When auth is enabled, admin pages require the logged-in user to be
the event owner — unauthorized visitors get redirected to the guest
view, and admin actions return 403. Also adds a copy-to-clipboard
button in the admin bar and a Makefile for common commands.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Auto-detect whether the user entered an email or phone number.
Email sends via Resend, phone sends via Twilio SMS. Users table
has nullable phone and email columns; verification_codes uses a
generic identifier field.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace email-based auth (Resend) with phone-based auth (Twilio SMS).
Add BBQ_FEATURES env var for toggling features at deploy time — when
auth is disabled, no login routes are registered and the app works
as before.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Going section now shows both RSVPs and people who claimed slots,
deduplicated by name (case-insensitive). Claim-only people don't get a
remove button—they unclaim from the slot card instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hosts can now add a free-form description (with markdown rendering via
goldmark) when creating or editing events. Descriptions render safely
with no raw HTML passthrough. Includes ALTER TABLE migration for
existing databases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Generates a branded 1200x630 PNG per event with title, date/time/location
using Go's image package and a custom bitmap font. Supports BBQ_BASE_URL
env var for absolute URLs required by link preview crawlers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
People can now RSVP without claiming a slot. OG tags show
event title, date/time/location, and headcount in link previews.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Go + chi + SQLite + HTMX with SSE live updates.
Soft Brutalism design, emoji picker, Docker deploy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Ryan Chen