16 Commits

Include renames

Author	SHA1	Message	Date
renovate	82cf300f50	chore(deps): update dependency scriban.signed to 7.2.6	2026-08-10 03:03:27 +00:00
renovate	ff8b0bf984	chore(deps): update dependency cliwrap to 3.10.4	2026-08-03 17:02:11 +00:00
timothy	fbbdaeca3c	chore(deps): batch three Renovate patch bumps ... Consolidates the three open Renovate PRs into one change so they land on a single CI pipeline instead of three. They all edit Directory.Packages.props, so merging them individually would force a rebase + full re-run for each remaining PR. CliWrap 3.10.2 -> 3.10.3 Meziantou.Analyzer 3.0.115 -> 3.0.129 SQLitePCLRaw.bundle_e_sqlite3 3.0.3 -> 3.0.4 Also refreshes the #8 security-pin comment, which named 3.0.3 explicitly. Renovate only rewrites the version attribute, so its own PR would have left that comment contradicting the line directly beneath it. The pin's intent is unchanged: stay on the 3.x line that ships the patched native SQLite (GHSA-2m69-gcr7-jv3q), and 3.0.4 still satisfies Microsoft.Data.Sqlite's `>= 2.1.10`. All three original PRs went red on 2026-07-27, but none of the failures reached any code. The runner host had exhausted its disk at ~03:20 UTC: tar cache-restore failing with "No space left on device", SQLite Error 13 "database or disk is full", and ErsatzTV refusing to boot for want of 128 MB of free space. #681's migration job in particular died during cache restore, before either the SQLite or MySQL half ran, so the native-bundle bump was never actually exercised there. Verified locally on this combined change: - dotnet build -c Release: 0 errors; zero MA/S/CA analyzer diagnostics, so the Meziantou 3.0.115 -> 3.0.129 jump introduces no new rules that bite - full test suite: 4440 passed, 0 failed across all 7 test projects - SQLite model drift clean + all migrations applied to a fresh DB, which is the exact job that was red on #681 Supersedes #679, #680, #681.	2026-07-30 22:58:01 +02:00
timothy	be85a462a4	Merge pull request 'chore(deps): update dependency humanizer.core to 3.0.10' (#328) from renovate/humanizer-monorepo into main	2026-07-16 18:38:12 +00:00
timothyandClaude Opus 4.8	940af13a5f	fix(deps): #314 — pin Microsoft.OpenApi 2.7.5 (GHSA-v5pm-xwqc-g5wc, High) ... Microsoft.AspNetCore.OpenApi 10.0.2 + Scalar.AspNetCore pull Microsoft.OpenApi 2.0.0 transitively — High severity (stack overflow parsing a circular $ref; fixed in 2.7.5). Direct-pin 2.7.5 in CPM + a direct ErsatzTV PackageReference so the override actually resolves (the #8 SQLitePCLRaw transitive-override pattern). Build clean (transformers compile unchanged against 2.7.5), v1.json byte-identical (no OpenAPI-output change), ErsatzTV + ErsatzTV.Tests both vuln-clear, 198 OpenAPI/contract/security tests green. refs #314 #8 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:09:30 +02:00
renovate	8e5075e419	chore(deps): update dependency humanizer.core to 3.0.10	2026-07-13 03:01:42 +00:00
timothyandClaude Opus 4.8	0b23d4b6b1	feat(api): #295 PR1 — browser SPA session auth (session-OR-key gate, server-only) ... Implements the ratified #295 design (PR1, server-only, backward compatible). The /api surface now accepts a valid X-Api-Key (machine) OR an authenticated session (browser cookie, local login or OIDC), gated by the evolved ApiAuthorizationFilter (renamed from ApiKeyAuthorizationFilter; same fail-closed EndpointRequiresKey predicate). Machine/key behavior is byte-identical and the SPA keeps working via its stored key — the SPA login flow lands in PR2. - ApiAuthorizationFilter: key-first (CSRF-immune) then session; session-authed mutations require the X-CSRF header (403 otherwise). Attributes renamed [RequiresApiKey]->[RequiresAuthentication], [SkipApiKeyAuthorization]->[SkipApiAuthorization]. - Cookie scheme ctv-session always registered (Lax/SameAsRequest/14d sliding, 401 not redirect for /api); OIDC handler revived when configured (profile scope, userinfo, auth-method claim); UseAuthentication/UseAuthorization/UseRateLimiter revived in the legacy MapWhen branch. - Local admin = single credential in ConfigElement rows (username / PBKDF2 hash via Microsoft.Extensions.Identity.Core / rotating security stamp) — NO DB migration. Password change rotates the stamp; CookieSecurityStampValidator revokes stale local sessions. Env-seed recovery (Auth:LocalAdmin:*) via LocalAdminSeedService. - AuthController /api/auth/{config,session,setup,login,logout,password} + browser-nav GET /auth/oidc/login; excluded from OpenAPI (machine-audience spec). Per-IP rate limit on login/setup/password; dummy-hash verify (no user enumeration). - ForwardedHeaders now strict opt-in: X-Forwarded-* ignored unless KnownProxies/Networks configured (rate-limiter IP + cookie-Secure integrity). Deployment: operators behind a proxy must set ForwardedHeaders:KnownProxies. - Tests: session/CSRF filter cases + 17 Application/Auth handler tests; full ErsatzTV.Tests green (1499). No OpenAPI/generated-artifact drift. - Docs: api-conventions section 9 rewritten; decisions.md entry (supersedes #206 inert-OIDC note). Refs #295 #197 #206 #58 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:14:54 +02:00
timothyandClaude Opus 4.8	408b0deb89	feat(91b): remove legacy Blazor Server UI (#91 phase b) ... The ChicoryTV React SPA (web/, served at /app) now has full parity for every route the Blazor UI served, so the legacy Blazor Server / MudBlazor UI is deleted. This is the milestone-capping removal of #91 phase (b). Deleted: ErsatzTV/Pages/**, Shared/**, ViewModels/** (39 edit VMs), Validators/** (10 edit-VM validators), App.razor, _Imports.razor, Locals/{Shared,Pages}/** (Blazor loc resx; Locals/Resources.* kept), wwwroot/css + wwwroot/lib, libman.json, and the orphaned MultiSelectBaseTests. Startup.cs (surgical, not wholesale): removed AddRazorPages/AuthorizeFolder, AddServerSideBlazor, AddMudServices, AddSortable, AddCourier, the HtmlSanitizer registration, the Blazor-attached OIDC UseAuthentication/UseAuthorization middleware (per the #206 auth-posture sign-off), MapBlazorHub, and MapFallbackToPage("/_Host"). Renamed the branch blazor->legacy; it still co-hosts MapControllers, /docs (Scalar), dev MapOpenApi and the redirect middleware. Replaced the _Host fallback with a catch-all (MapFallback -> 302 /app) that excludes /api|/artwork|/docs|/openapi (genuine 404) per #204. Kept all OIDC/JWT/API-key service wiring (inert unless configured; real auth is #197), ConditionalIptvAuthorizeFilter, ApiKeyAuthorizationFilter. Pruned 9 now-unused packages (all verified zero remaining consumers) from Directory.Packages.props + ErsatzTV.csproj: MudBlazor, Heron.MudCalendar, Blazored.FluentValidation, BlazorSortable, MediatR.Courier.DependencyInjection, Markdig, HtmlSanitizer, Chronic.Core, NaturalSort.Extension. Also removed the now-dead #25 razor-Sonar NoWarn. LegacyUiRedirects: added the 14 /media/sources/* -> /app/libraries/* redirects (SPA screens landed in #202) and lifted the #204-era /media/sources prefix ban. Tests: Release build clean; full solution suite green. Updated Startup source-text tests + added regression coverage that Blazor wiring is gone, the catch-all is wired, and all 14 media-sources routes redirect. Docs: blazor-route-parity.md (phase b COMPLETE), decisions.md (removal entry), CLAUDE.md, contributing.md, README.md all updated in this PR. Rollback: tag blazor-final is cut on pre-merge main as the first merge action. Part of #91. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 21:01:04 +02:00
timothy	7e5a6b75ce	Merge pull request 'chore(deps): update dependency entityframeworkprofiler.appender to 6.0.6053' (#132) from renovate/entityframeworkprofiler.appender-6.x into main	2026-07-07 09:58:02 +00:00
renovateandtimothy	7319e31fa1	chore(deps): update dependency entityframeworkprofiler.appender to 6.0.6053	2026-07-07 11:44:15 +02:00
timothy	d3f71faf66	chore(deps): apply open Renovate patch updates refs #22	2026-07-07 11:42:56 +02:00
timothyandClaude Fable 5	47c3c3b5e2	fix(deps): bump Scriban.Signed 6.5.2 -> 7.2.5 (GHSA-5wr9-m6jw-xx44) ... The advisory published against Scriban < 7.0.0 (sandbox escape) turns NuGetAudit's NU1904 into a restore failure for every build, blocking all CI. Full solution builds and both test suites pass on 7.2.5 (XMLTV goldens unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:59:13 +02:00
timothyandClaude Opus 4.8	c788ae57f1	test: enforce layer dependency direction with NetArchTest (#12) ... Add ErsatzTV.Architecture.Tests asserting the solution's layering, so a "just import it here" violation fails the build instead of eroding the architecture over time: - Core must not depend on Application/Infrastructure*/Scanner, nor on EF Core / Pomelo / Microsoft.Data.Sqlite / Dapper. - FFmpeg (lowest layer) must not depend on any other ErsatzTV layer. - Application must not depend on the concrete Infrastructure.Sqlite/.MySql providers (only the Infrastructure abstraction). - Infrastructure must not depend on Application or the concrete providers. Uses NetArchTest.eNhancedEdition — the maintained fork; the original NetArchTest.Rules is unmaintained since 2021 and its older Mono.Cecil doesn't reliably parse .NET 10 assemblies. Runs via the existing `dotnet test` in CI. Rules verified with a negative control (a known-true dependency asserted forbidden fails as expected — so they're not vacuous). Refs #12 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 09:53:09 +02:00
3 people	f2d0a36ed6	build: adopt static-analysis packs at suggestion (#15, increment 1) ... Add Roslynator, SonarAnalyzer.CSharp, Meziantou.Analyzer, and AsyncFixer as central analyzer references (Directory.Build.targets, CPM-versioned, guarded on ManagePackageVersionsCentrally so the gitignored .mcp tool isn't affected). .editorconfig defaults dotnet_analyzer_diagnostic.severity to `suggestion` so the packs surface findings without failing the TreatWarningsAsErrors (TWAE) build; rules are promoted to warning/error incrementally (promotion = enforcement via the existing TWAE build, so no separate lint step is needed). StyleCop.Analyzers is intentionally excluded: its latest stable (1.1.118) crashes (AD0001) on C# records and overlaps the existing .editorconfig/Roslynator. Blazor .razor: editorconfig severity overrides don't reach analyzer diagnostics in Razor @code (source-generator limitation; dotnet format can't fix them either), so the currently-firing SonarAnalyzer rules are temporarily NoWarn-ed in ErsatzTV.csproj and burned down rule-by-rule in #25. The same rules run at suggestion on .cs. Formatting normalization (mixed UTF-8 BOM + whitespace) is deferred to its own PR. Full-solution Release build green (0 errors, 0 warnings). Refs #15 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 07:37:15 +00:00
timothyandClaude Opus 4.8	01647b6e50	fix(deps): clear NCalcSync and SQLitePCLRaw vulnerability advisories ... NCalcSync 5.11.0 -> 6.3.2 clears CVE-2026-55254 / GHSA-3w5p-95mh-gq75 (the factorial-DoS advisory on NCalc.Core/NCalcSync). NCalc 6 split its assemblies and renamed the custom-function API, so port OpacityExpressionHelper: FunctionArgs -> FunctionEventArgs, and args.Parameters[i].Evaluate() -> args.Parameters.Evaluate(i) (FunctionData.Count / Evaluate(index)). Add a regression test covering the migrated opacity wiring (the feature had no tests). NCalc 6 transitively requires Microsoft.Extensions.Logging.Abstractions >= 10.0.7, so bump the centrally-pinned Microsoft.Extensions.* family 10.0.2 -> 10.0.7 to avoid the NU1605 downgrade error (a .NET 10 servicing patch bump). SQLitePCLRaw: EF Core 9's Sqlite provider pulls the vulnerable bundle 2.1.10 (GHSA-2m69-gcr7-jv3q, outdated bundled SQLite). Directly pin SQLitePCLRaw.bundle_e_sqlite3 3.0.3 in Infrastructure.Sqlite to override the transitive version with the patched native (lib.e_sqlite3 3.50.3); core 3.0.3 satisfies Microsoft.Data.Sqlite's >= 2.1.10 requirement under EF Core 9. Verified: `dotnet list package --vulnerable --include-transitive` reports 0 vulnerable projects; restore + Release build clean; full test suite green under UTC. (2 pre-existing PlayoutModeSchedulerBase filler tests fail only under non-UTC local timezones, unrelated to these deps; they pass in CI.) Refs #8 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 02:03:41 +02:00
timothyandClaude Opus 4.8	77a28fcefc	build: adopt Central Package Management (Directory.Packages.props) ... Move all 154 PackageReference versions (96 distinct packages) out of the 14 project files into a single central Directory.Packages.props with ManagePackageVersionsCentrally=true. No version changes — every package was already pinned identically across projects (no conflicts detected), so this is a pure relocation: updates become one-line and cross-project version drift is structurally impossible. Also copy Directory.Packages.props into the Docker image build before restore: with CPM the csproj carry no versions, so the image's `dotnet restore` fails without the central manifest (verified: NU1015 across every project). Restore + Release build verified locally, plus a simulation of the image's restore layer under linux-x64 (0 errors; only the pre-existing NCalcSync/SQLitePCLRaw advisories remain, demoted to warnings, tracked in #8). Part of #14. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 01:07:52 +02:00