khannurien
07d0344be7
v3: src/components sorted into feature folders, the four largest files split, and the component tests mirror the new layout — 48 components sat in one flat folder, ChatModal ran to 1301 lines, DumpCreateModal to 983, and the tests were grouped by theme, so there was no telling which component had none. Components now live in category/, chat/, comment/, dump/ (with dump/create/ for the new-dump wizard), editor/, form/, layout/ (header, page shell, floating buttons), player/, playlist/, profile/, social/ (vote, like, follow, the who-voted popover) and ui/; FeedTabBar and PresenceRow, used by the index page alone, move to pages/index/. ChatModal gives up ChatMessageItem, PendingItem, ChatEditBox and ReplyRef, the message limits and text helpers (chat/message.ts), the day and clock labels (chat/time.ts) and the draft storage (utils/chatDraft.ts, next to dumpDraft.ts). DumpCreateModal gives up StepIndicator, LocalFilePreview, TitleField and DuplicateNotice; CommentThread gives up CommentForm and CommentNode; TextEditor gives up the emoji picker popup and its skin-tone storage; MediaPlayer gives up its icons (which FilePreview imported from it), Waveform, SeekBar and the remembered volume. NewPlaylistForm, a button that opens a modal holding the form, is NewPlaylistButton now, and Thumbnail, ThumbnailPlaceholder, FilePreview and RichContentCard use named exports like everything else. The tests are split one file per component under src/test/components/<folder>/ (and src/test/pages/index/), the same 625 of them. No behaviour changes; the catalogues only move their source references.
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-27 19:30:28 +00:00
khannurien
54e86c4366
v3: the frontend gets a test suite, and the bugs it turned up are fixed — deno task test:web runs 612 tests over src/ in about 11s: Vitest on jsdom with Testing Library, built on the app's own Vite config so the SWC/Lingui transform and the .po loader are what ship. src/test/ holds the harness: a routing fetch stub (queued once-responses, fallback defaults), a FakeWebSocket the tests open, feed and drop, jsdom polyfills, fixtures, and two render helpers — one over hand-set context values, one over the real provider tree (auth, socket, player, follows, categories, chat). It covers every util and hook, every provider (the socket protocol end to end: votes and likes with ack/timeout/error rollback, chat sends/echoes/retries/read markers/reconcile, reconnect backfill), the components (header and search history, cards, Markdown, thumbnails, media and global player, the text editor's mentions/emoji/uploads, comments, the new-dump modal, the chat), and every page.
...
Build and Publish Docker Image / build-and-push (push) Successful in 48s
Fixed along the way. Dumps: clearing a dump's note sent `comment: undefined`, which JSON drops, so the server kept the old one; it's sent as null now. Replacing a file dropped a visibility change made in the same save (the file endpoint doesn't read it); it follows as a separate update. Renaming a dump onto a new slug kept showing the old title until reload. The thumbnail picker and delete on the edit page failed without a word, the latter as an unhandled rejection. Playlists: an edit that kept the slug waited on the socket's echo to show, and a new cover never appeared (the upload's answer was ignored, a refused one said nothing); covers were also served stale for an hour, since `max-age=3600` met an unversioned URL — setPlaylistImage now bumps updated_at and every cover URL carries `?v=` (playlistImageUrl). Removing a dump, reordering, and deleting a playlist ignored non-OK answers, leaving page and server apart; they restore, reload or report. Profile: clearing "Who am I?" sent undefined and came back on reload; your own upvoted list (and the upvoted page) was empty until the socket's welcome, and forever without one; "View all" under Following linked to a route that doesn't exist and is a Load more now. Chat: Escape on "Delete this message?" closed the whole chat — ConfirmModal takes Escape first, in the capture phase. Player: a pause or play from a media key, headset or the OS wasn't reflected (MediaPlayer follows the element's own play/pause events), and the seek bar tracked dragging with mouse events only, so on touch the thumb fought timeupdate. Feeds: a guest on /~/followed got a blank page; a server error in the followed feed read as "Could not connect". Search: a failed later page threw away the results shown. Notifications: a failed mark-read replaced a loaded list with an error. Silent failures now say so: deleting a comment, the voters/likers "Load more" (stuck on "Loading…"), and the password-reset request, which said "sent" whatever happened.
Notifications also stop hiding what was new: the bell still clears on opening the page, but the dots and the "N new" count stay for the visit instead of vanishing the moment the mark-read lands, and one arriving while the page is open is marked read too, so the bell doesn't count it.
Accessibility: Modal and ConfirmModal are dialogs (role, aria-modal, labelled/described); playlist membership rows are checkboxes that work from the keyboard; a dump's title, and the profile's email and description, can be opened for editing from the keyboard (the pencil shows on focus); the category editor's ✓ and the global player's video button have names. Player, rich-content and download labels were hard-coded English and are translated, with the new French strings. Lint: fast-refresh and render-purity rules are off for src/test/ only, where probes hand their context out on purpose.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-27 14:35:41 +00:00
khannurien
bfce3186f8
v3: the frontend stops trusting what it last saw — a review of src/ turned up counts that fell to zero, stale copies winning over fresh ones, sessions that tabs trampled on each other, and a player queue that outlived its listener, and this closes them. Voting or liking something with no live count yet started from 0, so a dump with five votes read 1 on the click and, with the socket down, 0 for good once the undo fired; the buttons now pass the count they show, which the optimistic update and its undo start from. After a reconnect the chat re-read its history as the truth, but the merge let the live copy of a message win, so an edit made while the socket was down never showed; the resync now replaces live copies with what it fetched. Every dump_updated added the dump to the live list if it wasn't there, so retitling a months-old dump put it at the top of New, Hot and Journal for everyone, while one that had arrived live kept its old title; an edit now refreshes a live entry in place and adds nothing, and the server announces a dump going public as a dump_created, which is the one case that is an arrival. The new-dump modal let a slow preview for the previous link land on the new one, title suggestion included; changing the link now aborts both lookups. Markdown found mentions by rewriting the source text with a rule that, unlike the server's, didn't skip an @ after a word character, so an email address linked its domain, a URL like mastodon.social/@bob was split, and @ in code came out as literal link syntax; mentions are now found by a remark step over text nodes only, by the server's rule. Changing the password in one tab stored fresh tokens that any other open tab wiped the moment its old token drew a 401; the session now lives behind utils/authStorage.ts, tabs follow each other through storage events (so a logout also signs out every tab), a 401 only forgets the stored session if it still holds that token, and in-place session updates go through a new updateSession() rather than re-reading localStorage. The persisted player queue carries media-token URLs yet survived logout for the next person to sign in; it is now stamped with its owner, not restored for anyone else, cleared on logout or account switch (a guest's queue survives signing in), and older unstamped queues holding a file are dropped. Playlist checkboxes in the new-dump and add-to-playlist modals flipped whether or not the server agreed and now wait for it. CommentThread and the Dump page's loads use authFetch like the rest, so a 401 there signs out consistently; isTokenExpired has one home; and the useScrollLock imports carry their extension so deno check passes.
...
Build and Publish Docker Image / build-and-push (push) Successful in 42s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-24 20:24:38 +00:00
khannurien
2ad8ae73d5
v3: the API stops trusting what it's handed — a review of api/ turned up a server anyone could crash, uploads that ran script on the app's origin, and a server that would fetch its own network on request, and this closes them along with the smaller holes around them. A WebSocket message that wasn't an object (a bare null will do) threw inside the listener, which Deno treats as uncaught and exits on; messages are now shape-checked and the handler can't throw out. Uploaded files kept the MIME type the uploader's browser claimed, so an .html or .svg dump opened from /api/files ran with the session token in reach; only images, audio, video, PDF and plain text are served inline now, the rest download, and every file carries nosniff and a sandboxing CSP (PDFs aside, which Chrome won't render sandboxed). The image proxy passed image/svg+xml straight through the same way and now takes raster formats only. Outbound fetches for previews, the proxy and Bandcamp checked the hostname against a partial list — no 169.254.169.254, no 0.0.0.0, an IPv6 check that never matched a bracketed hostname, nothing for names that resolve inward, and redirects followed blindly; every hop now resolves and is refused if any address is private or reserved, redirects are walked by hand, the curl fallback is pinned to the checked IP, and /api/preview needs a login. PATCH /users/me accepted a new password without the current one and now takes only the description and email; a wrong password at login answered 500 because the handler caught its own 401, and now says 401. Changing or resetting a password now ends every older session through users.tokens_valid_after (migration 0015) and an iat on every token, with change-password handing back fresh tokens the modal keeps, and all token checks go through one authenticate() that also refuses deleted users. Invites and reset links are claimed atomically before the async hash rather than marked after, so one invite no longer opens several accounts, and an email address belongs to one account. File and thumbnail URLs carry a media-only token rather than the session token, so a URL in a log exposes files and not the account; older sessions fetch one on load. Private things stop leaking into broadcasts: private playlist updates go to their owner, votes and likes on someone else's private dump 404 and their counts go to the owner alone, and a private dump can't be slipped into a playlist. Smaller: selfProvider only claims this site's own host, so github.com/users/bob stops rendering our bob; the chat read marker can't be parked in the future on an empty chat; dump mutations use the resolved id so a slug works; multipart dumps get the title and comment limits; logins and reset requests are rate-limited through a shared token bucket; the password compare is constant-time; ffmpeg reads only local files in known video containers.
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-24 20:07:33 +00:00
khannurien
8c3efe6c30
v3: inline edit forms and the narrow-viewport search row ease open instead of popping in
...
Build and Publish Docker Image / build-and-push (push) Successful in 41s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-09-19 20:26:18 +00:00
khannurien
a9b94c0bfb
v3: added an "in collections" section to dump pages, listing the collections a dump belongs to
...
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-08-08 11:41:36 +00:00
khannurien
aab5b5bfd5
v3: various improvements and fixes to real-time updates
Build and Publish Docker Image / build-and-push (push) Successful in 40s
2026-06-29 07:52:56 +00:00
khannurien
324bff3133
v3: various minor visual fixes
Build and Publish Docker Image / build-and-push (push) Successful in 39s
2026-06-28 17:00:44 +00:00
khannurien
fae25f3e6c
v3: added site-wide categories, added admin category management, various visual fixes
Build and Publish Docker Image / build-and-push (push) Successful in 2m52s
2026-06-28 16:23:44 +00:00
khannurien
c8c7b05c25
v3: fixed inconsistent page titles
Build and Publish Docker Image / build-and-push (push) Successful in 41s
2026-06-28 06:51:42 +00:00
khannurien
810faaf21a
v3: added a roles/permissions system, added user management tab on user profile
Build and Publish Docker Image / build-and-push (push) Successful in 42s
2026-06-28 06:21:23 +00:00
khannurien
76de798faf
v3: fixed authorization bug with stale tokens, fixed private dump access bug, various small fixes across the app
Build and Publish Docker Image / build-and-push (push) Failing after 20s
2026-06-27 10:40:07 +00:00
khannurien
26f5abfa4e
v3: fixed linter error, code format
Build and Publish Docker Image / build-and-push (push) Successful in 41s
2026-06-22 17:31:21 +00:00
khannurien
4687a6b515
v3: add backlinks between dumps (via either dump url or dump target url mentioned through dump description and dump comments)
Build and Publish Docker Image / build-and-push (push) Successful in 43s
2026-06-21 20:30:03 +00:00
khannurien
cf988ae608
v3: allow users to edit dump thumbnail, fixed some linter errors in the frontend
Build and Publish Docker Image / build-and-push (push) Successful in 41s
2026-06-21 15:41:40 +00:00
khannurien
888aae45cf
v3: allow users to edit dump title
Build and Publish Docker Image / build-and-push (push) Successful in 2m54s
2026-06-21 12:57:46 +00:00
khannurien
b822f861ed
v3: lots of small UI tweaks and fixes
Build and Publish Docker Image / build-and-push (push) Successful in 46s
2026-04-11 08:35:16 +00:00
khannurien
9c889a9531
v3: fixed search in prod, lots of UI fixes across the app
Build and Publish Docker Image / build-and-push (push) Successful in 46s
2026-04-09 21:54:07 +00:00
khannurien
a69788c15b
v3: localization fixes, char counters & limits on all text fields, ux fixes
2026-04-03 19:47:37 +00:00
khannurien
0ce80398a4
v3: added localization, use global player for uploaded audio/video files
2026-04-03 15:29:33 +00:00
khannurien
c293f3e706
v3: code quality pass
2026-03-24 18:47:05 +00:00
khannurien
b96879a556
v3: fixes to database schema and user registration
2026-03-23 15:55:45 +00:00
khannurien
fbbbb43258
v3: code quality pass, various bug fixes
2026-03-23 07:47:49 +00:00
khannurien
a104113e05
v3: linter and formatter pass
2026-03-22 16:08:12 +00:00
khannurien
34e908d1bc
v3: added content slugs, fixed real-time updates in client, added @mentions across the app, added new file selector and drop zone
2026-03-22 16:06:26 +00:00
khannurien
39a0cc397e
v3: button styling consistency pass
2026-03-21 19:41:15 +00:00
khannurien
5bed03baa5
v3: error cards across the app, friendly network errors, code quality pass
2026-03-21 19:17:23 +00:00
khannurien
608c6bc6a8
v3: follows, notifications, invite-only registration, unread markers
2026-03-21 18:42:47 +00:00
khannurien
7c098e7c4c
v2: global player, infinite scroll, image picker, threaded comments
2026-03-21 13:55:22 +00:00
khannurien
be426eb150
v1 feature: added playlists
2026-03-16 16:52:53 +00:00
khannurien
867e64cb5b
v1 review pass: fixed some minor bugs
2026-03-16 11:08:39 +00:00
khannurien
e88fed4e98
vibe coded v1
2026-03-16 07:34:49 +00:00
khannurien
6207a7549f
initial commit, boilerplate stuff
2026-03-15 17:15:46 +00:00
