ammonia's default url_schemes whitelist excludes 'data', causing
data:image/* URLs to be stripped from img src attributes. Add 'data'
to allowed schemes. Also skip data: URIs in JS thumbnail logic.
- Separate /uploads and /api/upload routes from Dioxus app to avoid
IncrementalRenderer intercepting non-page requests
- Remove broken SmartIpKeyExtractor-based general_limit() that failed
under Dioxus dev server proxy (Unable To Extract Key)
- Move rate limiting into handlers using governor::RateLimiter directly
- Add IMAGE_LIMITER for /uploads/* serving
- Make all rate limits configurable via environment variables
- Add rate limit config to .env.example with sensible defaults
* feat(db): add pg_trgm search index on posts
* feat(api): use pg_trgm similarity search for posts
* fix(api): use ILIKE + word_similarity instead of % operator for search
- Remove unused tags.rs and related re-exports
- Convert strict_limit/upload_limit from Layer to manual check functions
- Add IP-based rate limiting checks to Register, Login, and upload_image
- Keep general_limit as global middleware for all other routes
Wrap all axum imports and constants with #[cfg(feature = "server")]
to prevent WASM compilation failures. Provide a no-op stub for
non-server builds.
Fixes: error[E0433]: cannot find module or crate in scope
Use is_ascii_alphanumeric() instead of is_alphanumeric() to keep
URLs clean. Non-ASCII characters (CJK, etc.) are replaced with
dashes. When the result is empty (pure non-ASCII title), fall back
to a Unix timestamp.
Introduce PublicUser struct without password_hash field. The
get_current_user server function now returns PublicUser via
CurrentUserResponse, so Argon2 hashes are never serialized to WASM.
Internal server-side functions (get_current_admin_user) continue
using the full User struct.
List pages (home, tags, search, admin) now use row_to_post_list which
reads pre-rendered content_html from DB instead of re-rendering markdown
on every request. Only get_post_by_slug uses row_to_post_full which
includes TOC, anchors, word count, and prev/next navigation.
Chinese characters (U+4E00-U+9FFF) also return true for is_alphabetic(),
so they were being counted as part of English words instead of individually.
Fix: check CJK range before is_alphabetic().
