ld
bb86950632
enforcement - test: cover authenticated register, login, upload, list, and download flow - test: verify file API routes reject test identity header injection - test: verify file API routes reject invalid, expired, and malformed tokens - test: verify cross-user ownership isolation for all file CRUD operations - refactor: rename test-only header constant to clarify it is not used in production
Docs
Documentation is organized by project. Use server/ for the Go backend and web/ for the browser client.
Server
| File | Content |
|---|---|
server/architecture.md |
Module layout, package boundaries |
server/decisions.md |
Technical decisions (ADR) |
server/roadmap.md |
Feature progress and status |
server/development.md |
Build, test, debug workflow |
Web
| File | Content |
|---|---|
web/decisions.md |
Technical decisions (ADR) |
web/roadmap.md |
Product boundary, foundation, planned structure, and deferred dependencies |