small performance and security changes

src/web/user/routes.py

@@ -1338,9 +1338,13 @@ async def dashboard(request: Request):
         })
 
 
+_ACTIVE_STATUSES = {"draft", "approved", "ready"}
+_ARCHIVE_STATUSES = {"scheduled", "published", "rejected"}
+
+
 @user_router.get("/posts", response_class=HTMLResponse)
 async def posts_page(request: Request):
-    """View user's own posts."""
+    """View user's own posts (active Kanban only)."""
     session = require_user_session(request)
     if not session:
         return RedirectResponse(url="/login", status_code=302)
@@ -1348,7 +1352,9 @@ async def posts_page(request: Request):
     try:
         user_id = UUID(session.user_id)
         profile = await db.get_profile(user_id)
-        posts = await db.get_generated_posts(user_id)
+        all_posts = await db.get_generated_posts(user_id)
+        active_posts = [p for p in all_posts if p.status in _ACTIVE_STATUSES]
+        archived_count = sum(1 for p in all_posts if p.status in _ARCHIVE_STATUSES)
         profile_picture = await get_user_avatar(session, user_id)
 
         return templates.TemplateResponse("posts.html", {
@@ -1356,8 +1362,9 @@ async def posts_page(request: Request):
             "page": "posts",
             "session": session,
             "profile": profile,
-            "posts": posts,
-            "total_posts": len(posts),
+            "posts": active_posts,
+            "total_posts": len(active_posts),
+            "archived_count": archived_count,
             "profile_picture": profile_picture
         })
     except Exception as e:
@@ -1370,6 +1377,61 @@ async def posts_page(request: Request):
             "session": session,
             "posts": [],
             "total_posts": 0,
+            "archived_count": 0,
+            "error": str(e)
+        })
+
+
+@user_router.get("/posts/archive", response_class=HTMLResponse)
+async def posts_archive_page(request: Request, page: int = 1):
+    """View archived posts (published, scheduled, rejected)."""
+    session = require_user_session(request)
+    if not session:
+        return RedirectResponse(url="/login", status_code=302)
+
+    try:
+        user_id = UUID(session.user_id)
+        all_posts = await db.get_generated_posts(user_id)
+        archived_posts = [p for p in all_posts if p.status in _ARCHIVE_STATUSES]
+        # Sort: scheduled first (upcoming), then by published_at/created_at desc
+        archived_posts.sort(
+            key=lambda p: (
+                p.status != "scheduled",
+                -(p.published_at or p.created_at or datetime.min.replace(tzinfo=timezone.utc)).timestamp()
+            )
+        )
+
+        per_page = 20
+        total = len(archived_posts)
+        total_pages = max(1, (total + per_page - 1) // per_page)
+        page = max(1, min(page, total_pages))
+        start = (page - 1) * per_page
+        page_posts = archived_posts[start:start + per_page]
+
+        profile_picture = await get_user_avatar(session, user_id)
+
+        return templates.TemplateResponse("posts_archive.html", {
+            "request": request,
+            "page": "posts",
+            "session": session,
+            "posts": page_posts,
+            "total": total,
+            "current_page": page,
+            "total_pages": total_pages,
+            "per_page": per_page,
+            "profile_picture": profile_picture
+        })
+    except Exception as e:
+        logger.error(f"Error loading posts archive: {e}")
+        return templates.TemplateResponse("posts_archive.html", {
+            "request": request,
+            "page": "posts",
+            "session": session,
+            "posts": [],
+            "total": 0,
+            "current_page": 1,
+            "total_pages": 1,
+            "per_page": 20,
             "error": str(e)
         })
 
@@ -1633,6 +1695,7 @@ async def post_detail_page(request: Request, post_id: str):
             "post_type_analysis": post_type_analysis,
             "final_feedback": final_feedback,
             "profile_picture_url": profile_picture_url,
+            "profile_picture": profile_picture_url,
             "media_items_dict": media_items_dict,
             "limit_reached": limit_reached,
             "limit_message": limit_message