- Add authorization.integration.test.ts covering unauthenticated/regular-user/admin
access across both admin-only and merely-authenticated routes
- Add stale push subscription cleanup test (disableSubscription excludes a device
from fan-out without deleting its row/history)
- Add retention test for a topic with no override falling back to the resolved
Admin-configured global default
- Update README status: Phases 2-10 complete
- Proxy notification image_url server-side (GET /api/v1/notifications/:id/image)
instead of loading it directly in the browser, so LAN-only image sources
(e.g. Frigate snapshots) still load for clients off that network
- Tighten CSP img-src to 'self' now that images are same-origin
- Update threat model / architecture docs to match the new image-fetch design
- Expand README: Home Assistant quick-start, Pocket ID/OIDC walkthrough,
Pangolin note, backup automation, new troubleshooting entries
- Fix docker-compose.yml: document that --env-file .env must be passed
explicitly (Compose's implicit .env lookup was unreliable with -f from
a different directory)
- Fix image-proxy tests to build a real session cookie (AUTH_MODE=oidc
applies inside the test container too, so requireAuth needs one)
siliconsolder