u

Author: danielehrhardt

.gitignore

@@ -46,3 +46,4 @@ next-env.d.ts
 /.omc
 /dist
 !.env.example
+/idea.md

next.config.ts

@@ -35,6 +35,8 @@ const securityHeaders = [
 const nextConfig: NextConfig = {
   output: "standalone",
   poweredByHeader: false,
+  // Allow testing the dev server via 127.0.0.1 in addition to localhost
+  allowedDevOrigins: ["127.0.0.1"],
   reactStrictMode: true,
   serverExternalPackages: ["imapflow", "mailparser", "nodemailer", "sanitize-html", "postgres"],
   images: {

src/app/(marketing)/layout.tsx

@@ -1,6 +1,6 @@
 import type { Viewport } from "next"
 import { redirect } from "next/navigation"
-import { getSettings } from "@/server/settings"
+import { getSettings, isSetupComplete } from "@/server/settings"
 import { SiteChrome } from "@/components/marketing/site-chrome"
 import { APP_ENTRY } from "@/content/marketing/site"
 import "@/components/marketing/marketing.css"
@@ -13,6 +13,8 @@ export const viewport: Viewport = { themeColor: "#FAF9F5" }
  * Legal pages live in the (legal) group so they stay reachable either way.
  */
 export default async function MarketingLayout({ children }: { children: React.ReactNode }) {
+  // A fresh instance goes straight to the first-run wizard
+  if (!(await isSetupComplete())) redirect("/setup")
   const general = await getSettings("general")
   if (general.marketingSite === false) redirect(APP_ENTRY)
   return <SiteChrome variant="full">{children}</SiteChrome>

src/components/inbox/composer/editor.tsx

@@ -179,33 +179,35 @@ export function EditorToolbar({ editor, className }: { editor: Editor | null; cl
           }
         : null,
   })
-  if (!editor || !state) return null
+  if (!editor) return null
+  // useEditorState only reports after the first transaction of a freshly mounted editor.
+  const active = state ?? { bold: false, italic: false, underline: false, strike: false, bullet: false, ordered: false, quote: false, code: false }
   const chain = () => editor.chain().focus()
   return (
     <div className={cn("flex flex-wrap items-center gap-0.5", className)} role="toolbar" aria-label="Formatting">
-      <ToolbarButton label="Bold" active={state.bold} onClick={() => chain().toggleBold().run()}>
+      <ToolbarButton label="Bold" active={active.bold} onClick={() => chain().toggleBold().run()}>
         <Bold />
       </ToolbarButton>
-      <ToolbarButton label="Italic" active={state.italic} onClick={() => chain().toggleItalic().run()}>
+      <ToolbarButton label="Italic" active={active.italic} onClick={() => chain().toggleItalic().run()}>
         <Italic />
       </ToolbarButton>
-      <ToolbarButton label="Underline" active={state.underline} onClick={() => chain().toggleUnderline().run()}>
+      <ToolbarButton label="Underline" active={active.underline} onClick={() => chain().toggleUnderline().run()}>
         <Underline />
       </ToolbarButton>
-      <ToolbarButton label="Strikethrough" active={state.strike} onClick={() => chain().toggleStrike().run()}>
+      <ToolbarButton label="Strikethrough" active={active.strike} onClick={() => chain().toggleStrike().run()}>
         <Strikethrough />
       </ToolbarButton>
       <span className="mx-1 h-4 w-px bg-border" aria-hidden />
-      <ToolbarButton label="Bulleted list" active={state.bullet} onClick={() => chain().toggleBulletList().run()}>
+      <ToolbarButton label="Bulleted list" active={active.bullet} onClick={() => chain().toggleBulletList().run()}>
         <List />
       </ToolbarButton>
-      <ToolbarButton label="Numbered list" active={state.ordered} onClick={() => chain().toggleOrderedList().run()}>
+      <ToolbarButton label="Numbered list" active={active.ordered} onClick={() => chain().toggleOrderedList().run()}>
         <ListOrdered />
       </ToolbarButton>
-      <ToolbarButton label="Quote" active={state.quote} onClick={() => chain().toggleBlockquote().run()}>
+      <ToolbarButton label="Quote" active={active.quote} onClick={() => chain().toggleBlockquote().run()}>
         <Quote />
       </ToolbarButton>
-      <ToolbarButton label="Code" active={state.code} onClick={() => chain().toggleCode().run()}>
+      <ToolbarButton label="Code" active={active.code} onClick={() => chain().toggleCode().run()}>
         <Code />
       </ToolbarButton>
       <LinkButton editor={editor} />

src/server/conversations/queries.ts

@@ -130,15 +130,14 @@ function encodeCursor(row: ListRow) {
   return Buffer.from(`${row.cursorTs}|${row.id}`).toString("base64url")
 }
 
+/** Postgres timestamptz text, e.g. "2026-09-27 10:00:00.123456+02" (parsed by Postgres itself). */
+const CURSOR_TS_RE = /^\d{4}-\d\d-\d\d[ T]\d\d:\d\d:\d\d(\.\d{1,6})?([+-]\d\d(:?\d\d)?|Z)?$/
+const CURSOR_ID_RE = /^[0-9a-f-]{36}$/i
+
 function decodeCursor(cursor: string): { ts: string; id: string } {
-  try {
-    const [ts, id] = Buffer.from(cursor, "base64url").toString("utf8").split("|")
-    // Postgres timestamptz text, e.g. "2026-09-27 10:00:00.123456+00" (parsed by Postgres itself).
-    if (!ts || !id || !/^[0-9a-f-]{36}$/i.test(id) || !/^\d{4}-\d\d-\d\d[ T]\d\d:\d\d:\d\d(\.\d{1,6})?([+-]\d\d(:?\d\d)?|Z)?$/.test(ts)) throw new Error()
-    return { ts, id }
-  } catch {
-    throw new ApiError(400, "Invalid cursor", "invalid_cursor")
-  }
+  const [ts, id] = Buffer.from(cursor, "base64url").toString("utf8").split("|")
+  if (!ts || !id || !CURSOR_ID_RE.test(id) || !CURSOR_TS_RE.test(ts)) throw new ApiError(400, "Invalid cursor", "invalid_cursor")
+  return { ts, id }
 }
 
 export async function listConversations(

src/server/conversations/scope.ts

@@ -40,8 +40,8 @@ export async function loadScope(ctx: Ctx): Promise<InboxScope> {
 
 /**
  * Visibility of conversations for inbox queries: the foundation rules plus
- * "internal chats are only visible to their current members" (leaving or
- * being removed from a chat revokes access even for its creator/followers).
+ * "internal chats are only visible to their current members": leaving or
+ * being removed from a chat revokes access, also for its creator/followers.
  */
 export function visibleWhere(ctx: Ctx, scope: InboxScope) {
   const c = schema.conversations