6 Commits

Include renames

Author	SHA1	Message	Date
timothyandClaude Opus 4.8	a88240dcec	feat(#58): ErsatzTV.Mcp — read + cautious-write MCP server over /api/v1 ... Fresh stdio JSON-RPC MCP server wrapping the frozen /api/v1 surface, superseding the closed read-only PR #76. 26 read tools (six families + search/all-items & search/artists discovery) and cautious-write CRUD: collections (incl. idempotent membership adds for #487), smart collections, schedules, playouts, channels (create/update/delete/reset), and a Jellyfin-focused media-source sync/scan slice. Writes gated behind ERSATZTV_ALLOW_WRITES (default false, runtime-enforced). Security baseline carried forward from PR #76/#289: read-only backstop, JSON-RPC DoS guards + bounded stdin reader, per-request CTS over headers+body, response-size cap, arg validation vs InputSchema, reverse-proxy prefix preservation. Machine-key auth (X-Api-Key, CSRF-exempt). If-Match/ETag round-trip for the one replace-all PUT that honors it. Cold-review fixes folded in: - HIGH: reject control chars (CR/LF) in the ifMatch value before it reaches TryAddWithoutValidation — SocketsHttpHandler writes it verbatim, so a crafted value could smuggle headers onto the X-Api-Key request. - Cache the empty-args JsonDocument (no per-call pooled-doc leak). - Accept explicit JSON null for optional fields so a nullable API field (e.g. dailyRebuildTime) can be cleared as documented. Deferred (documented): the ~40-field replace-list writes and redesign workflow tools (#63-#68). Docs: docs/mcp.md, docs/README.md index, docs/decisions.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 00:42:00 +02:00
timothyandClaude Opus 4.8	a2c056dd7a	docs(release): prepare v26.9.0 promotion [decisions-edit] ... Consolidate docs/decisions.md (1923 -> 1028) by extracting four cohesive topic clusters into docs/decisions/ (optimistic-concurrency, api-auth-security, release-ci-governance, spa-modularization) — content relocated verbatim (lossless; all rationale + reversals preserved), main Index rebuilt to reference the topic files plus the remaining in-file entries, docs/README.md points back at the decisions Index. Add the v26.9.0 row to the ci-cd.md version table. refs #340 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 22:17:23 +02:00
timothyandClaude Opus 4.8	408b0deb89	feat(91b): remove legacy Blazor Server UI (#91 phase b) ... The ChicoryTV React SPA (web/, served at /app) now has full parity for every route the Blazor UI served, so the legacy Blazor Server / MudBlazor UI is deleted. This is the milestone-capping removal of #91 phase (b). Deleted: ErsatzTV/Pages/**, Shared/**, ViewModels/** (39 edit VMs), Validators/** (10 edit-VM validators), App.razor, _Imports.razor, Locals/{Shared,Pages}/** (Blazor loc resx; Locals/Resources.* kept), wwwroot/css + wwwroot/lib, libman.json, and the orphaned MultiSelectBaseTests. Startup.cs (surgical, not wholesale): removed AddRazorPages/AuthorizeFolder, AddServerSideBlazor, AddMudServices, AddSortable, AddCourier, the HtmlSanitizer registration, the Blazor-attached OIDC UseAuthentication/UseAuthorization middleware (per the #206 auth-posture sign-off), MapBlazorHub, and MapFallbackToPage("/_Host"). Renamed the branch blazor->legacy; it still co-hosts MapControllers, /docs (Scalar), dev MapOpenApi and the redirect middleware. Replaced the _Host fallback with a catch-all (MapFallback -> 302 /app) that excludes /api|/artwork|/docs|/openapi (genuine 404) per #204. Kept all OIDC/JWT/API-key service wiring (inert unless configured; real auth is #197), ConditionalIptvAuthorizeFilter, ApiKeyAuthorizationFilter. Pruned 9 now-unused packages (all verified zero remaining consumers) from Directory.Packages.props + ErsatzTV.csproj: MudBlazor, Heron.MudCalendar, Blazored.FluentValidation, BlazorSortable, MediatR.Courier.DependencyInjection, Markdig, HtmlSanitizer, Chronic.Core, NaturalSort.Extension. Also removed the now-dead #25 razor-Sonar NoWarn. LegacyUiRedirects: added the 14 /media/sources/* -> /app/libraries/* redirects (SPA screens landed in #202) and lifted the #204-era /media/sources prefix ban. Tests: Release build clean; full solution suite green. Updated Startup source-text tests + added regression coverage that Blazor wiring is gone, the catch-all is wired, and all 14 media-sources routes redirect. Docs: blazor-route-parity.md (phase b COMPLETE), decisions.md (removal entry), CLAUDE.md, contributing.md, README.md all updated in this PR. Rollback: tag blazor-final is cut on pre-merge main as the first merge action. Part of #91. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 21:01:04 +02:00
timothyandClaude Fable 5	dfd2134cb4	docs: queue protocol v2 — state moves to pinned Gitea tracker #237 (parallel-session safe) ... Handoff file reduced to static kickoff prompt + append-only lessons lore; queue/arc/session log live in pinned tracker ersatztv#237 with in-progress claim labels and end-of-session triage. Decision recorded in decisions.md; docs index updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-11 01:17:26 +02:00
timothyandClaude Opus 4.8	0290594f0b	docs: testing map + generated endpoint index (#185) ... Adds docs/testing.md as the authoritative testing map (consolidated from docs/contributing.md §8, now shrunk to a pointer), and a generated docs/endpoint-index.md via scripts/generate-endpoint-index.py (hooked into scripts/update-openapi.sh). Updates docs/README.md's reading order and removes the "still to come" placeholder. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 07:38:47 +02:00
timothyandClaude Fable 5	50ae0a7f3b	docs: onboarding/convention docs part 1 + handoff past #180/#182/#183 (parity endgame) ... Adds docs/README.md (index), api-conventions.md, spa-conventions.md, e2e-local.md + scripts/e2e-local.sh, blazor-route-parity.md (#91 phase-b tracker), domain-model.md, decisions.md. Rule (CLAUDE.md): read these at session start instead of re-recon; update in the same PR that changes a convention/route/decision. Part 2 = #185. Handoff: #180/#141/#158/#161 closed (PRs #181/#182/#183); #145 playback-only; #91 readiness plan posted; next prompt = #185 + quick wins + #155/#151/#152/#153. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 00:03:01 +02:00