fix: stop the app shell answering for /.well-known/

Adding the connector to Claude failed with "Couldn't register with
Verdande's sign-in service", on a server that has no sign-in service and
needs none.

Claude probes /.well-known/oauth-authorization-server before connecting to
an MCP server. The SPA fallback answered 200 with a page of HTML — which
reads as "yes, there is an authorization server here" — so it went on to
dynamic client registration and failed there instead of concluding the
obvious thing, which is that this server does not use OAuth and the key in
the URL is the whole credential.

/.well-known/ is reserved by RFC 8615 and is never a route in this app. A
404 is the true answer, and it is also the useful one: the client stops
asking and uses the URL as given.

This is the third time the catch-all has caused a confusing failure by
saying 200 to something that does not exist — /mcp itself was the second.
The fallback should hand back the shell for routes the app might have, not
for every path on the server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -6,7 +6,9 @@ on:
     tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
 
 permissions:
-  contents: read
+  # write rather than read: the job creates the GitHub Release the update notice
+  # reads. packages: write is for pushing the image.
+  contents: write
   packages: write
 
 jobs:
@@ -50,3 +52,15 @@ jobs:
             VERSION=${{ github.ref_name }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      # A tag is not a release. The in-app update notice reads GitHub's
+      # releases/latest, which answers 404 for a repository that only has tags —
+      # so without this step the check can never find anything, however correctly
+      # it is switched on.
+      #
+      # Created after the image, so a release never announces a version that
+      # failed to build.
+      - uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          make_latest: true

cmd/verdande/main.go

@@ -77,7 +77,11 @@ func run() error {
 
 	errc := make(chan error, 1)
 	go func() {
-		log.Info("listening", "addr", cfg.Addr)
+		// The version is repeated here rather than only on the "starting" line
+		// above: this is the line the Rune's done_regex matches, so it is the one
+		// sitting at the bottom of the panel console after a deploy — which is
+		// exactly when somebody wants to know what actually started.
+		log.Info("listening", "addr", cfg.Addr, "version", version)
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			errc <- err
 		}

docs/api.md

@@ -52,6 +52,10 @@ what a person reads is decided by the client, which knows what language they are
 | `forbidden` | 403 | Cross-site request, or admin needed. |
 | `not_found` | 404 | Does not exist, or you cannot see it. |
 | `conflict` | 409 | Already exists, or the state does not allow it. |
+| `gmail_not_configured` | 409 | No Google OAuth client is registered on this server. |
+| `ai_not_configured` | 409 | No AI provider has been set up. |
+| `totp_not_enabled` | 409 | Two-factor is off, and the request needs it on. |
+| `inbox_protected` | 409 | The Inbox cannot be deleted. |
 | `validation_failed` | 422 | Check `fields`. |
 | `rate_limited` | 429 | Too many attempts. |
 | `internal_error` | 500 | Our fault. |
@@ -96,6 +100,8 @@ curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
 | `POST` | `/projects/{id}/invites` | Share it. `{"email": …, "role": "editor"\|"viewer"}` |
 | `DELETE` | `/projects/{id}/members/{userID}` | |
 | `GET` | `/projects/{id}/activity` | |
+| `GET` | `/trash/projects` | What you have deleted and can still bring back, with how long is left. |
+| `POST` | `/trash/projects/{id}/restore` | Brings it back with the tasks that went with it. |
 
 ### Views, filters and labels
 

docs/openapi.yaml

@@ -785,6 +785,42 @@ paths:
         "204": { description: Deleted. }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/trash/projects:
+    get:
+      tags: [projects]
+      summary: Projects you have deleted and can still bring back.
+      description: |
+        Only your own. Restoring has been possible since the trash existed, but
+        the endpoint takes an id — and the id is what you no longer have once the
+        project has gone from the interface.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  projects:
+                    type: array
+                    items:
+                      allOf:
+                        - $ref: "#/components/schemas/Project"
+                        - type: object
+                          properties:
+                            deleted_at: { type: string, format: date-time }
+                            purge_after:
+                              type: string
+                              format: date-time
+                              description: |
+                                When it stops being recoverable. Sent rather than
+                                left for the client to work out, because the
+                                retention window is the server's and a second
+                                copy of it will one day disagree.
+                            task_count:
+                              type: integer
+                              description: Tasks that went with it, and would come back with it.
+
   /api/v1/trash/projects/{projectID}/restore:
     parameters:
       - { name: projectID, in: path, required: true, schema: { type: string } }
@@ -1718,7 +1754,15 @@ paths:
         broken volume reports unhealthy instead of pretending to work.
       security: []
       responses:
-        "200": { description: Healthy. }
+        "200":
+          description: Healthy. Carries the running version — the one thing you can ask without a session.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status: { type: string, const: ok }
+                  version: { type: string, example: v0.3.1 }
         "503": { description: Unhealthy. }
 
   /ics/{token}:
@@ -1946,6 +1990,13 @@ components:
             type: object
             properties:
               address: { type: string, example: todo+abc123@example.dk }
+              configured:
+                type: boolean
+                description: |
+                  Whether a mail server is set up at all. The address is real
+                  either way, but with no mail server nothing on the internet
+                  routes to it — and an interface that does not say so is
+                  promising something that will not happen.
     Gmail:
       description: OK
       content:
@@ -1995,6 +2046,10 @@ components:
             - rate_limited
             - internal_error
             - payload_too_large
+            - gmail_not_configured
+            - ai_not_configured
+            - totp_not_enabled
+            - inbox_protected
         error: { type: string }
         fields:
           type: object

internal/httpapi/errorcodes_test.go

@@ -0,0 +1,149 @@
+package httpapi
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// The comment above the code list in errors.go says they are kept in one place
+// "so the frontend's mapping can be checked against it rather than discovered
+// from whatever a handler happened to write". Nothing checked it, and the
+// frontend was quietly missing entries — which is not a cosmetic gap: a code
+// with no message falls through to the server's English log prose, and a code
+// mapped to the wrong sentence tells the person something untrue. Connecting
+// Gmail without an OAuth client said "Det er der allerede."
+
+var (
+	codeConst   = regexp.MustCompile(`(?m)^\s*Code\w+\s*=\s*"([a-z_]+)"`)
+	messageKey  = regexp.MustCompile(`(?m)^\s*([a-z_]+):\s*$|^\s*([a-z_]+):\s*'`)
+	messagesTop = "const MESSAGES = {"
+)
+
+func TestEveryErrorCodeHasAMessageInTheFrontend(t *testing.T) {
+	codes := serverErrorCodes(t)
+	messages := frontendMessageKeys(t)
+
+	var missing []string
+	for _, code := range codes {
+		if !messages[code] {
+			missing = append(missing, code)
+		}
+	}
+	sort.Strings(missing)
+
+	for _, code := range missing {
+		t.Errorf("%q is returned by the API and has no message in web/src/lib/api.js — "+
+			"a person would be shown the server's English log prose", code)
+	}
+}
+
+func serverErrorCodes(t *testing.T) []string {
+	t.Helper()
+
+	source, err := os.ReadFile("errors.go")
+	if err != nil {
+		t.Fatalf("read errors.go: %v", err)
+	}
+	var codes []string
+	for _, m := range codeConst.FindAllStringSubmatch(string(source), -1) {
+		codes = append(codes, m[1])
+	}
+	if len(codes) == 0 {
+		t.Fatal("no codes were read out of errors.go — the scanner and the file disagree")
+	}
+	return codes
+}
+
+// frontendMessageKeys reads the keys of the MESSAGES object. A small scanner
+// rather than a JS parser, for the same reason the OpenAPI check uses one: it
+// needs one thing out of a file this test also owns.
+func frontendMessageKeys(t *testing.T) map[string]bool {
+	t.Helper()
+
+	source, err := os.ReadFile(filepath.Join("..", "..", "web", "src", "lib", "api.js"))
+	if err != nil {
+		t.Fatalf("read api.js: %v", err)
+	}
+	body := string(source)
+
+	start := strings.Index(body, messagesTop)
+	if start < 0 {
+		t.Fatalf("could not find %q in api.js", messagesTop)
+	}
+	body = body[start+len(messagesTop):]
+	end := strings.Index(body, "\n};")
+	if end < 0 {
+		t.Fatal("the MESSAGES object does not end where this scanner expects")
+	}
+
+	keys := map[string]bool{}
+	for _, line := range strings.Split(body[:end], "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "//") {
+			continue
+		}
+		name, _, ok := strings.Cut(line, ":")
+		if ok {
+			keys[strings.TrimSpace(name)] = true
+		}
+	}
+	if len(keys) == 0 {
+		t.Fatal("no message keys were read out of api.js")
+	}
+	return keys
+}
+
+// The four that used to be indistinguishable from "that already exists".
+func TestTheMisleadingConflictsHaveTheirOwnCodes(t *testing.T) {
+	for _, code := range []string{
+		CodeGmailNotConfigured,
+		CodeAINotConfigured,
+		CodeTOTPNotEnabled,
+		CodeInboxProtected,
+	} {
+		if code == CodeConflict {
+			t.Errorf("%q is still plain conflict", code)
+		}
+	}
+
+	messages := frontendMessageKeys(t)
+	for _, code := range []string{"gmail_not_configured", "ai_not_configured",
+		"totp_not_enabled", "inbox_protected"} {
+		if !messages[code] {
+			t.Errorf("%q has no Danish message", code)
+		}
+	}
+}
+
+// The Inbox is the one project that cannot be deleted, and saying "that already
+// exists" about it helps nobody.
+func TestDeletingTheInboxSaysWhy(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, projects := ts.do(t, "GET", "/api/v1/projects", nil)
+	list, _ := projects["projects"].([]any)
+
+	var inboxID string
+	for _, raw := range list {
+		p := raw.(map[string]any)
+		if p["is_inbox"] == true {
+			inboxID = p["id"].(string)
+		}
+	}
+	if inboxID == "" {
+		t.Fatal("no inbox was found")
+	}
+
+	resp, body := ts.do(t, "DELETE", "/api/v1/projects/"+inboxID, nil)
+	if resp.StatusCode != 409 {
+		t.Fatalf("status %d, want 409", resp.StatusCode)
+	}
+	if body["code"] != CodeInboxProtected {
+		t.Errorf("code = %v, want %q", body["code"], CodeInboxProtected)
+	}
+}

internal/httpapi/errors.go

@@ -36,6 +36,17 @@ const (
 	CodeRateLimited     = "rate_limited"
 	CodeInternal        = "internal_error"
 	CodePayloadTooLarge = "payload_too_large"
+
+	// Four situations that used to answer plain `conflict`, which the frontend
+	// renders as "that already exists". For these that is not merely vague, it is
+	// wrong: an unconfigured Gmail is not a Gmail that is already there, and a
+	// second factor that is off is not one that is on. A code exists so the
+	// interface can say the true thing — the server's own prose is English for a
+	// log, and deciding what a person reads is the frontend's job.
+	CodeGmailNotConfigured = "gmail_not_configured"
+	CodeAINotConfigured    = "ai_not_configured"
+	CodeTOTPNotEnabled     = "totp_not_enabled"
+	CodeInboxProtected     = "inbox_protected"
 )
 
 func writeError(w http.ResponseWriter, status int, code, message string) {

internal/httpapi/gmail_handlers.go

@@ -30,8 +30,8 @@ func (s *Server) handleGmailAuthorize(w http.ResponseWriter, r *http.Request) {
 	cfg := s.gmailConfig()
 
 	if !cfg.Configured() {
-		writeError(w, http.StatusConflict, CodeConflict,
+		writeError(w, http.StatusConflict, CodeGmailNotConfigured,
-			"Gmail er ikke sat op på denne server — administratoren skal registrere en OAuth-klient hos Google")
+			"no Google OAuth client is registered on this server")
 		return
 	}
 

internal/httpapi/integrations_handlers.go

@@ -18,6 +18,12 @@ import (
 
 type mailAddressResponse struct {
 	Address string `json:"address"`
+	// Configured says whether a mail server has been set up at all. Without one
+	// the address is still minted and still valid — the token is real, and the
+	// endpoint that receives mail works — but nothing on the internet routes to
+	// it yet, and an interface that shows the address without saying so is
+	// promising something that will not happen.
+	Configured bool `json:"configured"`
 }
 
 // handleGetMailAddress returns the personal address that turns an email into a
@@ -34,7 +40,10 @@ func (s *Server) handleGetMailAddress(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, "mail token", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, mailAddressResponse{Address: s.mailAddress(token)})
+	writeJSON(w, http.StatusOK, mailAddressResponse{
+		Address:    s.mailAddress(token),
+		Configured: s.cfg.SMTP.Host != "",
+	})
 }
 
 func (s *Server) handleRotateMailAddress(w http.ResponseWriter, r *http.Request) {
@@ -47,7 +56,10 @@ func (s *Server) handleRotateMailAddress(w http.ResponseWriter, r *http.Request)
 		s.internal(w, "set mail token", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, mailAddressResponse{Address: s.mailAddress(token)})
+	writeJSON(w, http.StatusOK, mailAddressResponse{
+		Address:    s.mailAddress(token),
+		Configured: s.cfg.SMTP.Host != "",
+	})
 }
 
 func (s *Server) mailAddress(token string) string {
@@ -55,7 +67,15 @@ func (s *Server) mailAddress(token string) string {
 	if from := s.cfg.SMTP.From; strings.Contains(from, "@") {
 		// The mail server's own domain, which is the one that can actually route
 		// this — the web address may well be a tunnel hostname that receives no mail.
-		domain = from[strings.Index(from, "@")+1:]
+		//
+		// Except when it is the default. VERDANDE_SMTP_FROM falls back to
+		// verdande@localhost, so an instance with no mail server at all was
+		// handing out todo+…@localhost: an address that looks real, cannot
+		// possibly receive anything, and gives no hint which of the two it is.
+		// The public hostname is at least a domain that exists.
+		if d := from[strings.Index(from, "@")+1:]; d != "" && d != "localhost" {
+			domain = d
+		}
 	}
 	return "todo+" + token + "@" + domain
 }
@@ -251,8 +271,8 @@ func (s *Server) handleAISplit(w http.ResponseWriter, r *http.Request) {
 	}
 	if !cfg.Configured() {
 		// Not an error the user did anything to cause: the feature is simply off.
-		writeError(w, http.StatusConflict, CodeConflict,
+		writeError(w, http.StatusConflict, CodeAINotConfigured,
-			"der er ikke sat en AI-udbyder op under indstillinger")
+			"no AI provider is configured")
 		return
 	}
 
@@ -299,8 +319,8 @@ func (s *Server) handleAISummary(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !cfg.Configured() {
-		writeError(w, http.StatusConflict, CodeConflict,
+		writeError(w, http.StatusConflict, CodeAINotConfigured,
-			"der er ikke sat en AI-udbyder op under indstillinger")
+			"no AI provider is configured")
 		return
 	}
 

internal/httpapi/integrations_test.go

@@ -880,3 +880,106 @@ func TestMCPWithKeyIgnoresTheSessionCookie(t *testing.T) {
 			resp.StatusCode)
 	}
 }
+
+// --- mail to task ------------------------------------------------------------------
+
+// The address used to come out as todo+…@localhost on any instance without a
+// mail server, because VERDANDE_SMTP_FROM defaults to verdande@localhost and the
+// domain was taken from it unconditionally. That address looks real, cannot
+// receive anything, and gives no hint which of the two it is.
+func TestMailAddressDoesNotClaimToBeLocalhost(t *testing.T) {
+	ts := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://todo.example.dk"
+		// Left at the default, as an instance with no mail server has it.
+		c.SMTP.From = "verdande@localhost"
+	})
+	ts.bootstrap(t)
+
+	_, body := ts.do(t, "GET", "/api/v1/mail-address", nil)
+	address, _ := body["address"].(string)
+
+	if strings.HasSuffix(address, "@localhost") {
+		t.Errorf("address = %q — that can never receive mail", address)
+	}
+	if !strings.HasSuffix(address, "@todo.example.dk") {
+		t.Errorf("address = %q, want the public hostname", address)
+	}
+	if body["configured"] != false {
+		t.Error("no SMTP host is set, so configured should be false")
+	}
+}
+
+// A real sender address still wins: the mail server's own domain is the one that
+// can actually route this, and the web address may be a tunnel hostname.
+func TestMailAddressPrefersTheConfiguredSender(t *testing.T) {
+	ts := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://tunnel-abc123.example.net"
+		c.SMTP.Host = "mail.firma.dk"
+		c.SMTP.From = "verdande@firma.dk"
+	})
+	ts.bootstrap(t)
+
+	_, body := ts.do(t, "GET", "/api/v1/mail-address", nil)
+	address, _ := body["address"].(string)
+
+	if !strings.HasSuffix(address, "@firma.dk") {
+		t.Errorf("address = %q, want the sender's domain", address)
+	}
+	if body["configured"] != true {
+		t.Error("an SMTP host is set, so configured should be true")
+	}
+}
+
+// A 200 with the app shell is an answer that says "yes, that exists" to anything
+// that asks. For /.well-known/ that is actively harmful: it is a reserved
+// namespace, and a client probing it is asking a yes-or-no question.
+//
+// Claude asks /.well-known/oauth-authorization-server before connecting to an
+// MCP server. It read the shell as "there is an authorization server here" and
+// then failed trying to register with it, reporting a broken sign-in service on
+// a server that has none and needs none.
+func TestWellKnownDoesNotAnswerWithTheAppShell(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	for _, path := range []string{
+		"/.well-known/oauth-authorization-server",
+		"/.well-known/oauth-protected-resource",
+		"/.well-known/openid-configuration",
+		"/.well-known/anything-at-all",
+	} {
+		resp, err := ts.client.Get(ts.URL + path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+
+		if resp.StatusCode != http.StatusNotFound {
+			t.Errorf("%s: status %d, want 404", path, resp.StatusCode)
+		}
+		if strings.Contains(string(body), "<!doctype html") {
+			t.Errorf("%s: answered with the app shell", path)
+		}
+	}
+}
+
+// The one well-known path that is real still works — it is a route, not a
+// fallthrough, so the rule above must not have swallowed it.
+func TestWellKnownCalDAVStillRedirects(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	client := &http.Client{
+		CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+	}
+	resp, err := client.Get(ts.URL + "/.well-known/caldav")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusNotFound {
+		t.Error("CalDAV discovery was caught by the well-known rule")
+	}
+}

internal/httpapi/projects_handlers.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 
@@ -141,7 +142,7 @@ func (s *Server) handleDeleteProject(w http.ResponseWriter, r *http.Request) {
 	projectID := chi.URLParam(r, "projectID")
 	if err := s.db.DeleteProject(r.Context(), projectID); err != nil {
 		if strings.Contains(err.Error(), "Inbox cannot be deleted") {
-			writeError(w, http.StatusConflict, CodeConflict, "the Inbox cannot be deleted")
+			writeError(w, http.StatusConflict, CodeInboxProtected, "the Inbox cannot be deleted")
 			return
 		}
 		s.storeError(w, "delete project", err)
@@ -151,6 +152,38 @@ func (s *Server) handleDeleteProject(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+type trashedProjectJSON struct {
+	projectJSON
+	DeletedAt string `json:"deleted_at"`
+	// PurgeAfter is when it stops being recoverable. Sent rather than left for
+	// the frontend to work out, because the retention window is the server's and
+	// a copy of it in the interface is a copy that will one day disagree.
+	PurgeAfter string `json:"purge_after"`
+	TaskCount  int    `json:"task_count"`
+}
+
+// handleListTrashedProjects is what makes restoring reachable. The restore
+// endpoint has always existed; without this, using it meant knowing the id of
+// something that had already vanished from the interface.
+func (s *Server) handleListTrashedProjects(w http.ResponseWriter, r *http.Request) {
+	trashed, err := s.db.ListTrashedProjects(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, "list trashed projects", err)
+		return
+	}
+
+	out := make([]trashedProjectJSON, 0, len(trashed))
+	for _, t := range trashed {
+		out = append(out, trashedProjectJSON{
+			projectJSON: toProjectJSON(t.Project),
+			DeletedAt:   t.DeletedAt.Format(time.RFC3339),
+			PurgeAfter:  t.DeletedAt.Add(s.cfg.TrashRetention).Format(time.RFC3339),
+			TaskCount:   t.TaskCount,
+		})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"projects": out})
+}
+
 func (s *Server) handleRestoreProject(w http.ResponseWriter, r *http.Request) {
 	projectID := chi.URLParam(r, "projectID")
 	// Permission cannot be checked through ProjectRole here: a trashed project is

internal/httpapi/projects_test.go

@@ -0,0 +1,83 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// Restoring has been possible since the trash existed. Finding what to restore
+// has not: the endpoint takes an id, and the id is exactly what you no longer
+// have once the project has gone from the interface.
+func TestTheTrashCanBeListedAndRestored(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, created := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Ferie"})
+	id := created["id"].(string)
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "book fly", "project_id": id})
+
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/projects/"+id, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete: status %d", resp.StatusCode)
+	}
+
+	// Gone from the ordinary listing.
+	_, live := ts.do(t, "GET", "/api/v1/projects", nil)
+	for _, raw := range live["projects"].([]any) {
+		if raw.(map[string]any)["id"] == id {
+			t.Fatal("a deleted project is still in the project list")
+		}
+	}
+
+	// And findable in the trash, with enough to decide whether to bring it back.
+	_, trash := ts.do(t, "GET", "/api/v1/trash/projects", nil)
+	list, _ := trash["projects"].([]any)
+	if len(list) != 1 {
+		t.Fatalf("want one project in the trash, got %v", list)
+	}
+	entry := list[0].(map[string]any)
+	if entry["name"] != "Ferie" {
+		t.Errorf("name = %v", entry["name"])
+	}
+	if entry["task_count"] != float64(1) {
+		t.Errorf("task_count = %v, want 1 — the count is what says whether it matters",
+			entry["task_count"])
+	}
+	if entry["purge_after"] == nil || entry["deleted_at"] == nil {
+		t.Errorf("no deadline was reported: %v", entry)
+	}
+
+	if resp, _ := ts.do(t, "POST", "/api/v1/trash/projects/"+id+"/restore", nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("restore: status %d", resp.StatusCode)
+	}
+
+	// Back, with its task.
+	_, tasks := ts.do(t, "GET", "/api/v1/tasks?project_id="+id, nil)
+	if got, _ := tasks["tasks"].([]any); len(got) != 1 {
+		t.Errorf("the task did not come back with the project: %v", got)
+	}
+	_, trash = ts.do(t, "GET", "/api/v1/trash/projects", nil)
+	if list, _ := trash["projects"].([]any); len(list) != 0 {
+		t.Errorf("still in the trash after restoring: %v", list)
+	}
+}
+
+// Somebody else's deleted project is not in your trash, and you cannot restore it.
+func TestTheTrashIsPerOwner(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, created := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Privat"})
+	id := created["id"].(string)
+	ts.do(t, "DELETE", "/api/v1/projects/"+id, nil)
+
+	other := ts.newUser(t, "anden@example.dk", "Anden")
+
+	_, trash := other.do(t, "GET", "/api/v1/trash/projects", nil)
+	if list, _ := trash["projects"].([]any); len(list) != 0 {
+		t.Errorf("somebody else's deleted project is visible: %v", list)
+	}
+	resp, _ := other.do(t, "POST", "/api/v1/trash/projects/"+id+"/restore", nil)
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status %d, want 404", resp.StatusCode)
+	}
+}

internal/httpapi/server.go

@@ -285,9 +285,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				})
 			})
 
-			// Restoring is outside the block above: a trashed project is invisible
+			// The trash is outside the block above: a deleted project is invisible
-			// to the permission check by design, so the handler resolves ownership
+			// to the permission check by design, so these handlers resolve
-			// itself.
+			// ownership themselves.
+			r.Get("/trash/projects", s.handleListTrashedProjects)
 			r.Post("/trash/projects/{projectID}/restore", s.handleRestoreProject)
 
 			r.Route("/sections/{sectionID}", func(r chi.Router) {
@@ -348,7 +349,11 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+	// The version travels with the health check because this is the one endpoint
+	// that answers without a session. "Which version is actually running?" is
+	// otherwise a question you cannot ask from outside — and after a deploy it is
+	// the first question there is.
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ok", "version": Version})
 }
 
 // serveWeb serves the PWA, falling back to index.html so that client-side routes
@@ -360,6 +365,21 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
 		return
 	}
+
+	// /.well-known/ is reserved by RFC 8615 and is never a route in the app.
+	// Handing back the shell there does not merely waste a response: it tells
+	// whoever asked that the thing they were looking for exists.
+	//
+	// That is not hypothetical. Claude probes
+	// /.well-known/oauth-authorization-server before connecting to an MCP server,
+	// read 200 and a page of HTML as "there is an authorization server here", and
+	// then failed trying to register with it — reporting a broken sign-in service
+	// on a server that has none and needs none. A 404 means "no OAuth here", the
+	// client stops asking, and the key in the URL is used as intended.
+	if strings.HasPrefix(r.URL.Path, "/.well-known/") {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
+		return
+	}
 	if s.web == nil {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		w.WriteHeader(http.StatusOK)

internal/httpapi/totp_handlers.go

@@ -116,7 +116,7 @@ func (s *Server) handleRecoveryCodesRegenerate(w http.ResponseWriter, r *http.Re
 	user := userFrom(r.Context())
 
 	if !user.TOTPEnabled {
-		writeError(w, http.StatusConflict, CodeConflict,
+		writeError(w, http.StatusConflict, CodeTOTPNotEnabled,
 			"two-factor authentication is not switched on")
 		return
 	}

internal/store/projects.go

@@ -234,6 +234,55 @@ func (db *DB) DeleteProject(ctx context.Context, projectID string) error {
 	})
 }
 
+// TrashedProject is a deleted project, with when it went and when it goes for good.
+type TrashedProject struct {
+	Project
+	DeletedAt time.Time
+	TaskCount int
+}
+
+// ListTrashedProjects returns what the caller owns and has deleted.
+//
+// Restoring has been possible since the trash existed, but only if you already
+// knew the project's id — which is exactly what you no longer have once it has
+// gone from the interface. A recovery window nobody can reach is not one.
+//
+// Owned, not shared: a member of a project somebody else deleted has no business
+// bringing it back.
+func (db *DB) ListTrashedProjects(ctx context.Context, userID string) ([]TrashedProject, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT p.id, p.name, p.color, p.icon, p.view_mode, p.owner_id, p.is_inbox,
+		       p.archived, p.sort_order, p.created_at, p.updated_at, p.deleted_at,
+		       (SELECT count(*) FROM tasks t
+		         WHERE t.project_id = p.id AND t.deleted_at = p.deleted_at) AS task_count
+		FROM projects p
+		WHERE p.owner_id = ? AND p.deleted_at IS NOT NULL
+		ORDER BY p.deleted_at DESC`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []TrashedProject{}
+	for rows.Next() {
+		var t TrashedProject
+		var created, updated, deleted int64
+		var icon sql.NullString
+		if err := rows.Scan(&t.ID, &t.Name, &t.Color, &icon, &t.ViewMode, &t.OwnerID,
+			&t.IsInbox, &t.Archived, &t.SortOrder, &created, &updated, &deleted,
+			&t.TaskCount); err != nil {
+			return nil, err
+		}
+		t.Icon = icon.String
+		t.CreatedAt = time.Unix(created, 0).UTC()
+		t.UpdatedAt = time.Unix(updated, 0).UTC()
+		t.DeletedAt = time.Unix(deleted, 0).UTC()
+		t.Role = RoleOwner
+		out = append(out, t)
+	}
+	return out, rows.Err()
+}
+
 // RestoreProject brings a project back, along with the tasks that were deleted with
 // it. Tasks deleted before it are left in the trash: they were deleted on purpose
 // and separately, and restoring a project should not undo that too.

rune/verdande.yaml

@@ -11,7 +11,7 @@ gameskill:
     invites and reminders, then start it and open the URL to create the first
     admin account.
   author: "kristianwind"
-  version: 1
+  version: 2
   icon: "app"
 
   # The image is distroless — no shell — so keep_entrypoint runs the binary the
@@ -70,6 +70,14 @@ gameskill:
       pattern: '^[0-9]+(ns|us|ms|s|m|h)$'
       hint: "must be a duration like 720h, 30m or 45s"
 
+    # Off by default because it is an outbound request nobody asked for. It sends
+    # no identifier and reads one public URL — GitHub's releases API — but that is
+    # a choice to make rather than a default to inherit.
+    - key: VERDANDE_UPDATE_CHECK
+      name: "Look for new releases (asks GitHub once a day; sends nothing about you)"
+      type: bool
+      default: false
+
   install:
     # The image has no shell, so the install step borrows one. It only has to make
     # the directory layout exist; verdande creates and migrates its own database on

web/e2e/smoke.spec.js

@@ -82,6 +82,12 @@ test('hvert link i sidebjælken fører et sted hen', async ({ page }) => {
 	for (const href of hrefs) {
 		await sidebar.locator(`a[href="${href}"]`).first().click();
 
+		// Wait for the navigation before looking at the page. Without this the
+		// assertion can be satisfied by the heading of the page you just left —
+		// which is not a hypothetical: a change that removed a project page's
+		// heading entirely passed here on a fast machine and failed on CI.
+		await page.waitForURL(`**${href}`);
+
 		// Something with a heading rendered. A route written outside the routes
 		// tree lands on the SPA shell and renders nothing — which is exactly how
 		// the label route broke, and it answered 200 the whole time.
@@ -180,6 +186,47 @@ test('manifestet og service workeren findes, og ikonerne findes også', async ({
 	expect(await worker.text()).toContain("addEventListener('push'");
 });
 
+/**
+ * A project can be renamed, deleted and brought back.
+ *
+ * The round trip matters more than the three steps: deleting used to be a
+ * one-way door in the interface — the API could restore, but only from an id
+ * that had already disappeared from the screen.
+ */
+test('et projekt kan omdøbes, slettes og hentes tilbage', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByRole('button', { name: 'Nyt projekt' }).click();
+	await sidebar.getByLabel('Projektnavn').fill('Ferie');
+	await sidebar.getByLabel('Projektnavn').press('Enter');
+
+	await expect(page.getByRole('heading', { name: 'Ferie' })).toBeVisible();
+
+	// The heading is the rename affordance: click it, and it becomes a field.
+	await page.getByRole('button', { name: 'Ferie' }).click();
+	const title = page.getByLabel('Projektets navn');
+	await title.fill('Sommerferie');
+	await title.press('Enter');
+	await expect(sidebar.getByRole('link', { name: 'Sommerferie' })).toBeVisible();
+
+	page.once('dialog', (dialog) => dialog.accept());
+	await page.getByRole('button', { name: 'Slet projektet' }).click();
+
+	await expect(sidebar.getByRole('link', { name: 'Sommerferie' })).toBeHidden();
+
+	// And it is reachable again, which is the half that did not exist.
+	await page.goto('/indstillinger/data');
+	const trash = page.locator('section.panel').filter({ hasText: 'Papirkurv' });
+	await expect(trash.getByText('Sommerferie')).toBeVisible();
+
+	await trash.getByRole('button', { name: 'Hent tilbage' }).click();
+	await expect(sidebar.getByRole('link', { name: 'Sommerferie' })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
 /**
  * The MCP connector address must not fall through to the app shell.
  *

web/src/lib/api.js

@@ -34,9 +34,29 @@ const MESSAGES = {
 	validation_failed: 'Tjek felterne herunder.',
 	payload_too_large: 'Det er for stort.',
 	internal_error: 'Noget gik galt. Prøv igen.',
-	offline: 'Ingen forbindelse til serveren.'
+	bad_request: 'Anmodningen kunne ikke læses.',
+	// Client-only: a network failure is not an HTTP status, so the server has no
+	// code for it.
+	offline: 'Ingen forbindelse til serveren.',
+
+	// Situations that used to arrive as a plain `conflict` and were therefore
+	// shown as "Det er der allerede." — which was not merely vague but wrong. An
+	// unconfigured Gmail is not a Gmail that is already connected.
+	gmail_not_configured:
+		'Gmail er ikke sat op på denne server. Administratoren skal registrere en OAuth-klient hos Google og sætte VERDANDE_GMAIL_CLIENT_ID og _SECRET.',
+	ai_not_configured: 'Der er ikke valgt en AI-udbyder. Sæt den op under Indstillinger → AI.',
+	totp_not_enabled: 'To-faktor er ikke slået til.',
+	inbox_protected: 'Indbakken kan ikke slettes.'
 };
 
+/**
+ * What to show a person for a failed request.
+ *
+ * A code with no message here falls back to the server's prose, which is English
+ * and written for a log — not good, but better than swallowing the only
+ * explanation there is. A code that turns up in that fallback is a code this
+ * table is missing.
+ */
 export function humanMessage(err) {
 	if (!(err instanceof ApiError)) return MESSAGES.offline;
 	return MESSAGES[err.code] ?? err.message ?? MESSAGES.internal_error;
@@ -156,6 +176,7 @@ export const api = {
 	createProject: (data) => post('/projects', data),
 	updateProject: (id, data) => patch(`/projects/${id}`, data),
 	deleteProject: (id) => del(`/projects/${id}`),
+	listTrashedProjects: () => get('/trash/projects'),
 	restoreProject: (id) => post(`/trash/projects/${id}/restore`),
 
 	listSections: (projectId) => get(`/projects/${projectId}/sections`),

web/src/routes/indstillinger/data/+page.svelte

@@ -101,6 +101,36 @@
 	}
 
 	let exportProject = $state('');
+
+	// --- the trash -------------------------------------------------------------
+
+	let trashed = $state([]);
+	let loadingTrash = $state(true);
+
+	$effect(() => {
+		api
+			.listTrashedProjects()
+			.then((r) => (trashed = r.projects))
+			.catch((e) => app.toast(humanMessage(e)))
+			.finally(() => (loadingTrash = false));
+	});
+
+	async function restore(project) {
+		const previous = trashed;
+		trashed = trashed.filter((p) => p.id !== project.id);
+		try {
+			await api.restoreProject(project.id);
+			await app.refreshProjects();
+		} catch (e) {
+			trashed = previous;
+			app.toast(humanMessage(e));
+		}
+	}
+
+	/** Whole days left, rounded down — "0 dage tilbage" is the truthful last day. */
+	function daysLeft(iso) {
+		return Math.max(0, Math.floor((new Date(iso) - Date.now()) / 86400000));
+	}
 </script>
 
 <section class="panel">
@@ -146,6 +176,38 @@
 	{/if}
 </section>
 
+<section class="panel">
+	<header>
+		<h2>Papirkurv</h2>
+		<p class="hint">
+			Slettede projekter, med deres opgaver. De bliver hentet tilbage præcis som
+			de var — bortset fra opgaver, du havde slettet hver for sig først; dem var
+			der en grund til.
+		</p>
+	</header>
+
+	{#if loadingTrash}
+		<p class="empty">…</p>
+	{:else if trashed.length === 0}
+		<p class="empty">Papirkurven er tom.</p>
+	{:else}
+		<ul class="list">
+			{#each trashed as project (project.id)}
+				<li>
+					<div class="what">
+						<span class="title">{project.name}</span>
+						<span class="meta">
+							{project.task_count} opgave{project.task_count === 1 ? '' : 'r'} ·
+							{daysLeft(project.purge_after)} dage tilbage
+						</span>
+					</div>
+					<button class="use" onclick={() => restore(project)}>Hent tilbage</button>
+				</li>
+			{/each}
+		</ul>
+	{/if}
+</section>
+
 <section class="panel">
 	<header>
 		<h2>Eksport</h2>

web/src/routes/indstillinger/integrationer/+page.svelte

@@ -96,10 +96,18 @@
 
 	let feedURL = $state('');
 	let mailAddress = $state('');
+	/** Null until loaded, so the warning does not flash before the answer is in. */
+	let mailConfigured = $state(null);
 
 	$effect(() => {
 		api.feed().then((r) => (feedURL = r.url)).catch(() => {});
-		api.getMailAddress().then((r) => (mailAddress = r.address)).catch(() => {});
+		api
+			.getMailAddress()
+			.then((r) => {
+				mailAddress = r.address;
+				mailConfigured = r.configured;
+			})
+			.catch(() => {});
 	});
 
 	async function rotateFeed() {
@@ -114,7 +122,9 @@
 	async function rotateMail() {
 		if (!confirm('Ny adresse? Mail til den gamle bliver afvist.')) return;
 		try {
-			mailAddress = (await api.rotateMailAddress()).address;
+			const r = await api.rotateMailAddress();
+			mailAddress = r.address;
+			mailConfigured = r.configured;
 		} catch (e) {
 			app.toast(humanMessage(e));
 		}
@@ -218,6 +228,16 @@
 		</p>
 	</header>
 
+	{#if mailConfigured === false}
+		<p class="callback" data-tone="bad">
+			Der er ingen mailserver sat op på denne server, så adressen herunder kan
+			ikke modtage noget endnu. Sæt <span class="mono">VERDANDE_SMTP_HOST</span> og
+			de øvrige SMTP-indstillinger, og få mailserveren til at aflevere post til
+			<span class="mono">todo+*</span> videre til
+			<span class="mono">/inbound/mail</span>.
+		</p>
+	{/if}
+
 	<div class="field">
 		<label for="mail">Din adresse</label>
 		<input id="mail" class="mono" value={mailAddress} readonly />

web/src/routes/projekt/[id]/+page.svelte

@@ -1,6 +1,7 @@
 <script>
 	/** One project: its sections, its tasks, and who it is shared with. */
 	import { page } from '$app/stores';
+	import { goto } from '$app/navigation';
 	import { api, humanMessage } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import TaskList from '$lib/components/TaskList.svelte';
@@ -65,6 +66,41 @@
 	let open = $derived(app.tasks.filter((t) => !t.completed && !t.parent_id));
 	let unsectioned = $derived(open.filter((t) => !t.section_id));
 
+	let editing = $state(false);
+
+	/** Renames on blur. A no-op when nothing changed, so tabbing through is free. */
+	async function rename(input) {
+		const name = input.value.trim();
+		editing = false;
+		if (!name || name === project.name) return;
+
+		try {
+			project = await api.updateProject(project.id, { name });
+			// The sidebar reads its own copy, so it has to be told.
+			await app.refreshProjects();
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
+	async function remove() {
+		const days = 30;
+		const confirmed = confirm(
+			`Slet "${project.name}" med alle dets opgaver?\n\n` +
+				`Det havner i papirkurven og kan hentes tilbage under ` +
+				`Indstillinger → Data og skabeloner i ${days} dage.`
+		);
+		if (!confirmed) return;
+
+		try {
+			await api.deleteProject(project.id);
+			await app.refreshProjects();
+			goto('/');
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
 	async function invite(event) {
 		event.preventDefault();
 		inviteError = '';
@@ -87,7 +123,38 @@
 <div class="view">
 	{#if project}
 		<header>
-			<h1>{project.name}</h1>
+			<!-- A heading first, a field second. Swapping the h1 out for an input
+			     outright cost the page its heading — which the sidebar smoke test
+			     caught, and which is a real loss: every view here has one, and it is
+			     what a screen reader announces on arrival. So the heading stays and
+			     becomes editable on click. -->
+			{#if editing}
+				<!-- svelte-ignore a11y_autofocus -->
+				<input
+					class="title"
+					autofocus
+					value={project.name}
+					aria-label="Projektets navn"
+					onblur={(e) => rename(e.currentTarget)}
+					onkeydown={(e) => {
+						if (e.key === 'Enter') e.currentTarget.blur();
+						if (e.key === 'Escape') {
+							e.currentTarget.value = project.name;
+							editing = false;
+						}
+					}}
+				/>
+			{:else}
+				<h1 class:renameable={isOwner}>
+					{#if isOwner}
+						<button onclick={() => (editing = true)} title="Klik for at omdøbe">
+							{project.name}
+						</button>
+					{:else}
+						{project.name}
+					{/if}
+				</h1>
+			{/if}
 			<div class="views" role="group" aria-label="Visning">
 				{#each [['list', 'Liste'], ['board', 'Board'], ['calendar', 'Kalender']] as [value, label]}
 					<button
@@ -103,6 +170,14 @@
 					{project.shared ? `Delt · ${project.member_count}` : 'Del'}
 				</button>
 			{/if}
+
+			{#if isOwner && !project.is_inbox}
+				<button class="remove" onclick={remove} aria-label="Slet projektet">
+					<svg viewBox="0 0 24 24" aria-hidden="true">
+						<path d="M4 7h16M9 7V5a1 1 0 011-1h4a1 1 0 011 1v2M6 7l1 13h10l1-13" />
+					</svg>
+				</button>
+			{/if}
 		</header>
 
 		{#if showShare}
@@ -225,6 +300,72 @@
 		overflow-wrap: anywhere;
 	}
 
+	/* The heading's button carries no button-ness: it is the heading, and the only
+	   hint that it does anything is the underline on hover. */
+	h1.renameable button {
+		font: inherit;
+		letter-spacing: inherit;
+		color: inherit;
+		text-align: left;
+		border-bottom: 1px solid transparent;
+	}
+
+	h1.renameable button:hover {
+		border-bottom-color: var(--line-strong);
+	}
+
+	/* Matches the heading it stands in for, so the swap does not move the page. */
+	.title {
+		flex: 1;
+		min-width: 0;
+		font-size: var(--text-2xl);
+		font-weight: 560;
+		letter-spacing: -0.015em;
+		background: transparent;
+		border: 1px solid transparent;
+		border-radius: var(--radius);
+		padding: var(--s1) var(--s2);
+		margin-left: calc(var(--s2) * -1);
+		outline: none;
+	}
+
+	.title:hover {
+		border-color: var(--line);
+	}
+
+	.title:focus {
+		background: var(--surface);
+		border-color: var(--accent);
+	}
+
+	.remove {
+		flex: none;
+		width: 30px;
+		height: 30px;
+		display: grid;
+		place-items: center;
+		border-radius: var(--radius);
+		color: var(--ink-faint);
+		transition:
+			color var(--fast) var(--ease),
+			background var(--fast) var(--ease);
+	}
+
+	.remove:hover {
+		color: var(--danger);
+		background: var(--danger-sunken);
+	}
+
+	.remove svg {
+		width: 16px;
+		height: 16px;
+		fill: none;
+		stroke: currentColor;
+		stroke-width: 1.6;
+		stroke-linecap: round;
+		stroke-linejoin: round;
+	}
+
 	.views {
 		display: flex;
 		gap: 1px;