First activation slice of semantic search (docs/discovery/05+06):
- EmbeddingBackfillWorker: fills Email.Embedding in small batches (32, 2s pause,
newest first; subject+snippet, truncated) so interactive load is never starved.
Exits immediately when the embedding provider is unavailable — AI-off deployments
are untouched, Ollama hiccups back off instead of crashing the host.
- compose: optional 'ollama' service under the 'ai' profile (persistent model
volume, commented GPU passthrough for the RTX 3080); api gets
Ai__OllamaBaseUrl pointing at it.
- LiveDb test proves the worker persists 768-dim vectors against real pgvector
(deterministic fake provider); LiveDb classes serialised into one xUnit
collection (concurrent MigrateAsync on a fresh DB races — found while testing).
Verified against REAL Ollama locally: pulled nomic-embed-text in a container and
confirmed the /api/embeddings contract the provider uses returns 768-dim vectors.
Full suite 55 green (4 LiveDb vs real pgvector); format clean.
Next slice: hybrid RRF ranking in SearchService once embeddings exist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01):
- V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist
+ DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into
UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a
validated external URL can't 3xx into an internal target. +33 unit tests.
- V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev).
- V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer
echo ex.Message to clients (logged server-side, generic message returned).
- V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private
ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config.
- V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow).
- V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days.
- V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy,
COOP) + HSTS in prod.
- V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on.
- V-12: API container runs as non-root 'app' user (keys dir pre-owned).
- V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no
weak default fallback).
API compatibility preserved (clamps not rejections; error-body shape changes only on
failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit
NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda
cesnimda