Block a user
Add Vitest integration tests for SvelteKit load functions
Add axe-playwright accessibility checks to E2E suite
Add @vitest/coverage-v8 with 80% branch coverage threshold to frontend build
Add JaCoCo branch coverage gate (80% minimum) to Maven build
Add Testcontainers + @DataJpaTest against real PostgreSQL 16
As a user I want to @mention other users in comments so they are notified and linked to their profile
🔴 Blocker:
Architecture review — @mkeller
Two concerns, one hard blocker.
🔴 Blocker: {@html renderBody()} is an XSS injection point
The plan says:
Use
{@html renderBody(comment)}in…
As a user I want to receive notifications for archive activity so I stay informed when family members annotate, comment, or start conversations
Architecture review — @mkeller
Overall the backend design is clean. Schema is minimal, email reuse is pragmatic, preference storage as two boolean columns on AppUser is the right call (no…
devops(testing): add axe-core accessibility checks to Playwright E2E suite
fix(a11y): add skip-to-main-content link in layout for keyboard navigation
fix(security): add Content-Security-Policy headers to SvelteKit responses
fix(ui): replace localStorage panel state restore with SvelteKit snapshot API to eliminate flash on load
fix(a11y): replace clickable divs with button elements in PdfViewer and AnnotationLayer
refactor(frontend): extract extractErrorCode() helper to eliminate repeated as-unknown-as type assertions
fix(security): enforce maximum file upload size limit
fix(security): add rate limiting to login and password-reset endpoints
fix(security): annotate AppUser.password with @JsonIgnore to prevent accidental hash leakage
improvement(mobile): move language switcher out of mobile header into navigation drawer