petrbalvin
d26d3b5a5b
fix: strip HTML tags from derived excerpt
...
gsub(/<[^>]+>/, '') before stripping markdown markup, so auto-generated
excerpts don't leak raw HTML from post bodies.
2026-06-25 22:06:49 +02:00
petrbalvin
4597c685da
test: add RSS feed endpoint tests
...
Verify content type, RSS structure, draft exclusion, and language
element.
2026-06-25 21:41:19 +02:00
petrbalvin
2181538691
feat: add language element to RSS feed channel
2026-06-25 21:40:57 +02:00
petrbalvin
9dd55adc30
fix: add periodic cleanup of login_attempts hash
...
Sweep stale entries every 5 minutes to prevent unbounded memory growth
from IPs that touch the login endpoint once and never return.
2026-06-25 21:40:37 +02:00
petrbalvin
7a31b50ca7
docs: add [development] section to CHANGELOG, document in CONTRIBUTING
...
Record ongoing changes under [development] in CHANGELOG.md. Update the
release workflow to rename [development] to the versioned section.
2026-06-25 21:37:27 +02:00
petrbalvin
b2b8156648
refactor: split Server into api_routes and admin_routes modules
...
Keep server.rb focused on configuration, session setup, and shared
helpers. Extract route definitions into registered Sinatra extension
modules. Exclude the registered methods from AbcSize/MethodLength
metrics — large registered methods are the idiomatic Sinatra pattern.
2026-06-25 21:35:07 +02:00
petrbalvin
140b16b55a
feat: add in-memory rate limiting for login endpoint
...
Rate-limit POST /admin/login at 10 attempts per 60 seconds per IP.
Stored in Volumen.login_attempts so tests can reset the counter.
2026-06-25 21:33:16 +02:00
petrbalvin
2348352fab
feat: add lastmod to sitemap entries
2026-06-25 21:31:57 +02:00
petrbalvin
184aa9b3d8
feat: add pubDate to RSS feed items
2026-06-25 21:31:02 +02:00
petrbalvin
0a70b74b55
fix: wire session_ttl config into Rack session cookie expiration
...
The admin.session_ttl value was defined in defaults, template, and
documentation but never read — sessions had no expiration. Pass it as
expire_after to Rack::Session::Cookie. A value <= 0 means persistent
(until browser close), matching the documented behaviour.
2026-06-25 21:30:20 +02:00
petrbalvin
dd3efe870e
feat: initial release of volumen — a file-based Markdown blog engine
2026-06-21 13:15:06 +02:00
petrbalvin