mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-10-26 14:30:13 +00:00

Files

T

xarmian 9b911ded2c fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579 )

Every sign-in minted a new session row and overwrote the cookie, and the
replaced row stayed valid until its TTL: a live credential no UI could
reach, and one that kept a BUG-3007-checked stream authorized past a
sign-in as another user.

destroyReplacedSessions deletes the rows named by the session cookies the
request presented (both names in secure mode, where the legacy unprefixed
cookie is shadowed from then on), after the new row is minted and set.
It deletes by presented token only, never by user id, so the same user's
other sessions and CLI padsess_ bearers survive. Best-effort: a failed
delete is logged and never fails the sign-in.

Called from createAuthSession (password login, 2FA verify, register,
cloud OAuth, bootstrap) and from handleResetPassword, which mints its own
session and whose DeleteUserSessions covers only the reset user.

Eight test-setup register calls move from the admin's cookie to a bearer:
they relied on the orphan this removes. BUG-3232 tracks register signing a
signed-in admin in as the new user.

Claude-Session: https://claude.ai/code/session_016PXRzXhokr61CLbbu3Txj9

2026-09-26 14:25:10 -04:00

.vscode

Initial release

2026-03-26 01:52:36 +00:00

e2e

fix(web): a text selection dragged out of a modal no longer closes it — backdrops dismiss only when the press and the release both land on them (BUG-3229) (#1578 )

2026-09-26 14:16:42 -04:00

scripts

ci(web): decide the npm audit gate from the report, not the exit code, and run it last (BUG-2881) (#1247 )

2026-09-04 10:45:21 -04:00

src

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579 )

2026-09-26 14:25:10 -04:00

static

feat(web): violet retheme — accent-primary alias, neutral scale, card tokens, radius, AA text (TASK-2291) (#1018 )

2026-07-24 14:03:53 -04:00

.gitignore

test(e2e): Playwright smoke test infrastructure + 2 dashboard tests (TASK-689) (#225 )

2026-04-22 22:35:08 -04:00

.npmrc

Initial release

2026-03-26 01:52:36 +00:00

package-lock.json

chore(deps)(deps-dev): bump the npm-minor-and-patch group (#1408 )

2026-09-21 13:59:23 -04:00

package.json

chore(deps)(deps-dev): bump the npm-minor-and-patch group (#1408 )

2026-09-21 13:59:23 -04:00

playwright.config.ts

fix(e2e): disable rate limiting on the E2E server to stop 429 flakes (BUG-2089) (#922 )

2026-07-11 14:30:32 -04:00

README.md

refactor(web): delete unmounted components carrying real logic (TASK-2632) (#1163 )

2026-08-19 11:39:39 -04:00

svelte.config.js

Initial release

2026-03-26 01:52:36 +00:00

tsconfig.json

test(web): jsdom/Svelte vitest harness + Modal & breakpoint tests (TASK-2081) (#887 )

2026-07-09 19:53:55 -04:00

vite.config.ts

Initial release

2026-03-26 01:52:36 +00:00

vitest.config.ts

fix(web): vitest refuses a project it cannot run instead of dropping it (BUG-3045) (#1346 )

2026-09-13 18:36:35 -04:00

README.md

Pad Web UI

SvelteKit 2 + Svelte 5 frontend for Pad, compiled to static files and embedded into the Go binary.

Development

npm install
npm run dev          # Dev server at localhost:5173 (proxies API to localhost:7777)
npm run build        # Production build to build/
npm run check        # Type checking with svelte-check

When developing, run the Go backend separately with make dev from the project root.

Building for Production

Do not build in isolation. Always use make build from the project root — this builds the web frontend, then compiles the Go binary with the build output embedded via //go:embed.

Stack

Svelte 5 with runes ($state, $derived, $effect)
SvelteKit 2 with adapter-static (SPA mode)
Tiptap block editor with markdown round-trip
svelte-dnd-action for drag-and-drop in board/list views
SSE for real-time updates
TypeScript throughout

Structure

src/
  routes/                    SvelteKit pages
    +layout.svelte           App shell (sidebar + main)
    +page.svelte             Landing/redirect
    [workspace]/
      +page.svelte           Dashboard (collections, phases, activity)
      +layout.svelte         SSE connection per workspace
      [collection]/
        +page.svelte         Collection view (board/list)
      [collection]/[item]/
        +page.svelte         Item detail + editor
      conventions/            Purpose-built conventions page
      playbooks/              Purpose-built playbooks page
      settings/               Workspace settings
  lib/
    api/client.ts            HTTP API client
    components/
      layout/                Sidebar, navigation
      editor/                Tiptap editor, raw markdown editor
      fields/                FieldEditor, relation picker
      items/                 ItemCard, ItemDetail
      collections/           BoardView, ListView
      common/                StatusBadge, badges, modals
      search/                CommandPalette
    stores/                  Svelte 5 reactive stores
      workspace.svelte.ts    Workspace state
      collections.svelte.ts  Collection + item state
      ui.svelte.ts           Sidebar, mobile state
    types/index.ts           TypeScript types and constants
  app.css                    Global styles and design tokens