[geoffrey-wu]

Summary

• Feature of the Day text is now stored as markdown in the site-config collection (qbreader db, name: 'feature-of-the-day') instead of hardcoded in client/index.html.
• routes/home.js serves /, rendering the markdown into the page. Result is cached for 60s, so edits show up within a minute with no deploy or restart. The document must exist (see below).
• Markdown goes through marked, then DOMPurify with a small allowlist (a, b, br, code, em, i, li, ol, p, strong, ul; only href), so <script>, event handlers, and javascript: links are stripped.
• Admins edit it at /admin/site-config (linked from the admin portal) via GET/PUT /api/admin/site-config/:id. Names are restricted to those in server/site-config.js, and markdown is capped at 2000 characters.

Notes

• Adds one dependency, marked. dompurify and jsdom were already present.
• Before deploying, insert { "name": "feature-of-the-day", "markdown": "You can filter your queries to only show [standard format](/about/standard-format) sets." } into site-config. There is no fallback, so the home page returns a 500 if the document is missing.

Testing

• npm run lint passes.
• Booted the server: / renders the default text with an empty collection, and the admin page/API redirect when logged out.
• Sanitizer checked directly against script tags, onerror attributes, and javascript: links.
• Not tested: saving from the admin page while logged in as an admin.

🤖 Generated with Claude Code

[geoffrey-wu]

.