Changelog

All notable changes to Project Syrup, newest first.

Legend: Stable — production-ready, recommended for live drops Beta — pre-release, for testing only (see Beta Testers)

v0.1.23-beta.3

Beta dev 2026-06-14
Added
  • Share to Instagram — Waffle Card PNG — GET /waffle/:slug/card.png generates a downloadable PNG share card for any active waffle. Two formats via ?format=: story (default, 1080×1920 vertical) or square (1080×1080). Cards show the waffle title, spot price, spots remaining, and the claim URL. Generated with fogleman/gg using embedded Inter font and Project Syrup branding; cached on disk per slug+format, rate-limited.
  • Share Message Templates — Admins and waffle managers can create and manage reusable caption templates under Management → Share Templates. Templates support placeholders ({title}, {price}, {spots}, {url}, etc.). One template can be set as the default.
  • Per-Waffle Share Message Editor — The admin waffle manage page now includes a Share to Instagram section: choose a template, edit the rendered caption, copy the claim URL, pick Story or Square format, download the card PNG, or regenerate the cached card.
  • Share Message Regenerate Endpoint — POST /api/admin/waffles/:id/share-message/regenerate-card invalidates the disk cache and forces a fresh card render on next request.
Fixed
  • Archived Waffles Return 404 Publicly — GET /waffle/:slug and GET /api/waffles/:slug now return 404 for archived waffles instead of leaking data through public endpoints.
  • Share card cache invalidation — Updating a share message or template now correctly invalidates the associated cached PNG.
  • CSRF on Admin Base Template — CSRF meta tag added to the admin base layout to ensure share-message JS requests carry the token correctly.

v0.1.23-beta.2

Beta dev 2026-06-12
Added
  • Public Version Endpoint — GET /api/version returns the running app version as JSON ({"version":"v0.1.23-beta.2"}). No authentication required.

v0.1.23-beta.1

Beta dev 2026-06-12
Fixed
  • Admin Archive / Unarchive / Delete — Form posts to /admin/waffles/:id/archive, /admin/waffles/:id/unarchive, and /admin/waffles/:id/delete were returning 404. Routes are now registered and CSRF-protected.
  • Gin Route Parameter Conflict — Parameter name mismatch between sibling routes caused the app to panic on startup. Route parameter names unified to :id throughout the waffle management group.

v0.1.23-beta.0

Beta dev 2026-06-12
Added
  • Shareable Buyer Card — GET /buyer/:handle/card renders a chromeless, mobile-optimized stat card. Shows wins, losses, spots claimed, win rate, luck rating (actual vs. statistically expected), and trophy case (items won, parsed from quoted text in waffle titles). Open Graph and Twitter Card meta tags make the URL preview inline when shared.
  • Buyer Card JSON API — GET /api/buyers/:handle/card returns all computed card data as JSON.
  • Buyer Stats Page Redesign — /buyer/:handle now shows luck rating and trophy case alongside win/loss history.

v0.1.22

Stable v0.1.22 2026-06-10
Added
  • Stored Payment Methods — Structured pool of payment options (Venmo, PayPal, CashApp, Zelle) replaces the old free-text payment_info field. See Admin Manual → Payment Methods.
  • Payment Method Admin Page — /admin/payment-methods CRUD with soft-delete and usage warnings before deactivating an in-use method.
  • Payment Method Public Display — Public waffle pages render selected payment methods grouped by type with icons and clickable links.
  • Docker Version Auto-Detect — Build process extracts version from main.go when VERSION=dev, eliminating hardcoded version strings.
  • Versioned Dev Docker Tags — Dev branch builds now publish both the floating dev tag and the detected app version (e.g. v0.1.22-beta.3) for safer beta pinning.
Changed
  • Waffle Create/Edit Forms — payment_info textarea replaced with a multi-select checkbox list of stored payment methods. The old field is gone.
  • Admin Navigation Rename — "Admin Tools" dropdown is now called "Management". Payment Methods is the newest entry in the dropdown.
  • Docker Image OCI Metadata — org.opencontainers.image.version now uses the detected app version instead of the branch name.
  • Agent Guidance — Expanded Scooby-Doo commit-message style guide and added local Docker pre-flight testing reminders for future release bumps.

v0.1.21

Stable v0.1.21 2026-06-10

Promoted from v0.1.21-beta.0 / v0.1.21-beta.1 with no additional changes.

Added
  • Random Spot Selection — Public waffle pages include a "Pick Random Spots" flow so buyers can enter a spot count and let the app claim available spots for them automatically.
  • Random Claim API — New POST /api/claims/random endpoint reuses existing claim rate limiting, Instagram handle normalization, transactional row locking, and WebSocket spot updates.
  • Partial Fulfillment — Random claims claim as many available spots as possible when the requested count exceeds availability, returning both claimed and requested counts in the response.
Changed
  • Live Stats Updates — Available / Pending / Paid counts and the progress bar update in real-time as WebSocket spot events come in. No more page reloads to see current counts.
  • Disable Random on Manual Selection — The "Pick Random Spots" button is disabled when manual spots are selected, preventing conflicting claim submissions.
  • Shared Handle Input — Random claims share the same Instagram handle input as manual spot selection while keeping the two claim actions independent.
  • Feature Attribution — Random spot selection credited as a community feature idea from @OrangeSoJuicy on Instagram. Jinkies.
Fixed
  • No Hard Random Count Limit — Removed the client-side maximum count so server-side partial-fulfillment behavior remains authoritative.

v0.1.20

v0.1.20 2026-06-04
Added
  • Multiple Items per Waffle — New item_count field on waffles (1–10). When greater than 1, the Set Winner UI lets you pick one paid spot per item to draw multiple winners simultaneously.
  • Multiple Winner Support — Waffle model now stores winning_spot_numbers and winning_instagram_handles as JSONB arrays. Existing single-winner data is backfilled by migration 012.
  • Multi-Winner UI — Manage page renders one spot dropdown per item, displays a winner list on the public page, and supports dynamic add/change/clear of winners post-draw.
Changed
  • Winner Endpoints Take Arrays — POST /winner and POST /change-winner now expect {"winning_spot_numbers": [...]} instead of a single spot_number.
  • Backup & Smoke-Test Scripts — Added operational scripts and synced documentation version references to v0.1.20.

v0.1.19

v0.1.19 2026-06-04
⚠️ Upgrade note: migrations are now embedded
The app no longer reads migration files from the filesystem. The ./backend/migrations:/app/migrations:ro volume mount in your docker-compose.prod.yml can be removed (it is now harmless but unnecessary). See Deployment → Database Migrations.
Added
  • Embedded Migrations — SQL migration files are compiled into the binary via //go:embed. No filesystem mount or file-sync step required at deploy time.
  • Winner Dropdown — The Set Winner field on the waffle manage page is now a dropdown listing all paid spots with their Instagram handles, replacing the free-text spot number input.
Changed
  • Tag-Driven CI/CD — Release type now follows tag format. Tags matching v*.*.*-* (e.g. v0.1.19-rc.1) produce a GitHub pre-release; plain v*.*.* tags produce a stable release and move latest + major.minor Docker tags.
  • Footer Version — Docker build now correctly stamps the image with the git tag so the footer shows the real version instead of always displaying dev.
  • Dark Theme Only — Light/dark toggle removed. The app now runs the warm dark theme exclusively, aligned with the projectsyrup.app design language.
  • Re-theme — Base colors updated from purple-grey to warm dark brown to match projectsyrup.app (amber accent, warm cream text, glass header).

v0.1.17

v0.1.17 2026-05-31
Added
  • Progress Bars — DaisyUI fill progress bars on waffle cards (public list, admin dashboard, waffle detail) showing claimed vs total spots at a glance.
  • Image Thumbnails — Waffle list cards now render an image_url thumbnail when set, with an onerror handler to gracefully hide broken images.
  • Open Graph Meta Tags — OG tags added to waffle detail and home pages for richer link previews when shared on Instagram or other platforms.
  • Configurable Trusted Proxies — New TRUSTED_PROXIES environment variable accepts comma-separated CIDRs. Defaults to RFC 1918 ranges if unset or invalid. Ensures real client IPs are captured correctly behind Cloudflare, nginx, or cloud load balancers.
  • Extended Private IP Detection — WHOIS skip logic now covers IPv6 loopback (::1), link-local (fe80::/10), ULA (fc00::/7), and CGNAT (100.64.0.0/10) in addition to the existing RFC 1918 ranges.
  • Template Functions — Added mul and div template helper functions used by the new progress bar calculations.

v0.1.18

v0.1.18 2026-05-31
Added
  • Users Registry — New users table with GetOrCreateUser, ListUsers, and BackfillUsers service functions, admin users list page and JSON API endpoint.
  • User Backfill — Automatic backfill of existing claimed_by_handle values from spots table into users table on application startup.
Fixed
  • Duplicate Lockout Removal — Resolved duplicate Instagram handle lockout preventing claim submissions for handles with existing pending/paid spots.

v0.1.16

v0.1.16 2026-05-31
Changed
  • Dev/Stable Release Channels — Docker workflow dev branch trigger, version bump, CHANGELOG backfill, README channels section.

v0.1.15

v0.1.15 2026-05-30
Added
  • Admin Profile Expansion — First name, last name, email, and social links fields on admin profile.

v0.1.14

v0.1.14 2026-05-30
Changed
  • Admin UI Polish — Password change UI, tooltips, responsive layout fix.

v0.1.13

v0.1.13 2026-05-29
Changed
  • Admin Nav Grouping — Grouped admin navigation under Admin Tools dropdown.

v0.1.12

v0.1.12 2026-05-29
Added
  • Audit Log Nav Prominence — Moved audit log to top nav, added admin filter, and added server settings tab.
  • Role-Permissions Guide — Inline role-permissions guide on admin users page.

v0.1.11

v0.1.11 2026-05-29
Fixed
  • Archived Waffle Filter — Admin active and archived waffle lists now show the correct records.
  • Buyer Stats Recalculation — Clear/change winner actions now refresh buyer win/loss stats.
  • Password Reset API — Forgot-password JSON response no longer exposes reset tokens.
  • Drought Report Dates — Missing last-entry dates now render cleanly instead of showing Invalid Date.
Changed
  • Admin Code Cleanup — Removed unused spot/winner handlers and consolidated shared audit/password confirmation helpers.
  • Accessibility Polish — Claim success/error feedback now announces via aria-live.
  • Audit Export Link — CSV export filters are URL-encoded.

v0.1.10

v0.1.10 2026-05-29
Fixed
  • Admin Login Redirect — Already-authenticated admins are redirected from login to the dashboard.
  • Public Header/Footer Spacing — Public header and footer vertical spacing now better matches admin layout density.

v0.1.9

v0.1.9 2026-05-29
Added
  • CI Pipeline — dev branch added to GitHub Actions trigger.
  • Audit Export UI — CSV export button on admin audit log page with date filter support.
  • WebSocket Heartbeat — Server-side ping/pong with per-connection mutex, client-side stale detection.
  • Smoke Tests — Shell script for end-to-end Docker Compose validation.
  • Data Retention — Configurable audit_log and login_history retention (default 90 days).
  • Release Automation — GitHub Release auto-created on tag push with CHANGELOG excerpt.

v0.1.8

v0.1.8 2026-05-28
Added
  • CI Pipeline — GitHub Actions workflow with go test, vet, govulncheck, and Docker build checks.
  • Audit Log CSV Export — New API endpoint to export audit log entries as CSV.
  • WebSocket Reconnect Logic — Exponential backoff jitter and max retry cap for resilient client reconnection.
  • gosec G104 Triage — All unhandled error returns reviewed and explicitly handled across the codebase.

v0.1.7

v0.1.7 2026-05-27
Added
  • Admin Audit Log — Full audit trail with audit_log table, service layer, JSON API, and admin UI at /admin/audit.
  • Last Login IP Tracking — Login history records and displays the IP address of each admin session.
  • Brute-Force Lockout — Rate-limited login endpoints with configurable failed attempt threshold and lockout duration.
  • Configurable JWT Expiration — System setting to control JWT token lifetime.
  • Password Policy Enforcement — Server-side validation enforcing minimum length and rejecting common/weak passwords.
  • Destructive Action Confirmation — Delete, deactivate, and role-demotion operations require current password confirmation.

v0.1.5

v0.1.5 2026-05-27
Added
  • Login History — Audit trail tracking admin logins with IP, browser, OS, and device type.
  • WHOIS Enrichment — Async WHOIS lookups on login to capture org, country, city, and ASN.
  • System Settings — Configurable WHOIS server, super_admin only.
  • Winner Management — Admin-only endpoints to clear winner and change winner with buyer stats recalculation.
  • Settings Dropdown — Consolidated admin nav menu under username.
  • About Page — Public about page with admin-only system extras section.
  • Login History Pages — My Login History tab on settings page + full admin login history page with role-based filtering.

v0.1.0

v0.1.0 2026-05-26
Added
  • Multi-Admin Auth — Role-based access control with super_admin, admin, and waffle_manager roles.
  • Admin Management — Create admins, change roles, deactivate accounts, reset passwords (super_admin only).
  • waffle_manager Role — Create and manage waffles + view reports, without archive/delete/user-management access.
  • Timezone Settings — Per-admin timezone preference with IANA timezone dropdown.
  • Password Reset — Self-service reset tokens plus authenticated password changes.
  • Instagram Media Links — Link to posts showing what's being waffled (supports multiple items).
  • Archive + Delete Controls — Hide completed waffles by default, or type DELETE for permanent removal.
Changed
  • Migrated all UI to DaisyUI with syrup theme and amber primary colors.
  • Redesigned navigation with Inter font and unified brand colors.

v0.0.9

v0.0.9 2026-05-26
Added
  • DaisyUI Migration — Complete UI overhaul with DaisyUI component library and syrup color theme.
  • Production Deployment — docker-compose.prod.yml, .env.example, and GHCR image workflow.
  • PWA Service Worker — Offline caching with service worker registration.
  • Rate Limiting — Request rate limiting for public endpoints.

v0.0.8

v0.0.8 2026-05-25
Added
  • Seed Data — Demo waffle and admin data for fresh installs.
  • Navigation Redesign — Cleaner admin nav with role-based visibility.
  • Inter Font — Modern typography across all pages.
  • Brand Color Unification — Consistent amber/brown color scheme.

v0.0.5

v0.0.5 2026-05-24
Added
  • PWA Support — Web App Manifest, app icons, standalone display metadata.
  • Offline Page — Cached offline.html for when the network is unavailable.

v0.0.1

v0.0.1 2026-05-20
Added
  • Initial Public Release — Project Syrup foundation.
  • Docker Compose setup with PostgreSQL 16.
  • Go backend with Gin framework and server-rendered Tailwind CSS templates.
  • WebSocket hub for real-time spot updates.
  • Basic waffle CRUD operations.
  • Spot claim and payment tracking.
  • Admin authentication system.