New /settings page (linked from the header's burger menu) offers:
- CSV export of the user's links, for spreadsheet apps.
- SQL dump export as INSERT INTO links (...) statements, scoped to
the current user only — never a raw full-database dump, since that
would leak other accounts' password hashes and data. Embeddings are
excluded (regenerated via "KI neu beschreiben lassen" if needed).
- SQL import that re-adds a previously exported dump to the current
account (additive, doesn't touch existing links).
Import safety (app/backup.py): uploaded SQL is never executed against
the real database. Each non-comment line is required to start with
"insert into links" and is run one statement at a time against an
isolated in-memory SQLite database with only a whitelisted `links`
schema (no id/user_id columns) — sqlite3.execute() also rejects
multiple statements per call. Only after that succeeds are rows
copied into the real DB via the ORM, with user_id forced to the
logged-in user. Verified this rejects DROP TABLE, ATTACH DATABASE,
stacked statements, cross-table subqueries, and user_id injection.
Upload is capped at 2 MB.
Also adds download/upload icons and a proper file-input styling
pattern (visually-hidden input + <label> trigger + filename readout),
since the browser's ::file-selector-button pseudo-element didn't
render reliably in testing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Links can be bookmarked for a later look via a toggle button on the
card (🏷️/🔖), shown with a yellow border while flagged. A new
sidebar section "Merkliste" links to /?review=1, filtering to just
the flagged links; the count updates live via the existing facets
query.
Since the project has no migration framework, add a minimal
startup check that ALTER TABLEs in the needs_review column for
existing SQLite databases (create_all only creates missing tables).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The category and manufacturer fields in the edit form now offer the
already-used values via a datalist dropdown, while still allowing a
new value to be typed. Both edit entry points (open edit form and AI
re-describe) pass the current lists.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Cards previously had ragged heights because summaries vary in length.
Follow the community-scripts.org card pattern instead: fixed-height
title and summary blocks (clamped to 2 and 3 lines with an ellipsis),
a colored letter avatar derived from the domain, category and
manufacturer as badges in the header, tags in a single clipped row,
and domain plus added-date in a footer.
The avatar color is derived locally from the domain, so no external
favicon requests are made.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a sort dropdown offering newest/oldest first and name A-Z/Z-A.
Sorting applies to plain listings, text search, and semantic search
results, and the sidebar facet links preserve the current choice.
Invalid sort values fall back to the default.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The created_at timestamp was already stored but never displayed. Add
a "datum" Jinja filter that converts the stored UTC value to local
time and render it on both the link card and the edit form.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Links can now be edited manually (title, summary, category,
manufacturer, tags) via an inline edit form, with a "KI neu
beschreiben lassen" action that re-fetches the URL and lets the AI
regenerate all fields. Editing recomputes the search embedding.
Also adds an app footer showing author, version, and hostname.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
FastAPI + HTMX Web-App zum Speichern von Links mit automatischer
KI-Kategorisierung, Zusammenfassung und semantischer Suche (OpenAI).
Mehrbenutzer mit Login, SQLite-Persistenz, Docker/Docker-Compose-Setup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
