Tags

Tags give the ability to mark specific points in history as being important

  • v0.3

    b844d164 · feat(papers): add an "Edit Paper" form, reusing Add Paper's page · 
    Features

* Added duplicate paper detection (DOI/title/author matching, owner-triggered, with a review queue and restore flow).
* Added blind review mode, hiding decisions from everyone (owner included) until explicitly revealed.
* Added stratified review sampling, restricting the reviewer role to a random subset of papers.
* Added CSV export of a project's papers.
* Added a search filter for papers by title/author/venue, plus toggle-button filters by decision status and "review sample only."
* Added a manual add paper and edit form 

Security

* Raised the session idle timeout from 10 to 30 minutes.
* Added a security audit trail (login, access denials, membership, decisions).
* Required CSRF tokens on the fetch-driven /api/ routes and on the delete-project action.
* Set up CodeQL alongside bandit and fixed the findings both surfaced.
* Fixed an open-redirect-adjacent bug where auth failures were surfaced via alert() instead of a flash+redirect.
* Fixed expired-session handling on /api/ routes to return JSON 401 instead of an HTML redirect.

UI/navigation

* Self-hosted an accessibility-friendly font (Atkinson Hyperlegible) and replaced emoji with a real icon set, plus softer status/role badge styling.
* Replaced the "..." action menu with proper navbar dropdowns, and gave project management its own dedicated page.
* Decluttered the main navigation and dashboard generally.
* Fixed several mobile bugs: dropdown submenus floating instead of expanding inline, the paper detail overlay auto-opening on page load, and cramped paper-list/detail-panel height splits.
* Fixed the "et al." label incorrectly appearing for solo-author papers.

Deployment/infra

* Hardened the production systemd unit and added MariaDB support (alongside SQLite).
* Fixed several nginx-subpath bugs (post-login redirect, dashboard card links) and a setup-ui.sh path bug.
* Added GitLab CI (pytest + coverage + bandit) and wrote up 17+ ADRs documenting the architecture decisions made along the way.

  • v0.2

    e6b382a7 · fix(members): treat the typeahead query as literal text, not a LIKE pattern · 
    v0.2

- Refactored project details page into multiple JS files for clarity and maintainability
- Improved security for auth workflow
- Migrated to SQLAlchemy 3
- Refactored routes.py to handle http-related duties only, creating a service layer
- Fixed the import feature (was storing original file once per record) and made the process faster

  • v0.1

    5ef7afc3 · feat(sharing): add debounced username typeahead to the add-member form · 
    v0.1

- LDAP authentication (with a test-mode fallback for local dev)
- Project management with URL-safe, IDOR-safe slugs
- Project sharing with three roles: owner, reviewer, viewer
- Paper filtering: yes/no/maybe decisions with optional reason, plus comments
- BibTeX/RIS import with automatic format detection and file validation
- Bulk abstract backfill via OpenAlex, Crossref, Semantic Scholar, and Elsevier
- Debounced username typeahead when adding project members
- Schema migrations via Flask-Migrate/Alembic
- Rate limiting across all endpoints, Redis-backed in production