food, branch auth

auth: trust nginx HTTPS proxy for CSRF (SECURE_PROXY_SSL_HEADER + CSRF_TRUSTED_ORIGINS)

2026-06-23T19:45:46+00:00

Co-Authored-By: Claude Opus 4.8

Phase 2: session auth for the web UI

2026-06-23T19:37:48+00:00

Require login for /app/, with a long sliding session so you log in once per device and effectively stay in. - AppLoginRequiredMiddleware gates only /app/; /api/ keeps DRF token auth and /admin/ keeps its own login (a blanket LoginRequired would break token requests, whose user isn't resolved until the view runs). - Login page (styled to the dark palette) via django.contrib.auth.urls; logout control in the nav. - Session: ~1 year cookie, sliding (saved every request), survives browser close. - Dropped every @csrf_exempt now that a real session + CSRF token are in place (HTMX already sends X-CSRFToken). - SECRET_KEY and DEBUG now read from the environment (prod-safe defaults); systemd loads an optional /var/lib/food/.env. - Tests authenticate, plus new coverage: /app/ redirects when logged out, login grants access, /api/ is not caught by the app gate. Co-Authored-By: Claude Opus 4.8

move to uv

2026-06-23T19:16:23+00:00

Migrate dependency management to uv

2026-06-23T18:55:42+00:00

Replace requirements.txt with pyproject.toml (direct deps only; uv resolves the rest into uv.lock). Point the systemd unit at the uv-managed .venv, and gitignore it. Run `uv lock` to generate the lockfile and commit it. Co-Authored-By: Claude Opus 4.8

Phase 1: mobile-first pantry redesign with In/Low/Out state

2026-06-23T18:55:16+00:00

Track presence (In/Low/Out) as the primary signal instead of exact quantities; quantity becomes an optional integer, unit optional too (migration 0003 backfills state from quantity: 0 -> out, else in). - Pantry rebuilt as a phone-first card list: colored state rail, segmented In/Low/Out switch (server-driven HTMX), greyed out-items, live summary counts. - Fast add: bottom add bar with type-ahead autocomplete, location picker, and quick-add chips for things you've run out of. - Per-item menu (move / set expiry / delete); expiry is now an optional quiet pill, never required. - New endpoints: pantry search + set-state; dropped the old edit-expiry/cancel flow and its partial. - Recipes matcher made presence-based (have-it beats have-enough); state added to admin. Tests cover state, add/restock, search, presence matching, and page rendering. Co-Authored-By: Claude Opus 4.8

Add planning docs: research, requirements, redesign plan

2026-06-23T18:55:16+00:00

Research of current state, requirements for the web-first pivot (pantry polish -> auth -> MCP), and the phased implementation plan. Co-Authored-By: Claude Opus 4.8

Simplify from claude

2026-06-22T21:50:48+00:00

Add food.tomflux.xyz to ALLOWED_HOSTS

2026-04-02T22:23:20+00:00

Pantry move/expiry edit + smart shopping list with summary

2026-04-02T22:18:01+00:00

- Move items between fridge↔freezer (freezer→fridge sets +7d or shelf life expiry, fridge→freezer clears expiry) - Inline expiry date editor on fridge items (📅 button) - Smart shopping list now shows recipe gaps (missing required slot ingredients) - Summary card shows breakdown: X staple restocks, Y expiring, Z recipe gaps

CSRF exempt HTMX views (localhost-only app)

2026-04-02T22:12:16+00:00