Merge pull request #66 from kristianwind/indbakken-har-en-adresse-apps-kan-skubbe-til

feat(indbakke): en adresse, andre programmer kan skubbe en opgave til

README.md

@@ -24,9 +24,10 @@ Documentation: [`docs/`](docs/), built with Material for MkDocs.
 
 ## Why this exists
 
-Todoist Pro, self-hosted, on your own hardware, with your own data — and with the
-integrations that a hosted product will not build for you: a real CalDAV server, a
-mail-to-task address, and an MCP endpoint so Claude can work your task list directly.
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data, and with the integrations that a
+hosted product will not build for you: a real CalDAV server, a mail-to-task address,
+and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
@@ -102,7 +103,7 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | CalDAV server (two-way VTODO) | Done, tested |
 | Mail-to-task | Done, tested |
 | AI layer (Anthropic/OpenAI/Google/local) | Built, degrades when unconfigured |
-| Gmail: OAuth2 with PKCE, polling, one-way to tasks | Done, tested |
+| Gmail: OAuth2 with PKCE, polling to tasks, unstars what it imports | Done, tested |
 | Google Calendar: read-only, laid over the task calendar | Built, never run against Google |
 | Calendar subscriptions: ICS and webcal, several per person | Done, tested |
 | Times on tasks, set by dragging in the week grid | Done, tested |

cmd/verdande/main.go

@@ -80,6 +80,16 @@ func run() error {
 		log.Info("notes sealed", "count", sealed)
 	}
 
+	// Names created before the app capitalised them on the way in — "andreas"
+	// rather than "Andreas". Idempotent, so it is a cheap pass of names once it has
+	// caught up. A failure here does not stop the start: a lower-case first name is
+	// a blemish, not a broken instance.
+	if fixed, err := db.NormalizeUserNames(context.Background()); err != nil {
+		log.Error("normalize user names", "err", err)
+	} else if fixed > 0 {
+		log.Info("user names normalized", "count", fixed)
+	}
+
 	httpapi.Version = version
 	api := httpapi.New(cfg, db, log, webAssets(log))
 

docs/api.md

@@ -85,7 +85,7 @@ what a person reads is decided by the client, which knows what language they are
 curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
   -H "Authorization: Bearer vrd_..." \
   -H "Content-Type: application/json" \
-  -d '{"text": "betal moms i morgen kl 10 p1 #Firma @regnskab"}'
+  -d '{"text": "file the VAT return tomorrow at 10am p1 #Accounts @tax"}'
 ```
 
 ### Projects and sections
@@ -108,7 +108,7 @@ curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
 | Method | Path | |
 |---|---|---|
 | `GET` | `/today` | Overdue and due today, in your timezone. |
-| `GET` | `/upcoming?days=7` | One entry per day, empty days included. |
+| `GET` | `/upcoming?days=7` | One entry per day, empty days included. Up to 31; over that is capped. |
 | `GET` | `/search?q=` | Across everything you can see. |
 | `GET` `POST` | `/filters` | |
 | `GET` | `/filters/{id}/tasks` | Run one. |

docs/configuration.md

@@ -12,6 +12,25 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
 
+## Behind a proxy
+
+verdande keys its login rate limit and its audit log on the caller's address, so
+that address has to be one the caller cannot forge. A forwarded-for header is
+believed only when the machine that connected is a trusted proxy; a connection
+straight off the internet is keyed on the address it really came from.
+
+| Variable | Default | What it does |
+|---|---|---|
+| `VERDANDE_TRUSTED_PROXIES` | private networks | Whose `X-Forwarded-For` to believe, as comma-separated CIDRs. The default trusts loopback and the private ranges — the shape of a reverse proxy or tunnel sharing the host or the docker bridge. Set to `none` for an instance exposed directly with no proxy, so no forwarded header is ever believed. |
+| `VERDANDE_REAL_IP_HEADER` | `X-Forwarded-For` | The header the client address is read from, for a trusted proxy. |
+
+!!! warning "A proxy that does not overwrite the header"
+    The default is safe when your proxy replaces a client-supplied
+    `X-Forwarded-For` with the real address — nginx, Caddy and Cloudflare Tunnel all
+    do. If yours passes the client's own header through, narrow
+    `VERDANDE_TRUSTED_PROXIES` to just your proxy's address so a visitor cannot
+    choose the address they are rate-limited and logged as.
+
 ## Sessions and links
 
 | Variable | Default | What it does |
@@ -55,7 +74,7 @@ Then enable the APIs and scopes for whichever you want:
 
 | For | Enable | Scope |
 |---|---|---|
-| Mailboxes | Gmail API | `gmail.readonly` |
+| Mailboxes | Gmail API | `gmail.modify` |
 | Calendar | Google Calendar API | `calendar.readonly` |
 
 | Variable | What it does |

docs/filters.md

@@ -1,7 +1,7 @@
 # Saved filters
 
-A filter is a small expression describing a slice of your tasks. The grammar is
-Todoist's, so if you are coming from there you already know it.
+A filter is a small expression describing a slice of your tasks. The grammar will
+feel familiar if you have used query-based filters in other task apps.
 
 ```
 today & p1

docs/index.md

@@ -11,28 +11,46 @@ of. Which is what a to-do list is.
 
 ## What it is for
 
-Todoist Pro, on your own hardware, with your own data. And with the integrations a
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data. And with the integrations a
 hosted product will not build for you: a real CalDAV server, an address you can
 forward mail to, and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
-- **[Quick add](quick-add.md) that reads what you type.** `betal moms i morgen kl
-  10 p1 #Firma @regnskab` becomes a task due tomorrow at 10:00, priority 1, in
-  Firma, labelled regnskab. Danish and English, mixed freely in one line.
+- **[Quick add](quick-add.md) that reads what you type.** `file the VAT return
+  tomorrow at 10am p1 #Accounts @tax` becomes a task due tomorrow at 10:00,
+  priority 1, in Accounts, labelled tax. Danish and English, mixed freely in one
+  line.
 - **Projects, sections, sub-tasks, labels, [saved filters](filters.md).** List,
   board and calendar views, and foldable groups over the projects in the sidebar.
-- **Notes, beside the work.** Rich text to write in, Markdown on disk. A note is
-  shared by filing it in a project; `#project` and `[[another note]]` are links,
-  and a task shows what has been written about it.
+  The calendar draws each task to its length — drag the foot to resize, the body
+  to move it.
+- **Notes, beside the work.** Rich text to write in, Markdown on disk. Share a
+  single note with a person, or file it in a project; `#project` and
+  `[[another note]]` are links, and a task shows what has been written about it.
+- **Delegate, and snooze.** Hand a task to somebody and it is marked with an
+  arrow to them, gathered on a *Waiting on others* page. Snooze one to park it,
+  greyed, at the foot of the list until a moment you pick — without touching when
+  it is due.
 - **Drag where it means something** — reorder a list or a board, file a project
   under a group, drop a task on another project, or drop it on another day.
 - **Sharing** with owner, editor and viewer roles. Anyone outside your instance
   joins through an invite link.
 - **Live sync** — a change made by somebody else appears without a refresh.
-- **Repeating tasks** as RRULE, reminders, comments and attachments.
-- **[Calendar](caldav.md), [mail](mail.md) and [Claude](mcp.md)** connected over
-  open standards rather than private formats.
+- **Repeating tasks** as RRULE, comments and attachments, and reminders that go
+  out as Web Push to an iPhone or a Mac.
+- **[Your mail as an inbox](mailboxes.md).** Star a mail in Gmail, or flag one
+  over IMAP in iCloud or Fastmail, and it becomes a task — and the star or flag
+  comes off once it has, so a starred inbox empties as the tasks are made instead
+  of only filling up.
+- **[Calendar](caldav.md) and [Claude](mcp.md)** connected over open standards
+  rather than private formats.
+- **Six themes**, three dark and three light — including *Charcoal*, a warm
+  near-black after Apple Notes — and a size and typeface chosen apart from them.
+- **Holds through a short network drop.** A save rides out a few seconds of no
+  signal and goes through when it comes back; a reload opens from what it last saw
+  rather than the browser's offline page. It installs as a PWA.
 
 ## What it looks like
 
@@ -48,7 +66,19 @@ columns.*
 
 ![Waiting on others](screenshots/delegated.png)
 
-*What you have handed to somebody else, grouped by whoever has it.*
+*What you have handed to somebody else, grouped by whoever has it — and each row
+marked with an arrow to them, so a delegated task reads as delegated wherever you
+meet it.*
+
+![Notes in the Charcoal theme](screenshots/notes-charcoal.png)
+
+*Charcoal, the newest of six themes — a warm near-black after Apple Notes, with
+amber where the accent green usually is.*
+
+![The six themes as swatches](screenshots/themes.png)
+
+*Six themes — three dark, three light — chosen on the settings page, with the
+typeface and how tightly it sits set apart from them.*
 
 ![Settings, integrations](screenshots/settings.png)
 

docs/mcp.md

@@ -57,9 +57,9 @@ Both endpoints run the same server and reach the same things.
 | `complete_task` | Tick one off. |
 | `add_comment` | Comment on a task. |
 
-`create_task` prefers natural language, so *"add betal moms i morgen kl 10 p1
-#Firma"* goes through the same parser the app uses — dates, priorities, projects,
-labels and recurrence in either language.
+`create_task` prefers natural language, so *"add file the VAT return tomorrow at
+10am p1 #Accounts"* goes through the same parser the app uses — dates, priorities,
+projects, labels and recurrence in either language.
 
 ## What it can reach
 

docs/openapi.yaml

@@ -805,14 +805,36 @@ paths:
         "200": { $ref: "#/components/responses/Task" }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/tasks/{taskID}/snooze:
+    parameters:
+      - { name: taskID, in: path, required: true, schema: { type: string } }
+    post:
+      tags: [tasks]
+      summary: Snooze a task until a time, or wake it.
+      description: |
+        Parks the task at the bottom of its list, greyed, until `until` passes —
+        nothing else about it moves. An empty `until` wakes it now.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                until: { type: string, format: date-time, description: "RFC3339; empty to wake." }
+      responses:
+        "200": { $ref: "#/components/responses/Task" }
+        "404": { $ref: "#/components/responses/NotFound" }
+        "422": { $ref: "#/components/responses/Validation" }
+
   /api/v1/tasks/quick-add:
     post:
       tags: [tasks]
       summary: Create a task from one line of natural language.
       description: |
-        Danish and English. `betal moms i morgen kl 10 p1 #Firma @vigtigt` becomes
-        a task due tomorrow at 10:00, priority 1, in the project Firma, labelled
-        vigtigt. An unknown `#project` is not an error — the task goes to the
+        Danish and English. `file the VAT return tomorrow at 10am p1 #Accounts @tax`
+        becomes a task due tomorrow at 10:00, priority 1, in the project Accounts,
+        labelled tax. An unknown `#project` is not an error — the task goes to the
         Inbox rather than a thought being thrown away over a typo.
       requestBody:
         required: true
@@ -1228,7 +1250,7 @@ paths:
 
         The one click that opens Google's consent screen already exists. What it
         needs behind it is a registered client, and no app can conjure one: Google
-        issues no Gmail access to an unregistered client, and `gmail.readonly` is a
+        issues no Gmail access to an unregistered client, and `gmail.modify` is a
         restricted scope, so an id shipped inside a public image would be both
         extractable from it and unusable without Google's security review of every
         deployment that used it.
@@ -2343,7 +2365,12 @@ paths:
       tags: [views]
       summary: The next few days, empty ones included.
       parameters:
-        - { name: days, in: query, schema: { type: integer, default: 7 } }
+        - {
+            name: days,
+            in: query,
+            description: "How many days to return, counting today. Above the maximum is capped, not refused.",
+            schema: { type: integer, default: 7, minimum: 1, maximum: 31 },
+          }
       responses:
         "200":
           description: OK
@@ -2691,6 +2718,25 @@ paths:
       responses:
         "200": { $ref: "#/components/responses/MailAddress" }
 
+  /api/v1/hook-url:
+    get:
+      tags: [integrations]
+      summary: Your personal address for pushing a task in from somewhere else.
+      description: >
+        Minted on first ask. Its own token rather than the mail one: the two are
+        the same kind of secret, but they leak separately — a URL that has been
+        sitting in a shortcut on a lost phone has to be replaceable without
+        changing the address other people have in their address books.
+      responses:
+        "200": { $ref: "#/components/responses/HookURL" }
+
+  /api/v1/hook-url/rotate:
+    post:
+      tags: [integrations]
+      summary: Issue a new push address, retiring the old one at once.
+      responses:
+        "200": { $ref: "#/components/responses/HookURL" }
+
   /api/v1/notifications:
     get:
       tags: [integrations]
@@ -2990,6 +3036,12 @@ paths:
     post:
       tags: [notes]
       summary: Write a note.
+      description: >
+        `#Projekt` files the note against a project and `[[Another note]]` links to
+        one. A third, `@Name`, shares the note with that person as a viewer and
+        tells them — only the owner's mentions share, and only a name that has just
+        appeared in the text counts, so a note saved on every typing pause does not
+        share itself twice.
       requestBody:
         required: true
         content:
@@ -3053,6 +3105,11 @@ paths:
     patch:
       tags: [notes]
       summary: Change a note. Every field is optional; what is sent is what changes.
+      description: >
+        A name written with an `@` that was not in the text before shares the note
+        with that person as a viewer and tells them. Only the owner's mentions
+        share — an editor may write the name, but giving somebody else's note away
+        is the owner's alone — and a role already granted is never lowered by one.
       requestBody:
         required: true
         content:
@@ -3072,6 +3129,147 @@ paths:
         "204": { description: Deleted }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/notes/{noteID}/shares:
+    parameters:
+      - name: noteID
+        in: path
+        required: true
+        schema: { type: string }
+    get:
+      tags: [notes]
+      summary: Who a note is shared with, and who it can be shared with.
+      description: >
+        Owner only. Returns the people the note is already shared with, each with
+        their role, and the candidates the owner may add — everyone on the instance
+        who is not already on the note.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  shares:
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteShare" }
+                  candidates:
+                    type: array
+                    items: { $ref: "#/components/schemas/Person" }
+                  invites:
+                    description: >
+                      Addresses invited to the note that have not been taken up yet.
+                      There is no account behind them, so there is no name or colour
+                      to show — the address is all there is until they arrive.
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteInvite" }
+                  follows:
+                    description: >
+                      The notes this one points at with [[links]], which are shared
+                      alongside it. Owner's own notes only.
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteFollow" }
+        "404": { $ref: "#/components/responses/NotFound" }
+    post:
+      tags: [notes]
+      summary: Share a note with a person, or change the role they hold.
+      description: >
+        The person is named either by `user_id` — somebody picked from the
+        candidates — or by `email`. An address that already has an account is
+        shared with straight away; one that does not gets an invitation, which
+        becomes the share the moment the account is created (201).
+
+        The notes this one points at with [[links]] are shared with the same person
+        and the same role, so a link in a shared note leads somewhere. Only notes
+        the sharer owns follow, and the response lists them.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              description: One of user_id or email.
+              properties:
+                user_id: { type: string }
+                email: { type: string, format: email }
+                role: { type: string, enum: [viewer, editor] }
+      responses:
+        "200":
+          description: Shared
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  user:
+                    description: >
+                      Who it was shared with. Sent back because a caller that shared
+                      by address does not otherwise know who it reached.
+                    $ref: "#/components/schemas/Person"
+                  role: { type: string, enum: [viewer, editor] }
+                  follows:
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteFollow" }
+        "201":
+          description: >
+            Invited. The address has no account yet, so a link that creates one and
+            the share together has been issued.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  invited: { $ref: "#/components/schemas/NoteInvite" }
+                  link:
+                    description: The signup link, shown so it can be passed on.
+                    type: string
+                  emailed:
+                    description: >
+                      False when the instance has no mail configured, which is when
+                      the link is the only way the invitation reaches anybody.
+                    type: boolean
+        "404": { $ref: "#/components/responses/NotFound" }
+        "409": { $ref: "#/components/responses/Conflict" }
+        "422": { $ref: "#/components/responses/Validation" }
+
+  /api/v1/notes/{noteID}/invites/{inviteID}:
+    delete:
+      tags: [notes]
+      summary: Withdraw an invitation to a note before it is used.
+      description: >
+        The only way back. Only the token's hash is stored, so a link sent to the
+        wrong address cannot be looked up and invalidated — only the row it belongs
+        to can.
+      parameters:
+        - name: noteID
+          in: path
+          required: true
+          schema: { type: string }
+        - name: inviteID
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        "204": { description: Withdrawn }
+        "404": { $ref: "#/components/responses/NotFound" }
+
+  /api/v1/notes/{noteID}/shares/{userID}:
+    delete:
+      tags: [notes]
+      summary: Take a person's access to a note away again.
+      parameters:
+        - name: noteID
+          in: path
+          required: true
+          schema: { type: string }
+        - name: userID
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        "204": { description: Unshared }
+        "404": { $ref: "#/components/responses/NotFound" }
+
   /api/v1/notes/linking/{kind}/{targetID}:
     get:
       tags: [notes]
@@ -3573,6 +3771,69 @@ paths:
                   task_id: { type: string }
         "404": { description: "No such address. Identical to a malformed one, deliberately." }
 
+  /inbound/hook/{token}:
+    post:
+      tags: [integrations]
+      summary: Push a task into somebody's inbox from another program.
+      description: |
+        The token in the path is the whole credential — the caller is a shortcut on
+        a phone or a script, and neither can sign in. A token here can do one
+        thing: create a task in that person's inbox. An API token can do everything,
+        which is why this is not one.
+
+        The body is read three ways, because those are the three you meet: JSON from
+        a service, a form field from a webhook form, and plain text from a shortcut
+        that just sends what was selected. The first line becomes the task and the
+        rest sits underneath it, and the line goes through the quick-add parser — so
+        "Ring til Anders i morgen p1 #Firma" means here what it means in the box at
+        the top of the app.
+
+        POST only. A GET would be easier to call, and that is exactly the problem:
+        a browser prefetch, a link check in a chat, and a revisited history entry
+        would all create tasks nobody asked for.
+      security: []
+      parameters:
+        - name: token
+          in: path
+          required: true
+          schema: { type: string }
+      requestBody:
+        required: true
+        content:
+          text/plain:
+            schema:
+              type: string
+              description: First line the task, the rest its description.
+          application/json:
+            schema:
+              type: object
+              properties:
+                text: { type: string }
+                title: { description: Same as text. }
+                content: { description: Same as text. }
+                note: { type: string }
+                body: { description: Same as note. }
+                description: { description: Same as note. }
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                text: { type: string }
+                note: { type: string }
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  task_id: { type: string }
+                  content: { type: string }
+        "404": { description: "No such address. Identical to a malformed one, deliberately." }
+        "422": { $ref: "#/components/responses/Validation" }
+        "429": { description: Too many pushes; the address is rate limited. }
+
   /oauth/gmail/callback:
     get:
       tags: [integrations]
@@ -3839,6 +4100,15 @@ components:
                 type: array
                 items: { type: string }
 
+    HookURL:
+      description: The address another program pushes to.
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              url: { type: string }
+
   schemas:
     Calendar:
       type: object
@@ -3907,6 +4177,14 @@ components:
         pinned: { type: boolean }
         created_at: { type: string, format: date-time }
         updated_at: { type: string, format: date-time }
+        shared_with_me:
+          type: boolean
+          description: >
+            True when the reader reached this note through a direct share rather
+            than by owning it or its project. What puts it in the Delt med mig group.
+        owner:
+          allOf: [{ $ref: "#/components/schemas/Person" }]
+          description: Who the note belongs to, present on a note shared with the reader.
         links:
           type: array
           description: What the body points at, read out of the text on the way in.
@@ -3923,6 +4201,48 @@ components:
         body: { type: string, description: "Markdown. Its first line becomes the title." }
         pinned: { type: boolean }
 
+    Person:
+      type: object
+      description: A user, as much of one as a name and a colour.
+      properties:
+        id: { type: string }
+        name: { type: string }
+        avatar_color: { type: string }
+
+    NoteShare:
+      type: object
+      description: One person's direct grant on a note.
+      properties:
+        user: { $ref: "#/components/schemas/Person" }
+        role: { type: string, enum: [viewer, editor] }
+        linked:
+          description: >
+            True when the person has this note because another shared note points
+            at it, rather than because it was shared with them on its own. Such a
+            grant is taken back by removing the link or the share it came from, not
+            by removing it here.
+          type: boolean
+        via:
+          description: The title of the shared note that points at this one.
+          type: string
+
+    NoteFollow:
+      type: object
+      description: A note that is shared alongside another because that one links to it.
+      properties:
+        note_id: { type: string }
+        title: { type: string }
+
+    NoteInvite:
+      type: object
+      description: >
+        A share on a note that is waiting for an account. The address is the whole
+        of who the person is until they sign up.
+      properties:
+        id: { type: string }
+        email: { type: string, format: email }
+        role: { type: string, enum: [viewer, editor] }
+
     Mailbox:
       type: object
       description: One connected mailbox. The password and any token are never returned.
@@ -4411,12 +4731,22 @@ components:
 
     Notification:
       type: object
+      description: >
+        Something somebody else did that you need to know about. `kind` says what
+        happened and the client composes the sentence from it, so the bell follows
+        the reader's language; `title` is the server's own Danish wording, used for
+        Web Push, which has no dictionary to look words up in.
       properties:
         id: { type: string }
         actor_name: { type: string }
         project_id: { type: string }
         task_id: { type: string }
-        kind: { type: string }
+        note_id:
+          description: Set on a notification about a note — a shared note somebody else edited.
+          type: string
+        kind:
+          type: string
+          enum: [assigned, note.changed, comment]
         title: { type: string }
         body: { type: string }
         read: { type: boolean }

docs/quick-add.md

@@ -3,11 +3,11 @@
 One line in, a fully-formed task out.
 
 ```
-betal moms i morgen kl 10 p1 #Firma @regnskab
+file the VAT return tomorrow at 10am p1 #Accounts @tax
 ```
 
-becomes a task called **betal moms**, due tomorrow at 10:00, priority 1, in the
-Firma project, labelled regnskab.
+becomes a task called **file the VAT return**, due tomorrow at 10:00, priority 1,
+in the Accounts project, labelled tax.
 
 The parts it understands are tinted underneath the text as you type, so you can see
 it being read before you commit to it.
@@ -16,8 +16,8 @@ it being read before you commit to it.
 
 | You type | It means |
 |---|---|
-| `#Firma` | Put it in that project. `#"Q3 rapport"` for a name with spaces. |
-| `@regnskab` | Add that label. As many as you like. |
+| `#Accounts` | Put it in that project. `#"Q3 report"` for a name with spaces. |
+| `@tax` | Add that label. As many as you like. |
 | `p1` … `p4` | Priority. `!!!`, `!!` and `!` also work. |
 | `i dag`, `i morgen`, `i overmorgen` | Today, tomorrow, the day after. |
 | `mandag`, `på fredag` | The next such weekday. |

docs/self-hosting.md

@@ -1,7 +1,8 @@
-# Self-hosting
+# With Docker
 
-verdande is one static binary and one directory. There is no database server, no
-cache, no queue and no second process.
+Running it yourself outside a panel: one static binary and one directory. There is
+no database server, no cache, no queue and no second process. (Yggdrasil is
+self-hosting too — for that route see [As a Rune](rune.md).)
 
 ## Docker
 

go.mod

@@ -3,8 +3,10 @@ module github.com/kristianwind/verdande
 go 1.26.3
 
 require (
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc
 	github.com/coder/websocket v1.8.15
 	github.com/emersion/go-imap/v2 v2.0.0-beta.8
+	github.com/emersion/go-message v0.18.2
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/go-webauthn/webauthn v0.17.4
 	github.com/pquerna/otp v1.5.0
@@ -14,9 +16,7 @@ require (
 )
 
 require (
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect

internal/auth/auth_test.go

@@ -265,6 +265,39 @@ func TestRecoveryCodes(t *testing.T) {
 	}
 }
 
+// TOTPStep returns the step a code matched, and it must be the same step across
+// the tolerance window — that number is what makes a code single-use, so a code
+// entered a little early or late has to spend the same step, not a new one.
+func TestTOTPStepIsStableAcrossTheWindow(t *testing.T) {
+	secret, _, err := NewTOTPSecret("verdande", "k@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 3, 10, 10, 0, 15, 0, time.UTC)
+	code := codeAt(t, secret, now)
+
+	want, err := TOTPStep(secret, code, now)
+	if err != nil {
+		t.Fatalf("the current code did not match: %v", err)
+	}
+	// Verified one step late — the code is still valid, and must report the step it
+	// was issued at, not the step it was checked at.
+	got, err := TOTPStep(secret, code, now.Add(30*time.Second))
+	if err != nil {
+		t.Fatalf("code rejected one step late: %v", err)
+	}
+	if got != want {
+		t.Errorf("same code reported step %d then %d; a replay check keyed on that would not catch it", want, got)
+	}
+
+	if _, err := TOTPStep(secret, "000000", now); err == nil {
+		t.Error("a wrong code returned a step")
+	}
+	if _, err := TOTPStep("", code, now); err != ErrNoTOTPSecret {
+		t.Errorf("empty secret: %v, want ErrNoTOTPSecret", err)
+	}
+}
+
 // codeAt produces the code an authenticator app would display at that moment,
 // using the same settings VerifyTOTP checks against.
 func codeAt(t *testing.T, secret string, now time.Time) string {

internal/auth/totp.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base32"
 	"errors"
 	"fmt"
@@ -9,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/boombuler/barcode/qr"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
 )
@@ -49,6 +51,41 @@ func NewTOTPSecret(issuer, account string) (secret, uri string, err error) {
 	return key.Secret(), key.URL(), nil
 }
 
+// TOTPQRSVG renders the otpauth:// URI as a QR code, as an SVG a phone camera can
+// read. SVG rather than a PNG data URI so it stays crisp at any size and adds no
+// base64 blob to the page — one dark path on a white square, which is what a scanner
+// needs whatever theme the page is in.
+//
+// The barcode encoder is already in the module graph (pquerna/otp draws on it), so
+// this borrows a dependency rather than adding one.
+func TOTPQRSVG(uri string) (string, error) {
+	code, err := qr.Encode(uri, qr.M, qr.Auto)
+	if err != nil {
+		return "", fmt.Errorf("auth: encode totp qr: %w", err)
+	}
+	b := code.Bounds()
+	n := b.Dx()
+	// A four-module quiet zone all round, which the spec requires and scanners rely
+	// on — without it the code runs to the edge and a reader cannot find its border.
+	const quiet = 4
+	size := n + quiet*2
+
+	var sb strings.Builder
+	fmt.Fprintf(&sb, `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 %d %d" shape-rendering="crispEdges">`, size, size)
+	sb.WriteString(`<rect width="100%" height="100%" fill="#ffffff"/><path fill="#111312" d="`)
+	for y := 0; y < n; y++ {
+		for x := 0; x < n; x++ {
+			// Dark modules are black; the red channel is 0 for those and full for the
+			// light ones. One 1×1 rect per dark module, merged into a single path.
+			if r, _, _, _ := code.At(b.Min.X+x, b.Min.Y+y).RGBA(); r == 0 {
+				fmt.Fprintf(&sb, "M%d %dh1v1h-1z", x+quiet, y+quiet)
+			}
+		}
+	}
+	sb.WriteString(`"/></svg>`)
+	return sb.String(), nil
+}
+
 // TOTPURI rebuilds the otpauth:// URI for an existing secret, for showing the QR
 // code again before enrolment is confirmed.
 func TOTPURI(secret, issuer, account string) string {
@@ -82,6 +119,40 @@ func VerifyTOTP(secret, code string, now time.Time) error {
 	return nil
 }
 
+// TOTPStep verifies a code and returns the counter of the step it matched, so the
+// caller can refuse to accept the same step twice.
+//
+// ValidateCustom answers only yes or no, and "yes" for a code inside the skew
+// window is not enough to stop a replay: a code seen in flight stays valid for the
+// rest of its period, and the fix is to record which step was spent and never
+// accept that step or an earlier one again. That needs the number, so this walks
+// the same window ValidateCustom would — one step either side — and reports the
+// counter of the match. The comparison is constant time for the same reason the
+// password check is: a code is a secret being checked against a computed value.
+func TOTPStep(secret, code string, now time.Time) (int64, error) {
+	if secret == "" {
+		return 0, ErrNoTOTPSecret
+	}
+	code = strings.ReplaceAll(strings.TrimSpace(code), " ", "")
+
+	for offset := -int64(totpSkew); offset <= int64(totpSkew); offset++ {
+		at := now.Add(time.Duration(offset) * totpPeriod * time.Second)
+		want, err := totp.GenerateCodeCustom(secret, at, totp.ValidateOpts{
+			Period:    totpPeriod,
+			Skew:      0,
+			Digits:    totpDigits,
+			Algorithm: otp.AlgorithmSHA1,
+		})
+		if err != nil {
+			return 0, ErrInvalidCode
+		}
+		if subtle.ConstantTimeCompare([]byte(want), []byte(code)) == 1 {
+			return at.Unix() / totpPeriod, nil
+		}
+	}
+	return 0, ErrInvalidCode
+}
+
 // NewRecoveryCodes returns single-use codes for someone who has lost their phone,
 // and the hashes to store. Without these, losing a device means losing the account,
 // and the only fix left is editing the database by hand.

internal/config/config.go

@@ -7,6 +7,7 @@ package config
 
 import (
 	"fmt"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -80,6 +81,26 @@ type Config struct {
 	// TrashRetention is how long a soft-deleted task or project stays recoverable.
 	TrashRetention time.Duration
 
+	// TrustedProxies are the peers whose forwarded-for header may be believed.
+	//
+	// The rate limiter and the audit log key on the caller's address, and that
+	// address is only as honest as wherever it was read. Read it from a header that
+	// anybody can set, and an attacker rotates it to get a fresh guess-bucket for
+	// every request and to write someone else's IP into the log. So the header is
+	// believed only when the machine that *connected* is one of these — a reverse
+	// proxy or tunnel the operator put there — and ignored when the connection came
+	// straight off the internet.
+	//
+	// The default is "the peer is on a private network", which is exactly the shape
+	// of a homelab behind Caddy, nginx or a Cloudflare Tunnel: the proxy shares the
+	// host or the docker bridge, so its address is loopback or RFC1918. A directly
+	// exposed instance sees a public peer, trusts nothing, and keys on the real
+	// connection. Override with VERDANDE_TRUSTED_PROXIES (comma-separated CIDRs),
+	// or "none" to trust no proxy at all.
+	TrustedProxies []netip.Prefix
+	// RealIPHeader is where the client address is read from, for a trusted peer.
+	RealIPHeader string
+
 	Dev bool
 }
 
@@ -149,9 +170,70 @@ func Load() (*Config, error) {
 	if c.DataDir, err = filepath.Abs(c.DataDir); err != nil {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
+
+	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
+	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
+		return nil, err
+	}
 	return c, nil
 }
 
+// defaultTrustedProxies is "the peer is not on the public internet": loopback,
+// the three RFC1918 ranges, Tailscale's CGNAT borrow, IPv6 unique-local and both
+// families' link-local. A proxy an operator stands up in front of this server is
+// on one of these; a stranger connecting directly is on none.
+var defaultTrustedProxies = mustPrefixes(
+	"127.0.0.0/8", "::1/128",
+	"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+	"100.64.0.0/10",
+	"fc00::/7",
+	"169.254.0.0/16", "fe80::/10",
+)
+
+// parseTrustedProxies reads the override. Empty keeps the private-network default;
+// the literal "none" trusts no proxy at all, for an instance that is exposed
+// directly and must never believe a forwarded header.
+func parseTrustedProxies(raw string) ([]netip.Prefix, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return defaultTrustedProxies, nil
+	}
+	if strings.EqualFold(raw, "none") {
+		return nil, nil
+	}
+	var out []netip.Prefix
+	for _, part := range strings.Split(raw, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		// A bare address is a host route: 10.0.0.5 means 10.0.0.5/32, so an operator
+		// naming one proxy does not have to know CIDR notation to do it.
+		if !strings.Contains(part, "/") {
+			addr, err := netip.ParseAddr(part)
+			if err != nil {
+				return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not an address or CIDR", part)
+			}
+			out = append(out, netip.PrefixFrom(addr, addr.BitLen()))
+			continue
+		}
+		p, err := netip.ParsePrefix(part)
+		if err != nil {
+			return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not a CIDR", part)
+		}
+		out = append(out, p.Masked())
+	}
+	return out, nil
+}
+
+func mustPrefixes(cidrs ...string) []netip.Prefix {
+	out := make([]netip.Prefix, 0, len(cidrs))
+	for _, c := range cidrs {
+		out = append(out, netip.MustParsePrefix(c))
+	}
+	return out
+}
+
 // DBPath, FilesDir and BackupsDir are the three things that live on the /data volume.
 func (c *Config) DBPath() string     { return filepath.Join(c.DataDir, "verdande.db") }
 func (c *Config) FilesDir() string   { return filepath.Join(c.DataDir, "files") }

internal/gmail/gmail.go

@@ -1,14 +1,20 @@
 // Package gmail is the small slice of the Gmail API verdande needs, and the scope
 // it asks for.
 //
-// The connection is one-way on purpose: a starred or labelled message becomes a
-// task, and nothing verdande does afterwards touches the mailbox. Unstarring the
-// message does not delete the task, completing the task does not unstar the
-// message. Two-way would mean deciding what to do when both sides changed, and the
-// only honest answer to that is a synchronisation model far bigger than the feature.
+// The one thing verdande writes back is the star. A starred message becomes a
+// task, and once it has, the star comes off — exactly as the IMAP side takes the
+// flag off a mail it has imported, and for the same reason: the star meant "turn
+// this into a task", the task now exists, so the star is no longer true. Nothing
+// else is touched. Completing the task does not reach back to the mail; the mail
+// is a pointer the task was made from, not a copy the two have to be kept in step.
 //
-// Scope is gmail.readonly. verdande never needs to send, modify or delete, and
-// asking for less is what makes the consent screen something a person can agree to.
+// That one write is why the scope is gmail.modify rather than gmail.readonly.
+// Removing the STARRED label is a modify, and Gmail offers no narrower scope that
+// can do it — so the consent screen asks for more than it used to, and the trade
+// is deliberate: a starred inbox that empties itself as the tasks are made, rather
+// than one that fills with stars nothing ever clears. Still not send, still not
+// delete — modify is labels, and the only label verdande removes is the one that
+// triggered the task.
 //
 // The OAuth flow itself moved to internal/google when Calendar needed the same one.
 // The names below are aliases so that every call site — and this package's own
@@ -27,8 +33,10 @@ import (
 	"github.com/kristianwind/verdande/internal/google"
 )
 
-// Read-only, and only mail. Not profile, not contacts, not send.
-const Scope = "https://www.googleapis.com/auth/gmail.readonly"
+// Read mail and change its labels, and only mail. Not profile, not contacts, not
+// send, not delete. The single write is removing the STARRED label from a message
+// that has become a task; see the package comment for why that costs modify.
+const Scope = "https://www.googleapis.com/auth/gmail.modify"
 
 const defaultAPIBase = "https://gmail.googleapis.com/gmail/v1"
 
@@ -169,6 +177,25 @@ func (c *Client) get(ctx context.Context, url string, out any) error {
 	return google.Get(ctx, c.http, c.accessToken, url, out)
 }
 
+// Unstar takes the star off the given messages — one call for all of them, the way
+// the IMAP side unflags a batch, so a sweep that made ten tasks is one write and
+// not ten.
+//
+// STARRED is a system label whose id is its name, so no lookup is needed; a custom
+// label would need one, and verdande removes none. batchModify answers 204 with no
+// body on success. An empty list is a no-op, not a call: batchModify with no ids is
+// an error on Google's side and nothing worth making a round trip to hear.
+func (c *Client) Unstar(ctx context.Context, ids []string) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	body := struct {
+		IDs            []string `json:"ids"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
+	}{IDs: ids, RemoveLabelIDs: []string{"STARRED"}}
+	return google.Post(ctx, c.http, c.accessToken, c.api()+"/users/me/messages/batchModify", body, nil)
+}
+
 // SenderName pulls "Anders Jensen" out of "Anders Jensen <anders@example.dk>",
 // falling back to the address when there is no display name.
 func SenderName(from string) string {

internal/gmail/gmail_test.go

@@ -1,16 +1,81 @@
 package gmail
 
 import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 )
 
 // The scope is the one thing verdande chooses about the connection, and it is the
 // one the person reads on the consent screen. The flow itself is exercised in
-// internal/google; what belongs here is that Gmail still asks for read-only mail.
-func TestTheScopeIsReadOnlyMail(t *testing.T) {
-	if !strings.HasSuffix(Scope, "gmail.readonly") {
-		t.Errorf("scope = %q; verdande never needs to send or modify", Scope)
+// internal/google; what belongs here is that Gmail asks for modify — read plus the
+// one write it makes, taking the star off an imported message — and nothing wider.
+func TestTheScopeIsModifyMail(t *testing.T) {
+	if !strings.HasSuffix(Scope, "gmail.modify") {
+		t.Errorf("scope = %q; want gmail.modify — read, plus removing the star", Scope)
+	}
+	// Modify is the ceiling. Send, or the full account, would be a different promise
+	// to the person on the consent screen than the one this feature needs.
+	for _, wider := range []string{"gmail.send", "mail.google.com", "gmail.settings"} {
+		if strings.Contains(Scope, wider) {
+			t.Errorf("scope = %q; must not include %q", Scope, wider)
+		}
+	}
+}
+
+// Unstar removes the star from a batch in one call, and it addresses the messages
+// it was given and only the STARRED label.
+func TestUnstarRemovesOnlyTheStar(t *testing.T) {
+	var gotPath string
+	var gotBody struct {
+		IDs            []string `json:"ids"`
+		AddLabelIDs    []string `json:"addLabelIds"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		raw, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(raw, &gotBody)
+		w.WriteHeader(http.StatusNoContent) // what batchModify answers on success
+	}))
+	defer srv.Close()
+
+	err := NewClient("token").At(srv.URL).Unstar(context.Background(), []string{"a", "b"})
+	if err != nil {
+		t.Fatalf("Unstar: %v", err)
+	}
+	if !strings.HasSuffix(gotPath, "/users/me/messages/batchModify") {
+		t.Errorf("path = %q, want the batchModify endpoint", gotPath)
+	}
+	if strings.Join(gotBody.IDs, ",") != "a,b" {
+		t.Errorf("ids = %v, want [a b]", gotBody.IDs)
+	}
+	if strings.Join(gotBody.RemoveLabelIDs, ",") != "STARRED" {
+		t.Errorf("removeLabelIds = %v, want [STARRED]", gotBody.RemoveLabelIDs)
+	}
+	if len(gotBody.AddLabelIDs) != 0 {
+		t.Errorf("addLabelIds = %v, want none — verdande adds no label", gotBody.AddLabelIDs)
+	}
+}
+
+// An empty batch is not a request: Gmail rejects a batchModify with no ids, and
+// there is nothing to say to it anyway.
+func TestUnstarOfNothingMakesNoCall(t *testing.T) {
+	called := false
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		called = true
+	}))
+	defer srv.Close()
+
+	if err := NewClient("token").At(srv.URL).Unstar(context.Background(), nil); err != nil {
+		t.Fatalf("Unstar(nil): %v", err)
+	}
+	if called {
+		t.Error("Unstar(nil) made a request; it should make none")
 	}
 }
 

internal/google/google.go

@@ -215,6 +215,40 @@ func Get(ctx context.Context, client *http.Client, accessToken, url string, out
 	return json.NewDecoder(resp.Body).Decode(out)
 }
 
+// Post sends a JSON body to a Google API and, unlike Get, does not insist on a
+// body coming back. A write call — modifying labels on a message — answers with
+// 204 No Content when it worked, so anything 2xx is success and only the body is
+// decoded, and only when the caller asked for one.
+func Post(ctx context.Context, client *http.Client, accessToken, url string, body, out any) error {
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(string(payload)))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return ErrUnauthorized
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("google: %s", resp.Status)
+	}
+	if out == nil || resp.StatusCode == http.StatusNoContent {
+		return nil
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
 func randomString(n int) (string, error) {
 	b := make([]byte, n)
 	if _, err := rand.Read(b); err != nil {

internal/httpapi/auth_handlers.go

@@ -218,7 +218,24 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err := auth.VerifyTOTP(user.TOTPSecret, req.Code, time.Now())
+	step, err := auth.TOTPStep(user.TOTPSecret, req.Code, time.Now())
+	if err == nil {
+		// The code is right; now it must also be unused. A TOTP code stays valid for
+		// its whole window, so one observed in flight — a phishing page, a proxy,
+		// over the shoulder — could otherwise be replayed until it expires. Spending
+		// the step here makes it single-use: a second presentation of the same code,
+		// or an earlier one, finds the step already gone.
+		fresh, cerr := s.db.ConsumeTOTPStep(r.Context(), user.ID, step)
+		if cerr != nil {
+			s.internal(w, r, "consume totp step", cerr)
+			return
+		}
+		if !fresh {
+			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
+				"that verification code has already been used")
+			return
+		}
+	}
 	if err != nil {
 		// A recovery code is accepted in the same field. Making somebody find a
 		// different form while locked out of their account is a poor time to

internal/httpapi/auth_test.go

@@ -372,6 +372,50 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 	}
 }
 
+// A TOTP code works once. A code seen in flight and replayed inside its window
+// must be refused the second time, or the second factor is only as good as the
+// thirty seconds an attacker has to reuse what they captured.
+func TestTOTPCodeIsSingleUse(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
+	}
+	secret, _ := body["secret"].(string)
+	resp, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
+		"code": codeFor(t, secret),
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp confirm: %d %v", resp.StatusCode, body)
+	}
+
+	// One code, captured once and presented twice.
+	code := codeFor(t, secret)
+
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "kristian@example.dk", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("first use of the code failed: %d %v", resp.StatusCode, body)
+	}
+
+	// A second login, same code, same window.
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "kristian@example.dk", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("the same code was accepted twice: %d %v", resp.StatusCode, body)
+	}
+}
+
 // A recovery code is accepted in the same field as a TOTP code, and works once.
 func TestRecoveryCodeCompletesLoginOnce(t *testing.T) {
 	ts := newTestServer(t)

internal/httpapi/csp_header_test.go

@@ -3,6 +3,8 @@ package httpapi
 import (
 	"strings"
 	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
 )
 
 // Politikken skal stå i svaret, og den skal stadig være stram.
@@ -50,6 +52,39 @@ func TestEveryResponseCarriesAStrictCSP(t *testing.T) {
 	}
 }
 
+// HSTS følger med, når instansen kører over HTTPS — og kun der.
+//
+// Sessionen bor i en __Host-cookie, der kun findes over TLS, så hele modellen
+// forudsætter allerede HTTPS. HSTS er det, der holder den forudsætning mod en
+// netværksangriber; men bedt om over ren HTTP ville den bede en browser om at
+// kræve et certifikat, en dev-instans ikke har. Begge halvdele skal stå prøven.
+func TestHSTSTracksHTTPS(t *testing.T) {
+	overHTTP := newTestServer(t) // BaseURL er http://localhost
+	resp, _ := overHTTP.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("HSTS sat over ren HTTP: %q", got)
+	}
+
+	overHTTPS := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://todo.example.dk"
+	})
+	resp, _ = overHTTPS.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got == "" {
+		t.Error("ingen HSTS over HTTPS")
+	} else if !strings.Contains(got, "includeSubDomains") {
+		t.Errorf("HSTS uden includeSubDomains: %q", got)
+	}
+	// Permissions-Policy står på hvert svar, uanset skema: den lukker for kamera,
+	// mikrofon og placering, som appen aldrig beder om.
+	if got := resp.Header.Get("Permissions-Policy"); !strings.Contains(got, "camera=()") {
+		t.Errorf("Permissions-Policy lukker ikke for kameraet: %q", got)
+	}
+	// COOP isolerer browserkonteksten og står på hvert svar.
+	if got := resp.Header.Get("Cross-Origin-Opener-Policy"); got != "same-origin" {
+		t.Errorf("Cross-Origin-Opener-Policy er ikke same-origin: %q", got)
+	}
+}
+
 // Et bilag må ikke kunne blive læst som et dokument.
 func TestAttachmentsAreNotServedAsDocuments(t *testing.T) {
 	for _, mime := range []string{"image/svg+xml", "text/html", "application/xhtml+xml", "text/xml"} {

internal/httpapi/gmail_handlers.go

@@ -251,10 +251,12 @@ func (s *Server) handleGmailSyncNow(w http.ResponseWriter, r *http.Request) {
 // takes a context and a user rather than a request.
 // maxGmailSeen bounds the list of message ids already turned into tasks.
 //
-// Gmail is read-only here — the scope is `gmail.readonly`, deliberately, because
-// asking for less is what makes the consent screen something a person can agree
-// to — so verdande cannot unstar a message the way the IMAP side unflags one. The
-// record has to live on this side, and a record on this side has to be bounded.
+// The star is taken off an imported message now, so on a starred trigger the mail
+// leaves the query on its own and this list is a safety net rather than the only
+// record. It still earns its place: it covers the window between making the task
+// and the star coming off, and it is the whole of the dedup for a label trigger,
+// where the label is the person's and not ours to remove. A record on this side
+// has to be bounded.
 //
 // A count rather than the previous rule of "whatever Gmail returned this run",
 // which was not a bound but a way of forgetting.
@@ -381,6 +383,29 @@ func (s *Server) SyncGmail(ctx context.Context, user *store.User) (int, error) {
 		s.hub.Publish(projectID, "task.created", toTaskJSON(*task))
 	}
 
+	// The star comes off every message this query returned that now has a task —
+	// the ones made this run and the ones a run before it already made. Gated to the
+	// triggers that are about the star: for a label trigger the star is the person's
+	// own and not ours to touch, and dedup there rests on the seen list alone.
+	//
+	// Best effort, exactly like the IMAP unflag: a task made is not undone by a star
+	// that would not come off. The likeliest reason it will not, right after this
+	// ships, is a connection still holding the old read-only grant — the write is a
+	// 403 until the account is reconnected, and this logs it rather than failing the
+	// sync. It self-heals: the mail stays starred, stays in the next query, and is
+	// tried again once the grant is there.
+	if box.Trigger == "starred" || box.Trigger == "both" {
+		unstar := make([]string, 0, len(ids))
+		for _, id := range ids {
+			if seen[id] {
+				unstar = append(unstar, id)
+			}
+		}
+		if err := client.Unstar(ctx, unstar); err != nil {
+			s.log.Warn("gmail unstar", "err", err, "user", user.ID, "count", len(unstar))
+		}
+	}
+
 	if created > 0 {
 		// The ids this run saw, on top of the ones already known.
 		//
@@ -442,8 +467,8 @@ func (s *Server) handleVersion(w http.ResponseWriter, r *http.Request) {
 //
 // The one click that opens Google's consent screen already exists; what it needs
 // behind it is a registered client, and that is not something any app can conjure:
-// Google issues no Gmail access to an unregistered client, and `gmail.readonly` is
-// a restricted scope, so an id shipped inside a public image would be both
+// Google issues no Gmail access to an unregistered client, and `gmail.modify` is a
+// restricted scope, so an id shipped inside a public image would be both
 // extractable from it and unusable without Google's security review of every
 // deployment. The registration is a one-off. Having to edit a Rune's manifest and
 // recreate the container to paste the result was not.

internal/httpapi/gmail_test.go

@@ -1,14 +1,17 @@
 package httpapi
 
 import (
-	"github.com/kristianwind/verdande/internal/store"
+	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
 )
 
 // A Gmail failure has to survive being reported.
@@ -150,6 +153,84 @@ func TestASlowMailboxDoesNotHangTheRequest(t *testing.T) {
 	t.Logf("came back in %s with %d", took.Round(time.Millisecond), resp.StatusCode)
 }
 
+// A message that becomes a task has its star taken off — the write that the whole
+// gmail.modify scope is for. The mail's own inbox empties as the tasks are made,
+// the way the IMAP side unflags what it imports.
+func TestASyncedGmailMessageIsUnstarred(t *testing.T) {
+	var unstarred struct {
+		hit  bool
+		body struct {
+			IDs            []string `json:"ids"`
+			RemoveLabelIDs []string `json:"removeLabelIds"`
+		}
+	}
+	google := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == "POST" && strings.HasSuffix(r.URL.Path, "/messages/batchModify"):
+			unstarred.hit = true
+			raw, _ := io.ReadAll(r.Body)
+			_ = json.Unmarshal(raw, &unstarred.body)
+			w.WriteHeader(http.StatusNoContent)
+		case strings.Contains(r.URL.Path, "/messages/") && r.URL.Query().Get("format") == "metadata":
+			writeTestJSON(w, map[string]any{
+				"id": "m1", "threadId": "t1", "snippet": "kort tekst",
+				"payload": map[string]any{"headers": []map[string]string{
+					{"name": "From", "value": "Anders <anders@example.dk>"},
+					{"name": "Subject", "value": "Møde på fredag"},
+				}},
+			})
+		case strings.HasSuffix(r.URL.Path, "/messages"):
+			writeTestJSON(w, map[string]any{"messages": []map[string]string{{"id": "m1"}}})
+		default:
+			http.Error(w, "unexpected "+r.Method+" "+r.URL.Path, http.StatusNotFound)
+		}
+	}))
+	defer google.Close()
+
+	ts := newTestServerWith(t, func(cfg *config.Config) {
+		cfg.GmailClientID = "test-client"
+		cfg.GmailClientSecret = "test-secret"
+		cfg.GoogleTokenURL = google.URL + "/token"
+		cfg.GmailAPIURL = google.URL
+	})
+	ts.bootstrap(t)
+
+	user, err := ts.db.UserByEmail(t.Context(), "kristian@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A live access token, so the run goes straight to the list without a refresh.
+	if err := ts.db.SaveMailbox(t.Context(), &store.Mailbox{
+		UserID: user.ID, Kind: "gmail", RefreshToken: "r", AccessToken: "a",
+		Trigger: "starred", ExpiresAt: time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	resp, body := ts.do(t, "POST", "/api/v1/gmail/sync", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("sync: status %d, want 200", resp.StatusCode)
+	}
+	if created, _ := body["created"].(float64); created != 1 {
+		t.Fatalf("created = %v, want 1", body["created"])
+	}
+
+	if !unstarred.hit {
+		t.Fatal("the message was never unstarred; its star is the one thing modify is for")
+	}
+	if strings.Join(unstarred.body.IDs, ",") != "m1" {
+		t.Errorf("unstarred ids = %v, want [m1]", unstarred.body.IDs)
+	}
+	if strings.Join(unstarred.body.RemoveLabelIDs, ",") != "STARRED" {
+		t.Errorf("removed = %v, want [STARRED]", unstarred.body.RemoveLabelIDs)
+	}
+}
+
+func writeTestJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(v)
+}
+
 func mustParse(t *testing.T, raw string) *url.URL {
 	t.Helper()
 	u, err := url.Parse(raw)

internal/httpapi/inbound_hook_test.go

@@ -0,0 +1,194 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// doRaw sender en krop, der ikke er JSON — en genvej på en telefon sender ren
+// tekst, og en webhook-formular sender felter. Det er halvdelen af det, der
+// prøves her.
+func (ts *testServer) doRaw(t *testing.T, method, path, contentType, body string) (*http.Response, map[string]any) {
+	t.Helper()
+	req, err := http.NewRequest(method, ts.URL+path, strings.NewReader(body))
+	if err != nil {
+		t.Fatalf("build request: %v", err)
+	}
+	req.Header.Set("Content-Type", contentType)
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	t.Cleanup(func() { resp.Body.Close() })
+
+	var decoded map[string]any
+	raw, _ := io.ReadAll(resp.Body)
+	if len(raw) > 0 {
+		_ = json.Unmarshal(raw, &decoded)
+	}
+	return resp, decoded
+}
+
+// hookURL henter personens egen krog-adresse, som fladen viser den.
+func (ts *testServer) hookURL(t *testing.T) string {
+	t.Helper()
+	resp, out := ts.do(t, "GET", "/api/v1/hook-url", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("hent krog-URL: %d", resp.StatusCode)
+	}
+	url, _ := out["url"].(string)
+	if !strings.Contains(url, "/inbound/hook/") {
+		t.Fatalf("url = %q", url)
+	}
+	return url
+}
+
+// hookPath er stien, testserveren kan kaldes på — URL'en er absolut, fordi den
+// skal kunne kopieres ind i en genvej på en telefon.
+func hookPath(url string) string {
+	return url[strings.Index(url, "/inbound/hook/"):]
+}
+
+// En linje ren tekst, skubbet ind udefra, bliver til en opgave i indbakken — og
+// betyder det samme, som den ville betyde i feltet øverst i fladen.
+func TestAPushFromAnotherAppLandsInTheInbox(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	path := hookPath(ts.hookURL(t))
+
+	anon := newSignedOut(t, ts)
+	resp, out := anon.doRaw(t, "POST", path, "text/plain",
+		"Ring til Anders p1\nhan ringede i går")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("skub: %d, %v", resp.StatusCode, out)
+	}
+
+	_, list := ts.do(t, "GET", "/api/v1/tasks", nil)
+	tasks, _ := list["tasks"].([]any)
+	var found map[string]any
+	for _, raw := range tasks {
+		task := raw.(map[string]any)
+		if task["content"] == "Ring til Anders" {
+			found = task
+		}
+	}
+	if found == nil {
+		t.Fatalf("opgaven kom ikke i indbakken: %v", tasks)
+	}
+	// Parseren er den samme som fladens: p1 er en prioritet og ikke en del af
+	// teksten, og resten af kroppen står under opgaven.
+	if found["priority"] != float64(1) {
+		t.Errorf("prioritet = %v, want 1", found["priority"])
+	}
+	if found["description"] != "han ringede i går" {
+		t.Errorf("beskrivelse = %v", found["description"])
+	}
+}
+
+// JSON fra en tjeneste, med de feltnavne folk faktisk sender.
+func TestTheHookReadsJSON(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	path := hookPath(ts.hookURL(t))
+	anon := newSignedOut(t, ts)
+
+	for _, body := range []string{
+		`{"text": "Køb mælk"}`,
+		`{"title": "Køb mælk"}`,
+		`{"content": "Køb mælk"}`,
+	} {
+		resp, out := anon.doRaw(t, "POST", path, "application/json", body)
+		if resp.StatusCode != http.StatusCreated {
+			t.Fatalf("%s: %d, %v", body, resp.StatusCode, out)
+		}
+		if out["content"] != "Køb mælk" {
+			t.Errorf("%s gav %v", body, out["content"])
+		}
+	}
+
+	// En krop, der siger JSON og ikke er det, læses ikke som tekst bagefter: en
+	// opgave, der hedder `{"txt": …}`, er en dårligere fejlmeddelelse end et 422.
+	resp, _ := anon.doRaw(t, "POST", path, "application/json", `{"txt": "skrevet forkert"}`)
+	if resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Errorf("forkert JSON gav %d, want 422", resp.StatusCode)
+	}
+}
+
+// Et token, der ikke findes, er det samme svar som et, der aldrig har eksisteret.
+// Alt andet er en maskine til at gætte tokens med.
+func TestAnUnknownHookTokenIsNotFound(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	anon := newSignedOut(t, ts)
+
+	resp, _ := anon.doRaw(t, "POST", "/inbound/hook/deteringentingogsaaslet", "text/plain", "hej")
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("ukendt token gav %d, want 404", resp.StatusCode)
+	}
+}
+
+// Den gamle URL holder op med at virke, når man skifter den. Det er den eneste vej
+// tilbage: adressen står i en genvej på en telefon eller i et script.
+func TestRotatingTheHookRetiresTheOldURL(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	old := hookPath(ts.hookURL(t))
+
+	resp, out := ts.do(t, "POST", "/api/v1/hook-url/rotate", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("skift: %d", resp.StatusCode)
+	}
+	fresh := hookPath(out["url"].(string))
+	if fresh == old {
+		t.Fatal("den nye URL er den gamle")
+	}
+
+	anon := newSignedOut(t, ts)
+	if resp, _ := anon.doRaw(t, "POST", old, "text/plain", "gammel"); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("den gamle URL virker stadig: %d", resp.StatusCode)
+	}
+	if resp, _ := anon.doRaw(t, "POST", fresh, "text/plain", "ny"); resp.StatusCode != http.StatusCreated {
+		t.Errorf("den nye URL virker ikke: %d", resp.StatusCode)
+	}
+}
+
+// Ingen tekst er ikke en opgave. En tom opgave i indbakken er værre end en fejl,
+// fordi den ser ud som om integrationen virker.
+func TestAnEmptyPushIsRefused(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	path := hookPath(ts.hookURL(t))
+	anon := newSignedOut(t, ts)
+
+	resp, _ := anon.doRaw(t, "POST", path, "text/plain", "   \n  ")
+	if resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Fatalf("tom tekst gav %d, want 422", resp.StatusCode)
+	}
+}
+
+// Et token kan én ting. Det ligger i et script på en anden maskine, og hvad der
+// ellers kan nås med det, er hvad der er sluppet ud sammen med det.
+func TestTheHookTokenIsNotAnAPIToken(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	url := ts.hookURL(t)
+	token := url[strings.LastIndex(url, "/")+1:]
+
+	anon := newSignedOut(t, ts)
+	req, err := http.NewRequest("GET", anon.URL+"/api/v1/tasks", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := anon.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusOK {
+		t.Fatal("krog-tokenet gav adgang til API'et")
+	}
+}

internal/httpapi/integrations_handlers.go

@@ -2,7 +2,9 @@ package httpapi
 
 import (
 	"encoding/json"
+	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -155,6 +157,191 @@ func (s *Server) handleInboundMail(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusCreated, map[string]string{"task_id": task.ID})
 }
 
+// --- en krog ind i indbakken --------------------------------------------------------
+
+type hookURLResponse struct {
+	URL string `json:"url"`
+}
+
+// handleGetHookURL returns the personal address another program can push a task
+// to, minting the token on first ask.
+//
+// Der var to veje ind i forvejen, og ingen af dem passer til "gem den her, mens
+// jeg står med telefonen i hånden". API-tokenet giver adgang til alt og skal have
+// en JSON-krop skrevet rigtigt; mailadressen virker først, når nogen har sat en
+// mailserver op. Det, der manglede, var en URL, man kan smide en linje tekst efter
+// — fra en genvej på telefonen, et script, en anden tjeneste.
+func (s *Server) handleGetHookURL(w http.ResponseWriter, r *http.Request) {
+	token, err := s.db.EnsureHookToken(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "hook token", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, hookURLResponse{URL: s.hookURL(token)})
+}
+
+// handleRotateHookURL mints a new one and retires the old.
+//
+// Den eneste vej tilbage, når en URL er sluppet ud: den står i en genvej på en
+// telefon eller i et script på en anden maskine, og der er ikke andet at trække
+// tilbage end tokenet selv.
+func (s *Server) handleRotateHookURL(w http.ResponseWriter, r *http.Request) {
+	token, err := auth.NewToken()
+	if err != nil {
+		s.internal(w, r, "generate hook token", err)
+		return
+	}
+	if err := s.db.SetHookToken(r.Context(), userFrom(r.Context()).ID, token); err != nil {
+		s.internal(w, r, "set hook token", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, hookURLResponse{URL: s.hookURL(token)})
+}
+
+func (s *Server) hookURL(token string) string {
+	return strings.TrimSuffix(s.cfg.BaseURL, "/") + "/inbound/hook/" + token
+}
+
+type hookRequest struct {
+	// Text er linjen, der bliver til opgaven. `title` og `content` tages med som
+	// de samme, fordi det er dem, andre tjenester i forvejen kalder feltet — og en
+	// integration, der fejler på et feltnavn, fejler tavst hos den, der satte den
+	// op.
+	Text    string `json:"text"`
+	Title   string `json:"title"`
+	Content string `json:"content"`
+	// Note er det, der står under opgaven. `body` og `description` ligeså.
+	Note        string `json:"note"`
+	Body        string `json:"body"`
+	Description string `json:"description"`
+}
+
+func (h hookRequest) line() string {
+	for _, v := range []string{h.Text, h.Title, h.Content} {
+		if strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func (h hookRequest) note() string {
+	for _, v := range []string{h.Note, h.Body, h.Description} {
+		if strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// handleInboundHook turns a POST from somewhere else into a task in the inbox.
+//
+// Tokenet i stien er hele legitimationen, som i kalenderfeedet og den indgående
+// post: den, der kalder, er et script eller en genvej på en telefon, og hverken
+// kan logge ind. Derfor kan et token herfra også kun én ting — lave en opgave i
+// den ene persons indbakke — hvor et API-token kan alt.
+//
+// Kroppen læses på tre måder, fordi de tre er dem, man møder: JSON fra en
+// tjeneste, et formularfelt fra en webhook-formular, og ren tekst fra en genvej,
+// der bare sender det, man har markeret. Første linje bliver til opgaven, resten
+// til noten under den — det er sådan, en tekst, man har delt, ser ud.
+//
+// Linjen læses med quick-add-parseren, så "Ring til Anders i morgen p1 #Firma"
+// betyder det samme her som i feltet øverst i fladen. Det er hele pointen med at
+// have én parser: den vej, teksten kom ind ad, ændrer ikke, hvad den betyder.
+func (s *Server) handleInboundHook(w http.ResponseWriter, r *http.Request) {
+	user, err := s.db.UserByHookToken(r.Context(), chi.URLParam(r, "token"))
+	if err != nil {
+		// Samme svar som en adresse, der aldrig har eksisteret: et endpoint, der
+		// kender forskel, er en maskine til at gætte tokens med.
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such address")
+		return
+	}
+
+	line, note := s.readHookBody(r)
+	if strings.TrimSpace(line) == "" {
+		writeFieldErrors(w, map[string]string{"text": "required"})
+		return
+	}
+
+	parsed := quickadd.Parse(line, time.Now().In(userLocation(user.Timezone)), user.Locale)
+	content := parsed.Content
+	if strings.TrimSpace(content) == "" {
+		content = line
+	}
+
+	projectID := ""
+	if parsed.Project != "" {
+		if id, err := s.db.ProjectByName(r.Context(), user.ID, parsed.Project); err == nil {
+			projectID = id
+		}
+	}
+	if projectID == "" {
+		if projectID, err = s.db.InboxID(r.Context(), user.ID); err != nil {
+			s.internal(w, r, "inbox", err)
+			return
+		}
+	}
+
+	task := &store.Task{
+		ProjectID: projectID, Content: content, Priority: parsed.Priority,
+		Description: strings.TrimSpace(note), DueDate: parsed.DueDate,
+		RecurrenceRule: parsed.Recurrence, CreatedBy: user.ID,
+	}
+	if err := s.db.CreateTask(r.Context(), task, parsed.Labels); err != nil {
+		s.internal(w, r, "create task from hook", err)
+		return
+	}
+
+	s.publish(projectID, "task.created", toTaskJSON(*task))
+	s.log.Info("task created from hook", "user", user.ID)
+	writeJSON(w, http.StatusCreated, map[string]string{"task_id": task.ID, "content": task.Content})
+}
+
+// readHookBody er de tre måder, en linje tekst kommer ind ad.
+//
+// Rækkefølgen er efter, hvor sikkert man ved, hvad man har: en erklæret
+// Content-Type tros, og ellers falder det tilbage på ren tekst — som er det, en
+// genvej på en telefon sender, når den ikke er blevet bedt om andet.
+//
+// En krop, der siger JSON, men ikke er det, læses ikke som tekst bagefter. Den,
+// der satte integrationen op, har skrevet noget forkert, og en opgave, der hedder
+// `{"txt": "køb mælk"}`, er en dårligere måde at finde ud af det på end et 422.
+func (s *Server) readHookBody(r *http.Request) (line, note string) {
+	const maxBody = 64 << 10
+	body, err := io.ReadAll(io.LimitReader(r.Body, maxBody))
+	if err != nil {
+		return "", ""
+	}
+	kind := r.Header.Get("Content-Type")
+
+	switch {
+	case strings.Contains(kind, "application/json"):
+		var req hookRequest
+		if err := json.Unmarshal(body, &req); err != nil {
+			return "", ""
+		}
+		return req.line(), req.note()
+
+	case strings.Contains(kind, "application/x-www-form-urlencoded"):
+		values, err := url.ParseQuery(string(body))
+		if err != nil {
+			return "", ""
+		}
+		req := hookRequest{
+			Text: values.Get("text"), Title: values.Get("title"), Content: values.Get("content"),
+			Note: values.Get("note"), Body: values.Get("body"), Description: values.Get("description"),
+		}
+		return req.line(), req.note()
+	}
+
+	// Ren tekst: første linje er opgaven, resten står under den. Sådan ser en tekst,
+	// man har delt fra en anden app, ud — en overskrift og noget under.
+	text := strings.TrimSpace(string(body))
+	first, rest, _ := strings.Cut(text, "\n")
+	return first, strings.TrimSpace(rest)
+}
+
 // mailToken reads the token out of "Name <todo+TOKEN@domain>".
 func mailToken(address string) string {
 	if i := strings.LastIndex(address, "<"); i >= 0 {

internal/httpapi/mcp_handlers.go

@@ -527,7 +527,9 @@ func (s *Server) registerNoteTools(m *mcp.Server) {
 			"is lost. Two things in the text are read out of it and become links: " +
 			"`#Projekt` files the note against that project, so it appears on the " +
 			"project's page without anybody filing it there, and `[[Another note]]` " +
-			"links to a note by its title. Use this to bring notes in from elsewhere — " +
+			"links to a note by its title. A third, `@Navn`, shares the note with that " +
+			"person and tells them — so only write one when the note is meant for them. " +
+			"Use this to bring notes in from elsewhere — " +
 			"Apple Notes, OneNote, a folder of Markdown — one call per note.",
 		InputSchema: mcp.Schema(map[string]any{
 			"body":       mcp.Str("The note as Markdown. Its first line becomes the title, so start with one. #Projekt and [[note]] become links."),

internal/httpapi/notes_handlers.go

@@ -19,21 +19,38 @@ import (
 
 // Notes.
 //
-// Access follows the project, because that is where a note lives: a note in a
-// shared project is readable by everybody who can read the project and writable
-// by an editor. A note with no project is its author's alone — the same answer a
-// task in the inbox gets, arrived at the same way rather than by a rule of its own.
+// Access has three ways in, and a note may have any of them at once. A note with
+// no project is its author's alone — the same answer a task in the inbox gets. A
+// note in a project is readable by everyone who can read the project and writable
+// by an editor. And a note can be shared with a person directly, which grants that
+// person a role of its own. The effective role is the most any of the three allow.
 
-// mayReadNote reports whether this person may see the note, and mayWriteNote
-// whether they may change it. Split, because a viewer on a shared project can do
-// the first and not the second.
+// mayTouchNote reports whether this person may act on the note at the given role —
+// RoleViewer to read, RoleEditor to change. Split by role because a viewer, whether
+// on a shared project or a shared note, may do the first and not the second.
 func (s *Server) mayTouchNote(r *http.Request, n *store.Note, role store.Role) bool {
 	user := userFrom(r.Context())
+	// The owner and the project path, exactly as before.
 	if n.ProjectID == "" {
-		return n.CreatedBy == user.ID
+		if n.CreatedBy == user.ID {
+			return true
+		}
+	} else if _, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, role); err == nil {
+		return true
 	}
-	_, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, role)
-	return err == nil
+	// A direct share grants its role on top of whatever the above allow.
+	if shareRole, ok, err := s.db.NoteShareRole(r.Context(), n.ID, user.ID); err == nil && ok {
+		return shareRole.AtLeast(role)
+	}
+	return false
+}
+
+// ownsNote reports whether this person is the note's owner — its created_by — which
+// is who, and only who, may hand it to other people. An editor on a shared note can
+// change its text; giving away access is the owner's alone, the same shape a
+// project takes where members edit but only the owner invites.
+func (s *Server) ownsNote(r *http.Request, n *store.Note) bool {
+	return n != nil && n.CreatedBy == userFrom(r.Context()).ID
 }
 
 func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
@@ -48,7 +65,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "search notes", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(s.readable(r, found))})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(s.readable(r, found)))})
 		return
 	}
 
@@ -62,7 +79,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "notes in project", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 		return
 	}
 
@@ -75,7 +92,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "list archived notes", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 		return
 	}
 
@@ -87,7 +104,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "list notes", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+	writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 }
 
 // briefly replaces each note's body with the first of it.
@@ -187,9 +204,152 @@ func (s *Server) handleCreateNote(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "create note", err)
 		return
 	}
+	// En ny note kan være den, en delt note hele tiden har peget på: linket er
+	// skrevet som en titel, og titlen fandtes ikke før nu.
+	//
+	// Kun når der står noget i den. En tom note har ingen titel, og et link peger på
+	// en titel — så der er intet at regne, og det kostede alligevel: udregningen
+	// åbner hver eneste af ejerens noter, og den lå her mellem "Ny note" og det
+	// svar, fladen venter på for at kunne tegne editoren. Halvfems millisekunder er
+	// nok til at nå at taste den første linje ind i den forrige note, som så blev
+	// tegnet væk. Målt i e2e-prøven for monospace, der begyndte at tabe sin titel.
+	if strings.TrimSpace(n.Body) != "" {
+		s.followLinks(r, n)
+		s.shareWithMentioned(r, n, "")
+	}
 	writeJSON(w, http.StatusCreated, n)
 }
 
+// followLinks holder de udledte delinger i takt med teksten.
+//
+// De noter, en delt note peger på, følger med — og teksten kan ændre sig, efter
+// delingen er sat. Et link skrevet i dag i en note, der blev delt i går, skal føre
+// samme sted hen for begge.
+//
+// Kun ejerens egne gemninger regner om, og det er ikke en optimering. Et link
+// peger på en titel, og en medredaktør må skrive i teksten — så hvis enhver
+// gemning talte med, kunne den, man har delt en note med, skrive
+// `[[Bankoplysninger]]` ind i den og dermed dele den med sig selv.
+//
+// Det lukker ikke hullet helt, og det skal siges frem for at lyde lukket: skriver
+// medredaktøren linket, og gemmer ejeren bagefter sin egen note, følger den note
+// med dér. Det, der står tilbage mod det, er synlighed — linket står som tekst i
+// ejerens egen note, og delingspanelet viser hver note, der er fulgt med, og hvem
+// der har den. En stille eskalering er det ikke; en, man kan overse, er den.
+//
+// Fejler det, siges det i loggen og ikke til den, der gemte: noten *er* gemt, og
+// et svar, der lyder som om den ikke er, ville få dem til at skrive den igen.
+func (s *Server) followLinks(r *http.Request, n *store.Note) {
+	if n == nil || n.CreatedBy != userFrom(r.Context()).ID {
+		return
+	}
+	if _, err := s.db.SyncLinkedShares(r.Context(), n.CreatedBy); err != nil {
+		s.log.Error("sync linked shares", "err", err, "note", n.ID)
+	}
+}
+
+// shareWithMentioned deler noten med dem, der er skrevet ind i den med et @.
+//
+// At nævne nogen i en note *er* at ville have dem til at læse den. Indtil nu var
+// det to handlinger — skriv navnet, åbn panelet, find personen, del — og den
+// anden blev glemt, så noten stod med en besked til en, der ikke kunne se den.
+//
+// Kun nye omtaler. Sammenlignet med teksten før gemningen på nøjagtig samme måde
+// som links, fordi en note gemmes ved hver tastepause: uden sammenligningen ville
+// hver eneste gemning være en ny deling og en ny besked om det samme navn.
+//
+// Kun ejerens omtaler deler. En medredaktør må skrive i noten, men ikke give den
+// videre — ellers kunne den, ejeren har delt med, skrive et navn og dermed dele
+// ejerens note med en, ejeren aldrig har hørt om. Det er den samme regel, panelet
+// følger: kun ejeren deler. En medredaktørs omtale er derfor tekst, og den giver
+// kun besked til en, der kan se noten i forvejen.
+//
+// Læser, ikke medredaktør. En omtale siger "se på det her", og det mindste, der
+// opfylder sætningen, er det rigtige at give — resten kan ejeren hæve i panelet,
+// og en rolle, der er hævet dér, sænkes ikke igen af en omtale.
+// Returnerer dem, der fik besked om omtalen, så den samme gemning ikke også
+// fortæller dem, at noten er blevet rettet.
+func (s *Server) shareWithMentioned(r *http.Request, n *store.Note, before string) map[string]bool {
+	told := map[string]bool{}
+	if n == nil || n.CreatedBy == "" {
+		return told
+	}
+	// Slået op mod alle konti på instansen — det er dem, noten kan deles med, og
+	// derfor dem, et navn kan betyde. Ejeren selv er ikke iblandt: en note kan ikke
+	// deles med den, der har den.
+	people, err := s.db.UsersForSharing(r.Context(), n.CreatedBy)
+	if err != nil {
+		s.log.Warn("people for mentions", "err", err, "note", n.ID)
+		return told
+	}
+
+	was := map[string]bool{}
+	for _, id := range store.MentionsIn(before, people) {
+		was[id] = true
+	}
+	fresh := []string{}
+	for _, id := range store.MentionsIn(n.Body, people) {
+		if !was[id] {
+			fresh = append(fresh, id)
+		}
+	}
+	if len(fresh) == 0 {
+		return told
+	}
+
+	actor := userFrom(r.Context())
+	owner := actor.ID == n.CreatedBy
+	shared := false
+	for _, id := range fresh {
+		if !owner {
+			continue
+		}
+		// En rolle, der allerede er sat, står. Omtalen skal give adgang til den, der
+		// ikke har nogen — ikke sætte en medredaktør ned til læser, fordi ejeren
+		// skrev deres navn i teksten.
+		if _, has, err := s.db.NoteShareRole(r.Context(), n.ID, id); err != nil {
+			s.log.Warn("mention share role", "err", err, "note", n.ID)
+			continue
+		} else if has {
+			continue
+		}
+		if err := s.db.ShareNote(r.Context(), n.ID, id, store.RoleViewer, actor.ID); err != nil {
+			s.log.Warn("share with mentioned", "err", err, "note", n.ID)
+			continue
+		}
+		shared = true
+	}
+	if shared {
+		// Og det, noten peger på, følger med delingen — samme vej som en deling
+		// sat i panelet.
+		s.followLinks(r, n)
+	}
+
+	// Besked til dem, der kan se noten. Efter delingen, så den, omtalen lige har
+	// givet adgang, er med — og kun til dem, så en medredaktørs omtale af en
+	// fremmed ikke bliver en besked om en note, de ikke kan åbne.
+	audience, err := s.db.NoteAudience(r.Context(), n.ID)
+	if err != nil {
+		s.log.Warn("note audience for mention", "err", err, "note", n.ID)
+		return told
+	}
+	canSee := map[string]bool{}
+	for _, id := range audience {
+		canSee[id] = true
+	}
+	for _, id := range fresh {
+		if !canSee[id] {
+			continue
+		}
+		s.notify(r, &store.Notification{
+			UserID: id, ActorID: actor.ID, ProjectID: n.ProjectID, NoteID: n.ID,
+			Kind: "note.mention", Title: actor.Name + " nævnte dig i en note", Body: n.Title,
+		})
+		told[id] = true
+	}
+	return told
+}
+
 func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 	var body noteBody
 	if err := decodeJSON(w, r, &body); err != nil {
@@ -206,9 +366,16 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if body.ProjectID != nil {
-		// Moving it means being allowed on both sides: you cannot file somebody
-		// else's note into your project, nor yours into theirs.
+	if body.ProjectID != nil && *body.ProjectID != n.ProjectID {
+		// Filing a note is the owner's call, not an editor's. A shared editor may
+		// change the text; letting them also move the note would let them file
+		// somebody else's note into a project the owner is not in — and the owner,
+		// who is not a member there, would lose their own note. So the move is
+		// owner-only, and then only into a project the owner may write to.
+		if !s.ownsNote(r, n) {
+			writeError(w, http.StatusForbidden, CodeForbidden, "only the note's owner can move it")
+			return
+		}
 		if *body.ProjectID != "" {
 			if _, err := store.RequireProjectRole(r.Context(), s.db, *body.ProjectID,
 				userFrom(r.Context()).ID, store.RoleEditor); err != nil {
@@ -218,6 +385,7 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		}
 		n.ProjectID = *body.ProjectID
 	}
+	before := n.Body
 	if body.Body != nil {
 		n.Body = *body.Body
 	}
@@ -225,20 +393,67 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		n.Pinned = *body.Pinned
 	}
 
+	// Læst før gemningen, sammenlignet efter. En gemning er en tastepause, ikke en
+	// begivenhed, så de fleste af dem ændrer intet af det her — og udregningen
+	// åbner hver eneste af ejerens noter, fordi titlerne er forseglet. Den skal
+	// køre, når svaret kan være blevet et andet, og ellers ikke.
+	wasLinking := store.LinksIn(before)
+	wasTitled := n.Title
+
 	if err := s.db.SaveNote(r.Context(), n); err != nil {
 		s.internal(w, r, "update note", err)
 		return
 	}
+	// Titlen tæller med: den *er* første linje, så en omskrevet overskrift flytter
+	// det, andres links peger på, uden at et eneste link er rørt.
+	if n.Title != wasTitled || !sameLinks(wasLinking, store.LinksIn(n.Body)) {
+		s.followLinks(r, n)
+	}
+	// Kun når teksten har flyttet sig. En note, der bliver stjernemarkeret eller
+	// lagt i et projekt, er ikke en note, nogen har skrevet i — og en besked om
+	// det ville lære folk at overse dem alle sammen.
+	if before != n.Body {
+		// Omtalerne først. Den, der lige er blevet nævnt, skal have "nævnte dig" og
+		// ikke også "rettede en note" om den samme gemning — det er én handling, og
+		// den ene sætning siger mere end den anden.
+		mentioned := s.shareWithMentioned(r, n, before)
+		s.notifyNoteChanged(r, n, mentioned)
+	}
 	writeJSON(w, http.StatusOK, n)
 }
 
+func sameLinks(a, b []store.NoteLink) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	in := make(map[store.NoteLink]bool, len(a))
+	for _, l := range a {
+		in[l] = true
+	}
+	for _, l := range b {
+		if !in[l] {
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) handleDeleteNote(w http.ResponseWriter, r *http.Request) {
 	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
 	if err != nil {
 		s.internal(w, r, "delete note", err)
 		return
 	}
-	if n == nil || !s.mayTouchNote(r, n, store.RoleEditor) {
+	// Deleting is not editing. Someone the note was shared with — even as an editor
+	// — may change its text, but throwing away the owner's note is the owner's to
+	// do. A project editor keeps the reach they have always had over a project's
+	// notes; a direct share does not extend that far.
+	mayDelete := s.ownsNote(r, n)
+	if !mayDelete && n != nil && n.ProjectID != "" {
+		_, perr := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, userFrom(r.Context()).ID, store.RoleEditor)
+		mayDelete = perr == nil
+	}
+	if n == nil || !mayDelete {
 		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
 		return
 	}
@@ -246,6 +461,9 @@ func (s *Server) handleDeleteNote(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "delete note", err)
 		return
 	}
+	// En note i papirkurven er ikke længere et udgangspunkt for noget. Det, den tog
+	// med sig, skal derfor heller ikke blive stående hos dem, den blev delt med.
+	s.followLinks(r, n)
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -280,6 +498,18 @@ func (s *Server) handleExportNotes(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Oldest first, and the id to break a tie. AllNotes comes back newest-first by
+	// the second, so two notes made in the same second have no order between them —
+	// and then which of two same-titled notes gets the plain name and which gets
+	// "(2)" is a coin toss that lands differently each export. Ordering the whole
+	// thing by when it was made settles it: the first note of a name keeps the name.
+	sort.SliceStable(notes, func(i, j int) bool {
+		if notes[i].CreatedAt.Equal(notes[j].CreatedAt) {
+			return notes[i].ID < notes[j].ID
+		}
+		return notes[i].CreatedAt.Before(notes[j].CreatedAt)
+	})
+
 	w.Header().Set("Content-Type", "application/zip")
 	w.Header().Set("Content-Disposition",
 		`attachment; filename="verdande-noter-`+time.Now().Format("2006-01-02")+`.zip"`)

internal/httpapi/notes_invite_test.go

@@ -0,0 +1,186 @@
+package httpapi
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// Hele vejen: ejeren deler en note med en adresse, der ikke har nogen konto, og
+// den, der tager imod invitationen, har noten fra det øjeblik, kontoen findes.
+func TestANoteCanBeSharedWithSomebodyWhoHasNoAccount(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	noteID := owner.createNote(t, "# Aftale om levering\nfredag kl. 9")
+
+	resp, body := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "sofie@example.dk", "role": "editor"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("invite by email: status %d, body %v", resp.StatusCode, body)
+	}
+	invited, _ := body["invited"].(map[string]any)
+	if invited == nil || invited["email"] != "sofie@example.dk" {
+		t.Fatalf("the response does not say who was invited: %v", body)
+	}
+	if invited["role"] != "editor" {
+		t.Errorf("role = %v, want the one the owner chose", invited["role"])
+	}
+	// Uden en postserver er linket det eneste, der findes, og det skal stå i
+	// svaret frem for at blive lovet i en mail, der ikke kom af sted.
+	if body["emailed"] != false {
+		t.Errorf("emailed = %v, want false with no mail server configured", body["emailed"])
+	}
+	link, _ := body["link"].(string)
+	if !strings.Contains(link, "token=") {
+		t.Fatalf("link = %q, want one carrying a token", link)
+	}
+
+	// Den venter i panelet under noten, så ejeren kan se, at den er sendt.
+	_, panel := owner.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil)
+	pending, _ := panel["invites"].([]any)
+	if len(pending) != 1 {
+		t.Fatalf("want one pending invite under the note, got %v", pending)
+	}
+
+	// Og linket laver kontoen og delingen i ét.
+	token := link[strings.Index(link, "token=")+len("token="):]
+	fresh := newSignedOut(t, owner)
+	resp, _ = fresh.do(t, "POST", "/api/v1/auth/signup", map[string]any{
+		"token": token, "name": "Sofie", "password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		t.Fatalf("signup with the note invite: status %d", resp.StatusCode)
+	}
+
+	// Noten er hendes at læse — og som medredaktør også at rette.
+	resp, note := fresh.do(t, "GET", "/api/v1/notes/"+noteID, nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("the invited person cannot read the note: status %d", resp.StatusCode)
+	}
+	if note["title"] != "Aftale om levering" {
+		t.Errorf("the invited person got something else: %v", note)
+	}
+	resp, _ = fresh.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]string{"body": "# Aftale om levering\nfredag kl. 10"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("an invited editor cannot write: status %d", resp.StatusCode)
+	}
+
+	// Og invitationen er brugt op: den står ikke længere og venter.
+	_, after := owner.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil)
+	if left, _ := after["invites"].([]any); len(left) != 0 {
+		t.Errorf("the invite is still pending after it was accepted: %v", left)
+	}
+	shares, _ := after["shares"].([]any)
+	if len(shares) != 1 {
+		t.Fatalf("want the accepted invite to be a share, got %v", shares)
+	}
+}
+
+// En adresse, der viser sig at høre til en konto, er den konto — ikke en
+// invitation til at oprette en, som personen aldrig kan komme igennem.
+func TestSharingByEmailFindsAnExistingAccount(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+	noteID := owner.createNote(t, "# Prisliste\n2026")
+
+	resp, body := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "Sofie@Example.dk"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("share with an existing address: status %d, body %v", resp.StatusCode, body)
+	}
+	person, _ := body["user"].(map[string]any)
+	if person == nil || person["id"] != sofie {
+		t.Fatalf("the response does not say who it reached: %v", body)
+	}
+	if _, invited := body["invited"]; invited {
+		t.Error("an address with an account was invited rather than shared with")
+	}
+
+	role, _, err := owner.db.NoteShareRole(t.Context(), noteID, sofie)
+	if err != nil || role != "viewer" {
+		t.Fatalf("share role = %v (%v), want viewer by default", role, err)
+	}
+}
+
+// To links til den samme indbakke er ikke en invitation mere: det er to, der gør
+// det samme, og kun det ene kan trækkes tilbage ad gangen.
+func TestASecondInviteToTheSameNoteIsRefused(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	noteID := owner.createNote(t, "# Bankoplysninger\nkonto")
+
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "ny@example.dk"}); resp.StatusCode != http.StatusCreated {
+		t.Fatalf("first invite: status %d", resp.StatusCode)
+	}
+	resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "ny@example.dk"})
+	if resp.StatusCode != http.StatusConflict {
+		t.Fatalf("second invite: status %d, want 409", resp.StatusCode)
+	}
+
+	// Trukket tilbage kan den derimod, og så kan der sendes en ny.
+	_, panel := owner.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil)
+	pending, _ := panel["invites"].([]any)
+	id := pending[0].(map[string]any)["id"].(string)
+	if resp, _ := owner.do(t, "DELETE", "/api/v1/notes/"+noteID+"/invites/"+id, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("withdraw: status %d", resp.StatusCode)
+	}
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "ny@example.dk"}); resp.StatusCode != http.StatusCreated {
+		t.Fatalf("invite again after withdrawing: status %d", resp.StatusCode)
+	}
+}
+
+// Kun ejeren. En medlæser, der kunne invitere, ville kunne give noten videre til
+// nogen, ejeren aldrig har hørt om — og til en konto, der ikke fandtes før.
+func TestOnlyTheOwnerCanInviteToANote(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+	noteID := owner.createNote(t, "# Ferieplan\nuge 29")
+
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("share: status %d", resp.StatusCode)
+	}
+
+	resp, _ := other.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"email": "fremmed@example.dk"})
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("an editor could invite somebody: status %d", resp.StatusCode)
+	}
+	if n, err := owner.db.ListNoteInvites(t.Context(), noteID); err != nil || len(n) != 0 {
+		t.Fatalf("invites = %v (%v), want none", n, err)
+	}
+}
+
+// En invitation til én note kan ikke bruges til at rydde en anden notes
+// invitationer af vejen: note-id'et er en del af WHERE, ikke et tjek udenom.
+func TestANoteInviteCannotBeWithdrawnThroughAnotherNote(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	mine := owner.createNote(t, "# Min note\n1")
+	other := owner.createNote(t, "# Min anden note\n2")
+
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+mine+"/shares",
+		map[string]string{"email": "ny@example.dk"}); resp.StatusCode != http.StatusCreated {
+		t.Fatal("invite failed")
+	}
+	invites, err := owner.db.ListNoteInvites(t.Context(), mine)
+	if err != nil || len(invites) != 1 {
+		t.Fatalf("invites = %v (%v)", invites, err)
+	}
+
+	resp, _ := owner.do(t, "DELETE", "/api/v1/notes/"+other+"/invites/"+invites[0].ID, nil)
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("status %d, want 404 for another note's invite", resp.StatusCode)
+	}
+	if left, _ := owner.db.ListNoteInvites(t.Context(), mine); len(left) != 1 {
+		t.Error("the invite was withdrawn through a note it does not belong to")
+	}
+}

internal/httpapi/notes_mention_test.go

@@ -0,0 +1,132 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// At nævne nogen i en note er at ville have dem til at læse den: omtalen deler
+// noten, og den, der bliver nævnt, får besked om det.
+func TestMentioningSomebodySharesTheNote(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Aftale om levering\nikke noget endnu")
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("noten var læselig før omtalen: %d", resp.StatusCode)
+	}
+
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale om levering\n@Sofie kan du kigge på det?"}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("ret noten: %d", resp.StatusCode)
+	}
+
+	// Delt, som læser.
+	role, has, err := owner.db.NoteShareRole(t.Context(), noteID, sofie)
+	if err != nil || !has || role != "viewer" {
+		t.Fatalf("deling = %v (findes: %v, fejl: %v), want viewer", role, has, err)
+	}
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusOK {
+		t.Fatalf("den omtalte kan ikke læse noten: %d", resp.StatusCode)
+	}
+
+	// Og sagt til — med omtalen som beskeden, ikke "rettede en note". Det er én
+	// handling, og den ene sætning siger mere end den anden.
+	list, unread := notifications(t, other)
+	if len(list) != 1 || unread != 1 {
+		t.Fatalf("Sofie fik %d beskeder (%v ulæste), want 1", len(list), unread)
+	}
+	if n := firstOf(t, list); n["kind"] != "note.mention" || n["note_id"] != noteID {
+		t.Errorf("besked = %v", n)
+	}
+}
+
+// En gemning mere med det samme navn i er ikke en omtale mere. En note gemmes ved
+// hver tastepause, så uden det bliver fem minutters skriveri til tyve beskeder.
+func TestTheSameMentionOnlyCountsOnce(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+
+	noteID := owner.createNote(t, "# Aftale\n@Sofie kigger")
+	// Omtalen stod i noten fra begyndelsen: den tæller ved oprettelsen.
+	if list, _ := notifications(t, other); len(list) != 1 {
+		t.Fatalf("en omtale i en ny note gav %d beskeder, want 1", len(list))
+	}
+
+	for i := 0; i < 3; i++ {
+		if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+			map[string]any{"body": "# Aftale\n@Sofie kigger på linje " + string(rune('a'+i))}); resp.StatusCode != http.StatusOK {
+			t.Fatal("ret noten")
+		}
+	}
+	// Tre gemninger mere: én besked om rettelserne, slået sammen, og ikke tre
+	// omtaler mere.
+	list, _ := notifications(t, other)
+	if len(list) != 2 {
+		t.Fatalf("tre gemninger med det samme navn gav %d beskeder, want 2", len(list))
+	}
+	if firstOf(t, list)["kind"] != "note.changed" {
+		t.Errorf("den nyeste besked = %v, want note.changed", firstOf(t, list))
+	}
+}
+
+// En medredaktør må skrive i noten, men ikke give den videre. Ellers kunne den,
+// ejeren har delt med, skrive et navn og dele ejerens note med en fremmed.
+func TestAnEditorsMentionDoesNotShareTheNote(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	editor := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+	peterClient := owner.newUser(t, "peter@example.dk", "Peter")
+	peter := userID(t, owner, "peter@example.dk")
+
+	noteID := owner.createNote(t, "# Aftale\nintet")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("del noten")
+	}
+
+	if resp, _ := editor.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale\n@Peter ved det"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("medredaktøren retter")
+	}
+
+	if _, has, err := owner.db.NoteShareRole(t.Context(), noteID, peter); err != nil || has {
+		t.Errorf("en medredaktørs omtale delte ejerens note (findes: %v, fejl: %v)", has, err)
+	}
+	// Og Peter får ikke besked om en note, han ikke kan åbne.
+	if list, _ := notifications(t, peterClient); len(list) != 0 {
+		t.Errorf("Peter fik %d beskeder om en note, han ikke kan se", len(list))
+	}
+	// Ejeren hører derimod, at der er skrevet i noten — det er stadig en rettelse.
+	if list, _ := notifications(t, owner); len(list) == 0 {
+		t.Error("ejeren hørte ikke, at medredaktøren skrev i noten")
+	}
+}
+
+// Rollen står. En omtale skal give adgang til den, der ikke har nogen — ikke
+// sætte en medredaktør ned til læser, fordi ejeren skrev deres navn.
+func TestAMentionDoesNotLowerAnExistingRole(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Aftale\nintet")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("del noten")
+	}
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale\n@Sofie retter selv"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("ret noten")
+	}
+
+	role, _, err := owner.db.NoteShareRole(t.Context(), noteID, sofie)
+	if err != nil || role != "editor" {
+		t.Errorf("rolle = %v (%v), want editor uændret", role, err)
+	}
+}

internal/httpapi/notes_share_handlers.go

@@ -0,0 +1,388 @@
+package httpapi
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// markShared fills in the two fields the list needs to show a note somebody else
+// shared with the reader: that it is such a note, and whose it is.
+//
+// Done in one pass over the page rather than per note: one query asks which of
+// these ids are shared with the reader, and one asks for the owners' names and
+// colours. A note the reader owns is never "shared with me", however it was
+// reached — the group is other people's notes, not one's own.
+func (s *Server) markShared(r *http.Request, notes []store.Note) []store.Note {
+	me := userFrom(r.Context()).ID
+	if len(notes) == 0 {
+		return notes
+	}
+
+	ids := make([]string, 0, len(notes))
+	for _, n := range notes {
+		if n.CreatedBy != me {
+			ids = append(ids, n.ID)
+		}
+	}
+	shared, err := s.db.NotesSharedWith(r.Context(), me, ids)
+	if err != nil {
+		// The list is worth more than the chip: a note without its "shared" mark
+		// still reads and still opens. Log nothing here — the store already did.
+		return notes
+	}
+
+	owners := map[string]store.Person{}
+	if len(shared) > 0 {
+		ownerIDs := make([]string, 0, len(shared))
+		for _, n := range notes {
+			if shared[n.ID] && n.CreatedBy != "" {
+				ownerIDs = append(ownerIDs, n.CreatedBy)
+			}
+		}
+		owners, _ = s.db.PeopleByIDs(r.Context(), ownerIDs)
+	}
+
+	for i := range notes {
+		if !shared[notes[i].ID] {
+			continue
+		}
+		notes[i].SharedWithMe = true
+		if p, ok := owners[notes[i].CreatedBy]; ok {
+			owner := p
+			notes[i].Owner = &owner
+		}
+	}
+	return notes
+}
+
+// handleListNoteShares is who a note is shared with. Owner only: the list of people
+// who can see your note is itself something only you should see.
+func (s *Server) handleListNoteShares(w http.ResponseWriter, r *http.Request) {
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	// 404, not 403: telling a stranger "not yours" still confirms the note exists.
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+
+	shares, err := s.db.ListNoteShares(r.Context(), n.ID)
+	if err != nil {
+		s.internal(w, r, "list note shares", err)
+		return
+	}
+	// Regnet forfra, én gang, og læst to veje ud af det samme svar: hvem der har
+	// *denne* note, fordi en anden peger på den, og hvilke noter der omvendt følger
+	// med den her. To udregninger af det samme er to, der kan blive uenige.
+	//
+	// Og forfra frem for læst af basen, så panelet viser det, der gælder nu — også
+	// når linkene er skrevet af en anden og delingerne derfor ikke er regnet om
+	// siden.
+	following, err := s.db.SyncLinkedShares(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "sync linked shares", err)
+		return
+	}
+	via := map[string]string{}
+	for _, l := range following {
+		if l.NoteID == n.ID {
+			via[l.UserID] = l.Via
+		}
+	}
+
+	out := make([]noteShareJSON, 0, len(shares))
+	already := map[string]bool{}
+	for _, sh := range shares {
+		// Panelet skal kunne sige forskel: en deling, nogen har valgt, tages tilbage
+		// ved at fjerne den — en, der er fulgt med, ved at fjerne linket eller den
+		// deling, den kom fra. En knap, der lover det første og gør det andet, er
+		// værre end ingen knap.
+		out = append(out, noteShareJSON{
+			User:   personJSON{ID: sh.User.ID, Name: sh.User.Name, AvatarColor: sh.User.AvatarColor},
+			Role:   string(sh.Role),
+			Linked: via[sh.User.ID] != "",
+			Via:    via[sh.User.ID],
+		})
+		already[sh.User.ID] = true
+	}
+
+	// The picker is filled from the same response, so the panel opens complete in
+	// one round-trip. People already on the note are left out — they are in the list
+	// above it, not the "add someone" menu.
+	candidates, err := s.db.UsersForSharing(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "share candidates", err)
+		return
+	}
+	cand := make([]personJSON, 0, len(candidates))
+	for _, p := range candidates {
+		if already[p.ID] {
+			continue
+		}
+		cand = append(cand, personJSON{ID: p.ID, Name: p.Name, AvatarColor: p.AvatarColor})
+	}
+
+	// De inviterede står ved siden af dem, der er kommet. Uden dem er en
+	// invitation sendt i går usynlig, og så sender man den igen — endnu et link til
+	// den samme indbakke, og ingen af dem til at trække tilbage.
+	invites, err := s.db.ListNoteInvites(r.Context(), n.ID)
+	if err != nil {
+		s.internal(w, r, "list note invites", err)
+		return
+	}
+	pending := make([]noteInviteJSON, 0, len(invites))
+	for _, i := range invites {
+		pending = append(pending, noteInviteJSON{ID: i.ID, Email: i.Email, Role: string(i.Role)})
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"shares":     out,
+		"candidates": cand,
+		"invites":    pending,
+		"follows":    followsOf(following, n.ID),
+	})
+}
+
+// followsOf er de noter, der følger med *denne* note — én linje pr. note, ikke én
+// pr. note og person. Panelet spørger på vegne af noten, og svaret "Prisliste
+// følger med" er det samme, hvem det så end deles med.
+func followsOf(all []store.LinkedShare, noteID string) []followJSON {
+	seen := map[string]bool{}
+	out := []followJSON{}
+	for _, l := range all {
+		if l.ViaID != noteID || seen[l.NoteID] {
+			continue
+		}
+		seen[l.NoteID] = true
+		out = append(out, followJSON{NoteID: l.NoteID, Title: l.Title})
+	}
+	return out
+}
+
+type followJSON struct {
+	NoteID string `json:"note_id"`
+	Title  string `json:"title"`
+}
+
+type noteShareJSON struct {
+	User personJSON `json:"user"`
+	Role string     `json:"role"`
+	// Sat, når personen har noten, fordi en anden delt note peger på den — ikke
+	// fordi nogen har delt netop den. `via` er den note, der peger.
+	Linked bool   `json:"linked"`
+	Via    string `json:"via,omitempty"`
+}
+
+type shareNoteRequest struct {
+	UserID string `json:"user_id"`
+	// Email deles der med, når personen ikke er at finde i listen — enten fordi
+	// man kender adressen bedre end navnet, eller fordi der ikke er nogen konto at
+	// finde endnu.
+	Email string `json:"email"`
+	Role  string `json:"role"`
+}
+
+// noteInviteJSON er en deling, der venter på en konto. Der er ikke noget navn og
+// ingen farve at vise: adressen er alt, hvad der findes om personen indtil de
+// dukker op.
+type noteInviteJSON struct {
+	ID    string `json:"id"`
+	Email string `json:"email"`
+	Role  string `json:"role"`
+}
+
+// handleShareNote grants a person a role on a note, or changes the role they hold.
+//
+// Der er to måder at sige, hvem det er. `user_id` er den, man har peget på i
+// listen. `email` er den, man kender adressen på — og det er den, der også virker,
+// når personen ikke har nogen konto: så bliver delingen til en invitation, der
+// venter, og bliver til en rigtig deling i det øjeblik, kontoen bliver oprettet.
+//
+// Det er ikke en ny magt til nogen. Enhver, der ejer et projekt, kunne i forvejen
+// invitere en fremmed ind på instansen pr. e-mail; det her er den samme handling
+// på en note, der ellers krævede tre skridt og en ventetid: invitér til instansen,
+// vent på at de opretter sig, find noten frem, del den.
+func (s *Server) handleShareNote(w http.ResponseWriter, r *http.Request) {
+	var req shareNoteRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+
+	role := store.Role(req.Role)
+	if role == "" {
+		role = store.RoleViewer
+	}
+	if role != store.RoleViewer && role != store.RoleEditor {
+		writeFieldErrors(w, map[string]string{"role": "must be viewer or editor"})
+		return
+	}
+
+	me := userFrom(r.Context())
+	email := store.NormalizeEmail(req.Email)
+
+	if req.UserID == "" && email == "" {
+		writeFieldErrors(w, map[string]string{"user_id": "required"})
+		return
+	}
+
+	// En adresse, der viser sig at høre til en konto, er den konto. At sende dem
+	// gennem en oprettelsesside, de ikke kan komme igennem, ville være en blindgyde
+	// — samme regel som en projektinvitation følger.
+	if req.UserID == "" {
+		if !strings.Contains(email, "@") {
+			writeFieldErrors(w, map[string]string{"email": "must be an email address"})
+			return
+		}
+		if email == store.NormalizeEmail(me.Email) {
+			writeFieldErrors(w, map[string]string{"email": "you already have this note"})
+			return
+		}
+		existing, err := s.db.UserByEmail(r.Context(), email)
+		if err != nil {
+			s.inviteToNote(w, r, n, email, role)
+			return
+		}
+		req.UserID = existing.ID
+	}
+
+	// The recipient must be a real account and not the sharer themselves; ShareNote
+	// refuses the owner, and a made-up id should not reach it.
+	if req.UserID == me.ID {
+		writeFieldErrors(w, map[string]string{"user_id": "you already have this note"})
+		return
+	}
+	person, err := s.db.PersonByID(r.Context(), req.UserID)
+	if err != nil {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such person")
+		return
+	}
+
+	if err := s.db.ShareNote(r.Context(), n.ID, req.UserID, role, me.ID); err != nil {
+		s.storeError(w, r, "share note", err)
+		return
+	}
+	s.notifyNoteShared(r, n, req.UserID)
+
+	// Og det, noten peger på, følger med. Svaret siger hvad — en deling, der stille
+	// tog tre noter mere med, ville være rigtig og alligevel ikke til at overskue.
+	followed, err := s.db.SyncLinkedShares(r.Context(), me.ID)
+	if err != nil {
+		s.internal(w, r, "sync linked shares", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"follows": followsOf(followed, n.ID),
+		// Personen sendes med retur, fordi fladen kan have delt med en adresse og
+		// derfor ikke selv ved, hvem den ramte.
+		"user": personJSON{ID: person.ID, Name: person.Name, AvatarColor: person.AvatarColor},
+		"role": string(role),
+	})
+}
+
+// inviteToNote sends a link that creates an account and the share at once.
+//
+// Linket vises i svaret, når der ikke er nogen post at sende det med. En
+// invitation, der forsvandt, fordi instansen ikke har en SMTP-server, ville se ud
+// som om den var sendt — og først blive opdaget som ikke-sendt af den, der ventede
+// på den.
+func (s *Server) inviteToNote(w http.ResponseWriter, r *http.Request, n *store.Note, email string, role store.Role) {
+	me := userFrom(r.Context())
+
+	// En anden invitation til den samme note i den samme indbakke er ikke en
+	// invitation mere: det er to links, der gør det samme, og kun det ene kan
+	// trækkes tilbage ad gangen.
+	pending, err := s.db.PendingNoteInvite(r.Context(), n.ID, email)
+	if err != nil {
+		s.internal(w, r, "pending note invite", err)
+		return
+	}
+	if pending {
+		writeError(w, http.StatusConflict, CodeConflict, "that address has already been invited to this note")
+		return
+	}
+
+	token, inv, err := s.db.CreateNoteInvite(r.Context(), email, n.ID, role, me.ID, s.cfg.InviteTTL)
+	if err != nil {
+		s.internal(w, r, "create note invite", err)
+		return
+	}
+	link := s.cfg.BaseURL + "/invite?token=" + token
+
+	emailed := false
+	if s.mail.Configured() {
+		if err := s.mail.SendNoteInvite(r.Context(), email, me.Name, n.Title, link, s.cfg.InviteTTL); err != nil {
+			s.log.Error("send note invite", "err", err, "to", email)
+		} else {
+			emailed = true
+		}
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]any{
+		"invited": noteInviteJSON{ID: inv.ID, Email: inv.Email, Role: string(inv.Role)},
+		"link":    link,
+		"emailed": emailed,
+	})
+}
+
+// handleDeleteNoteInvite withdraws an invitation before it is used.
+//
+// Det er den eneste vej tilbage. Kun aftrykket af tokenet er gemt, så et link, der
+// er sendt til den forkerte adresse, kan ikke findes frem og gøres ugyldigt — det
+// kan kun rækken, det hører til.
+func (s *Server) handleDeleteNoteInvite(w http.ResponseWriter, r *http.Request) {
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+	if err := s.db.DeleteNoteInvite(r.Context(), n.ID, chi.URLParam(r, "inviteID")); err != nil {
+		s.storeError(w, r, "delete note invite", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleUnshareNote takes a person's access away again.
+func (s *Server) handleUnshareNote(w http.ResponseWriter, r *http.Request) {
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+	if err := s.db.UnshareNote(r.Context(), n.ID, chi.URLParam(r, "userID")); err != nil {
+		s.internal(w, r, "unshare note", err)
+		return
+	}
+	// Det, der fulgte med, følger også med tilbage. Regnet forfra: de udledte rækker
+	// skrives om fra bunden, så en note, der stadig kan nås fra en anden deling,
+	// bliver stående, og en, der ikke kan, forsvinder.
+	if _, err := s.db.SyncLinkedShares(r.Context(), userFrom(r.Context()).ID); err != nil {
+		s.internal(w, r, "sync linked shares", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}

internal/httpapi/notes_share_test.go

@@ -0,0 +1,296 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// createNote makes a note as the current client and returns its id.
+func (ts *testServer) createNote(t *testing.T, body string) string {
+	t.Helper()
+	resp, out := ts.do(t, "POST", "/api/v1/notes", map[string]any{"body": body})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create note: status %d", resp.StatusCode)
+	}
+	id, _ := out["id"].(string)
+	if id == "" {
+		t.Fatal("create note returned no id")
+	}
+	return id
+}
+
+func userID(t *testing.T, ts *testServer, email string) string {
+	t.Helper()
+	u, err := ts.db.UserByEmail(t.Context(), email)
+	if err != nil {
+		t.Fatalf("look up %s: %v", email, err)
+	}
+	return u.ID
+}
+
+// A note shared with a person shows up in their list, marked as theirs-from-
+// somebody, and a viewer can read it but not change it.
+func TestSharedNoteReachesTheOtherPerson(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Ferieplan\nuge 29")
+
+	// Before sharing, Sofie cannot see it at all.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("an unshared note was reachable: %d", resp.StatusCode)
+	}
+
+	// Share it as a viewer.
+	resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("share: status %d", resp.StatusCode)
+	}
+
+	// Now it is in Sofie's list, flagged as shared with her and carrying its owner.
+	_, list := other.do(t, "GET", "/api/v1/notes", nil)
+	notes, _ := list["notes"].([]any)
+	var found map[string]any
+	for _, raw := range notes {
+		n := raw.(map[string]any)
+		if n["id"] == noteID {
+			found = n
+		}
+	}
+	if found == nil {
+		t.Fatal("the shared note is not in the recipient's list")
+	}
+	if found["shared_with_me"] != true {
+		t.Errorf("the note is not marked shared_with_me: %v", found)
+	}
+	ownerObj, _ := found["owner"].(map[string]any)
+	if ownerObj == nil || ownerObj["name"] != "Kristian" {
+		t.Errorf("the owner is not carried on the shared note: %v", found["owner"])
+	}
+
+	// A viewer reads it.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusOK {
+		t.Errorf("a viewer could not read the shared note: %d", resp.StatusCode)
+	}
+	// But cannot change it.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "hijacked"}); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("a viewer changed a shared note: %d", resp.StatusCode)
+	}
+}
+
+// An editor may change the text, but only the owner may delete the note or hand it
+// to somebody else.
+func TestSharedEditorCanWriteButNotGiveAway(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Delt\noprindelig")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("share as editor failed")
+	}
+
+	// The editor writes.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Delt\nrettet"}); resp.StatusCode != http.StatusOK {
+		t.Errorf("an editor could not change a shared note: %d", resp.StatusCode)
+	}
+
+	// The editor cannot re-share it: giving access is the owner's alone.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("an editor could read the share list: %d", resp.StatusCode)
+	}
+	// The editor cannot delete it.
+	if resp, _ := other.do(t, "DELETE", "/api/v1/notes/"+noteID, nil); resp.StatusCode == http.StatusNoContent {
+		t.Error("an editor deleted the owner's note")
+	}
+	// The note still exists for the owner.
+	if resp, _ := owner.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusOK {
+		t.Errorf("the note is gone after the editor's delete attempt: %d", resp.StatusCode)
+	}
+}
+
+// Unsharing takes access away again, and only the owner can do it.
+func TestUnshareRemovesAccess(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Hemmelig")
+	owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+
+	// A non-owner cannot unshare.
+	if resp, _ := other.do(t, "DELETE", "/api/v1/notes/"+noteID+"/shares/"+sofie, nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("a non-owner unshared a note: %d", resp.StatusCode)
+	}
+
+	// The owner can.
+	if resp, _ := owner.do(t, "DELETE", "/api/v1/notes/"+noteID+"/shares/"+sofie, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("owner unshare: %d", resp.StatusCode)
+	}
+	// And access is gone.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("the note was still reachable after unsharing: %d", resp.StatusCode)
+	}
+}
+
+// The share list is owner-only and offers the instance's other people as
+// candidates, minus those already on the note.
+func TestShareListShowsCandidatesAndIsOwnerOnly(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	owner.newUser(t, "sofie@example.dk", "Sofie")
+	owner.newUser(t, "anders@example.dk", "Anders")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Plan")
+	owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+
+	_, out := owner.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil)
+	shares, _ := out["shares"].([]any)
+	if len(shares) != 1 {
+		t.Fatalf("shares = %d, want 1", len(shares))
+	}
+	cands, _ := out["candidates"].([]any)
+	// Anders is a candidate; Sofie is already on the note and so is not.
+	names := map[string]bool{}
+	for _, c := range cands {
+		names[c.(map[string]any)["name"].(string)] = true
+	}
+	if !names["Anders"] {
+		t.Errorf("Anders is not offered as a candidate: %v", names)
+	}
+	if names["Sofie"] {
+		t.Error("somebody already on the note is offered as a candidate")
+	}
+	if names["Kristian"] {
+		t.Error("the owner is offered as a candidate to share with themselves")
+	}
+}
+
+// Sharing refuses a made-up person and the owner themselves.
+func TestShareRejectsUnknownAndSelf(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	me := userID(t, owner, "kristian@example.dk")
+	noteID := owner.createNote(t, "# Note")
+
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": "does-not-exist", "role": "viewer"}); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("sharing with an unknown id: %d, want 404", resp.StatusCode)
+	}
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": me, "role": "viewer"}); resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Errorf("sharing with oneself: %d, want 422", resp.StatusCode)
+	}
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": me, "role": "owner"}); resp.StatusCode == http.StatusOK {
+		t.Error("a note was shared at the owner role")
+	}
+}
+
+// De noter, en delt note peger på, følger med — og holder op igen.
+//
+// Det var meldt som en fejl den anden vej rundt: linkene i en delt note førte
+// ingen steder hen, fordi det, de pegede på, ikke var delt. Prøven går hele vejen
+// rundt om svaret på det — dybden, teksten der ændrer sig bagefter, det der ikke
+// må følge med, og vejen tilbage.
+func TestSharedNoteTakesItsLinksWithIt(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	// Prisliste peger videre på Leveringstider, så kæden er to led lang.
+	deep := owner.createNote(t, "# Leveringstider\nfire dage")
+	linked := owner.createNote(t, "# Prisliste\nog [[Leveringstider]]")
+	apart := owner.createNote(t, "# Bankoplysninger\nikke til deling")
+	noteID := owner.createNote(t, "# Aftale om levering\nse [[Prisliste]]")
+
+	reachable := func(id string) bool {
+		resp, _ := other.do(t, "GET", "/api/v1/notes/"+id, nil)
+		return resp.StatusCode == http.StatusOK
+	}
+
+	resp, out := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("share: status %d", resp.StatusCode)
+	}
+	// Svaret siger, hvad der fulgte med — hele kæden, ikke kun første led. En
+	// deling, der stille tog to noter mere med, ville være rigtig og alligevel ikke
+	// til at overskue.
+	follows, _ := out["follows"].([]any)
+	if len(follows) != 2 {
+		t.Fatalf("delingen nævnte %d noter, der fulgte med, want 2: %v", len(follows), out["follows"])
+	}
+
+	if !reachable(linked) {
+		t.Error("noten, den delte note peger på, fulgte ikke med")
+	}
+	if !reachable(deep) {
+		t.Error("kæden stoppede efter ét led")
+	}
+	if reachable(apart) {
+		t.Error("en note, ingen peger på, blev delt")
+	}
+
+	// Skrevet bagefter tæller også. Et link i dag i en note delt i går skal føre
+	// samme sted hen for begge.
+	senere := owner.createNote(t, "# Rabatter\nti procent")
+	if reachable(senere) {
+		t.Fatal("en helt ny note var delt, før noget pegede på den")
+	}
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale om levering\nse [[Prisliste]] og [[Rabatter]]"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("kunne ikke skrive videre i den delte note")
+	}
+	if !reachable(senere) {
+		t.Error("et link skrevet efter delingen fulgte ikke med")
+	}
+
+	// Og vejen tilbage: tages delingen tilbage, følger det med, den tog med sig.
+	if resp, _ := owner.do(t, "DELETE", "/api/v1/notes/"+noteID+"/shares/"+sofie, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("unshare: status %d", resp.StatusCode)
+	}
+	if reachable(linked) || reachable(deep) || reachable(senere) {
+		t.Error("det, der fulgte med delingen, blev stående, da den blev taget tilbage")
+	}
+}
+
+// En medredaktør kan ikke dele ejerens noter med sig selv ved at skrive et link.
+//
+// Det er den ene vej, "linkene følger med" kunne blive til en rettighedsfejl: et
+// link peger på en titel, og enhver, der må rette i en delt note, kan skrive en
+// titel. Derfor regnes delingerne kun om, når ejeren selv har gemt.
+func TestAnEditorCannotShareTheOwnersNotesWithThemselves(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	secret := owner.createNote(t, "# Bankoplysninger\nreg og konto")
+	noteID := owner.createNote(t, "# Fælles\nintet link her")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("share as editor failed")
+	}
+
+	// Hun skriver linket selv, i den note hun har fået lov at rette i.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Fælles\nse [[Bankoplysninger]]"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("medredaktøren kunne ikke skrive")
+	}
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+secret, nil); resp.StatusCode == http.StatusOK {
+		t.Error("en medredaktør delte ejerens note med sig selv ved at skrive et link")
+	}
+}

internal/httpapi/notifications_handlers.go

@@ -19,6 +19,7 @@ type notificationJSON struct {
 	ActorName string `json:"actor_name,omitempty"`
 	ProjectID string `json:"project_id,omitempty"`
 	TaskID    string `json:"task_id,omitempty"`
+	NoteID    string `json:"note_id,omitempty"`
 	Kind      string `json:"kind"`
 	Title     string `json:"title"`
 	Body      string `json:"body,omitempty"`
@@ -44,8 +45,8 @@ func (s *Server) handleListNotifications(w http.ResponseWriter, r *http.Request)
 	for _, n := range list {
 		out = append(out, notificationJSON{
 			ID: n.ID, ActorName: n.ActorName, ProjectID: n.ProjectID, TaskID: n.TaskID,
-			Kind: n.Kind, Title: n.Title, Body: n.Body, Read: n.ReadAt != nil,
-			CreatedAt: n.CreatedAt.Format(time.RFC3339),
+			NoteID: n.NoteID, Kind: n.Kind, Title: n.Title, Body: n.Body,
+			Read: n.ReadAt != nil, CreatedAt: n.CreatedAt.Format(time.RFC3339),
 		})
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"notifications": out, "unread": unread})
@@ -75,8 +76,9 @@ func (s *Server) notify(r *http.Request, n *store.Notification) {
 	}
 
 	s.hub.PublishToUser(n.UserID, "notification", notificationJSON{
-		ID: n.ID, ProjectID: n.ProjectID, TaskID: n.TaskID, Kind: n.Kind,
-		Title: n.Title, Body: n.Body, CreatedAt: n.CreatedAt.Format(time.RFC3339),
+		ID: n.ID, ActorName: n.ActorName, ProjectID: n.ProjectID, TaskID: n.TaskID,
+		NoteID: n.NoteID, Kind: n.Kind, Title: n.Title, Body: n.Body,
+		CreatedAt: n.CreatedAt.Format(time.RFC3339),
 	})
 
 	// Detached from the request: a push round trip to Google or Mozilla has no
@@ -102,6 +104,89 @@ func (s *Server) notifyProject(r *http.Request, projectID, taskID, actorID, kind
 	}
 }
 
+// notifyAssigned tells somebody a task is now theirs.
+//
+// Kun ved *skiftet*, og kun til den, der får den. En opgave, der bliver rørt ti
+// gange bagefter, er stadig den samme besked — og den, der uddelegerer, ved godt
+// hvad de lige har gjort.
+func (s *Server) notifyAssigned(r *http.Request, t *store.Task) {
+	if t == nil || t.AssigneeID == "" {
+		return
+	}
+	actor := userFrom(r.Context())
+	s.notify(r, &store.Notification{
+		UserID: t.AssigneeID, ActorID: actor.ID, ProjectID: t.ProjectID, TaskID: t.ID,
+		Kind: "assigned", Title: actor.Name + " gav dig en opgave", Body: t.Content,
+	})
+}
+
+// notifyNoteShared tells somebody that a note is now theirs to read.
+//
+// Én besked, når delingen sker, og ikke noget bagefter: den, der får en note delt,
+// skal vide, at den er der. At den senere bliver rettet, er en anden besked — den
+// skriver notifyNoteChanged — og de to må ikke sige det samme om det samme.
+//
+// Ikke sammenlagt med noget. En deling sker én gang pr. person pr. note, så der er
+// ikke en gentagelse at folde sammen — og bliver rollen ændret bagefter, er det
+// ikke en ny note at læse.
+func (s *Server) notifyNoteShared(r *http.Request, n *store.Note, userID string) {
+	if n == nil || userID == "" {
+		return
+	}
+	actor := userFrom(r.Context())
+	s.notify(r, &store.Notification{
+		UserID: userID, ActorID: actor.ID, ProjectID: n.ProjectID, NoteID: n.ID,
+		Kind: "note.shared", Title: actor.Name + " delte en note med dig", Body: n.Title,
+	})
+}
+
+// notifyNoteChanged tells everybody who can see a note that somebody else wrote in
+// it — folded into one line per note while it is unread.
+//
+// `except` er dem, den samme gemning allerede har sagt noget mere præcist til:
+// den, der lige er blevet nævnt ved navn, skal ikke også høre, at noten er rettet.
+//
+// Skrevet som ét kald pr. modtager frem for ét pr. note, fordi sammenlægningen er
+// pr. person: to mennesker kan have læst den forrige besked på hvert sit tidspunkt,
+// og den ene skal have en ny linje, mens den anden får sin gamle rykket op.
+func (s *Server) notifyNoteChanged(r *http.Request, n *store.Note, except map[string]bool) {
+	if n == nil {
+		return
+	}
+	actor := userFrom(r.Context())
+	audience, err := s.db.NoteAudience(r.Context(), n.ID)
+	if err != nil {
+		s.log.Warn("note audience for notification", "err", err, "note", n.ID)
+		return
+	}
+	title := actor.Name + " rettede en note"
+	body := n.Title
+	for _, userID := range audience {
+		if userID == actor.ID || except[userID] {
+			continue
+		}
+		// Fold first, and only write a row when there was nothing to fold into.
+		// Den anden vej rundt — skriv, og ryd op bagefter — efterlader et vindue,
+		// hvor klokken siger to.
+		folded, err := s.db.BumpUnreadNoteNotification(r.Context(), userID, n.ID, actor.ID, title, body)
+		if err != nil {
+			s.log.Warn("fold note notification", "err", err, "note", n.ID)
+			continue
+		}
+		if folded {
+			// Klokken skal stadig vide det: tallet er uændret, men linjen er rykket
+			// op og siger nu et andet navn. Uden det her opdager en åben fane først
+			// den sammenlagte rettelse ved næste genindlæsning.
+			s.hub.PublishToUser(userID, "notification.folded", map[string]any{"note_id": n.ID})
+			continue
+		}
+		s.notify(r, &store.Notification{
+			UserID: userID, ActorID: actor.ID, ProjectID: n.ProjectID, NoteID: n.ID,
+			Kind: "note.changed", Title: title, Body: body,
+		})
+	}
+}
+
 // PushToUser is pushToUser for callers outside this package — the reminder job,
 // which has the schedule but not the keys.
 func (s *Server) PushToUser(userID, title, body, projectID string) {
@@ -148,15 +233,32 @@ func (s *Server) pushToUser(userID, title, body, projectID string) pushOutcome {
 		return out
 	}
 
-	payload := push.Payload{Title: title, Body: body, URL: "/projekt/" + projectID}
+	target := "/projekt/" + projectID
+	if projectID == "" {
+		target = "/"
+	}
+	// Mærket på ikonet følger med beskeden. Talt her frem for i service-workeren,
+	// som ikke har nogen hukommelse mellem to opvågninger og derfor kun kunne lægge
+	// én til noget, den ikke kender — et mærke, der tæller sig selv op og aldrig
+	// ned. Fejler tællingen, sendes beskeden alligevel: en besked uden et tal er
+	// stadig en besked.
+	unread, err := s.db.UnreadNotificationCount(ctx, userID)
+	if err != nil {
+		s.log.Warn("unread count for push", "err", err)
+	}
+	payload := push.Payload{Title: title, Body: body, URL: target, Unread: unread}
+	subject := s.vapidSubject()
 	for _, sub := range subs {
 		err := push.Send(ctx, push.Subscription{
 			Endpoint: sub.Endpoint, P256dh: sub.P256dh, Auth: sub.Auth,
 		}, payload, push.VAPID{
-			Public: public, Private: private, Subject: "mailto:" + s.cfg.SMTP.From,
+			Public: public, Private: private, Subject: subject,
 		})
 		if err == nil {
 			out.Sent++
+			if delErr := s.db.MarkPushDelivered(ctx, sub.Endpoint); delErr != nil {
+				s.log.Warn("mark push delivered", "err", delErr)
+			}
 			continue
 		}
 		// Warn, not Debug.
@@ -257,6 +359,29 @@ func (s *Server) vapidKeys(ctx contextLike) (string, string, error) {
 	return s.db.InstanceKeys(ctx, push.GenerateVAPIDKeys)
 }
 
+// vapidSubject is the "sub" claim a push service is told to reach the sender at.
+//
+// It has to be one the service will actually accept, and Apple is the strict one:
+// it answers 403 Forbidden to a mailto whose domain is made up — which is exactly
+// what the old fallback, mailto:verdande@example.invalid, was on an instance with
+// no mail set up. Every push to an iPhone or a Mac was rejected, silently as far as
+// the person waiting for the notification could tell.
+//
+// So a real address is used when there is one, and otherwise the instance's own
+// https address — which is a valid VAPID subject, points at something that exists,
+// and Apple accepts. Verified against web.push.apple.com: the mailto gets a 403,
+// the https URL a 201.
+func (s *Server) vapidSubject() string {
+	from := strings.TrimSpace(s.cfg.SMTP.From)
+	if from != "" && strings.Contains(from, "@") && !strings.HasSuffix(from, "@localhost") {
+		return "mailto:" + from
+	}
+	if strings.HasPrefix(s.cfg.BaseURL, "https://") || strings.HasPrefix(s.cfg.BaseURL, "http://") {
+		return s.cfg.BaseURL
+	}
+	return "mailto:verdande@example.invalid"
+}
+
 // --- subscription endpoints -----------------------------------------------------------
 
 type pushSubscriptionRequest struct {

internal/httpapi/notifications_test.go

@@ -0,0 +1,205 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// notifications reads somebody's bell.
+func notifications(t *testing.T, ts *testServer) ([]any, float64) {
+	t.Helper()
+	resp, out := ts.do(t, "GET", "/api/v1/notifications", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("list notifications: status %d", resp.StatusCode)
+	}
+	list, _ := out["notifications"].([]any)
+	unread, _ := out["unread"].(float64)
+	return list, unread
+}
+
+func firstOf(t *testing.T, list []any) map[string]any {
+	t.Helper()
+	if len(list) == 0 {
+		t.Fatal("ingen beskeder")
+	}
+	n, _ := list[0].(map[string]any)
+	return n
+}
+
+// At blive tildelt en opgave giver besked — og kun ved selve skiftet.
+func TestBeingGivenATaskNotifiesTheAssignee(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	_, project := owner.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Fælles"})
+	projectID, _ := project["id"].(string)
+	// Medlemskab kommer gennem en invitation; en konto, der allerede findes, bliver
+	// medlem med det samme.
+	if resp, _ := owner.do(t, "POST", "/api/v1/projects/"+projectID+"/invites",
+		map[string]any{"email": "sofie@example.dk", "role": "editor"}); resp.StatusCode >= 300 {
+		t.Fatalf("invitér: %d", resp.StatusCode)
+	}
+
+	resp, task := owner.do(t, "POST", "/api/v1/tasks",
+		map[string]any{"project_id": projectID, "content": "ring til revisor"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("opret opgave: %d", resp.StatusCode)
+	}
+	taskID, _ := task["id"].(string)
+
+	// Hvad hun havde, før nogen tildelte hende noget. Ikke nødvendigvis nul —
+	// invitationen kan selv have sagt noget — og prøven handler om forskellen.
+	before, _ := notifications(t, other)
+
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/tasks/"+taskID,
+		map[string]any{"assignee_id": sofie}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("tildel: %d", resp.StatusCode)
+	}
+
+	list, _ := notifications(t, other)
+	if len(list) != len(before)+1 {
+		t.Fatalf("Sofie fik %d beskeder, want %d", len(list), len(before)+1)
+	}
+	n := firstOf(t, list)
+	if n["kind"] != "assigned" {
+		t.Errorf("kind = %v, want assigned", n["kind"])
+	}
+	if n["task_id"] != taskID {
+		t.Errorf("beskeden pegede ikke på opgaven: %v", n["task_id"])
+	}
+	if n["actor_name"] != "Kristian" {
+		t.Errorf("actor_name = %v", n["actor_name"])
+	}
+
+	// En rettelse af noget andet, mens den samme tildeling står i forespørgslen,
+	// er ikke en ny besked. Det er dét, en fladet, der sender hele opgaven ved hver
+	// ændring, gør — og så bliver klokken ubrugelig på en dag.
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/tasks/"+taskID,
+		map[string]any{"assignee_id": sofie, "content": "ring til revisoren"}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("ret: %d", resp.StatusCode)
+	}
+	if now, _ := notifications(t, other); len(now) != len(before)+1 {
+		t.Errorf("en uændret tildeling gav besked igen: %d beskeder", len(now))
+	}
+
+	// Og den, der tildeler sig selv, får ingenting.
+	me := userID(t, owner, "kristian@example.dk")
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/tasks/"+taskID,
+		map[string]any{"assignee_id": me}); resp.StatusCode != http.StatusOK {
+		t.Fatalf("tildel til sig selv: %d", resp.StatusCode)
+	}
+	if list, _ := notifications(t, owner); len(list) != 0 {
+		t.Errorf("man fik besked om noget, man selv gjorde: %d beskeder", len(list))
+	}
+}
+
+// En rettelse i en delt note giver besked — og gentagne rettelser bliver til én,
+// så længe den ikke er læst.
+func TestEditingASharedNoteNotifiesTheOthers(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Aftale om levering\nfirst")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("del noten")
+	}
+
+	// Selve delingen er den første besked: Sofie skal vide, at noten er der, før
+	// nogen retter i den. Den tælles med i alt, hvad der følger.
+	if list, unread := notifications(t, other); len(list) != 1 || unread != 1 ||
+		firstOf(t, list)["kind"] != "note.shared" {
+		t.Fatalf("delingen gav %d beskeder (%v ulæste): %v", len(list), unread, list)
+	}
+
+	// Ejeren skriver. Sofie skal høre det.
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale om levering\nanden linje"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("ret noten")
+	}
+	list, unread := notifications(t, other)
+	if unread != 2 || len(list) != 2 {
+		t.Fatalf("Sofie fik %d beskeder (%v ulæste), want 2 — delingen og rettelsen",
+			len(list), unread)
+	}
+	n := firstOf(t, list)
+	if n["kind"] != "note.changed" || n["note_id"] != noteID {
+		t.Errorf("besked = %v", n)
+	}
+
+	// En gemning mere, mens den er ulæst, må ikke blive til en linje mere. En note
+	// gemmes ved hver tastepause, så uden det her er fem minutters skriveri tyve
+	// ens linjer i klokken.
+	for i := 0; i < 3; i++ {
+		if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+			map[string]any{"body": "# Aftale om levering\nlinje nummer " + string(rune('a'+i))}); resp.StatusCode != http.StatusOK {
+			t.Fatal("ret noten igen")
+		}
+	}
+	if list, unread := notifications(t, other); len(list) != 2 || unread != 2 {
+		t.Errorf("tre gemninger blev til %d beskeder, want 2 — delingen og én rettelse",
+			len(list))
+	}
+
+	// Læst, og så en rettelse mere: dét er en ny ting at få at vide.
+	if resp, _ := other.do(t, "POST", "/api/v1/notifications/read", nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatal("markér som læst")
+	}
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale om levering\nefter læsningen"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("ret noten efter læsningen")
+	}
+	if list, unread := notifications(t, other); len(list) != 3 || unread != 1 {
+		t.Errorf("efter læsningen gav en rettelse %d beskeder (%v ulæste), want 3 og 1", len(list), unread)
+	}
+
+	// Ejeren har ikke fået besked om sine egne rettelser undervejs.
+	if list, _ := notifications(t, owner); len(list) != 0 {
+		t.Errorf("ejeren fik %d beskeder om sine egne rettelser", len(list))
+	}
+
+	// Og den anden vej: Sofie skriver, ejeren hører det.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Aftale om levering\nfra Sofie"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("Sofie retter")
+	}
+	list, _ = notifications(t, owner)
+	if len(list) != 1 {
+		t.Fatalf("ejeren fik %d beskeder, da noten blev rettet af en anden, want 1", len(list))
+	}
+	if firstOf(t, list)["actor_name"] != "Sofie" {
+		t.Errorf("beskeden nævnte ikke hvem: %v", list[0])
+	}
+
+	// En ændring, der ikke er tekst, er ikke en rettelse at give besked om.
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"pinned": true}); resp.StatusCode != http.StatusOK {
+		t.Fatal("stjernemarkér")
+	}
+	if list, _ := notifications(t, other); len(list) != 3 {
+		t.Errorf("en stjernemarkering gav besked: %d beskeder, want 3", len(list))
+	}
+}
+
+// En note, ingen deler, er ingen at give besked.
+func TestEditingAPrivateNoteNotifiesNobody(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+
+	noteID := owner.createNote(t, "# Min egen\nintet")
+	if resp, _ := owner.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Min egen\nnoget"}); resp.StatusCode != http.StatusOK {
+		t.Fatal("ret noten")
+	}
+	if list, _ := notifications(t, other); len(list) != 0 {
+		t.Errorf("Sofie hørte om en note, hun ikke kan se: %d beskeder", len(list))
+	}
+	if list, _ := notifications(t, owner); len(list) != 0 {
+		t.Errorf("ejeren fik besked om sin egen note: %d beskeder", len(list))
+	}
+}

internal/httpapi/push_subject_test.go

@@ -0,0 +1,33 @@
+package httpapi
+
+import (
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// The VAPID subject has to be one a push service will accept. Apple answers 403 to
+// a mailto with a made-up domain, which is what the no-mail fallback used to be, so
+// every push to an Apple device was refused. With no real address, the instance's
+// own https URL is used instead — valid, real, and accepted.
+func TestVAPIDSubject(t *testing.T) {
+	cases := []struct {
+		name    string
+		from    string
+		baseURL string
+		want    string
+	}{
+		{"a real address is used as-is", "todo@example.dk", "https://verdande.example.dk", "mailto:todo@example.dk"},
+		{"no mail falls back to the https url", "", "https://verdande.example.dk", "https://verdande.example.dk"},
+		{"the localhost default is not a real address", "verdande@localhost", "https://verdande.example.dk", "https://verdande.example.dk"},
+		{"a plain http dev url still serves as a subject", "", "http://localhost:8080", "http://localhost:8080"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s := &Server{cfg: &config.Config{BaseURL: tc.baseURL, SMTP: config.SMTP{From: tc.from}}}
+			if got := s.vapidSubject(); got != tc.want {
+				t.Errorf("vapidSubject() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

internal/httpapi/realip.go

@@ -0,0 +1,88 @@
+package httpapi
+
+import (
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// realIP rewrites r.RemoteAddr to the client address a trusted proxy reported,
+// and does nothing at all when the peer is not trusted.
+//
+// This replaces chi's middleware.RealIP, which is deprecated precisely because it
+// believes a forwarded header from anyone: an attacker sets X-Forwarded-For to a
+// new value on every request and gets a fresh rate-limit bucket each time, and
+// writes whatever address they like into the audit log. The one control that
+// exists for when a password is already gone is keyed on this address, so it has
+// to be an address the caller cannot choose.
+//
+// The gate is the peer. A header is read only when the machine that opened the
+// connection is one of cfg.TrustedProxies — a reverse proxy or tunnel the operator
+// put there. A connection straight off the internet is trusted for nothing, so its
+// header is ignored and it is keyed on the address it actually came from. Behind a
+// proxy that overwrites the client's own header (nginx, Caddy and cloudflared all
+// do) the value is then the real client and cannot be forged from outside.
+func realIP(cfg *config.Config) func(http.Handler) http.Handler {
+	trusted := cfg.TrustedProxies
+	header := cfg.RealIPHeader
+	if header == "" {
+		header = "X-Forwarded-For"
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if ip := trustedClientIP(r, trusted, header); ip != "" {
+				// Port preserved off the original peer only for shape; downstream
+				// clientIP() splits it away, and the forwarded value carries none.
+				r.RemoteAddr = ip
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// trustedClientIP returns the forwarded client address if the peer may be believed,
+// or "" to leave RemoteAddr untouched.
+func trustedClientIP(r *http.Request, trusted []netip.Prefix, header string) string {
+	peer := r.RemoteAddr
+	if host, _, err := net.SplitHostPort(peer); err == nil {
+		peer = host
+	}
+	peerAddr, err := netip.ParseAddr(peer)
+	if err != nil || !isTrusted(peerAddr, trusted) {
+		return ""
+	}
+
+	raw := r.Header.Get(header)
+	if raw == "" {
+		return ""
+	}
+	// The leftmost entry is the original client. That entry is only as trustworthy
+	// as the proxy that wrote it — but the trusted proxy is exactly the one that
+	// replaces a client-supplied header, so on the deployments this is written for
+	// it is the real client, and on a direct connection we never reach this line.
+	first := raw
+	if i := strings.IndexByte(raw, ','); i >= 0 {
+		first = raw[:i]
+	}
+	first = strings.TrimSpace(first)
+	if _, err := netip.ParseAddr(first); err != nil {
+		return ""
+	}
+	return first
+}
+
+func isTrusted(addr netip.Addr, trusted []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	addr = addr.Unmap()
+	for _, p := range trusted {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}

internal/httpapi/realip_test.go

@@ -0,0 +1,94 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// The address the rate limiter keys on must be one the caller cannot choose. A
+// forwarded header is believed only from a trusted proxy, and ignored from a
+// stranger connecting directly — the difference between a control and a suggestion.
+func TestRealIPTrustsOnlyTheProxy(t *testing.T) {
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+
+	cases := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		want       string
+	}{
+		{
+			// A private peer is a proxy the operator put there: believe it.
+			name:       "trusted proxy is believed",
+			remoteAddr: "10.1.2.3:5000",
+			xff:        "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// A public peer connected straight to us; its header is a guess.
+			name:       "public peer header ignored",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "203.0.113.9",
+			want:       "198.51.100.7",
+		},
+		{
+			// No header from a trusted proxy leaves the peer as the answer.
+			name:       "trusted peer without header",
+			remoteAddr: "127.0.0.1:5000",
+			xff:        "",
+			want:       "127.0.0.1",
+		},
+		{
+			// A spoofed value from a stranger cannot become the key.
+			name:       "spoof from outside does not win",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "127.0.0.1",
+			want:       "198.51.100.7",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", "/api/v1/auth/login", nil)
+			r.RemoteAddr = tc.remoteAddr
+			if tc.xff != "" {
+				r.Header.Set("X-Forwarded-For", tc.xff)
+			}
+			h.ServeHTTP(httptest.NewRecorder(), r)
+			if seen != tc.want {
+				t.Errorf("keyed on %q, want %q", seen, tc.want)
+			}
+		})
+	}
+}
+
+// "none" turns the trust off entirely, for an instance exposed directly.
+func TestRealIPTrustNone(t *testing.T) {
+	t.Setenv("VERDANDE_TRUSTED_PROXIES", "none")
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.1.2.3:5000" // even a private peer is not trusted now
+	r.Header.Set("X-Forwarded-For", "203.0.113.9")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if seen != "10.1.2.3" {
+		t.Errorf("keyed on %q, want the peer 10.1.2.3", seen)
+	}
+}

internal/httpapi/server.go

@@ -66,6 +66,7 @@ type Server struct {
 	// Sat kun af prøver; se icsClient().
 	icsFetch     *http.Client
 	mailLimiter  *limiter
+	hookLimiter  *limiter
 	resetLimiter *limiter
 	// Second factors are counted against the *account*, not the address. An
 	// address bucket is defeated by anybody with more than one address, which is
@@ -93,6 +94,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		// day. Sixty a minute never touches real delivery and still puts a ceiling
 		// on the one public write path that has none.
 		mailLimiter:  newLimiter(60, time.Minute),
+		hookLimiter:  newLimiter(60, time.Minute),
 		resetLimiter: newLimiter(5, time.Hour),
 		// Tighter than the password bucket, and for a whole hour. Somebody typing
 		// their own code gets it right on the first or second try; ten in an hour is
@@ -110,7 +112,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
+	// Not middleware.RealIP: that believes a forwarded header from anyone, which
+	// lets a caller pick the address the rate limiter and audit log key on. This
+	// one reads the header only from a trusted proxy — see realip.go.
+	r.Use(realIP(cfg))
 	r.Use(requestLogger(log))
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
@@ -140,6 +145,20 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 	r.Method(http.MethodPost, "/inbound/mail",
 		s.rateLimit(s.mailLimiter, http.HandlerFunc(s.handleInboundMail)))
 
+	// En krog ind i indbakken: en URL, et andet program kan skubbe en linje tekst
+	// til. Uden for /api/v1 og uden for sessionen af samme grund som feedet og
+	// posten ovenfor — den, der kalder, er en genvej på en telefon eller et script,
+	// og kan ikke logge ind, så tokenet i stien er hele legitimationen.
+	//
+	// Kun POST. En GET ville være nemmere at kalde, og det er præcis problemet:
+	// forudindlæsning i en browser, en linkkontrol i en chat og en historik, der
+	// bliver besøgt igen, ville alle lave opgaver, ingen har bedt om.
+	//
+	// Sin egen kvote frem for postens: en travl integration skal ikke kunne lukke
+	// for den indgående post, og omvendt.
+	r.Method(http.MethodPost, "/inbound/hook/{token}",
+		s.rateLimit(s.hookLimiter, http.HandlerFunc(s.handleInboundHook)))
+
 	// MCP with the token in the query string, for clients that cannot send a
 	// header. Claude's custom-connector dialog takes a URL and nothing else, so
 	// /api/v1/mcp — which wants Authorization: Bearer — cannot be configured from
@@ -316,6 +335,9 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Get("/mail-address", s.handleGetMailAddress)
 			r.Post("/mail-address/rotate", s.handleRotateMailAddress)
 
+			r.Get("/hook-url", s.handleGetHookURL)
+			r.Post("/hook-url/rotate", s.handleRotateHookURL)
+
 			// Personal API tokens. Behind requireSession rather than the ambient
 			// auth: a token must not be able to mint or revoke another.
 			r.Route("/tokens", func(r chi.Router) {
@@ -345,6 +367,14 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Post("/", s.handleCreateNote)
 				r.Post("/import", s.handleImportNotes)
 				r.Get("/linking/{kind}/{targetID}", s.handleNotesLinking)
+				// Sharing a note with a person directly — its own access list, beside
+				// the project path. Owner only; see notes_share_handlers.go.
+				r.Get("/{noteID}/shares", s.handleListNoteShares)
+				r.Post("/{noteID}/shares", s.handleShareNote)
+				r.Delete("/{noteID}/shares/{userID}", s.handleUnshareNote)
+				// En invitation til en note er en deling, der venter på en konto.
+				// Den kan tages tilbage indtil den bruges; se handleShareNote.
+				r.Delete("/{noteID}/invites/{inviteID}", s.handleDeleteNoteInvite)
 				r.Get("/{noteID}", s.handleGetNote)
 				r.Patch("/{noteID}", s.handleUpdateNote)
 				r.Delete("/{noteID}", s.handleDeleteNote)
@@ -543,6 +573,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 					r.Post("/complete", s.handleCompleteTask)
 					r.Post("/reopen", s.handleReopenTask)
 					r.Post("/move", s.handleMoveTask)
+					r.Post("/snooze", s.handleSnoozeTask)
 				})
 			})
 		})
@@ -665,6 +696,31 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler {
 		h.Set("X-Frame-Options", "DENY")
 		h.Set("Referrer-Policy", "same-origin")
 		h.Set("Content-Security-Policy", s.csp)
+		// The session lives in a __Host- cookie that only exists over HTTPS, so the
+		// whole security model already assumes TLS. HSTS is what makes that
+		// assumption hold against a network attacker: without it, the very first
+		// navigation can be stripped to http:// and the cookie handed over in the
+		// clear. Gated on the same condition as the cookie's Secure flag, so a
+		// plain-HTTP dev instance is never told to demand a certificate it cannot
+		// present. Two years, subdomains included; no preload directive, because
+		// asking to be hard-coded into browsers is a decision the operator makes
+		// for their domain, not one a self-hosted app makes for them.
+		if s.secureCookies() {
+			h.Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
+		}
+		// verdande uses none of the powerful browser features, so the safest policy
+		// is to turn them all off: an injected element cannot ask for the camera,
+		// the microphone or the location if the page itself has already declined
+		// them. Named explicitly rather than with a wildcard because the wildcard
+		// form of this header is not universally understood, and a directive a
+		// browser ignores is not a control.
+		h.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), "+
+			"payment=(), usb=(), interest-cohort=()")
+		// Isolate the browsing context: a window this page opened, or one that
+		// opened it, cannot keep a handle across the origin boundary. verdande
+		// never scripts another window, so there is nothing to lose and a whole
+		// class of cross-window attacks to close.
+		h.Set("Cross-Origin-Opener-Policy", "same-origin")
 		next.ServeHTTP(w, r)
 	})
 }

internal/httpapi/tasks_handlers.go

@@ -16,23 +16,24 @@ import (
 )
 
 type taskJSON struct {
-	ID          string   `json:"id"`
-	ProjectID   string   `json:"project_id"`
-	SectionID   string   `json:"section_id,omitempty"`
-	ParentID    string   `json:"parent_id,omitempty"`
-	Content     string   `json:"content"`
-	Description string   `json:"description,omitempty"`
-	Priority    int      `json:"priority"`
-	DueDate     string   `json:"due_date,omitempty"`
-	DueDatetime string   `json:"due_datetime,omitempty"`
-	DurationMin *int     `json:"duration_min,omitempty"`
-	Recurrence  string   `json:"recurrence_rule,omitempty"`
-	RepeatText  string   `json:"recurrence_text,omitempty"`
-	AssigneeID  string   `json:"assignee_id,omitempty"`
-	Labels      []string `json:"labels"`
-	Completed   bool     `json:"completed"`
-	CompletedAt string   `json:"completed_at,omitempty"`
-	CreatedBy   string   `json:"created_by"`
+	ID           string   `json:"id"`
+	ProjectID    string   `json:"project_id"`
+	SectionID    string   `json:"section_id,omitempty"`
+	ParentID     string   `json:"parent_id,omitempty"`
+	Content      string   `json:"content"`
+	Description  string   `json:"description,omitempty"`
+	Priority     int      `json:"priority"`
+	DueDate      string   `json:"due_date,omitempty"`
+	DueDatetime  string   `json:"due_datetime,omitempty"`
+	DurationMin  *int     `json:"duration_min,omitempty"`
+	Recurrence   string   `json:"recurrence_rule,omitempty"`
+	RepeatText   string   `json:"recurrence_text,omitempty"`
+	AssigneeID   string   `json:"assignee_id,omitempty"`
+	Labels       []string `json:"labels"`
+	Completed    bool     `json:"completed"`
+	CompletedAt  string   `json:"completed_at,omitempty"`
+	SnoozedUntil string   `json:"snoozed_until,omitempty"`
+	CreatedBy    string   `json:"created_by"`
 	// What the row can say without being opened. Sent with every task rather than
 	// fetched when one is opened, because the point is that you see it in the list.
 	SubtaskCount    int     `json:"subtask_count,omitempty"`
@@ -67,6 +68,9 @@ func toTaskJSON(t store.Task) taskJSON {
 	if t.CompletedAt != nil {
 		j.CompletedAt = t.CompletedAt.Format(time.RFC3339)
 	}
+	if t.SnoozedUntil != nil {
+		j.SnoozedUntil = t.SnoozedUntil.Format(time.RFC3339)
+	}
 	return j
 }
 
@@ -241,6 +245,10 @@ func (s *Server) handleCreateTask(w http.ResponseWriter, r *http.Request) {
 	t.Labels = req.Labels
 	s.activity(r, t.ProjectID, t.ID, "task.created", map[string]any{"content": t.Content})
 	s.publish(t.ProjectID, "task.created", toTaskJSON(*t))
+	// Lavet til en anden med det samme. Det er den samme besked som at blive
+	// tildelt en, der allerede fandtes — hvad der ikke skal ske er, at den ene vej
+	// ind i "det her er dit nu" giver besked og den anden ikke.
+	s.notifyAssigned(r, t)
 	writeJSON(w, http.StatusCreated, toTaskJSON(*t))
 }
 
@@ -268,6 +276,17 @@ func (s *Server) handleUpdateTask(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// Læst før ændringen, og kun når der faktisk kommer en tildeling med i den:
+	// beskeden skal gå på *skiftet*, ikke på at feltet stod i forespørgslen. Den,
+	// der får en opgave tildelt igen, den allerede har, skal ikke have besked om
+	// det hver gang nogen retter en overskrift.
+	wasAssigned := ""
+	if req.AssigneeID != nil {
+		if before, err := s.db.GetTask(r.Context(), taskID, user.ID); err == nil {
+			wasAssigned = before.AssigneeID
+		}
+	}
+
 	u := store.TaskUpdate{
 		Description: req.Description, Priority: req.Priority,
 		SectionID: req.SectionID, ParentID: req.ParentID,
@@ -320,6 +339,9 @@ func (s *Server) handleUpdateTask(w http.ResponseWriter, r *http.Request) {
 	}
 	s.activity(r, t.ProjectID, t.ID, "task.updated", nil)
 	s.publish(t.ProjectID, "task.updated", toTaskJSON(*t))
+	if req.AssigneeID != nil && t.AssigneeID != wasAssigned {
+		s.notifyAssigned(r, t)
+	}
 	writeJSON(w, http.StatusOK, toTaskJSON(*t))
 }
 
@@ -698,3 +720,52 @@ func parseLimit(raw string, def, max int) int {
 	}
 	return n
 }
+
+type snoozeRequest struct {
+	// Until is an RFC3339 time to snooze to, or empty to wake the task now.
+	Until string `json:"until"`
+}
+
+// handleSnoozeTask parks a task until a time, or wakes it. Snooze changes nothing
+// but when the task wants to be seen — its due date and everything else stay put.
+func (s *Server) handleSnoozeTask(w http.ResponseWriter, r *http.Request) {
+	var req snoozeRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	taskID := chi.URLParam(r, "taskID")
+	user := userFrom(r.Context())
+
+	role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
+	if err != nil || !role.CanEdit() {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+
+	var until *time.Time
+	if strings.TrimSpace(req.Until) != "" {
+		parsed, perr := time.Parse(time.RFC3339, req.Until)
+		if perr != nil {
+			writeFieldErrors(w, map[string]string{"until": "must be an RFC3339 time"})
+			return
+		}
+		until = &parsed
+	}
+	if err := s.db.SnoozeTask(r.Context(), taskID, until); err != nil {
+		s.storeError(w, r, "snooze task", err)
+		return
+	}
+
+	t, err := s.db.GetTask(r.Context(), taskID, user.ID)
+	if err != nil {
+		s.storeError(w, r, "get task", err)
+		return
+	}
+	verb := "task.snoozed"
+	if until == nil {
+		verb = "task.unsnoozed"
+	}
+	s.activity(r, t.ProjectID, t.ID, verb, nil)
+	s.publish(t.ProjectID, "task.updated", toTaskJSON(*t))
+	writeJSON(w, http.StatusOK, toTaskJSON(*t))
+}

internal/httpapi/tasks_test.go

@@ -285,6 +285,49 @@ func TestTodayAndUpcoming(t *testing.T) {
 	}
 }
 
+// The horizon is the list's, and it is asked for per request: seven days is the
+// default, thirty is what Kommende offers for "when does this month get busy", and
+// anything past the cap is trimmed rather than refused — a client that asks for a
+// year gets a month, not a 400.
+func TestUpcomingHorizon(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, out := ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content":  "om tyve dage",
+		"due_date": userDate(t, 20),
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create: %d %v", resp.StatusCode, out)
+	}
+
+	count := func(query string) (int, int) {
+		t.Helper()
+		_, view := ts.do(t, "GET", "/api/v1/upcoming"+query, nil)
+		days, _ := view["days"].([]any)
+		var tasks int
+		for _, d := range days {
+			day, _ := d.(map[string]any)
+			list, _ := day["tasks"].([]any)
+			tasks += len(list)
+		}
+		return len(days), tasks
+	}
+
+	if n, found := count(""); n != 7 || found != 0 {
+		t.Errorf("default horizon returned %d days and %d tasks, want 7 and 0", n, found)
+	}
+	if n, found := count("?days=30"); n != 30 || found != 1 {
+		t.Errorf("days=30 returned %d days and %d tasks, want 30 and 1", n, found)
+	}
+	if n, _ := count("?days=365"); n != 31 {
+		t.Errorf("days=365 returned %d days, want it capped at 31", n)
+	}
+	if n, _ := count("?days=nonsense"); n != 7 {
+		t.Errorf("an unreadable days returned %d days, want the default 7", n)
+	}
+}
+
 func TestSearchFindsAcrossProjects(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)
@@ -1817,3 +1860,50 @@ func TestATaskIsFoundByAWordInsideAWord(t *testing.T) {
 		}
 	}
 }
+
+// A snoozed task sinks to the bottom of the list and greys until its time; waking
+// it puts it back. The list order is what the row's dimming rides on.
+func TestSnoozeSinksAndWakes(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, a := ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "Alfa"})
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "Bravo"})
+	aID, _ := a["id"].(string)
+
+	// Snooze Alfa two days out.
+	future := time.Now().Add(48 * time.Hour).UTC().Format(time.RFC3339)
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/"+aID+"/snooze", map[string]any{"until": future})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("snooze: %d %v", resp.StatusCode, body)
+	}
+	if body["snoozed_until"] == "" || body["snoozed_until"] == nil {
+		t.Error("the response does not carry snoozed_until")
+	}
+
+	// Alfa now sorts after Bravo, though it was created first.
+	order := func() []string {
+		_, list := ts.do(t, "GET", "/api/v1/tasks", nil)
+		var out []string
+		for _, raw := range list["tasks"].([]any) {
+			out = append(out, raw.(map[string]any)["content"].(string))
+		}
+		return out
+	}
+	got := order()
+	if len(got) != 2 || got[0] != "Bravo" || got[1] != "Alfa" {
+		t.Errorf("snoozed task did not sink: order = %v", got)
+	}
+
+	// Wake it, and it comes back above Bravo.
+	resp, body = ts.do(t, "POST", "/api/v1/tasks/"+aID+"/snooze", map[string]any{"until": ""})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("wake: %d %v", resp.StatusCode, body)
+	}
+	if s, _ := body["snoozed_until"].(string); s != "" {
+		t.Errorf("waking left snoozed_until set: %q", s)
+	}
+	if got := order(); got[0] != "Alfa" {
+		t.Errorf("woken task did not return: order = %v", got)
+	}
+}

internal/httpapi/totp_handlers.go

@@ -17,6 +17,9 @@ import (
 type totpSetupResponse struct {
 	Secret string `json:"secret"`
 	URI    string `json:"uri"`
+	// The URI as a scannable QR code (SVG). The secret and URI stay for typing in by
+	// hand on a device that cannot scan.
+	QR string `json:"qr"`
 }
 
 func (s *Server) handleTOTPSetup(w http.ResponseWriter, r *http.Request) {
@@ -54,7 +57,12 @@ func (s *Server) handleTOTPSetup(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "store totp secret", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, totpSetupResponse{Secret: secret, URI: uri})
+	qrSVG, err := auth.TOTPQRSVG(uri)
+	if err != nil {
+		s.internal(w, r, "render totp qr", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, totpSetupResponse{Secret: secret, URI: uri, QR: qrSVG})
 }
 
 type totpConfirmResponse struct {

internal/httpapi/views_handlers.go

@@ -51,7 +51,8 @@ type upcomingDay struct {
 	Tasks []taskJSON `json:"tasks"`
 }
 
-// handleUpcoming returns the next seven days, one entry per day.
+// handleUpcoming returns the next `days` days, one entry per day, seven by default
+// and at most a month.
 //
 // Empty days are included on purpose: the view is a calendar strip, and a Thursday
 // missing from the response because nothing is due would collapse the layout and
@@ -65,10 +66,14 @@ func (s *Server) handleUpcoming(w http.ResponseWriter, r *http.Request) {
 	from := start.Format("2006-01-02")
 	to := start.AddDate(0, 0, days-1).Format("2006-01-02")
 
+	// The row limit follows the window rather than sitting at a constant, or a
+	// month asked for with the same ceiling as a week would truncate the last days
+	// silently — and a day cut off the end of the answer looks exactly like a day
+	// with nothing due.
 	tasks, err := s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
 		DueFrom:   from,
 		DueBefore: to,
-		Limit:     1000,
+		Limit:     200 * days,
 	})
 	if err != nil {
 		s.internal(w, r, "upcoming", err)

internal/ics/ics.go

@@ -62,8 +62,13 @@ func Render(cal Calendar) string {
 
 	for _, t := range cal.Tasks {
 		writeTodo(&b, t, cal.Domain)
-		// A dated task also goes out as an event, for clients that ignore VTODO.
-		if t.DueDatetime != nil && !t.Completed {
+		// A dated task also goes out as an event, for the calendar apps that ignore
+		// VTODO — which is all of them: Apple Calendar and Google both drop a
+		// subscribed to-do on the floor and show only events. A task with a clock
+		// time becomes a timed event; one with only a date, an all-day event. Once
+		// this was limited to timed tasks, so a date-only task — most of them —
+		// simply never appeared in the calendar it was subscribed into.
+		if !t.Completed && (t.DueDatetime != nil || t.DueDate != "") {
 			writeEvent(&b, t, cal.Domain)
 		}
 	}
@@ -128,22 +133,31 @@ func writeTodo(b *strings.Builder, t Task, domain string) {
 }
 
 func writeEvent(b *strings.Builder, t Task, domain string) {
-	start := *t.DueDatetime
-	// Without a stated duration a task is shown as half an hour. A zero-length
-	// event collapses to an invisible sliver in most calendar grids.
-	minutes := 30
-	if t.DurationMin != nil && *t.DurationMin > 0 {
-		minutes = *t.DurationMin
-	}
-	end := start.Add(time.Duration(minutes) * time.Minute)
-
 	b.WriteString("BEGIN:VEVENT\r\n")
 	// A distinct UID suffix: the event and the to-do describe the same task, and
 	// sharing a UID would make a client treat them as two versions of one item.
 	writeLine(b, "UID:"+t.ID+"-event@"+domain)
 	writeLine(b, "DTSTAMP:"+utc(t.UpdatedAt))
-	writeLine(b, "DTSTART:"+utc(start))
-	writeLine(b, "DTEND:"+utc(end))
+
+	if t.DueDatetime != nil {
+		start := *t.DueDatetime
+		// Without a stated duration a task is shown as half an hour. A zero-length
+		// event collapses to an invisible sliver in most calendar grids.
+		minutes := 30
+		if t.DurationMin != nil && *t.DurationMin > 0 {
+			minutes = *t.DurationMin
+		}
+		writeLine(b, "DTSTART:"+utc(start))
+		writeLine(b, "DTEND:"+utc(start.Add(time.Duration(minutes)*time.Minute)))
+	} else {
+		// A date with no time is an all-day event. DTEND is exclusive — a one-day
+		// event ends on the following date — which is what keeps it a single day in
+		// the grid rather than bleeding into the next.
+		day := strings.ReplaceAll(t.DueDate, "-", "")
+		writeLine(b, "DTSTART;VALUE=DATE:"+day)
+		writeLine(b, "DTEND;VALUE=DATE:"+nextDay(t.DueDate))
+	}
+
 	writeLine(b, "SUMMARY:"+escape(t.Content))
 	if t.Description != "" {
 		writeLine(b, "DESCRIPTION:"+escape(t.Description))
@@ -157,6 +171,17 @@ func writeEvent(b *strings.Builder, t Task, domain string) {
 
 func utc(t time.Time) string { return t.UTC().Format("20060102T150405Z") }
 
+// nextDay is the YYYYMMDD after a YYYY-MM-DD date, for an all-day event's exclusive
+// DTEND. A malformed date is returned as its own compacted form rather than
+// dropped, so a task never loses its event over a bad string.
+func nextDay(date string) string {
+	d, err := time.Parse("2006-01-02", date)
+	if err != nil {
+		return strings.ReplaceAll(date, "-", "")
+	}
+	return d.AddDate(0, 0, 1).Format("20060102")
+}
+
 // escape applies RFC 5545 text escaping. A comma or semicolon in a task title is
 // a value separator in iCalendar, so an unescaped one silently truncates the
 // summary at that character in every client.

internal/ics/ics_test.go

@@ -102,19 +102,28 @@ func TestWholeDayDueDatesAreDates(t *testing.T) {
 
 // Google Calendar ignores VTODO. Timed tasks are therefore also emitted as events,
 // or a feed is useless in the calendar most people actually keep.
-func TestTimedTasksAlsoBecomeEvents(t *testing.T) {
+func TestDatedTasksBecomeEvents(t *testing.T) {
 	out := Render(sample())
 
-	if strings.Count(out, "BEGIN:VEVENT") != 1 {
-		t.Fatalf("got %d VEVENTs, want one for the single timed task",
-			strings.Count(out, "BEGIN:VEVENT"))
+	// Every dated, unfinished task becomes an event, so it shows in a calendar app
+	// that ignores VTODO — timed t1, and date-only t2 and t3. The finished t4 has no
+	// date and no event.
+	if got := strings.Count(out, "BEGIN:VEVENT"); got != 3 {
+		t.Fatalf("got %d VEVENTs, want 3 (one timed, two all-day)", got)
 	}
-	if !strings.Contains(out, "DTSTART:20260310T090000Z") {
-		t.Error("the event has no start")
+
+	// The timed one keeps its clock and its 45-minute duration.
+	if !strings.Contains(out, "DTSTART:20260310T090000Z") || !strings.Contains(out, "DTEND:20260310T094500Z") {
+		t.Error("the timed event's start or duration is wrong")
 	}
-	// 45 minutes of stated duration.
-	if !strings.Contains(out, "DTEND:20260310T094500Z") {
-		t.Error("the event's end does not reflect the task's duration")
+	// The date-only ones are all-day: a DATE start and an exclusive next-day end, so
+	// they sit on their own day rather than bleeding into the next.
+	if !strings.Contains(out, "DTSTART;VALUE=DATE:20260312") || !strings.Contains(out, "DTEND;VALUE=DATE:20260313") {
+		t.Error("the date-only event is not a single all-day event")
+	}
+	// A recurring date-only task carries its rule onto the event.
+	if !strings.Contains(out, "RRULE:FREQ=WEEKLY;BYDAY=MO") {
+		t.Error("the recurring task's event has no RRULE")
 	}
 	// The event must not share the to-do's UID, or clients treat them as one item.
 	if !strings.Contains(out, "UID:t1-event@todo.example.dk") {

internal/mail/mail.go

@@ -38,11 +38,30 @@ func New(cfg config.SMTP, baseURL string, log *slog.Logger) *Sender {
 func (s *Sender) Configured() bool { return s.cfg.Configured() }
 
 func (s *Sender) SendInvite(ctx context.Context, to, inviterName, projectName, link string, ttl time.Duration) error {
-	subject := fmt.Sprintf("%s har delt noget med dig i verdande", inviterName)
 	what := "verdande"
 	if projectName != "" {
 		what = "projektet “" + projectName + "”"
 	}
+	return s.sendInvite(ctx, to, inviterName, what, link, ttl)
+}
+
+// SendNoteInvite is the same letter about a single note.
+//
+// The title is in the mail because it is what makes the invitation mean anything —
+// "Kristian har inviteret dig til noten “Aftale om levering”" is a sentence
+// somebody can decide about, where "til en note" is one they have to click a link
+// to understand. It travels no further than the address the owner typed, which is
+// the address they chose to share the note with.
+func (s *Sender) SendNoteInvite(ctx context.Context, to, inviterName, noteTitle, link string, ttl time.Duration) error {
+	what := "en note"
+	if noteTitle != "" {
+		what = "noten “" + noteTitle + "”"
+	}
+	return s.sendInvite(ctx, to, inviterName, what, link, ttl)
+}
+
+func (s *Sender) sendInvite(ctx context.Context, to, inviterName, what, link string, ttl time.Duration) error {
+	subject := fmt.Sprintf("%s har delt noget med dig i verdande", inviterName)
 	body := fmt.Sprintf(`Hej
 
 %s har inviteret dig til %s.

internal/push/push.go

@@ -56,6 +56,13 @@ type Payload struct {
 	Body  string `json:"body,omitempty"`
 	URL   string `json:"url,omitempty"`
 	Tag   string `json:"tag,omitempty"`
+	// Unread er tallet, mærket på appens ikon skal stå på, når beskeden lander.
+	//
+	// Sendt med frem for talt i service-workeren. Den har ingen hukommelse mellem
+	// to opvågninger, så den kan kun lægge én til noget, den ikke ved hvad er — og
+	// et mærke, der tæller sig selv op, kommer aldrig ned igen af sig selv. Tallet
+	// er serverens, og serveren ved det i forvejen.
+	Unread int `json:"unread,omitempty"`
 }
 
 var b64 = base64.RawURLEncoding

internal/push/push_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/ecdh"
 	"crypto/rand"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -64,3 +65,25 @@ func testVAPID(t *testing.T) VAPID {
 	}
 	return VAPID{Public: pub, Private: priv, Subject: "mailto:kristian@example.dk"}
 }
+
+// Tallet til mærket på ikonet skal med i beskeden — og skal blive væk, når der
+// ikke er noget at sige. Service-workeren læser netop det: er `unread` ikke et
+// tal, står mærket, som det stod, frem for at blive nulstillet af en tælling, der
+// ikke lykkedes.
+func TestPayloadCarriesTheUnreadCount(t *testing.T) {
+	with, err := json.Marshal(Payload{Title: "hej", Unread: 3})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(with), `"unread":3`) {
+		t.Errorf("payload = %s, want the unread count in it", with)
+	}
+
+	without, err := json.Marshal(Payload{Title: "hej"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(without), "unread") {
+		t.Errorf("payload = %s, want no count when there is none to send", without)
+	}
+}

internal/store/invites.go

@@ -16,6 +16,7 @@ type Invite struct {
 	ID        string
 	Email     string
 	ProjectID string // empty for an invite to the instance rather than to a project
+	NoteID    string // set when the invite is to a single note
 	Role      Role
 	CreatedBy string
 	CreatedAt time.Time
@@ -68,36 +69,46 @@ func (db *DB) CreateFirstAdmin(ctx context.Context, u *User, inboxName string) e
 	})
 }
 
-// CreateInvite issues an invite and returns the token for the emailed link.
-// projectID may be empty, which invites somebody to the instance rather than to a
-// particular project.
+// CreateInvite issues an invite to a project and returns the token for the emailed
+// link. projectID may be empty, which invites somebody to the instance rather than
+// to a particular project.
 func (db *DB) CreateInvite(ctx context.Context, email, projectID string, role Role, createdBy string, ttl time.Duration) (string, *Invite, error) {
-	if !role.Valid() {
-		return "", nil, fmt.Errorf("store: %q is not a role", role)
+	return db.createInvite(ctx, &Invite{Email: email, ProjectID: projectID, Role: role, CreatedBy: createdBy}, ttl)
+}
+
+// CreateNoteInvite issues an invite to a single note.
+//
+// Same row, same token, same link as a project invite — the difference is only
+// what the person gets when they arrive, and that is settled in AcceptInvite. A
+// second table for "invited to a note" would have meant a second signup path to
+// keep in step with this one, and the two would drift the first time either was
+// touched.
+func (db *DB) CreateNoteInvite(ctx context.Context, email, noteID string, role Role, createdBy string, ttl time.Duration) (string, *Invite, error) {
+	if noteID == "" {
+		return "", nil, errors.New("store: a note invite needs a note")
+	}
+	return db.createInvite(ctx, &Invite{Email: email, NoteID: noteID, Role: role, CreatedBy: createdBy}, ttl)
+}
+
+func (db *DB) createInvite(ctx context.Context, inv *Invite, ttl time.Duration) (string, *Invite, error) {
+	if !inv.Role.Valid() {
+		return "", nil, fmt.Errorf("store: %q is not a role", inv.Role)
 	}
 	token, err := auth.NewToken()
 	if err != nil {
 		return "", nil, err
 	}
 	now := time.Now().UTC()
-	inv := &Invite{
-		ID:        NewID(),
-		Email:     NormalizeEmail(email),
-		ProjectID: projectID,
-		Role:      role,
-		CreatedBy: createdBy,
-		CreatedAt: now,
-		ExpiresAt: now.Add(ttl),
-	}
+	inv.ID = NewID()
+	inv.Email = NormalizeEmail(inv.Email)
+	inv.CreatedAt = now
+	inv.ExpiresAt = now.Add(ttl)
 
-	var project any
-	if projectID != "" {
-		project = projectID
-	}
 	_, err = db.ExecContext(ctx,
-		`INSERT INTO invites (id, email, project_id, role, token_hash, created_by, created_at, expires_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-		inv.ID, inv.Email, project, string(inv.Role), auth.HashToken(token),
+		`INSERT INTO invites (id, email, project_id, note_id, role, token_hash, created_by, created_at, expires_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		inv.ID, inv.Email, nullString(inv.ProjectID), nullString(inv.NoteID),
+		string(inv.Role), auth.HashToken(token),
 		inv.CreatedBy, inv.CreatedAt.Unix(), inv.ExpiresAt.Unix())
 	if err != nil {
 		return "", nil, err
@@ -112,14 +123,14 @@ func (db *DB) InviteByToken(ctx context.Context, token string) (*Invite, error)
 		return nil, ErrInviteInvalid
 	}
 	var inv Invite
-	var projectID sql.NullString
+	var projectID, noteID sql.NullString
 	var created, expires int64
 	var accepted sql.NullInt64
 
 	err := db.QueryRowContext(ctx,
-		`SELECT id, email, project_id, role, created_by, created_at, expires_at, accepted_at
+		`SELECT id, email, project_id, note_id, role, created_by, created_at, expires_at, accepted_at
 		 FROM invites WHERE token_hash = ?`, auth.HashToken(token)).
-		Scan(&inv.ID, &inv.Email, &projectID, &inv.Role, &inv.CreatedBy, &created, &expires, &accepted)
+		Scan(&inv.ID, &inv.Email, &projectID, &noteID, &inv.Role, &inv.CreatedBy, &created, &expires, &accepted)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrInviteInvalid
 	}
@@ -131,6 +142,7 @@ func (db *DB) InviteByToken(ctx context.Context, token string) (*Invite, error)
 	}
 
 	inv.ProjectID = projectID.String
+	inv.NoteID = noteID.String
 	inv.CreatedAt = time.Unix(created, 0).UTC()
 	inv.ExpiresAt = time.Unix(expires, 0).UTC()
 	return &inv, nil
@@ -144,10 +156,16 @@ type PendingInvite struct {
 	Email       string
 	ProjectID   string
 	ProjectName string
-	Role        Role
-	InvitedBy   string
-	CreatedAt   time.Time
-	ExpiresAt   time.Time
+	// NoteID is set for an invitation to a single note. The note is named by its
+	// id and never by its title: titles are sealed in the database, and a private
+	// note's first line is not something an administrator's user list should
+	// spell out. That there is an account on its way is the administrator's
+	// business; what it was invited to read is not.
+	NoteID    string
+	Role      Role
+	InvitedBy string
+	CreatedAt time.Time
+	ExpiresAt time.Time
 }
 
 // ListPendingInvites returns invites that are neither accepted nor expired.
@@ -159,7 +177,8 @@ type PendingInvite struct {
 // able to say which it is.
 func (db *DB) ListPendingInvites(ctx context.Context) ([]PendingInvite, error) {
 	rows, err := db.QueryContext(ctx, `
-		SELECT i.id, i.email, COALESCE(i.project_id, ''), COALESCE(p.name, ''), i.role,
+		SELECT i.id, i.email, COALESCE(i.project_id, ''), COALESCE(p.name, ''),
+		       COALESCE(i.note_id, ''), i.role,
 		       COALESCE(u.name, ''), i.created_at, i.expires_at
 		FROM invites i
 		LEFT JOIN projects p ON p.id = i.project_id
@@ -175,8 +194,8 @@ func (db *DB) ListPendingInvites(ctx context.Context) ([]PendingInvite, error) {
 	for rows.Next() {
 		var p PendingInvite
 		var created, expires int64
-		if err := rows.Scan(&p.ID, &p.Email, &p.ProjectID, &p.ProjectName, &p.Role,
-			&p.InvitedBy, &created, &expires); err != nil {
+		if err := rows.Scan(&p.ID, &p.Email, &p.ProjectID, &p.ProjectName, &p.NoteID,
+			&p.Role, &p.InvitedBy, &created, &expires); err != nil {
 			return nil, err
 		}
 		p.CreatedAt = time.Unix(created, 0).UTC()
@@ -200,12 +219,16 @@ func (db *DB) DeleteInvite(ctx context.Context, inviteID string) error {
 	return nil
 }
 
-// AcceptInvite marks the invite used and grants the membership it promised, in one
+// AcceptInvite marks the invite used and grants what it promised, in one
 // transaction. Splitting the two would allow a signup to fail partway and leave a
 // live invite behind, which is a link that still works after it has been used.
 //
 // The UPDATE is guarded on accepted_at IS NULL, so two requests racing with the
-// same link produce one membership and one failure rather than two memberships.
+// same link produce one grant and one failure rather than two.
+//
+// What is granted depends on what the invite was to: a project membership, a share
+// on a single note, or — when it carries neither — nothing beyond the account the
+// caller has just created.
 func (db *DB) AcceptInvite(ctx context.Context, inviteID, userID string) error {
 	return db.Tx(ctx, func(tx *sql.Tx) error {
 		res, err := tx.ExecContext(ctx,
@@ -218,13 +241,40 @@ func (db *DB) AcceptInvite(ctx context.Context, inviteID, userID string) error {
 			return ErrInviteInvalid
 		}
 
-		var projectID sql.NullString
+		var projectID, noteID sql.NullString
 		var role Role
+		var invitedBy string
 		if err := tx.QueryRowContext(ctx,
-			`SELECT project_id, role FROM invites WHERE id = ?`, inviteID).
-			Scan(&projectID, &role); err != nil {
+			`SELECT project_id, note_id, role, created_by FROM invites WHERE id = ?`, inviteID).
+			Scan(&projectID, &noteID, &role, &invitedBy); err != nil {
 			return err
 		}
+
+		if noteID.Valid && noteID.String != "" {
+			// created_by is the person who invited, not the person arriving: the row
+			// records who did the sharing, the same as a share made from the panel.
+			//
+			// The note may have been deleted between the invite and the signup. The
+			// foreign key would refuse the row and take the whole signup with it, so
+			// the note is looked up first and a share on a note that is gone is
+			// simply not made — the account is still worth creating.
+			var alive int
+			if err := tx.QueryRowContext(ctx,
+				`SELECT count(*) FROM notes WHERE id = ? AND deleted_at IS NULL AND created_by <> ?`,
+				noteID.String, userID).Scan(&alive); err != nil {
+				return err
+			}
+			if alive == 0 {
+				return nil
+			}
+			_, err = tx.ExecContext(ctx, `
+				INSERT INTO note_shares (note_id, user_id, role, created_by, created_at)
+				VALUES (?, ?, ?, ?, ?)
+				ON CONFLICT (note_id, user_id) DO UPDATE SET role = excluded.role`,
+				noteID.String, userID, string(role), invitedBy, time.Now().Unix())
+			return err
+		}
+
 		if !projectID.Valid || projectID.String == "" {
 			return nil // an invite to the instance, with no project attached
 		}
@@ -240,6 +290,81 @@ func (db *DB) AcceptInvite(ctx context.Context, inviteID, userID string) error {
 	})
 }
 
+// --- invitationer til én note ----------------------------------------------------
+
+// NoteInvite is somebody who has been invited to a note and has not arrived yet.
+// The email address is the whole of who they are — there is no account to name
+// them by, which is the entire reason the row exists.
+type NoteInvite struct {
+	ID        string    `json:"id"`
+	Email     string    `json:"email"`
+	Role      Role      `json:"role"`
+	CreatedAt time.Time `json:"-"`
+	ExpiresAt time.Time `json:"-"`
+}
+
+// ListNoteInvites is who has been invited to a note and not yet taken it up.
+//
+// The panel needs them beside the people who *are* on the note: without this, an
+// invitation sent yesterday is invisible, and the owner sends it again — a second
+// link to the same inbox, and no way to take either back.
+//
+// Expired ones are left out, the same rule the administrator's list follows: an
+// invite past its date is not something anybody can act on.
+func (db *DB) ListNoteInvites(ctx context.Context, noteID string) ([]NoteInvite, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT id, email, role, created_at, expires_at
+		FROM invites
+		WHERE note_id = ? AND accepted_at IS NULL AND expires_at > ?
+		ORDER BY created_at`, noteID, time.Now().Unix())
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []NoteInvite{}
+	for rows.Next() {
+		var i NoteInvite
+		var created, expires int64
+		if err := rows.Scan(&i.ID, &i.Email, &i.Role, &created, &expires); err != nil {
+			return nil, err
+		}
+		i.CreatedAt = time.Unix(created, 0).UTC()
+		i.ExpiresAt = time.Unix(expires, 0).UTC()
+		out = append(out, i)
+	}
+	return out, rows.Err()
+}
+
+// DeleteNoteInvite withdraws an invitation to a note, and refuses to withdraw
+// anything else.
+//
+// The note id is part of the WHERE rather than checked beforehand: the owner has
+// been established for *this* note, and one statement that can only touch this
+// note's rows cannot be talked into deleting a project invite by id.
+func (db *DB) DeleteNoteInvite(ctx context.Context, noteID, inviteID string) error {
+	res, err := db.ExecContext(ctx,
+		`DELETE FROM invites WHERE id = ? AND note_id = ?`, inviteID, noteID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// PendingNoteInvite reports whether this address already has a live invitation to
+// this note, so a second attempt can say so instead of sending a second link.
+func (db *DB) PendingNoteInvite(ctx context.Context, noteID, email string) (bool, error) {
+	var n int
+	err := db.QueryRowContext(ctx, `
+		SELECT count(*) FROM invites
+		WHERE note_id = ? AND email = ? AND accepted_at IS NULL AND expires_at > ?`,
+		noteID, NormalizeEmail(email), time.Now().Unix()).Scan(&n)
+	return n > 0, err
+}
+
 // --- password resets ----------------------------------------------------------
 
 // CreatePasswordReset invalidates any outstanding reset for the user before issuing

internal/store/mentions.go

@@ -0,0 +1,116 @@
+package store
+
+import (
+	"sort"
+	"strings"
+	"unicode"
+)
+
+// MentionsIn reads the people named with an @ out of a body, and returns their
+// ids in the order they are written.
+//
+// Slået op i navnene frem for tolket ud af teksten. Et navn kan have mellemrum,
+// bindestreg og punktum i sig, og et udtryk, der skulle fange dem alle, ville
+// også fange sætningen bagefter: `@Sofie i morgen` ville blive til en person, der
+// hedder "Sofie i morgen", og ellers til "Sofie", alt efter hvor grådigt det var
+// skrevet. Her er der ikke noget at gætte — der står et navn, eller der gør ikke.
+//
+// Det er også dét, der gør det forsvarligt at *dele* på: en omtale giver adgang,
+// og adgang må ikke afhænge af, hvor langt et regulært udtryk valgte at læse.
+//
+// Længste navn først, så "@Sofie Jensen" bliver Sofie Jensen og ikke Sofie med et
+// efternavn hængende bagefter — også når begge findes som konti.
+func MentionsIn(body string, people []Person) []string {
+	if body == "" || len(people) == 0 {
+		return nil
+	}
+	lower := strings.ToLower(body)
+
+	byLength := make([]Person, len(people))
+	copy(byLength, people)
+	sort.SliceStable(byLength, func(i, j int) bool {
+		return len(byLength[i].Name) > len(byLength[j].Name)
+	})
+
+	// Hvilke tegn der allerede er læst som en del af en omtale. Uden det ville
+	// "@Sofie Jensen" også tælle som en omtale af Sofie, hvis begge er konti — og
+	// noten ville blive delt med en, der ikke står i den.
+	claimed := make([]bool, len(body))
+	found := map[string]int{} // bruger -> hvor i teksten, så rækkefølgen kan bæres
+
+	for _, p := range byLength {
+		name := strings.ToLower(strings.TrimSpace(p.Name))
+		if name == "" || p.ID == "" {
+			continue
+		}
+		needle := "@" + name
+		for at := 0; ; {
+			i := strings.Index(lower[at:], needle)
+			if i < 0 {
+				break
+			}
+			i += at
+			at = i + len(needle)
+
+			end := i + len(needle)
+			if overlaps(claimed, i, end) || !isMention(body, i, end) {
+				continue
+			}
+			for j := i; j < end; j++ {
+				claimed[j] = true
+			}
+			if _, seen := found[p.ID]; !seen {
+				found[p.ID] = i
+			}
+		}
+	}
+
+	out := make([]string, 0, len(found))
+	for id := range found {
+		out = append(out, id)
+	}
+	sort.Slice(out, func(i, j int) bool { return found[out[i]] < found[out[j]] })
+	return out
+}
+
+func overlaps(claimed []bool, from, to int) bool {
+	for i := from; i < to && i < len(claimed); i++ {
+		if claimed[i] {
+			return true
+		}
+	}
+	return false
+}
+
+// isMention er de to kanter om navnet.
+//
+// Foran: begyndelsen af noten eller noget, der ikke er en bogstavstavelse — så en
+// e-mailadresse ikke bliver til en omtale, fordi der tilfældigvis står et navn
+// efter snabel-a'et.
+//
+// Bagved: ikke midt i et længere ord. "@Sofies kalender" er skrevet om Sofie og
+// tæller med — ejefaldets s hører til sætningen, ikke til en anden person — men
+// "@Sofienberg" er et sted og ikke en, der skal have noten delt. Grænsen er sat
+// ved, at et bogstav *lige* efter navnet kun må være et ejefalds-s.
+func isMention(body string, from, to int) bool {
+	runes := []rune(body[:from])
+	if len(runes) > 0 {
+		prev := runes[len(runes)-1]
+		if unicode.IsLetter(prev) || unicode.IsDigit(prev) || prev == '@' {
+			return false
+		}
+	}
+
+	rest := body[to:]
+	if rest == "" {
+		return true
+	}
+	next := []rune(rest)
+	if next[0] == 's' || next[0] == 'S' {
+		next = next[1:]
+		if len(next) == 0 {
+			return true
+		}
+	}
+	return !unicode.IsLetter(next[0]) && !unicode.IsDigit(next[0])
+}

internal/store/mentions_test.go

@@ -0,0 +1,54 @@
+package store
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestMentionsIn(t *testing.T) {
+	people := []Person{
+		{ID: "sofie", Name: "Sofie"},
+		{ID: "sofie-jensen", Name: "Sofie Jensen"},
+		{ID: "kristian", Name: "Kristian"},
+	}
+
+	for _, tc := range []struct {
+		name string
+		body string
+		want []string
+	}{
+		{"ingen omtale", "En helt almindelig note om noget", nil},
+		{"én omtale", "@Sofie kan du kigge på det her?", []string{"sofie"}},
+		{"midt i en sætning", "Aftalt med @Kristian i går", []string{"kristian"}},
+		{"uden hensyn til store bogstaver", "@sofie ja", []string{"sofie"}},
+		{"to omtaler i den rækkefølge de står", "@Kristian og @Sofie", []string{"kristian", "sofie"}},
+		{"den samme to gange er én", "@Sofie ... og @Sofie igen", []string{"sofie"}},
+		// Det lange navn vinder, og det korte tælles ikke med oveni: noten deles
+		// med den, der står i den, og ikke også med en, der ikke gør.
+		{"længste navn vinder", "@Sofie Jensen kigger på det", []string{"sofie-jensen"}},
+		// En adresse er ikke en omtale. Ellers ville enhver note med en mailadresse
+		// i sig dele sig selv med den, der tilfældigvis hedder noget efter snabel-a.
+		{"e-mailadresse", "skriv til hej@Sofie.dk", nil},
+		{"ejefald tæller med", "det står i @Sofies kalender", []string{"sofie"}},
+		{"et længere ord gør ikke", "vi mødtes på @Sofienberg", nil},
+		{"ukendt navn", "@Ingen her", nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := MentionsIn(tc.body, people)
+			if len(got) == 0 && len(tc.want) == 0 {
+				return
+			}
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("MentionsIn(%q) = %v, want %v", tc.body, got, tc.want)
+			}
+		})
+	}
+}
+
+// Ingen mennesker, ingen omtaler: opslaget sker i navnene, så en tom liste er et
+// tomt svar frem for et gæt på, hvad et @ mon betød.
+func TestMentionsInWithoutPeople(t *testing.T) {
+	if got := MentionsIn("@Sofie hej", nil); got != nil {
+		t.Errorf("got %v, want nothing to resolve against", got)
+	}
+}

internal/store/migrations/0029_totp_single_use.sql

@@ -0,0 +1,11 @@
+-- A TOTP code is meant to be usable once. RFC 6238 says so in as many words: the
+-- verifier must reject a code that has already been accepted, or a code observed in
+-- flight — over the shoulder, off a phishing page, out of a proxy — can be replayed
+-- for the rest of its thirty-second window.
+--
+-- totp_last_step records the counter of the most recently accepted code (Unix time
+-- divided by the period). A login accepts a code only when its step is strictly
+-- greater, so the same code cannot be spent twice and time cannot run backwards.
+-- Null means no code has been accepted yet, which is every account until its owner
+-- next signs in with one.
+ALTER TABLE users ADD COLUMN totp_last_step INTEGER;

internal/store/migrations/0030_note_shares.sql

@@ -0,0 +1,30 @@
+-- Sharing a note with a person, rather than only by filing it in a shared project.
+--
+-- Until now a note was shared exactly one way: put it in a project, and everyone
+-- who could read the project could read the note. That is the right tool when the
+-- note belongs with a body of work, and the wrong one when it is just "let Sofie
+-- see this" — it makes you stand up a project to hand over a single page.
+--
+-- A note_shares row is that direct grant: this note, this person, this role. It
+-- sits alongside the project path, not instead of it — a note can be loose, filed,
+-- shared with people, or any combination, and access is the most that any of those
+-- allow. Only the note's owner (its created_by) writes these rows.
+--
+-- role is 'viewer' or 'editor', the same words a project membership uses, so there
+-- is one idea of what a role means in this program and not two.
+CREATE TABLE note_shares (
+    note_id    TEXT NOT NULL REFERENCES notes (id) ON DELETE CASCADE,
+    user_id    TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    role       TEXT NOT NULL DEFAULT 'viewer',
+    created_by TEXT REFERENCES users (id) ON DELETE SET NULL,
+    created_at INTEGER NOT NULL,
+
+    -- One share per person per note: sharing again changes the role, it does not
+    -- add a second row that the first would then quietly disagree with.
+    PRIMARY KEY (note_id, user_id)
+);
+
+-- "Which notes are shared with me" is asked on every visit to the notes page, to
+-- build the Delt med mig group and to widen what the list may show. It is a lookup
+-- by user_id, so that is what carries the index.
+CREATE INDEX note_shares_by_user ON note_shares (user_id);

internal/store/migrations/0031_task_snooze.sql

@@ -0,0 +1,7 @@
+-- Snooze: put a task out of the way without finishing or filing it. A snoozed task
+-- sinks to the bottom of its list and greys out until the time it is snoozed to,
+-- then comes back on its own — no job wakes it, because "snoozed" is simply
+-- snoozed_until being still in the future, read against the clock each time.
+--
+-- Null means not snoozed, which is every task until somebody snoozes one.
+ALTER TABLE tasks ADD COLUMN snoozed_until INTEGER;

internal/store/migrations/0032_shares_follow_links.sql

@@ -0,0 +1,22 @@
+-- De noter, en delt note peger på, følger med delingen.
+--
+-- Et `[[link]]` i en note, der er delt, pegede indtil nu på noget, modtageren
+-- ikke havde fået. Linket stod der, kunne ses, og førte ingen steder hen — meldt
+-- af den første, der prøvede at læse en delt note, og med rette: den, der deler
+-- en note, deler det, noten *siger*, og et link er en del af det, den siger.
+--
+-- Rækken er den samme som en almindelig deling. `linked` er den ene forskel: den
+-- siger, at rækken ikke er valgt af nogen, men udledt af, hvad noten peger på.
+-- Det gør to ting muligt, som en boolsk værdi ellers sjældent gør sig fortjent
+-- til. Fladen kan sige *hvorfor* en person har den note — "den fulgte med" er en
+-- anden sætning end "du delte den". Og udledningen kan regnes forfra hver gang:
+-- de udledte rækker må slettes og skrives igen efter hver ændring, mens de
+-- valgte aldrig røres. Uden skellet ville en oprydning enten lade forældede
+-- delinger blive stående eller fjerne dem, ejeren selv havde sat.
+--
+-- Kun ejerens egne noter følger med. Et link peger på en *titel*, og titler kan
+-- skrives af enhver, der må rette i noten — så hvis et link kunne hente hvad som
+-- helst, ville en medredaktør kunne skrive `[[Bankoplysninger]]` og læse med.
+-- Opslaget sker derfor kun blandt de noter, ejeren selv ejer, og deling af dem
+-- har ejeren allerede ret til.
+ALTER TABLE note_shares ADD COLUMN linked INTEGER NOT NULL DEFAULT 0;

internal/store/migrations/0033_notifications_about_notes.sql

@@ -0,0 +1,18 @@
+-- En besked kan handle om en note.
+--
+-- Tabellen kunne pege på et projekt og en opgave, fordi det var de to ting, der
+-- kunne ske noget med. Nu kan der også: en note, der er delt, bliver rettet af en
+-- anden, og den, den er delt med, skal kunne se at det er sket — uden at åbne den
+-- for at opdage det.
+--
+-- En søjle ved siden af de to andre frem for et generisk (kind, id)-par. De tre er
+-- ikke det samme slags nul: en besked om en opgave har *også* et projekt, og en om
+-- en note har måske ingen af delene. Et par ville skulle tolkes hvert sted, det
+-- læses, og fremmednøglen — som er dén, der rydder beskeden op, når noten slettes
+-- — kan et generisk par slet ikke have.
+ALTER TABLE notifications ADD COLUMN note_id TEXT REFERENCES notes (id) ON DELETE CASCADE;
+
+-- Beskeder om den samme note bliver slået sammen, mens de er ulæste, og opslaget
+-- er nøjagtig det: min, ulæst, om denne note.
+CREATE INDEX notifications_unread_by_note
+    ON notifications (user_id, note_id) WHERE read_at IS NULL AND note_id IS NOT NULL;

internal/store/migrations/0034_invitationer_til_en_note.sql

@@ -0,0 +1,30 @@
+-- En invitation kan handle om en note.
+--
+-- En note kunne deles med nogen, der allerede havde en konto — og kun med dem.
+-- Skulle en, der ikke havde en, læse med, skulle man først invitere dem til
+-- instansen, vente på at de oprettede sig, og så finde noten frem og dele den. Tre
+-- skridt og en ventetid for det, der er én sætning: "lad Sofie se den her".
+--
+-- Rækken er den, der allerede findes. En invitation bærer i forvejen en e-mail, en
+-- rolle og et forseglet token; det eneste, der manglede, var at kunne sige, hvad
+-- den er en invitation *til*. project_id sagde det for projekter, og note_id siger
+-- det nu for noter.
+--
+-- To søjler frem for én kolonne med et id og en art ved siden af — samme valg som
+-- notifications traf i 0033, og af samme grund: fremmednøglen. ON DELETE CASCADE
+-- er dén, der rydder invitationen væk, når noten slettes, inden nogen når at tage
+-- imod en invitation til noget, der ikke er der længere. Et generisk par kan ikke
+-- have den nøgle, og oprydningen skulle så skrives i kode, der huskede at køre.
+--
+-- De to udelukker hinanden i praksis, men det står ikke som en CHECK: en
+-- invitation uden nogen af delene er den gyldige "kom med på instansen", og en
+-- regel, der skulle tillade nul eller én af to, ville skulle skrives om hver gang
+-- der kom en tredje slags ting at invitere til.
+ALTER TABLE invites ADD COLUMN note_id TEXT REFERENCES notes (id) ON DELETE CASCADE;
+
+-- Panelet under en note spørger "hvem er inviteret til den her, og har ikke taget
+-- imod endnu" hver gang, det åbnes. Det er opslaget, og det er derfor, det er
+-- indekset. Kun de uafklarede: en invitation, der er taget imod, er en deling nu
+-- og står i note_shares.
+CREATE INDEX invites_pending_by_note
+    ON invites (note_id) WHERE accepted_at IS NULL AND note_id IS NOT NULL;

internal/store/migrations/0035_en_krog_ind_i_indbakken.sql

@@ -0,0 +1,21 @@
+-- En personlig adresse, andre programmer kan skubbe en opgave ind ad.
+--
+-- Der var to veje ind i forvejen, og ingen af dem passer til "gem den her, mens
+-- jeg står med telefonen i hånden". API-tokenet giver adgang til alt og skal have
+-- en JSON-krop skrevet rigtigt; mailadressen virker først, når nogen har sat en
+-- mailserver op, og går gennem en indbakke, der kan være minutter om det. Det, der
+-- manglede, var en URL, man kan smide en linje tekst efter.
+--
+-- Sit eget token frem for at låne mailens. De to er den samme slags hemmelighed,
+-- men de bliver kompromitteret hver for sig: en URL, der har ligget i en genvej på
+-- en telefon, der blev væk, skal kunne skiftes uden at mailadressen — som står i
+-- andres adressebøger — skifter med. Og omvendt.
+--
+-- Ikke et API-token. Et token herfra kan én ting: lave en opgave i den persons
+-- indbakke. Det er hele forskellen på en hemmelighed, man kan lægge i et script på
+-- en anden maskine, og en, man ikke kan.
+ALTER TABLE users ADD COLUMN hook_token TEXT;
+
+-- Opslaget er "hvem er det her token", og det er også dét, der skal være entydigt:
+-- to konti med det samme token er to konti, en opgave kan lande i.
+CREATE UNIQUE INDEX idx_users_hook_token ON users (hook_token) WHERE hook_token IS NOT NULL;

internal/store/names_test.go

@@ -0,0 +1,81 @@
+package store
+
+import (
+	"context"
+	"testing"
+)
+
+func TestNormalizeName(t *testing.T) {
+	cases := map[string]string{
+		"andreas":        "Andreas",
+		"Andreas":        "Andreas",
+		"anne mette":     "Anne Mette",
+		"  kristian  ":   "Kristian",
+		"anne   mette":   "Anne Mette",
+		"McDonald":       "McDonald", // an existing inner capital is kept
+		"óscar":          "Óscar",    // Unicode initial
+		"æblegaard":      "Æblegaard",
+		"":               "",
+		"   ":            "",
+		"mette-marie sø": "Mette-marie Sø", // only word-initials are raised
+		"iPhone listen":  "IPhone Listen",  // deliberately: the first letter is raised
+	}
+	for in, want := range cases {
+		if got := NormalizeName(in); got != want {
+			t.Errorf("NormalizeName(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestCreateUserCapitalisesName(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	u := &User{Email: "andreas@example.dk", Name: "andreas", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, u, "Inbox"); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	got, err := db.UserByEmail(ctx, "andreas@example.dk")
+	if err != nil {
+		t.Fatalf("read back: %v", err)
+	}
+	if got.Name != "Andreas" {
+		t.Errorf("stored name = %q, want %q", got.Name, "Andreas")
+	}
+}
+
+func TestNormalizeUserNamesBackfill(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	// An account as it looked before the app capitalised names: made properly,
+	// then set back to lower case behind the store's back to stand in for an old row.
+	u := &User{Email: "a@example.dk", Name: "Andreas", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, u, "Inbox"); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `UPDATE users SET name = 'andreas' WHERE id = ?`, u.ID); err != nil {
+		t.Fatalf("downgrade name: %v", err)
+	}
+
+	fixed, err := db.NormalizeUserNames(ctx)
+	if err != nil {
+		t.Fatalf("normalize: %v", err)
+	}
+	if fixed != 1 {
+		t.Fatalf("fixed = %d, want 1", fixed)
+	}
+	got, _ := db.UserByID(ctx, u.ID)
+	if got.Name != "Andreas" {
+		t.Errorf("name after backfill = %q, want %q", got.Name, "Andreas")
+	}
+
+	// Idempotent: nothing left to do on a second pass.
+	again, err := db.NormalizeUserNames(ctx)
+	if err != nil {
+		t.Fatalf("normalize again: %v", err)
+	}
+	if again != 0 {
+		t.Errorf("second pass fixed = %d, want 0", again)
+	}
+}

internal/store/note_shares.go

@@ -0,0 +1,412 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"sort"
+	"strings"
+	"time"
+)
+
+// NoteShare is one person's direct grant on a note: who they are, and what they
+// may do. The person is carried whole rather than by id, because every caller of
+// this wants to show them — a name and an avatar colour, never a bare id.
+type NoteShare struct {
+	User Person `json:"user"`
+	Role Role   `json:"role"`
+}
+
+// ShareNote grants a person a role on a note, or changes the role if they already
+// had one. The owner is passed so the row records who did the sharing; the caller
+// has already checked that they may.
+//
+// Sharing a note with its own owner is refused: the owner already has everything a
+// share could give, and a row saying otherwise is a contradiction waiting to
+// confuse the access check.
+func (db *DB) ShareNote(ctx context.Context, noteID, userID string, role Role, byUserID string) error {
+	if !role.Valid() || role == RoleOwner {
+		return errors.New("store: a note can be shared as viewer or editor")
+	}
+	var createdBy sql.NullString
+	if err := db.QueryRowContext(ctx,
+		`SELECT COALESCE(created_by, '') FROM notes WHERE id = ? AND deleted_at IS NULL`,
+		noteID).Scan(&createdBy.String); errors.Is(err, sql.ErrNoRows) {
+		return ErrNotFound
+	} else if err != nil {
+		return err
+	}
+	if createdBy.String == userID {
+		return errors.New("store: a note is already the owner's")
+	}
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO note_shares (note_id, user_id, role, created_by, created_at)
+		VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT (note_id, user_id) DO UPDATE SET role = excluded.role`,
+		noteID, userID, role, byUserID, time.Now().Unix())
+	return err
+}
+
+// UnshareNote removes a person's grant. Removing one that is not there is not an
+// error: the end state the caller asked for — this person cannot see this note —
+// is the same either way.
+func (db *DB) UnshareNote(ctx context.Context, noteID, userID string) error {
+	_, err := db.ExecContext(ctx,
+		`DELETE FROM note_shares WHERE note_id = ? AND user_id = ?`, noteID, userID)
+	return err
+}
+
+// ListNoteShares is who a note is shared with, each with their role, ordered by
+// name so the list under a note does not reshuffle every time it is opened.
+func (db *DB) ListNoteShares(ctx context.Context, noteID string) ([]NoteShare, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT u.id, u.name, u.avatar_color, s.role
+		FROM note_shares s
+		JOIN users u ON u.id = s.user_id
+		WHERE s.note_id = ?
+		ORDER BY lower(u.name)`, noteID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []NoteShare
+	for rows.Next() {
+		var s NoteShare
+		if err := rows.Scan(&s.User.ID, &s.User.Name, &s.User.AvatarColor, &s.Role); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// NoteShareRole is the role a person holds on a note through a direct share, if
+// any. The bool is whether a share exists at all — distinct from a share whose
+// role could not be read — so a caller does not have to treat "no share" as an
+// error.
+func (db *DB) NoteShareRole(ctx context.Context, noteID, userID string) (Role, bool, error) {
+	var role Role
+	err := db.QueryRowContext(ctx,
+		`SELECT role FROM note_shares WHERE note_id = ? AND user_id = ?`, noteID, userID).Scan(&role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	if !role.Valid() {
+		// A role the database holds but this build does not understand is no access,
+		// never a guess — the same rule project roles follow.
+		return "", false, nil
+	}
+	return role, true, nil
+}
+
+// NotesSharedWith returns the ids, among those given, that are shared directly with
+// the user. It answers the Delt med mig question in one query rather than one per
+// note, and takes the ids it is scoping so it never has to load a person's whole
+// world to mark a single page.
+func (db *DB) NotesSharedWith(ctx context.Context, userID string, noteIDs []string) (map[string]bool, error) {
+	out := map[string]bool{}
+	if len(noteIDs) == 0 {
+		return out, nil
+	}
+	args := make([]any, 0, len(noteIDs)+1)
+	args = append(args, userID)
+	for _, id := range noteIDs {
+		args = append(args, id)
+	}
+	rows, err := db.QueryContext(ctx,
+		`SELECT note_id FROM note_shares WHERE user_id = ? AND note_id IN (`+placeholders(len(noteIDs))+`)`,
+		args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		out[id] = true
+	}
+	return out, rows.Err()
+}
+
+// --- de noter, en delt note peger på ---------------------------------------------
+
+// LinkedShare is one note that followed a share: which note, what it is called,
+// and which of the owner's shared notes brought it. The panel shows all three —
+// "Prisliste came along with Aftale om levering" is a sentence somebody can act
+// on, where a bare id is not.
+type LinkedShare struct {
+	NoteID string `json:"note_id"`
+	Title  string `json:"title"`
+	ViaID  string `json:"via_id"`
+	Via    string `json:"via"`
+	Role   Role   `json:"role"`
+	UserID string `json:"user_id"`
+}
+
+// Hvor langt en deling må brede sig.
+//
+// En note, der peger på en note, der peger på en note, er stadig én ting at læse,
+// og den skal følge med. Men noter kan pege i ring og i vifte, og "del denne ene
+// note" må ikke kunne blive til fire hundrede. Loftet er ikke en optimering: det
+// er den grænse, hvor en deling holder op med at være noget, ejeren kan overskue.
+const linkedShareLimit = 100
+
+// SyncLinkedShares regner de udledte delinger forfra for alt, hvad én person ejer.
+//
+// Kaldt efter enhver af ejerens egne handlinger, der kan flytte svaret: en deling,
+// en fjernet deling, og en gemning, der har ændret på det, noten peger på. Regnet
+// forfra frem for rettet til, fordi det er den samme kode hver gang og derfor det
+// samme resultat hver gang — en tilføjelse og en fjernelse er ikke to veje gennem
+// koden, men det samme kald med et andet udgangspunkt.
+//
+// Kun *direkte* delinger er udgangspunkt. En note i et delt projekt er delt af
+// projektet, og projektets folk kan se projektets noter; det er en anden vej ind,
+// med sine egne regler, og den blander sig ikke her.
+//
+// Returnerer, hvad der nu følger med, så kalderen kan sige det. Det er meningen at
+// det bliver sagt: en deling, der stille tager tre noter mere med, er ikke til at
+// overskue, uanset hvor rigtigt den gør det.
+func (db *DB) SyncLinkedShares(ctx context.Context, ownerID string) ([]LinkedShare, error) {
+	if ownerID == "" {
+		return nil, nil
+	}
+
+	// Har personen ikke delt noget, er der intet at regne — og det er de fleste,
+	// det meste af tiden. Uden det her ville hvert eneste klik i notelisten åbne
+	// hver eneste note for at finde ud af, at svaret er tomt: fladen spørger til
+	// delingerne, hver gang man vælger en note, man selv ejer.
+	//
+	// Ét spørgsmål dækker begge halvdele. Er der ingen rækker overhovedet, er der
+	// hverken en deling at brede ud eller en udledt række at rydde op efter.
+	var anyShare int
+	if err := db.QueryRowContext(ctx, `
+		SELECT EXISTS(
+			SELECT 1 FROM note_shares s
+			JOIN notes n ON n.id = s.note_id
+			WHERE n.created_by = ?)`, ownerID).Scan(&anyShare); err != nil {
+		return nil, err
+	}
+	if anyShare == 0 {
+		return nil, nil
+	}
+
+	// Ejerens egne noter, åbnet. Titlerne er forseglet i basen, og et link peger på
+	// en titel — så der er ikke noget opslag at lave i SQL. Målt andetsteds i denne
+	// fil: tolv hundrede noter koster nogle og tredive millisekunder at åbne, og det
+	// her kører kun, når ejeren selv har gjort noget.
+	mine, err := db.notesWhere(ctx, `WHERE created_by = ? AND deleted_at IS NULL`, ownerID)
+	if err != nil {
+		return nil, err
+	}
+	byTitle := map[string]string{}
+	title := map[string]string{}
+	for _, n := range mine {
+		title[n.ID] = n.Title
+		key := strings.ToLower(strings.TrimSpace(n.Title))
+		// Den første vinder, og listen kommer sorteret med den senest rørte først:
+		// to noter med samme titel er sjældent, og når det sker, er den, man skrev
+		// sidst, den, man mente.
+		if key != "" {
+			if _, taken := byTitle[key]; !taken {
+				byTitle[key] = n.ID
+			}
+		}
+	}
+
+	// Hvad hver note peger på, i ét spørgsmål frem for ét pr. note.
+	links := map[string][]string{}
+	rows, err := db.QueryContext(ctx, `
+		SELECT l.note_id, l.target_id
+		FROM note_links l
+		JOIN notes n ON n.id = l.note_id
+		WHERE l.kind = 'note' AND n.created_by = ? AND n.deleted_at IS NULL`, ownerID)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var from, target string
+		if err := rows.Scan(&from, &target); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		links[from] = append(links[from], target)
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	// De delinger, ejeren selv har sat.
+	type grant struct{ noteID, userID string }
+	direct := map[grant]Role{}
+	rows, err = db.QueryContext(ctx, `
+		SELECT s.note_id, s.user_id, s.role
+		FROM note_shares s
+		JOIN notes n ON n.id = s.note_id
+		WHERE s.linked = 0 AND n.created_by = ? AND n.deleted_at IS NULL`, ownerID)
+	if err != nil {
+		return nil, err
+	}
+	for rows.Next() {
+		var g grant
+		var role Role
+		if err := rows.Scan(&g.noteID, &g.userID, &role); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		if role.Valid() {
+			direct[g] = role
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	// Vandringen. Pr. person, fordi det er personen, delingen handler om: to
+	// forskellige mennesker kan have to forskellige noter og derfor to forskellige
+	// vifter ud fra dem.
+	wanted := map[grant]LinkedShare{}
+	perUser := map[string][]grant{}
+	for g := range direct {
+		perUser[g.userID] = append(perUser[g.userID], g)
+	}
+	for userID, roots := range perUser {
+		seen := map[string]bool{}
+		type step struct {
+			noteID string
+			via    string
+		}
+
+		// Medredaktør først, læser bagefter, og hver runde tømt for sig.
+		//
+		// En note kan nås fra to delte noter med hver sin rolle, og så skal den
+		// stærkeste gælde. Én kø med det hele i ville afgøre det på afstand frem for
+		// på rolle: et barnebarn af en redigerbar note ville tabe til et barn af en
+		// læsbar, fordi det stod længere bagude i køen. To runder gør reglen til
+		// rækkefølgen — er noten allerede nået som redigerbar, ser den anden runde
+		// den ikke.
+		for _, role := range []Role{RoleEditor, RoleViewer} {
+			var queue []step
+			for _, g := range roots {
+				if direct[g] != role || seen[g.noteID] {
+					continue
+				}
+				seen[g.noteID] = true
+				queue = append(queue, step{noteID: g.noteID, via: g.noteID})
+			}
+			for len(queue) > 0 && len(seen) <= linkedShareLimit {
+				cur := queue[0]
+				queue = queue[1:]
+				for _, target := range links[cur.noteID] {
+					id, ok := byTitle[strings.ToLower(strings.TrimSpace(target))]
+					// Et link, der ikke rammer en af ejerens egne noter, er enten
+					// dødt eller peger på en andens note. Ingen af delene er ejerens
+					// at dele.
+					if !ok || seen[id] {
+						continue
+					}
+					seen[id] = true
+					// Rollen arves fra den note, man kom fra. En medredaktør på en
+					// note bliver medredaktør på det, den peger på: teksten er én
+					// ting at arbejde i, og et link midt i den er ikke en grænse.
+					if _, isDirect := direct[grant{noteID: id, userID: userID}]; !isDirect {
+						wanted[grant{noteID: id, userID: userID}] = LinkedShare{
+							NoteID: id,
+							Title:  title[id],
+							ViaID:  cur.via,
+							Via:    title[cur.via],
+							Role:   role,
+							UserID: userID,
+						}
+					}
+					queue = append(queue, step{noteID: id, via: cur.via})
+				}
+			}
+		}
+	}
+
+	// Skrevet i én transaktion: mellem sletningen og skrivningen står basen med
+	// færre delinger, end den skal, og det er ikke et vindue nogen skal kunne læse i.
+	err = db.Tx(ctx, func(tx *sql.Tx) error {
+		if _, err := tx.ExecContext(ctx, `
+			DELETE FROM note_shares
+			WHERE linked = 1
+			  AND note_id IN (SELECT id FROM notes WHERE created_by = ?)`, ownerID); err != nil {
+			return err
+		}
+		for g, l := range wanted {
+			// DO NOTHING ved sammenstød: en direkte deling på den samme note er
+			// ejerens eget valg og har forrang. Den kan ikke nå herned — den er
+			// sorteret fra ovenfor — men reglen skal stå dér, hvor rækken skrives,
+			// ikke kun dér, hvor den udregnes.
+			if _, err := tx.ExecContext(ctx, `
+				INSERT INTO note_shares (note_id, user_id, role, created_by, created_at, linked)
+				VALUES (?, ?, ?, ?, ?, 1)
+				ON CONFLICT (note_id, user_id) DO NOTHING`,
+				g.noteID, g.userID, l.Role, ownerID, time.Now().Unix()); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	out := make([]LinkedShare, 0, len(wanted))
+	for _, l := range wanted {
+		out = append(out, l)
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].UserID != out[j].UserID {
+			return out[i].UserID < out[j].UserID
+		}
+		return strings.ToLower(out[i].Title) < strings.ToLower(out[j].Title)
+	})
+	return out, nil
+}
+
+// NoteAudience is everybody who can see a note: its owner, the people it is shared
+// with — chosen or followed along a link — and the members of the project it is
+// filed in.
+//
+// Ét spørgsmål frem for tre, fordi svaret skal være en mængde og ikke tre lister,
+// der skal lægges sammen bagefter: en person kan både eje projektet og have noten
+// delt direkte, og to beskeder om den samme rettelse er én for mange.
+//
+// The note's own row is joined rather than passed in, so a caller cannot ask about
+// a note that has been deleted and get an audience for it anyway.
+func (db *DB) NoteAudience(ctx context.Context, noteID string) ([]string, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT created_by FROM notes WHERE id = ? AND deleted_at IS NULL AND created_by IS NOT NULL
+		UNION
+		SELECT user_id FROM note_shares WHERE note_id = ?
+		UNION
+		SELECT p.owner_id FROM notes n JOIN projects p ON p.id = n.project_id
+		 WHERE n.id = ? AND n.deleted_at IS NULL AND p.deleted_at IS NULL
+		UNION
+		SELECT m.user_id FROM notes n JOIN project_members m ON m.project_id = n.project_id
+		 WHERE n.id = ? AND n.deleted_at IS NULL`,
+		noteID, noteID, noteID, noteID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		out = append(out, id)
+	}
+	return out, rows.Err()
+}

internal/store/notes.go

@@ -37,6 +37,17 @@ type Note struct {
 	// set by a caller: it is derived, and a caller that set it would be describing
 	// a note whose text says something else.
 	Links []NoteLink `json:"links,omitempty"`
+
+	// SharedWithMe is true when the person reading the list reached this note
+	// through a direct share rather than by owning it or being in its project. It
+	// is what puts the note in the Delt med mig group and shows whose note it is.
+	// Derived per request, so it is never stored and never set by a caller.
+	SharedWithMe bool `json:"shared_with_me,omitempty"`
+
+	// Owner is who the note belongs to — its created_by — as a name and a colour,
+	// for the chip on a note shared with the reader. Set only when it helps the
+	// list say something; nil the rest of the time.
+	Owner *Person `json:"owner,omitempty"`
 }
 
 // NoteLink is one reference from a note to something else.
@@ -263,8 +274,9 @@ func (db *DB) allNotes(ctx context.Context, userID string, archived bool) ([]Not
 		      UNION
 		      SELECT project_id FROM project_members WHERE user_id = ?
 		    )
+		    OR notes.id IN (SELECT note_id FROM note_shares WHERE user_id = ?)
 		  )
-		ORDER BY pinned DESC, updated_at DESC`, userID, userID, userID)
+		ORDER BY pinned DESC, updated_at DESC`, userID, userID, userID, userID)
 }
 
 // NotesLinking answers the backwards question: what points at this thing.

internal/store/notifications.go

@@ -18,6 +18,7 @@ type Notification struct {
 	ActorName string
 	ProjectID string
 	TaskID    string
+	NoteID    string
 	Kind      string
 	Title     string
 	Body      string
@@ -32,25 +33,54 @@ func (db *DB) CreateNotification(ctx context.Context, n *Notification) error {
 	n.CreatedAt = time.Now().UTC()
 
 	_, err := db.ExecContext(ctx,
-		`INSERT INTO notifications (id, user_id, actor_id, project_id, task_id, kind,
+		`INSERT INTO notifications (id, user_id, actor_id, project_id, task_id, note_id, kind,
 		                            title, body, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		n.ID, n.UserID, nullString(n.ActorID), nullString(n.ProjectID),
-		nullString(n.TaskID), n.Kind, n.Title, n.Body, n.CreatedAt.Unix())
+		nullString(n.TaskID), nullString(n.NoteID), n.Kind, n.Title, n.Body, n.CreatedAt.Unix())
 	return err
 }
 
+// BumpUnreadNoteNotification folds a second change to the same note into the first,
+// and says whether it found one to fold into.
+//
+// A note is saved on a typing pause, so writing a row per save would turn one
+// person editing one note for five minutes into a column of twenty identical
+// lines. Slået sammen, mens beskeden er ulæst: den rykker op som ny og siger hvem
+// der rørte den sidst.
+//
+// Kun mens den er ulæst — og det er hele reglen. Har man læst "Andreas rettede
+// Aftalen" og går videre, er den næste rettelse en ny ting at få at vide, ikke en
+// gentagelse af noget, man allerede har set.
+func (db *DB) BumpUnreadNoteNotification(ctx context.Context, userID, noteID, actorID, title, body string) (bool, error) {
+	res, err := db.ExecContext(ctx, `
+		UPDATE notifications
+		   SET created_at = ?, actor_id = ?, title = ?, body = ?
+		 WHERE user_id = ? AND note_id = ? AND kind = 'note.changed' AND read_at IS NULL`,
+		time.Now().UTC().Unix(), nullString(actorID), title, body, userID, noteID)
+	if err != nil {
+		return false, err
+	}
+	n, err := res.RowsAffected()
+	return n > 0, err
+}
+
 func (db *DB) ListNotifications(ctx context.Context, userID string, limit int) ([]Notification, error) {
 	if limit <= 0 || limit > 100 {
 		limit = 30
 	}
 	rows, err := db.QueryContext(ctx, `
 		SELECT n.id, n.user_id, n.actor_id, COALESCE(u.name, ''), n.project_id, n.task_id,
-		       n.kind, n.title, n.body, n.read_at, n.created_at
+		       n.note_id, n.kind, n.title, n.body, n.read_at, n.created_at
 		FROM notifications n
 		LEFT JOIN users u ON u.id = n.actor_id
 		WHERE n.user_id = ?
-		ORDER BY n.created_at DESC
+		-- Tiden er sekunder, og to ting kan ske i det samme sekund: en note bliver
+		-- delt og rettet i samme håndbevægelse. Uden andet at falde tilbage på
+		-- afgør basen selv, hvilken der står øverst, og klokken viser dem i den
+		-- rækkefølge, den nu engang fandt dem i. id'et er tidsordnet, så det er
+		-- den rigtige afgørelse at give den — og den er den samme hver gang.
+		ORDER BY n.created_at DESC, n.id DESC
 		LIMIT ?`, userID, limit)
 	if err != nil {
 		return nil, err
@@ -60,14 +90,15 @@ func (db *DB) ListNotifications(ctx context.Context, userID string, limit int) (
 	out := []Notification{}
 	for rows.Next() {
 		var n Notification
-		var actorID, projectID, taskID sql.NullString
+		var actorID, projectID, taskID, noteID sql.NullString
 		var readAt sql.NullInt64
 		var created int64
 		if err := rows.Scan(&n.ID, &n.UserID, &actorID, &n.ActorName, &projectID,
-			&taskID, &n.Kind, &n.Title, &n.Body, &readAt, &created); err != nil {
+			&taskID, &noteID, &n.Kind, &n.Title, &n.Body, &readAt, &created); err != nil {
 			return nil, err
 		}
-		n.ActorID, n.ProjectID, n.TaskID = actorID.String, projectID.String, taskID.String
+		n.ActorID, n.ProjectID = actorID.String, projectID.String
+		n.TaskID, n.NoteID = taskID.String, noteID.String
 		if readAt.Valid {
 			v := time.Unix(readAt.Int64, 0).UTC()
 			n.ReadAt = &v
@@ -204,6 +235,17 @@ func (db *DB) dropPushEndpoint(ctx context.Context, endpoint string) error {
 // has failed enough times. A push service says 404 or 410 when an endpoint is gone,
 // but it also has bad days — forgiving a few failures keeps a flaky network from
 // silently unsubscribing somebody's phone.
+// MarkPushDelivered records that a push went through: the failure count goes back
+// to zero and last_used_at moves forward. Without it a subscription that failed a
+// few times and then recovered would keep those failures on its record and be one
+// flaky night away from the ten that delete it — even though it is working.
+func (db *DB) MarkPushDelivered(ctx context.Context, endpoint string) error {
+	_, err := db.ExecContext(ctx,
+		`UPDATE push_subscriptions SET failures = 0, last_used_at = ? WHERE endpoint = ?`,
+		time.Now().Unix(), endpoint)
+	return err
+}
+
 func (db *DB) RecordPushFailure(ctx context.Context, endpoint string, permanent bool) error {
 	if permanent {
 		// Not scoped by user, and that is right here: this is the push service
@@ -288,6 +330,52 @@ func (db *DB) SetMailToken(ctx context.Context, userID, token string) error {
 	return err
 }
 
+// --- krogen ind i indbakken ------------------------------------------------------
+
+// EnsureHookToken returns the token in the person's webhook URL, minting one the
+// first time it is asked for.
+//
+// Sit eget token frem for mailens. De to er den samme slags hemmelighed, men de
+// slipper ud hver for sig: en URL, der har ligget i en genvej på en telefon, der
+// blev væk, skal kunne skiftes uden at mailadressen — som står i andres
+// adressebøger — skifter med.
+func (db *DB) EnsureHookToken(ctx context.Context, userID string) (string, error) {
+	var token sql.NullString
+	err := db.QueryRowContext(ctx, `SELECT hook_token FROM users WHERE id = ?`, userID).Scan(&token)
+	if err != nil {
+		return "", err
+	}
+	if token.Valid && token.String != "" {
+		return token.String, nil
+	}
+
+	fresh, err := auth.NewToken()
+	if err != nil {
+		return "", err
+	}
+	if err := db.SetHookToken(ctx, userID, fresh); err != nil {
+		return "", err
+	}
+	return fresh, nil
+}
+
+func (db *DB) SetHookToken(ctx context.Context, userID, token string) error {
+	_, err := db.ExecContext(ctx,
+		`UPDATE users SET hook_token = ?, updated_at = ? WHERE id = ?`,
+		token, time.Now().Unix(), userID)
+	return err
+}
+
+// UserByHookToken is who a webhook call is on behalf of. Tokenet er hele
+// legitimationen, så et tomt et er et nej med det samme frem for et opslag, der
+// kunne ramme en række, hvor søjlen aldrig er sat.
+func (db *DB) UserByHookToken(ctx context.Context, token string) (*User, error) {
+	if token == "" {
+		return nil, ErrNotFound
+	}
+	return db.scanUser(ctx, `SELECT `+userColumns+` FROM users WHERE hook_token = ?`, token)
+}
+
 func (db *DB) UserByMailToken(ctx context.Context, token string) (*User, error) {
 	if token == "" {
 		return nil, ErrNotFound

internal/store/tasks.go

@@ -29,6 +29,9 @@ type Task struct {
 	AssigneeID     string
 	CompletedAt    *time.Time
 	CompletedBy    string
+	// SnoozedUntil, when set and still in the future, parks the task at the bottom
+	// of its list, greyed, until it passes. Nil means the task is not snoozed.
+	SnoozedUntil *time.Time
 	// CreatedBy is empty when the author's account has been deleted: `created_by`
 	// is ON DELETE SET NULL so the task survives the person who wrote it.
 	CreatedBy string
@@ -219,7 +222,7 @@ func (db *DB) ListTasks(ctx context.Context, userID string, f TaskFilter) ([]Tas
 		SELECT t.id, t.project_id, t.section_id, t.parent_id, t.content, t.description,
 		       t.priority, t.due_date, t.due_datetime, t.due_timezone, t.duration_min,
 		       t.recurrence_rule, t.assignee_id, t.completed_at, t.completed_by,
-		       t.created_by, t.sort_order, t.created_at, t.updated_at,` + taskCounts + `
+		       t.created_by, t.sort_order, t.created_at, t.updated_at, t.snoozed_until,` + taskCounts + `
 		FROM tasks t
 		JOIN projects p ON p.id = t.project_id
 		WHERE ` + strings.Join(where, " AND ") + `
@@ -313,7 +316,7 @@ func (db *DB) GetTask(ctx context.Context, taskID, userID string) (*Task, error)
 		SELECT t.id, t.project_id, t.section_id, t.parent_id, t.content, t.description,
 		       t.priority, t.due_date, t.due_datetime, t.due_timezone, t.duration_min,
 		       t.recurrence_rule, t.assignee_id, t.completed_at, t.completed_by,
-		       t.created_by, t.sort_order, t.created_at, t.updated_at,`+taskCounts+`
+		       t.created_by, t.sort_order, t.created_at, t.updated_at, t.snoozed_until,`+taskCounts+`
 		FROM tasks t WHERE t.id = ? AND t.deleted_at IS NULL`, taskID)
 	if err != nil {
 		return nil, err
@@ -390,7 +393,32 @@ func order(f TaskFilter) string {
 	if f.CompletedOnly {
 		return "t.completed_at DESC, t.id DESC"
 	}
-	return "t.due_date IS NULL, t.due_date, t.priority, t.sort_order, t.created_at"
+	// A snoozed task sinks below everything else — the CASE is 1 while it is still
+	// snoozed and 0 the moment its time passes, so it rejoins the list in its proper
+	// place by the clock, with nothing to run. Compared as an integer, or the TEXT
+	// strftime returns would sort under every number.
+	snoozed := "(CASE WHEN t.snoozed_until > CAST(strftime('%s','now') AS INTEGER) THEN 1 ELSE 0 END)"
+	return snoozed + ", t.due_date IS NULL, t.due_date, t.priority, t.sort_order, t.created_at"
+}
+
+// SnoozeTask parks a task until a moment, or wakes it when until is nil. Only the
+// snooze changes; the due date, the time, everything else is left alone — a snooze
+// is about when you want to see it, not when it is due.
+func (db *DB) SnoozeTask(ctx context.Context, id string, until *time.Time) error {
+	var v any
+	if until != nil {
+		v = until.Unix()
+	}
+	res, err := db.ExecContext(ctx,
+		`UPDATE tasks SET snoozed_until = ?, updated_at = ? WHERE id = ? AND deleted_at IS NULL`,
+		v, time.Now().Unix(), id)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
 }
 
 func scanTask(rows *sql.Rows) (Task, error) {
@@ -400,13 +428,13 @@ func scanTask(rows *sql.Rows) (Task, error) {
 	// stays; it loses its author.
 	var createdBy sql.NullString
 	var dueDatetime, completedAt sql.NullInt64
-	var duration sql.NullInt64
+	var duration, snoozedUntil sql.NullInt64
 	var created, updated int64
 
 	err := rows.Scan(&t.ID, &t.ProjectID, &sectionID, &parentID, &t.Content, &t.Description,
 		&t.Priority, &dueDate, &dueDatetime, &dueTZ, &duration,
 		&recurrence, &assignee, &completedAt, &completedBy,
-		&createdBy, &t.SortOrder, &created, &updated,
+		&createdBy, &t.SortOrder, &created, &updated, &snoozedUntil,
 		&t.SubtaskCount, &t.SubtaskDone, &t.AttachmentCount)
 	if err != nil {
 		return t, err
@@ -432,6 +460,10 @@ func scanTask(rows *sql.Rows) (Task, error) {
 		v := int(duration.Int64)
 		t.DurationMin = &v
 	}
+	if snoozedUntil.Valid {
+		v := time.Unix(snoozedUntil.Int64, 0).UTC()
+		t.SnoozedUntil = &v
+	}
 	t.CreatedAt = time.Unix(created, 0).UTC()
 	t.UpdatedAt = time.Unix(updated, 0).UTC()
 	return t, nil

internal/store/users.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/kristianwind/verdande/internal/auth"
 )
@@ -62,6 +63,26 @@ func NormalizeEmail(email string) string {
 	return strings.ToLower(strings.TrimSpace(email))
 }
 
+// NormalizeName trims a display name and capitalises the first letter of every
+// word, leaving the rest of each word exactly as typed. So "andreas" becomes
+// "Andreas" and "anne mette" becomes "Anne Mette", while a name that already
+// carries a capital in the middle — "McDonald", an "iPhone" — keeps it: only the
+// first letter of a word is ever raised, never lowered.
+//
+// A name is the person's to spell; the one thing the instance insists on is that
+// it does not start in lower case, because a column of lower-case first names
+// reads as a bug the person cannot fix from their own keyboard. Unicode-aware, so
+// "æblegaard" and "óscar" are raised the same as an ASCII initial.
+func NormalizeName(name string) string {
+	fields := strings.Fields(name)
+	for i, f := range fields {
+		r := []rune(f)
+		r[0] = unicode.ToUpper(r[0])
+		fields[i] = string(r)
+	}
+	return strings.Join(fields, " ")
+}
+
 // CreateUser inserts a user and gives them an Inbox, in one transaction.
 //
 // The Inbox is created here rather than lazily on first use because every other
@@ -70,6 +91,7 @@ func NormalizeEmail(email string) string {
 // of them end up racing to create the second one.
 func (db *DB) CreateUser(ctx context.Context, u *User, inboxName string) error {
 	u.Email = NormalizeEmail(u.Email)
+	u.Name = NormalizeName(u.Name)
 	if u.ID == "" {
 		u.ID = NewID()
 	}
@@ -205,9 +227,50 @@ func (db *DB) SetSidebarCollapsed(ctx context.Context, userID string, sections [
 // Person is the public half of a user: what somebody else is allowed to see when
 // their name has to appear next to a task. No address, no hash, no timezone.
 type Person struct {
-	ID          string
-	Name        string
-	AvatarColor string
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	AvatarColor string `json:"avatar_color"`
+}
+
+// PersonByID resolves one user to a name and colour, or ErrNotFound. Used to check
+// that somebody a note is about to be shared with actually exists, without loading
+// the whole account.
+func (db *DB) PersonByID(ctx context.Context, id string) (Person, error) {
+	var p Person
+	err := db.QueryRowContext(ctx,
+		`SELECT id, name, avatar_color FROM users WHERE id = ?`, id).Scan(&p.ID, &p.Name, &p.AvatarColor)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Person{}, ErrNotFound
+	}
+	return p, err
+}
+
+// UsersForSharing is everyone on the instance except the caller — the people a note
+// can be handed to.
+//
+// Deliberately wider than ListPeople, which is the project collaborators. The whole
+// point of sharing a note directly is to do it without first standing up a shared
+// project, so the picker cannot be limited to people you already share a project
+// with. An instance's accounts are a closed, invited set to begin with — there is
+// no open signup — so listing them to each other is not disclosure, it is the
+// address book the feature needs.
+func (db *DB) UsersForSharing(ctx context.Context, meID string) ([]Person, error) {
+	rows, err := db.QueryContext(ctx,
+		`SELECT id, name, avatar_color FROM users WHERE id <> ? ORDER BY lower(name)`, meID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	people := []Person{}
+	for rows.Next() {
+		var p Person
+		if err := rows.Scan(&p.ID, &p.Name, &p.AvatarColor); err != nil {
+			return nil, err
+		}
+		people = append(people, p)
+	}
+	return people, rows.Err()
 }
 
 // PeopleByIDs looks up several users at once.
@@ -432,6 +495,7 @@ func (db *DB) UpdatePasswordHash(ctx context.Context, userID, hash, keepSessionI
 // invites were sent to, and changing it is a re-verification flow rather than a
 // field. Neither is is_admin — an account cannot promote itself.
 func (db *DB) UpdateProfile(ctx context.Context, userID, name, timezone, locale string) error {
+	name = NormalizeName(name)
 	res, err := db.ExecContext(ctx,
 		`UPDATE users SET name = ?, timezone = ?, locale = ?, updated_at = ? WHERE id = ?`,
 		name, timezone, locale, time.Now().Unix(), userID)
@@ -444,6 +508,56 @@ func (db *DB) UpdateProfile(ctx context.Context, userID, name, timezone, locale
 	return nil
 }
 
+// NormalizeUserNames capitalises the first letter of every existing user's name,
+// for the accounts created before the app started doing it on the way in.
+//
+// Idempotent: a name already normalised is left untouched, so it costs one pass
+// of names at each start and writes nothing once it has caught up. Like SealNotes
+// it runs at boot rather than as a migration, because the rule lives in Go —
+// Unicode-aware and per word — and SQLite's own UPPER cannot spell it.
+//
+// `updated_at` is not touched: fixing the spelling of a name the person chose is
+// the instance tidying up after itself, not the person editing their profile.
+func (db *DB) NormalizeUserNames(ctx context.Context) (int, error) {
+	rows, err := db.QueryContext(ctx, `SELECT id, name FROM users`)
+	if err != nil {
+		return 0, err
+	}
+	type pending struct{ id, name string }
+	var todo []pending
+	for rows.Next() {
+		var id, name string
+		if err := rows.Scan(&id, &name); err != nil {
+			rows.Close()
+			return 0, err
+		}
+		if n := NormalizeName(name); n != name {
+			todo = append(todo, pending{id, n})
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return 0, err
+	}
+	if len(todo) == 0 {
+		return 0, nil
+	}
+
+	err = db.Tx(ctx, func(tx *sql.Tx) error {
+		for _, p := range todo {
+			if _, err := tx.ExecContext(ctx,
+				`UPDATE users SET name = ? WHERE id = ?`, p.name, p.id); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+	return len(todo), nil
+}
+
 func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled bool) error {
 	// Sealed, like a mailbox password and for the same reason: the copies, not the
 	// server. A TOTP secret in a downloadable backup lets whoever holds the copy
@@ -466,6 +580,26 @@ func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled
 	return err
 }
 
+// ConsumeTOTPStep records a just-accepted TOTP step and reports whether it was
+// fresh. It answers false when the step has already been spent — the same code, or
+// an earlier one, being presented a second time.
+//
+// The guard is in the statement, not in a read-then-write: two logins racing with
+// the same stolen code must not both find the old value and both proceed. The row
+// moves forward only when the new step is strictly greater, so exactly one of them
+// updates a row and the other sees nothing change.
+func (db *DB) ConsumeTOTPStep(ctx context.Context, userID string, step int64) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET totp_last_step = ? WHERE id = ?
+		   AND (totp_last_step IS NULL OR totp_last_step < ?)`,
+		step, userID, step)
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n == 1, nil
+}
+
 // InboxID returns the user's Inbox project.
 func (db *DB) InboxID(ctx context.Context, userID string) (string, error) {
 	var id string

mkdocs.yml

@@ -44,8 +44,8 @@ extra_css:
 nav:
   - Home: index.md
   - Setting it up:
-      - Self-hosting: self-hosting.md
       - As a Rune: rune.md
+      - With Docker: self-hosting.md
       - Configuration: configuration.md
   - Using it:
       - Signing in: signing-in.md

site/index.html

@@ -856,8 +856,11 @@
 				</p>
 
 				<div class="actions">
-					<a class="button primary" href="https://kristianwind.github.io/verdande/self-hosting/">
-						Self-host it
+					<a class="button primary" href="https://kristianwind.github.io/verdande/rune/">
+						As a Rune
+					</a>
+					<a class="button" href="https://kristianwind.github.io/verdande/self-hosting/">
+						With Docker
 					</a>
 					<a class="button" href="https://github.com/kristianwind/verdande">Source</a>
 					<a class="button" href="https://kristianwind.github.io/verdande/">Documentation</a>
@@ -928,13 +931,33 @@
 				<div class="shots">
 					<figure class="shot">
 						<img
-							src="screenshots/board.webp"
-							alt="A project in board view: one column per section, with task cards showing due dates, labels and repetition."
+							src="screenshots/calendar-light.webp"
+							alt="A week in the calendar: timed tasks drawn to their length, a fifteen-minute stand-up short and a ninety-minute planning block tall, each on the day and at the time it is due."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Board view — one column per section.</figcaption>
+						<figcaption>The calendar draws a task to its length — drag its foot to change it.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/notes-shared-light.webp"
+							alt="Notes with a Shared with me group at the top of the list, holding a note somebody else shared, marked with whose it is, open on the right."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>A note shared with you, gathered under Shared with me.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/board.webp"
+							alt="A project in board view: one column per section, with task cards showing due dates, labels, an arrow to whoever a task is delegated to, and a snoozed card greyed at the foot of its column."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Board view — one column per section. A delegated card carries an arrow to whoever has it; a snoozed one greys at the foot.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -969,12 +992,22 @@
 					<figure class="shot">
 						<img
 							src="screenshots/themes.webp"
-							alt="The settings page showing five themes as swatches and, below them, four looks written in the typeface each one selects."
+							alt="The settings page showing six themes as swatches and, below them, four looks written in the typeface each one selects."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Five themes and four looks: how bright, and how it reads.</figcaption>
+						<figcaption>Six themes and four looks: how bright, and how it reads.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/notes-charcoal.webp"
+							alt="Notes in the Charcoal theme: a warm near-black modelled on Apple Notes, the note list on the left and a note open on the right, with amber where the accent green usually is."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Charcoal — the newest theme, a warm near-black after Apple Notes, amber for the accent.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -989,12 +1022,12 @@
 					<figure class="shot">
 						<img
 							src="screenshots/delegated.webp"
-							alt="Waiting on others: tasks that have been handed to somebody else, grouped under the person who has them."
+							alt="Waiting on others: tasks that have been handed to somebody else, grouped under the person who has them, each row carrying an arrow to that person."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Waiting on others — grouped by who has it.</figcaption>
+						<figcaption>Waiting on others — grouped by who has it, each marked with an arrow to them.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -1017,6 +1050,75 @@
 						<figcaption>Integrations: your mailbox, your calendar feed, your address.</figcaption>
 					</figure>
 				</div>
+
+				<h3 class="sub">Six themes, the same day</h3>
+				<p class="muted">
+					Three dark and three light — a property of the screen you are sitting at, a
+					laptop in the sun and a monitor in a dark room wanting different answers. The
+					typeface and how tight it sits are chosen apart from them.
+				</p>
+				<div class="shots">
+					<figure class="shot">
+						<img
+							src="screenshots/theme-northern-lights.webp"
+							alt="The Today view in the Northern lights theme: dark, with a green accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Northern lights — dark, a green accent. The default.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-charcoal.webp"
+							alt="The Today view in the Charcoal theme: a warm near-black modelled on Apple Notes, with amber for the accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Charcoal — a warm near-black after Apple Notes, amber accent.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-dusk.webp"
+							alt="The Today view in the Dusk theme: dark and warm, with an amber accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Dusk — dark and warm.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-daylight.webp"
+							alt="The Today view in the Daylight theme: light and coolly neutral."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Daylight — light and coolly neutral.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-paper.webp"
+							alt="The Today view in the Paper theme: light and warm, like paper."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Paper — light and warm, like paper.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-contrast.webp"
+							alt="The Today view in the Contrast theme: black on white, for bright light."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Contrast — black on white, for bright light.</figcaption>
+					</figure>
+				</div>
 			</section>
 
 			<section id="features">
@@ -1050,8 +1152,8 @@
 						<h3>Repeats, and says so in words</h3>
 						<p>
 							Recurring tasks are RRULE underneath and "every other Tuesday" on the
-							screen. Reminders are absolute or relative, and go out to the devices
-							you have allowed them on.
+							screen. Reminders are absolute or relative, and go out as Web Push to
+							an iPhone or a Mac you have allowed them on.
 						</p>
 					</div>
 					<div class="cell">
@@ -1063,12 +1165,47 @@
 							written about it. Archive what is done with it; the bin is for mistakes.
 						</p>
 					</div>
+					<div class="cell">
+						<h3>Share a note, or a page</h3>
+						<p>
+							Hand a single note to a person — to read or to edit — without standing up
+							a project for it. Notes other people share with you gather under
+							<em>Shared with me</em>, each marked with whose it is. File it in a project
+							instead and everyone who can read the project reads the note.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>How long it takes</h3>
+						<p>
+							A task can carry a length, and the calendar draws it to scale. Drag the
+							foot of a task to make it longer or shorter, or drag its body to another
+							day or time — the length comes along.
+						</p>
+					</div>
 					<div class="cell">
 						<h3>Waiting on others</h3>
 						<p>
 							What you have handed to somebody else, on its own page, grouped under
-							the person who has it. The thing a shared list stops being able to tell
-							you the moment it is shared.
+							the person who has it — and marked where you meet it too, with an arrow
+							out of your hands, so a list reads at a glance as which tasks are yours
+							and which you are waiting on.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>Snooze it out of the way</h3>
+						<p>
+							Park a task to this evening, tomorrow, next week, or a moment you pick.
+							It greys and sinks to the bottom of the list until then, and comes back
+							by itself — without touching when it is actually due.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>Holds through a drop</h3>
+						<p>
+							A tunnel, a lift, a base station handing over — the app does not go
+							blank when the signal does. A save you make rides out a few seconds of
+							no connection and goes through when it comes back, and a reload opens
+							from what it last saw rather than the browser's offline page.
 						</p>
 					</div>
 				</div>
@@ -1105,9 +1242,10 @@
 						<h3>Your mail, as an inbox</h3>
 						<p>
 							Star a mail in Gmail, or flag one over IMAP in iCloud or Fastmail, and
-							it becomes a task. Forward one to your own address instead and the
-							subject is parsed like anything else you type. One way: unstarring it
-							later does nothing to the task you made.
+							it becomes a task — and the star or flag comes off once it has, so a
+							starred inbox empties as the tasks are made instead of only filling up.
+							Forward one to your own address instead and the subject is parsed like
+							anything else you type.
 						</p>
 					</div>
 					<div class="cell">
@@ -1188,6 +1326,42 @@
 					<a href="https://github.com/kristianwind/verdande/releases">the releases page</a>.
 				</p>
 				<ul class="lately">
+					<li>
+						<span class="ver">0.42</span>
+						A sixth theme, <strong>Charcoal</strong> — a warm near-black after Apple
+						Notes, with amber for the accent. And the app now holds through a short
+						network drop: a save rides out a few seconds of no signal, and a reload
+						opens from what it last saw rather than the browser's offline page.
+					</li>
+					<li>
+						<span class="ver">0.42</span>
+						A starred Gmail message loses its star once it has become a task, the way
+						a flagged IMAP mail already did — so a starred inbox empties itself as the
+						tasks are made instead of only filling up.
+					</li>
+					<li>
+						<span class="ver">0.42</span>
+						Notes read as three lines, the last one the project they are filed under;
+						the calendar lightened to pastel days with today marked at the top; and
+						two-factor set-up shows a QR code to scan.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						A task you have delegated is marked where you meet it, not only on the
+						"Waiting on others" page. A task can be snoozed to the bottom of the list
+						until a moment you choose, and comes back by itself.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						Web Push reminders reach an iPhone and a Mac again, and every dated task
+						now shows up in a calendar you have subscribed to — not only the timed ones.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						The calendar draws each task to its length: drag the foot to resize, or the
+						body to move it. A single note can be shared with one person, and a
+						<code>[[note]]</code> is a link you follow inline.
+					</li>
 					<li>
 						<span class="ver">0.34</span>
 						Sections can be dragged into the order the work actually happens in. The
@@ -1199,21 +1373,6 @@
 						or drag in, a source view, and a copy button on code blocks. Search
 						stopped answering by date and started answering by relevance.
 					</li>
-					<li>
-						<span class="ver">0.32</span>
-						A calendar of its own as a menu item, with a read-only Google calendar
-						that can be laid over it.
-					</li>
-					<li>
-						<span class="ver">0.31</span>
-						Mailboxes over IMAP, so flagging a mail in iCloud or Fastmail makes a
-						task — not only Gmail.
-					</li>
-					<li>
-						<span class="ver">0.30</span>
-						An installation count that says exactly what it sends, and can be turned
-						off in one click.
-					</li>
 				</ul>
 			</section>