEdit(), nil
+}
+
+func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request) {
+	attachmentID := chi.URLParam(r, "attachmentID")
+
+	if _, err := s.reachAttachment(r, attachmentID); err != nil {
 		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
 		return
 	}
 
 	a, err := s.db.GetAttachment(r.Context(), attachmentID)
 	if err != nil {
-		s.storeError(w, "get attachment", err)
+		s.storeError(w, r, "get attachment", err)
 		return
 	}
 
@@ -338,12 +409,30 @@ func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request
 	}
 	defer f.Close()
 
-	// Everything is served as a download rather than rendered. An uploaded SVG or
-	// HTML file displayed inline would run its own script on this origin, with the
-	// session cookie attached — attachments are the one place a user supplies
-	// content that another user opens.
-	w.Header().Set("Content-Type", "application/octet-stream")
-	w.Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+
+	// Almost everything is served as a download rather than rendered. An uploaded
+	// SVG or HTML file displayed inline would run its own script on this origin,
+	// with the session cookie attached — attachments are the one place a user
+	// supplies content that another user opens.
+	//
+	// The exception is a short list of raster images, and it is not a softening of
+	// that rule but what makes a note work: a note carries its pictures in the text
+	// as `![](…)`, and served as octet-stream every one of them is a broken image.
+	// The whole Apple Notes import exists to bring those pictures along.
+	//
+	// Safe because it is an allowlist of formats that cannot carry script, sent as
+	// the exact type with `nosniff` — so the browser must treat it as that image or
+	// not at all, and can never be talked into reading it as HTML. SVG is
+	// deliberately absent: it is a document, not a picture, and it is the one image
+	// type that can run script.
+	disposition := "attachment"
+	contentType := "application/octet-stream"
+	if inlineImage[a.MimeType] {
+		disposition = "inline"
+		contentType = a.MimeType
+	}
+
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Content-Disposition", disposition+"; filename*=UTF-8''"+
 		strings.ReplaceAll(mime.QEncoding.Encode("utf-8", a.Filename), " ", "%20"))
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.Header().Set("Content-Length", fmt.Sprint(a.Size))
@@ -352,24 +441,36 @@ func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request
 	http.ServeContent(w, r, a.Filename, a.CreatedAt, f)
 }
 
+// inlineImage is what may be shown rather than downloaded.
+//
+// Raster formats only, and named one by one rather than matched on an "image/"
+// prefix: the prefix would let image/svg+xml through, which is a document that
+// can run script, and a list that grows by accident is how that happens.
+var inlineImage = map[string]bool{
+	"image/png":  true,
+	"image/jpeg": true,
+	"image/gif":  true,
+	"image/webp": true,
+	"image/avif": true,
+	// Sendes med, selv om ingen browser viser den endnu. Den er lige så ufarlig
+	// som de andre, og en iPhone-note er fuld af dem — den dag Safari viser dem,
+	// virker de, uden at nogen skal huske hvorfor de ikke gjorde.
+	"image/heic": true,
+	"image/heif": true,
+}
+
 func (s *Server) handleDeleteAttachment(w http.ResponseWriter, r *http.Request) {
 	attachmentID := chi.URLParam(r, "attachmentID")
-	user := userFrom(r.Context())
 
-	taskID, err := s.db.AttachmentTask(r.Context(), attachmentID)
-	if err != nil {
-		s.storeError(w, "attachment task", err)
-		return
-	}
-	role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
-	if err != nil || !role.CanEdit() {
+	canEdit, err := s.reachAttachment(r, attachmentID)
+	if err != nil || !canEdit {
 		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
 		return
 	}
 
 	path, err := s.db.DeleteAttachment(r.Context(), attachmentID)
 	if err != nil {
-		s.storeError(w, "delete attachment", err)
+		s.storeError(w, r, "delete attachment", err)
 		return
 	}
 

internal/httpapi/csp.go

@@ -36,7 +36,18 @@ func scriptHashes(web fs.FS) []string {
 	if err != nil {
 		return nil
 	}
+	return scriptHashesIn(raw)
+}
 
+// scriptHashesIn is the same thing over bytes that are already in hand.
+//
+// It exists because the notes edition does not serve the index.html that is on
+// disk — it serves a renamed copy of it (see shell.go) — and the policy has to
+// describe the bytes that actually leave the server. Hashing the file while
+// serving something else is the shape of mistake that cannot be noticed locally:
+// the policy is not enforced for a page opened from a file, so the page is blank
+// in production and nowhere else.
+func scriptHashesIn(raw []byte) []string {
 	var out []string
 	seen := map[string]bool{}
 	for _, match := range inlineScript.FindAllStringSubmatchIndex(string(raw), -1) {

internal/httpapi/csp_header_test.go

@@ -0,0 +1,101 @@
+package httpapi
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// Politikken skal stå i svaret, og den skal stadig være stram.
+//
+// Den er dét, der gjorde en XSS i noteeditoren til indsat HTML frem for kørt
+// script, dengang en `alt` slap uden om sin undslupning — og der var ingen prøve
+// på, at headeren overhovedet blev sendt. En sikkerhedsforanstaltning, ingen
+// prøve rører, er en, der kan forsvinde i en oprydning uden at nogen opdager det.
+func TestEveryResponseCarriesAStrictCSP(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, _ := ts.do(t, "GET", "/api/v1/auth/me", nil)
+	policy := resp.Header.Get("Content-Security-Policy")
+	if policy == "" {
+		t.Fatal("der er ingen Content-Security-Policy på svaret")
+	}
+
+	// Målt på script-src alene, og ikke på hele politikken.
+	//
+	// `style-src 'unsafe-inline'` står der med vilje og er forklaret i csp.go:
+	// Svelte skriver stilarter ind i dokumentet, og en indsat stil kan gøre en
+	// side grim, ikke køre kode. Det er script-src, der afgør, om indsat HTML
+	// bliver til et kørende script, og det er derfor den, prøven ser på.
+	scriptSrc := ""
+	for _, part := range strings.Split(policy, ";") {
+		if strings.HasPrefix(strings.TrimSpace(part), "script-src") {
+			scriptSrc = part
+		}
+	}
+	if scriptSrc == "" {
+		t.Fatal("der er ingen script-src i politikken")
+	}
+	for _, forbidden := range []string{"'unsafe-inline'", "'unsafe-eval'", "'unsafe-hashes'", "'strict-dynamic'"} {
+		if strings.Contains(scriptSrc, forbidden) {
+			t.Errorf("script-src indeholder %s: %q", forbidden, strings.TrimSpace(scriptSrc))
+		}
+	}
+
+	// Og de fire, der skal være der.
+	for _, want := range []string{"script-src", "object-src 'none'", "base-uri 'none'", "frame-ancestors 'none'"} {
+		if !strings.Contains(policy, want) {
+			t.Errorf("politikken mangler %q", want)
+		}
+	}
+}
+
+// HSTS følger med, når instansen kører over HTTPS — og kun der.
+//
+// Sessionen bor i en __Host-cookie, der kun findes over TLS, så hele modellen
+// forudsætter allerede HTTPS. HSTS er det, der holder den forudsætning mod en
+// netværksangriber; men bedt om over ren HTTP ville den bede en browser om at
+// kræve et certifikat, en dev-instans ikke har. Begge halvdele skal stå prøven.
+func TestHSTSTracksHTTPS(t *testing.T) {
+	overHTTP := newTestServer(t) // BaseURL er http://localhost
+	resp, _ := overHTTP.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("HSTS sat over ren HTTP: %q", got)
+	}
+
+	overHTTPS := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://todo.example.dk"
+	})
+	resp, _ = overHTTPS.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got == "" {
+		t.Error("ingen HSTS over HTTPS")
+	} else if !strings.Contains(got, "includeSubDomains") {
+		t.Errorf("HSTS uden includeSubDomains: %q", got)
+	}
+	// Permissions-Policy står på hvert svar, uanset skema: den lukker for kamera,
+	// mikrofon og placering, som appen aldrig beder om.
+	if got := resp.Header.Get("Permissions-Policy"); !strings.Contains(got, "camera=()") {
+		t.Errorf("Permissions-Policy lukker ikke for kameraet: %q", got)
+	}
+	// COOP isolerer browserkonteksten og står på hvert svar.
+	if got := resp.Header.Get("Cross-Origin-Opener-Policy"); got != "same-origin" {
+		t.Errorf("Cross-Origin-Opener-Policy er ikke same-origin: %q", got)
+	}
+}
+
+// Et bilag må ikke kunne blive læst som et dokument.
+func TestAttachmentsAreNotServedAsDocuments(t *testing.T) {
+	for _, mime := range []string{"image/svg+xml", "text/html", "application/xhtml+xml", "text/xml"} {
+		if inlineImage[mime] {
+			t.Errorf("%s står på listen over det, der vises inline", mime)
+		}
+	}
+	// Og listen skal faktisk kunne noget, ellers virker billeder i noter ikke.
+	for _, mime := range []string{"image/png", "image/jpeg"} {
+		if !inlineImage[mime] {
+			t.Errorf("%s mangler; billeder i noter kan ikke vises", mime)
+		}
+	}
+}

internal/httpapi/edition.go

@@ -0,0 +1,16 @@
+package httpapi
+
+import "github.com/kristianwind/verdande/internal/config"
+
+// edition is what this instance tells the world it is.
+//
+// Never the empty string, even when the config was built by hand in a test and
+// never went through config.Load: a flade that reads "" cannot tell "this is the
+// full program" from "this build forgot to say", and the first of those is the
+// answer that has always been true.
+func (s *Server) edition() string {
+	if s.cfg.NotesOnly() {
+		return config.EditionNotes
+	}
+	return config.EditionFull
+}

internal/httpapi/edition_test.go

@@ -0,0 +1,375 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// The notes edition is a different program, and this is what makes that true.
+//
+// A gate in a route tree is the easiest thing in the world to believe and the
+// hardest to see: the code reads `if full {`, somebody confirms the mechanism
+// exists, and nothing ever asks whether it covers the routes it was written for.
+// So this does not check that a gate is *present*. It walks both routers and
+// compares the two sets of routes they actually serve.
+//
+// The difference is written down below. A route added later that differs between
+// the editions — in either direction — fails here until somebody says which half
+// it belongs to. That is the point: the list is the decision, and the walk is
+// what keeps the decision honest.
+func TestNotesEditionServesOnlyItsOwnRoutes(t *testing.T) {
+	full := routesOf(t, config.EditionFull)
+	notes := routesOf(t, config.EditionNotes)
+
+	// Every route the full edition has and the notes edition does not. Written as
+	// the whole list rather than a prefix rule: a prefix is a description of what
+	// somebody meant, and this has to be a description of what is there.
+	//
+	// And note what this list could NOT catch, because it is the shape of mistake
+	// that outlived the first version of this test. The list went green at 29
+	// routes for two merges while CalDAV, the ICS feed, the inbox hook, four task
+	// exports, both task imports, the project templates, the sections and six AI
+	// task endpoints were all still served by the notes edition — because the test
+	// compares the router against THIS LIST, and the list was written from the
+	// routes somebody had thought of. It is a drift check, and it cannot be an
+	// is-it-complete check.
+	//
+	// So when a route is added that one edition should not have, the question to
+	// ask is not "does the walk still pass" but "can this endpoint do anything at
+	// all without the half it is being withheld from". Three of the ones above were
+	// settled by reading rather than by the name: a template turned out to create
+	// tasks (CreateProjectFromTemplate), `section_id` turned out to exist on
+	// `tasks` and not on `notes`, and add_comment turned out to hang off a task.
+	withheld := map[string]bool{}
+	for _, r := range []string{
+		"DELETE /api/v1/filters/{filterID}",
+		"DELETE /api/v1/labels/{labelID}",
+		"DELETE /api/v1/reminders/{reminderID}",
+		"DELETE /api/v1/sections/{sectionID}",
+		"DELETE /api/v1/tasks/{taskID}",
+		"DELETE /api/v1/templates/{templateID}",
+		"DELETE /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /.well-known/caldav",
+		"GET /api/v1/ai/plan",
+		"GET /api/v1/delegated",
+		"GET /api/v1/export/projects.zip",
+		"GET /api/v1/export/projects/{projectID}.csv",
+		"GET /api/v1/export/projects/{projectID}.ics",
+		"GET /api/v1/export/tasks.ics",
+		"GET /api/v1/feed",
+		"GET /api/v1/filters",
+		"GET /api/v1/filters/preview",
+		"GET /api/v1/filters/{filterID}/tasks",
+		"GET /api/v1/labels",
+		"GET /api/v1/projects/{projectID}/sections",
+		"GET /api/v1/tasks",
+		"GET /api/v1/tasks/quick-add/preview",
+		"GET /api/v1/tasks/{taskID}",
+		"GET /api/v1/tasks/{taskID}/comments",
+		"GET /api/v1/tasks/{taskID}/reminders",
+		"GET /api/v1/templates",
+		"GET /api/v1/upcoming",
+		"GET /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /ics/{token}",
+		"OPTIONS /caldav/*",
+		"PATCH /api/v1/filters/{filterID}",
+		"PATCH /api/v1/labels/{labelID}",
+		"PATCH /api/v1/sections/{sectionID}",
+		"PATCH /api/v1/tasks/{taskID}",
+		"POST /api/v1/ai/inbox/tidy",
+		"POST /api/v1/ai/inbox/tidy/apply",
+		"POST /api/v1/ai/plan/now",
+		"POST /api/v1/ai/tasks/{taskID}/split",
+		"POST /api/v1/feed/rotate",
+		"POST /api/v1/filters",
+		"POST /api/v1/import/csv",
+		"POST /api/v1/import/todoist",
+		"POST /api/v1/labels",
+		"POST /api/v1/projects/{projectID}/sections",
+		"POST /api/v1/projects/{projectID}/sections/reorder",
+		"POST /api/v1/tasks",
+		"POST /api/v1/tasks/quick-add",
+		"POST /api/v1/tasks/{taskID}/attachments",
+		"POST /api/v1/tasks/{taskID}/comments",
+		"POST /api/v1/tasks/{taskID}/complete",
+		"POST /api/v1/tasks/{taskID}/move",
+		"POST /api/v1/tasks/{taskID}/reminders",
+		"POST /api/v1/tasks/{taskID}/reopen",
+		"POST /api/v1/tasks/{taskID}/snooze",
+		"POST /api/v1/templates",
+		"POST /api/v1/templates/{templateID}/use",
+		"POST /inbound/hook/{token}",
+		"PROPFIND /caldav",
+		"PROPFIND /caldav/{userID}",
+		"PROPFIND /caldav/{userID}/{projectID}",
+		"PUT /api/v1/ai/plan",
+		"PUT /caldav/{userID}/{projectID}/{taskFile}",
+		"REPORT /caldav/{userID}/{projectID}",
+	} {
+		withheld[r] = true
+	}
+
+	var unexpected, stillThere []string
+	for r := range full {
+		if notes[r] {
+			if withheld[r] {
+				stillThere = append(stillThere, r)
+			}
+			continue
+		}
+		if !withheld[r] {
+			unexpected = append(unexpected, r)
+		}
+	}
+	// And the other direction: the notes edition must not grow a route the full
+	// one lacks. A gate that adds is not a gate either.
+	var onlyInNotes []string
+	for r := range notes {
+		if !full[r] {
+			onlyInNotes = append(onlyInNotes, r)
+		}
+	}
+
+	sort.Strings(unexpected)
+	sort.Strings(stillThere)
+	sort.Strings(onlyInNotes)
+	for _, r := range unexpected {
+		t.Errorf("withheld from the notes edition but not written down here: %s", r)
+	}
+	for _, r := range stillThere {
+		t.Errorf("listed as withheld and still served by the notes edition: %s", r)
+	}
+	for _, r := range onlyInNotes {
+		t.Errorf("served only by the notes edition: %s", r)
+	}
+
+	// Printed on the green as well as the red. "The editions differ correctly" over
+	// zero withheld routes and over twenty-nine are the same pass, and only one of
+	// them means anything — so the number is on screen either way.
+	t.Logf("full: %d routes · notes: %d · withheld: %d", len(full), len(notes), len(full)-len(notes))
+
+	// The half that stops this being a deletion rather than a gate: what the notes
+	// edition is FOR has to still be there.
+	for _, must := range []string{
+		"GET /api/v1/notes",
+		"POST /api/v1/notes",
+		"PATCH /api/v1/notes/{noteID}",
+		"DELETE /api/v1/notes/{noteID}",
+		// Deling er hele grunden til at det er et selvstændigt produkt frem for en
+		// enkeltbrugers notesblok, så den halvdel skal navngives her.
+		"POST /api/v1/notes/{noteID}/shares",
+		"GET /api/v1/notes/{noteID}/shares",
+		"POST /api/v1/notes/{noteID}/attachments",
+		"POST /api/v1/notes/import",
+		"GET /api/v1/export/notes.zip",
+		"GET /api/v1/export/account",
+		"POST /api/v1/ai/notes/{noteID}/actions",
+		"GET /api/v1/projects", // a notebook, in this edition
+		"GET /api/v1/search",
+		"GET /api/v1/auth/me",
+		// 34 ruter blev lukket i den anden omgang af denne port. Den her linje er
+		// den, der afgør, at det var en port: MCP-endepunktet er stadig der, og det
+		// er værktøjslisten bagved, der er kortere.
+		"POST /api/v1/mcp",
+		"POST /mcp",
+	} {
+		if !notes[must] {
+			t.Errorf("the notes edition does not serve %s — that is a deletion, not a gate", must)
+		}
+	}
+}
+
+// routesOf builds a server at one edition and returns every route it serves.
+func routesOf(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	srv := New(&config.Config{
+		BaseURL: "http://127.0.0.1", DataDir: t.TempDir(), Edition: edition,
+		SessionTTL: time.Hour, InviteTTL: time.Hour, ResetTTL: time.Hour,
+	}, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	out := map[string]bool{}
+	err = chi.Walk(srv.router,
+		func(method, route string, _ http.Handler, _ ...func(http.Handler) http.Handler) error {
+			if route != "/" {
+				route = strings.TrimSuffix(route, "/")
+			}
+			out[method+" "+route] = true
+			return nil
+		})
+	if err != nil {
+		t.Fatalf("walk routes: %v", err)
+	}
+	if len(out) < 50 {
+		// A walk that found almost nothing would make every comparison below pass.
+		t.Fatalf("only %d routes at edition %q — the walk found nothing to compare", len(out), edition)
+	}
+	return out
+}
+
+// The interface cannot gate itself on something it is not told, and it has to be
+// told before anybody is signed in — an instance's shape is not a permission.
+func TestSetupStateSaysWhichEdition(t *testing.T) {
+	for _, tc := range []struct{ edition, want string }{
+		{config.EditionFull, "full"},
+		{config.EditionNotes, "notes"},
+		{"", "full"}, // a config built by hand is the program as it has always been
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+
+		_, body := ts.do(t, "GET", "/api/v1/auth/setup", nil)
+		if got := body["edition"]; got != tc.want {
+			t.Errorf("edition %q reported as %v, want %q", tc.edition, got, tc.want)
+		}
+		// And the field it has always had is still there: adding one must not
+		// quietly replace the answer the sign-in screen depends on.
+		if _, ok := body["needs_setup"]; !ok {
+			t.Errorf("edition %q: needs_setup is gone from the answer", tc.edition)
+		}
+	}
+}
+
+// Search is mounted in both editions — notes and notebooks have to be findable —
+// so it is the one door that could still open onto the half the router just shut.
+//
+// Not a theoretical case. An instance converted from a full one still has the
+// tasks in its database, and ⌘K would be the only place they turned up.
+func TestNotesEditionSearchFindsNoTasks(t *testing.T) {
+	for _, tc := range []struct {
+		edition string
+		want    int
+	}{
+		{config.EditionFull, 1},
+		{config.EditionNotes, 0},
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+		ts.bootstrap(t)
+
+		_, me := ts.do(t, "GET", "/api/v1/auth/me", nil)
+		userID, _ := me["id"].(string)
+		if userID == "" {
+			t.Fatalf("no user: %v", me)
+		}
+
+		// Created through the store rather than the API: in the notes edition there
+		// is no route to create one, and the row this is about is the row that is
+		// already there.
+		inbox, err := ts.db.InboxID(context.Background(), userID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		task := &store.Task{ProjectID: inbox, Content: "Kvartalsregnskabet", CreatedBy: userID}
+		if err := ts.db.CreateTask(context.Background(), task, nil); err != nil {
+			t.Fatal(err)
+		}
+
+		_, body := ts.do(t, "GET", "/api/v1/search?q=Kvartalsregnskabet", nil)
+		found, _ := body["tasks"].([]any)
+		if len(found) != tc.want {
+			t.Errorf("edition %q: search returned %d tasks, want %d", tc.edition, len(found), tc.want)
+		}
+		// The full edition's number is the control: a search that finds nothing at
+		// all would satisfy the notes case for the wrong reason.
+		if tc.edition == config.EditionFull && len(found) == 0 {
+			t.Errorf("the full edition found no tasks either — this proves nothing about the notes one")
+		}
+	}
+}
+
+// TestNotesEditionOffersNoTaskToolsOverMCP.
+//
+// The same hole as the routes, through a different door — and it was still open
+// after the first gate. An MCP server advertises its tools, so a model connected
+// to a notes instance would be told it can create_task, call it, get something
+// back, and tell the person their task was filed.
+//
+// Asked through tools/list rather than by reading the server's own slice: that is
+// what a client actually sees, and the slice is unexported for the same reason.
+func TestNotesEditionOffersNoTaskToolsOverMCP(t *testing.T) {
+	taskTools := []string{"search_tasks", "create_task", "update_task", "complete_task", "add_comment"}
+	noteTools := []string{"search_notes", "create_note", "update_note"}
+
+	for _, edition := range []string{config.EditionFull, config.EditionNotes} {
+		t.Run(edition, func(t *testing.T) {
+			names := mcpToolNames(t, edition)
+
+			// Both editions: the shared tool, and the notes half.
+			for _, want := range append([]string{"list_projects"}, noteTools...) {
+				if !names[want] {
+					t.Errorf("%s edition does not offer %s", edition, want)
+				}
+			}
+			for _, task := range taskTools {
+				switch edition {
+				case config.EditionFull:
+					if !names[task] {
+						t.Errorf("the full edition lost %s — that is a deletion, not a gate", task)
+					}
+				default:
+					if names[task] {
+						t.Errorf("the notes edition offers %s over MCP", task)
+					}
+				}
+			}
+			t.Logf("%s: %d tools", edition, len(names))
+		})
+	}
+}
+
+// mcpToolNames asks one edition's MCP server for its tool list.
+func mcpToolNames(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := &config.Config{BaseURL: "http://localhost", DataDir: t.TempDir(), SessionTTL: time.Hour, Edition: edition}
+	srv := New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	resp := srv.mcp.Handle(context.Background(), "nobody", []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`))
+	if resp == nil {
+		t.Fatal("tools/list got no response")
+	}
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parsed struct {
+		Result struct {
+			Tools []struct{ Name string } `json:"tools"`
+		} `json:"result"`
+	}
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		t.Fatalf("tools/list: %v — %s", err, raw)
+	}
+	if len(parsed.Result.Tools) == 0 {
+		t.Fatalf("tools/list returned no tools at all: %s", raw)
+	}
+	names := map[string]bool{}
+	for _, tool := range parsed.Result.Tools {
+		names[tool.Name] = true
+	}
+	return names
+}

internal/httpapi/errorcodes_test.go

@@ -0,0 +1,149 @@
+package httpapi
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// The comment above the code list in errors.go says they are kept in one place
+// "so the frontend's mapping can be checked against it rather than discovered
+// from whatever a handler happened to write". Nothing checked it, and the
+// frontend was quietly missing entries — which is not a cosmetic gap: a code
+// with no message falls through to the server's English log prose, and a code
+// mapped to the wrong sentence tells the person something untrue. Connecting
+// Gmail without an OAuth client said "Det er der allerede."
+
+var (
+	codeConst   = regexp.MustCompile(`(?m)^\s*Code\w+\s*=\s*"([a-z_]+)"`)
+	messageKey  = regexp.MustCompile(`(?m)^\s*([a-z_]+):\s*$|^\s*([a-z_]+):\s*'`)
+	messagesTop = "const MESSAGES = {"
+)
+
+func TestEveryErrorCodeHasAMessageInTheFrontend(t *testing.T) {
+	codes := serverErrorCodes(t)
+	messages := frontendMessageKeys(t)
+
+	var missing []string
+	for _, code := range codes {
+		if !messages[code] {
+			missing = append(missing, code)
+		}
+	}
+	sort.Strings(missing)
+
+	for _, code := range missing {
+		t.Errorf("%q is returned by the API and has no message in web/src/lib/api.js — "+
+			"a person would be shown the server's English log prose", code)
+	}
+}
+
+func serverErrorCodes(t *testing.T) []string {
+	t.Helper()
+
+	source, err := os.ReadFile("errors.go")
+	if err != nil {
+		t.Fatalf("read errors.go: %v", err)
+	}
+	var codes []string
+	for _, m := range codeConst.FindAllStringSubmatch(string(source), -1) {
+		codes = append(codes, m[1])
+	}
+	if len(codes) == 0 {
+		t.Fatal("no codes were read out of errors.go — the scanner and the file disagree")
+	}
+	return codes
+}
+
+// frontendMessageKeys reads the keys of the MESSAGES object. A small scanner
+// rather than a JS parser, for the same reason the OpenAPI check uses one: it
+// needs one thing out of a file this test also owns.
+func frontendMessageKeys(t *testing.T) map[string]bool {
+	t.Helper()
+
+	source, err := os.ReadFile(filepath.Join("..", "..", "web", "src", "lib", "api.js"))
+	if err != nil {
+		t.Fatalf("read api.js: %v", err)
+	}
+	body := string(source)
+
+	start := strings.Index(body, messagesTop)
+	if start < 0 {
+		t.Fatalf("could not find %q in api.js", messagesTop)
+	}
+	body = body[start+len(messagesTop):]
+	end := strings.Index(body, "\n};")
+	if end < 0 {
+		t.Fatal("the MESSAGES object does not end where this scanner expects")
+	}
+
+	keys := map[string]bool{}
+	for _, line := range strings.Split(body[:end], "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "//") {
+			continue
+		}
+		name, _, ok := strings.Cut(line, ":")
+		if ok {
+			keys[strings.TrimSpace(name)] = true
+		}
+	}
+	if len(keys) == 0 {
+		t.Fatal("no message keys were read out of api.js")
+	}
+	return keys
+}
+
+// The four that used to be indistinguishable from "that already exists".
+func TestTheMisleadingConflictsHaveTheirOwnCodes(t *testing.T) {
+	for _, code := range []string{
+		CodeGmailNotConfigured,
+		CodeAINotConfigured,
+		CodeTOTPNotEnabled,
+		CodeInboxProtected,
+	} {
+		if code == CodeConflict {
+			t.Errorf("%q is still plain conflict", code)
+		}
+	}
+
+	messages := frontendMessageKeys(t)
+	for _, code := range []string{"gmail_not_configured", "ai_not_configured",
+		"totp_not_enabled", "inbox_protected"} {
+		if !messages[code] {
+			t.Errorf("%q has no Danish message", code)
+		}
+	}
+}
+
+// The Inbox is the one project that cannot be deleted, and saying "that already
+// exists" about it helps nobody.
+func TestDeletingTheInboxSaysWhy(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, projects := ts.do(t, "GET", "/api/v1/projects", nil)
+	list, _ := projects["projects"].([]any)
+
+	var inboxID string
+	for _, raw := range list {
+		p := raw.(map[string]any)
+		if p["is_inbox"] == true {
+			inboxID = p["id"].(string)
+		}
+	}
+	if inboxID == "" {
+		t.Fatal("no inbox was found")
+	}
+
+	resp, body := ts.do(t, "DELETE", "/api/v1/projects/"+inboxID, nil)
+	if resp.StatusCode != 409 {
+		t.Fatalf("status %d, want 409", resp.StatusCode)
+	}
+	if body["code"] != CodeInboxProtected {
+		t.Errorf("code = %v, want %q", body["code"], CodeInboxProtected)
+	}
+}

internal/httpapi/errorlog_handlers.go

@@ -0,0 +1,47 @@
+package httpapi
+
+import (
+	"net/http"
+	"time"
+)
+
+// What has gone wrong lately, kept where a restart cannot take it.
+//
+// The panel's watcher reports "HTTP 5xx, twice, at 11:49" — which is enough to
+// know something broke and nothing at all to act on. The line that explains it is
+// in the container's log, and a Rune's container is replaced on every restart, so
+// by the time anybody looks the explanation is gone. These rows are the same
+// information written somewhere that survives.
+
+type serverErrorJSON struct {
+	ID     string `json:"id"`
+	At     string `json:"at"`
+	Method string `json:"method"`
+	Path   string `json:"path"`
+	Status int    `json:"status"`
+	// What the handler was doing, in its own words — "list projects", "move task".
+	What    string `json:"what"`
+	Message string `json:"message"`
+	// Who was asking, when there was somebody: a fault only one account hits is a
+	// different problem from one everybody hits.
+	UserName string `json:"user_name,omitempty"`
+	// RequestID ties the row back to the log line, for whoever still has it.
+	RequestID string `json:"request_id,omitempty"`
+}
+
+func (s *Server) handleListErrors(w http.ResponseWriter, r *http.Request) {
+	errs, err := s.db.ListErrors(r.Context(), parseLimit(r.URL.Query().Get("limit"), 100, 500))
+	if err != nil {
+		s.internal(w, r, "list errors", err)
+		return
+	}
+	out := make([]serverErrorJSON, 0, len(errs))
+	for _, e := range errs {
+		out = append(out, serverErrorJSON{
+			ID: e.ID, At: e.At.Format(time.RFC3339), Method: e.Method, Path: e.Path,
+			Status: e.Status, What: e.What, Message: e.Message,
+			UserName: e.UserName, RequestID: e.RequestID,
+		})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"errors": out})
+}

internal/httpapi/errors.go

@@ -36,8 +36,44 @@ const (
 	CodeRateLimited     = "rate_limited"
 	CodeInternal        = "internal_error"
 	CodePayloadTooLarge = "payload_too_large"
+
+	// Four situations that used to answer plain `conflict`, which the frontend
+	// renders as "that already exists". For these that is not merely vague, it is
+	// wrong: an unconfigured Gmail is not a Gmail that is already there, and a
+	// second factor that is off is not one that is on. A code exists so the
+	// interface can say the true thing — the server's own prose is English for a
+	// log, and deciding what a person reads is the frontend's job.
+	CodeGmailNotConfigured = "gmail_not_configured"
+	CodeAINotConfigured    = "ai_not_configured"
+	CodeTOTPNotEnabled     = "totp_not_enabled"
+	CodeInboxProtected     = "inbox_protected"
+	// And a fifth, for the same reason: refusing to remove the last administrator
+	// is not "that already exists" either, and it is the one refusal on the user
+	// page that a person needs explained rather than merely reported.
+	CodeLastAdmin = "last_admin"
+
+	// Gmail said no. Its own words are the diagnosis — "invalid_grant",
+	// "insufficient authentication scopes" — and they are useless behind a generic
+	// sentence, which is what `internal_error` gave: a person clicked Fetch now,
+	// read "something went wrong", and had nowhere to go. The interface wraps the
+	// message in one that says where it came from.
+	CodeGmailFailed = "gmail_failed"
+
+	// And the same for a mailbox read over IMAP. A host's refusal is the whole
+	// diagnosis — a wrong app password, a host that is not listening, a folder that
+	// is not there — and it says it in its own words.
+	CodeMailboxFailed = "mailbox_failed"
+
+	// And for a calendar read from Google. Its own code rather than the Gmail one,
+	// because the sentence the interface wraps it in names where it came from — and
+	// "Gmail said no" about a calendar sends somebody to the wrong panel.
+	CodeCalendarFailed = "calendar_failed"
 )
 
+// errLastAdmin is returned to the caller that already wrote the response, so it
+// stops rather than carrying on. It is never rendered anywhere.
+var errLastAdmin = errors.New("httpapi: refused to remove the last administrator")
+
 func writeError(w http.ResponseWriter, status int, code, message string) {
 	writeJSON(w, status, APIError{Code: code, Message: message})
 }