2841 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
timothyandOpenAI Codex	bceffef856	refactor(web): extract Dashboard screen ... Move Dashboard rendering, health and on-air helpers, and detailed behavior tests into a screen-owned module while retaining only shell composition coverage in App. Refs #246 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 21:16:40 +02:00
timothy	ecde59be32	docs(queue): record cheap-worker launch config (#356) ... Merge the reviewed, green documentation update. Fixes #355.	2026-07-14 19:00:01 +00:00
timothyandOpenAI Codex	b37924545c	chore(ci): retry flaky Libraries screen test ... Retrigger CI after the existing Libraries scan-progress test failed once remotely but passed six consecutive local runs at the same documentation-only PR head. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:51:59 +02:00
timothyandOpenAI Codex	a54a2b6f82	chore(ci): retry runner setup for docs PR ... Retrigger CI after the migration job failed in Setup .NET while cleaning a missing runner-cache file, before any migration command executed. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:46:01 +02:00
timothyandOpenAI Codex	67bfc1ceb1	docs(queue): record cheap-worker launch config ... Record the tested GPT-5.4-Mini low-effort worker command, current spawn-agent limitation, and unsupported legacy model trap so future sessions can route bounded work without rediscovery. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:33:21 +02:00
timothyandOpenAI Codex	1e0eaca35e	docs(queue): start tool-bearing selectors at low effort ... Clarify that enabled web_search makes a cheap worker tool-bearing even when the selector intends to use only Gitea, reserve minimal for tool-free supplied-evidence synthesis, and require hard evidence/output caps. Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:03:57 +02:00
timothyandOpenAI Codex	7cbd871ab7	test(spa): close remaining playout gate gaps ... Cover the None action matrix, required add inputs, file-edit blank/trim/payload/refresh/error behavior, and clearing a default deco to null. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 19:22:41 +02:00
timothyandOpenAI Codex	6b41350e0c	test(spa): complete playout kind coverage ... Exercise default-deco persistence and errors plus the complete action, add-dialog, and edit-field kind matrices identified by cold review. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 19:12:56 +02:00
timothyandOpenAI Codex	533abe7cdb	refactor(spa): extract playouts screen ... Move the Playouts UI, route wrapper, helpers, and detailed behavior tests into a colocated screen module while preserving App-level navigation coverage. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 18:54:32 +02:00
timothy	e454ed94fd	Merge pull request 'docs(queue): enforce milestone-aware picker ranking' (#348) from codex/queue-picker-claim-comments into main	2026-07-14 06:03:46 +00:00
timothy	ffb3e6d5e1	Merge pull request 'fix(spa): clear dirty guard before saved navigation' (#349) from codex/344-dirty-guard into main	2026-07-14 06:02:35 +00:00
timothyandOpenAI Codex	b9305fdee9	fix(spa): preserve remote drafts during save ... Disable and gate remote connection draft inputs while a save owns the current revision. Exercise the real App-owned route transition after a successful save so the regression proves the editor unmounts without a dirty prompt. Refs #344 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 00:06:29 +02:00
timothyandOpenAI Codex	3481f98bcc	fix(spa): clear dirty guard before saved navigation ... Fixes #344 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:47:43 +02:00
timothyandOpenAI Codex	e280e9072c	docs(queue): enumerate milestone candidates ... Refs #347 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:31:04 +02:00
timothyandOpenAI Codex	d235b91d15	docs(queue): preserve reviewer comment claims ... Fixes #347 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:20:50 +02:00
timothyandOpenAI Codex	b2c093d2d6	docs(e2e): record real media-source validation results ... Refs #333 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 22:51:52 +02:00
timothyandCodex	8da1256ffa	docs(workflow): enforce session-wide cost routing ... Fixes #342 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:43:11 +02:00
timothyandCodex	2609b4ce59	fix: add cross-origin resource policy header ... Fixes #330 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:25:06 +02:00
timothyandCodex	80751a5d74	docs: require low-cost queue selection preflight ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 20:56:23 +02:00
timothyandCodex	985eed072c	docs(release): prepare v26.8.0 promotion [decisions-edit] ... refs #335 Co-Authored-By: Codex <noreply@openai.com> v26.8.0	2026-07-13 19:50:39 +02:00
timothyandCodex	977f9125a5	docs: track #202 real-server integration validation ... refs #202 #333 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:05:04 +02:00
timothyandCodex	954aff21f1	docs: make issue queue handoff client-neutral ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 18:59:40 +02:00
timothyandClaude Opus 4.8	a042623a53	fix(ci): #314 review — reap ZAP container in the cleanup() trap; warn on missing semgrep ... Cold review of PR #331: - Move the ZAP-container reap from an inline post-scan line into cleanup() (the EXIT trap) so a SIGINT/timeout kill mid-scan can't leave it running. - semgrep absent now prints a stderr WARN instead of silently skipping the SAST pass (no false confidence for a release gate). refs #314 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:36:08 +02:00
timothyandClaude Opus 4.8	366d5d316c	feat(ci): #314 — repeatable black-box security scan (authenticated ZAP + semgrep) ... scripts/security-scan.sh: boots a THROWAWAY container from the image under test (fresh config volume; never the deployed prod/test container — the active scan attacks write endpoints), reads its machine key, and runs an authenticated OWASP ZAP api-scan that imports /openapi/v1.json (all 160 /api/v1 ops) and injects X-Api-Key on every request via a replacer rule so it reaches the [RequiresAuthentication] + RequireKeyForReads surface — then a semgrep SAST cross-check. Wrapped in `timeout` because zap-api-scan can hang in post-scan cleanup after the report is already written. docs/ci-cd.md: new 'Security scanning' section (out-of-ecosystem black-box gate, run on the docker host per-release like migration-smoke, not a per-PR CI job) + the Microsoft.OpenApi 2.7.5 pin note in dependency management. refs #314 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:28:13 +02:00
timothyandClaude Opus 4.8	940af13a5f	fix(deps): #314 — pin Microsoft.OpenApi 2.7.5 (GHSA-v5pm-xwqc-g5wc, High) ... Microsoft.AspNetCore.OpenApi 10.0.2 + Scalar.AspNetCore pull Microsoft.OpenApi 2.0.0 transitively — High severity (stack overflow parsing a circular $ref; fixed in 2.7.5). Direct-pin 2.7.5 in CPM + a direct ErsatzTV PackageReference so the override actually resolves (the #8 SQLitePCLRaw transitive-override pattern). Build clean (transformers compile unchanged against 2.7.5), v1.json byte-identical (no OpenAPI-output change), ErsatzTV + ErsatzTV.Tests both vuln-clear, 198 OpenAPI/contract/security tests green. refs #314 #8 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:09:30 +02:00
timothyandClaude Opus 4.8	2e4e07a207	fix(#172): review B1 — sync 404 metadata test + extend create-group trim to Deco/DecoTemplate ... Cold review (PR #325) caught that removing the unreachable 404 from BlockController/TemplateController.CreateGroup left ApiErrorResponseMetadataTests still asserting those ops document 404 -> red Build & test. Removed those two stale assertions. For spec consistency, extended the trim to the two OTHER create-group actions carrying the same unreachable 404 (DecoController, DecoTemplateController -- their Create*GroupHandler only do a duplicate-name AnyAsync -> 422, never a lookup that 404s). Net: all four CreateGroup 404 assertions removed (422 siblings kept), both controllers trimmed, v1.json regenerated (4 unreachable 404 blocks gone total). PlaylistController.CreateGroup already carried no 404. Refs #172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:16:52 +02:00
timothyandClaude Opus 4.8	216130b4d7	fix(#172): API hardening — null-name 500s, duplicate template items, unreachable 404 ... Clears the still-live findings from #172 (verified against main; #2/#4/#7 and the auth/search/Trakt tail were already deliberate-documented or fixed since 2026-07-07). - Null/empty Name → 500 (10 create/replace handlers). Block/Template/DecoTemplate/Deco Create+Replace/Update + UpdateFFmpegProfile did `request.Name.Length > 50` on a client-nullable string → unhandled NullReferenceException → HTTP 500 (no global exception filter). Now `string.IsNullOrWhiteSpace(request.Name) || .Length > 50` → 422; also rejects empty/whitespace names, matching the group-create handlers' NotEmpty behavior. CreatePlaylist coalesces null→"" at the DTO so it was an empty-name persist, not a 500; guarded the same way. - ReplaceTemplateItems overlap validation iterated with an `item == otherItem` record value-equality skip, so two exact-duplicate items were value-equal and bypassed the intersection check (both persisted). Now index-based (i != j) so duplicates register as a self-intersection and are rejected 422. - Trimmed the unreachable 404 ProducesResponseType from POST /api/blocks/groups and POST /api/templates/groups (a create has no parent lookup that can 404); v1.json regenerated. - Regression tests: all 10 name-guard paths + the duplicate-items path (19 cases). - Docs: decisions.md entry + api-conventions.md §3b null-safe-validation bullet. fixes #172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:16:52 +02:00
timothyandClaude Opus 4.8	682dceec8f	fix(api): #286 review — allowlist non-/api routes in the versioning test; base-url-aware deprecation Link ... Cold-fork + Codex review of PR #326: - ApiRouteVersioningTests: iterate IRouteTemplateProvider (covers a template-less [HttpGet] paired with an action-level [Route]) and assert any non-/api route against an explicit KnownNonApiRoutes allowlist instead of silently skipping — an accidental absolute non-/api route (which would also escape ApiAuthorizationFilter's /api-scoped gate) now fails the test. - ApiVersionRewriteMiddleware: root the deprecation Link at Request.PathBase so it stays correct under ETV_BASE_URL (</etv/docs>, not host-root </docs>). refs #286 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:40:58 +02:00
timothyandClaude Opus 4.8	ef2bd65c27	feat(api): #286 — mount the whole /api surface at /api/v1 ... Version every /api route to /api/v1 (251 controller routes + ~24 Location headers + the scanner callback URL + the Startup request-log literal), uniform across the machine API, auth, scanner and scripted-build surfaces. Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth headers and query survive — carrying RFC 8594 Deprecation/Sunset headers, so curl / the future MCP server / bookmarks keep working. An already- versioned path passes through; a future /api/v2 is never forced to v1. Standardize the route convention (leading-slash absolute route per method, no class-[Route] — except the two Scanner/Scripted controllers whose ~all actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests (^/api/v\d+/ over the whole Controllers.Api surface; browser-nav /auth/oidc/login is out of scope). Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945 SPA request literals + the test mocks (regex + positional URL parsers). /api/v1 is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases (owner decision) with removal tracked as a Phase-3 follow-up. Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/ blazor-route-parity/e2e-local/domain-model. fixes #286 refs #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:30:20 +02:00
timothyandClaude Opus 4.8	51b67dea06	fix(#238): review — trakt sub-route no-op + data-driven wiring test ... Cold-review follow-ups (both non-blocking): - Low: the TopBar "Add Trakt List" button was a silent no-op on the /app/trakt-lists/{id} detail sub-route (setAddOpen state isn't rendered by the editor branch, and the screen is keyed by pathname so the state wouldn't survive a navigate). Guard on editingId: route back to the list from the detail view, open the dialog from the list. - Nit: the invariant test only spot-checked 2 screens. Replaced with a data-driven it.each over the 4 URL-navigating create screens (channels, filler, ffmpeg, watermarks) asserting each banner actually navigates — a typo'd route id now fails red. Docs wording corrected to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothyandClaude Opus 4.8	612b11589c	fix(#238): wire TopBar primary-action on create screens, drop dead buttons ... The shell TopBar rendered a primary-action button (Plus icon) for every screen, but only SchedulesScreen subscribed to its ctv:primary-action event — so every other screen's button was dead (a labelled no-op, or a bare "+" for the ~10 routes whose primaryAction was ''). Resolution (issue #238): the Plus-icon button is a "create new item" affordance. Keep + wire it only on the 8 list screens with a single create flow (channels, schedules, multi/rerun collections, trakt lists, filler presets, ffmpeg profiles, watermarks) via a shared usePrimaryAction hook (web/src/primaryAction.ts); drop it (primaryAction: '') everywhere else — where the action isn't a create (Save/Refresh/Play/Validate/Reset/Scan, all of which have correct in-body controls), is ambiguous (collections tabs), a silent no-op (builder, playlists), or misplaced (dashboard, libraries). The TopBar now renders the button only when primaryAction is non-empty. Also relabels the apiKey route's stale post-#295 "Save key"/description. Docs: spa-conventions.md §10 + decisions.md 2026-07-12. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothy	c197de421a	Merge pull request 'fix(api): #265 — If-Match evaluates per RFC 7232 (valid-but-non-matching -> 412)' (#322) from fix/265-ifmatch-412 into main ... Merge PR #322: #265 If-Match evaluates per RFC 7232 (valid-but-non-matching → 412)	2026-07-12 21:32:25 +00:00
timothy	ffece01c32	style: #265 — normalize whitespace in the 11 touched files (format gate #311) ... The fix-as-you-touch format gate requires every .cs this PR touches to fully conform to .editorconfig, including pre-existing whitespace on lines the change didn't edit. dotnet format (whitespace) applied to the 11 touched files; legacy files left untouched (no big-bang reformat). Whitespace/layout only — no behavior change. Refs #265	2026-07-12 23:21:00 +02:00
timothy	50cd29d841	fix(api): #265 review — quote-aware If-Match scanner, RFC OWS trim, de-BOM ... Independent review fix commit (cold fork MERGEABLE-WITH-NITS + Codex BLOCKED, 2 Highs): - Codex H1: a comma (0x2C) is a valid etagc and can appear INSIDE a quoted opaque-tag ("3,5" is ONE tag). The old Split(',') broke it into two malformed tokens → 400. Replaced with a quote-aware position scanner that treats a comma as a separator only outside the quotes; "3,5" is now one valid non-canonical tag → 412. - Codex H2: RFC 7230 OWS is SP/HTAB only. string.Trim() also strips NBSP and other Unicode whitespace, letting " * " masquerade as the "*" force-write escape. Trim only (' ', '\t'); such input is now Malformed → 400. - Fork nit: corrected the canonical-guard comment (interior-whitespace tags are rejected by IsEtagc, not NumberStyles.None). - CI Formatting gate: de-BOM the 8 touched legacy Application .cs (charset=utf-8, #311/#310). - Tests: added comma-in-tag ("3,5", "x,y","3"), empty-element tolerance, NBSP-not-OWS, trailing-junk, lowercase-weak, wildcard-in-list cases. Full ErsatzTV.Tests green (1556). Refs #253 #197	2026-07-12 23:09:36 +02:00
timothyandClaude Opus 4.8	8090e10408	fix(api): #265 — If-Match evaluates per RFC 7232 (valid-but-non-matching → 412, not 400) ... The shared optimistic-concurrency parser (ConcurrencyHeaders.ParseIfMatch) classified any non-canonical/weak/list If-Match value as Malformed → 400. Per RFC 7232 §3.1 a syntactically -valid entity-tag that simply doesn't strong-match must be 412; 400 is only for a genuine grammar violation. - Rewrite ParseIfMatch as a real RFC 7232 entity-tag/list parser: walks the comma-separated 1#entity-tag list, validates each [W/]DQUOTE *etagc DQUOTE member, and collects the strong members whose opaque text is our canonical decimal. Weak / empty / non-canonical / out-of-range tags are valid but contribute no version (→ empty set → 412); genuine grammar violations (unquoted, SP-in-tag, unterminated, garbage) → 400. - Reshape IfMatchCondition.ExpectedVersion : Option<int> → ExpectedVersions : Option<Seq<int>> and VersionedAggregateExtensions.CheckVersion → set membership (any strong match proceeds; empty set always 412). Threads through 10 replace/update commands + handlers + request mappers + 9 controllers. - No wire-contract change (400 + 412 already declared on every PUT; the field is header-derived and internal — no DTO/route/response-type/OpenAPI change). - Tests: ConcurrencyHeadersTests rewritten for the new classification (lists, weak, empty, non-canonical → Version/empty-set; grammar violations → Malformed) + new VersionedAggregateExtensionsTests for CheckVersion membership/empty-set/force-write. - Docs: api-conventions.md §7a rewritten; decisions.md entry appended. Refs #253 #197 fixes #265 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:09:36 +02:00
timothyandClaude Opus 4.8	6537697fe5	test(#319): hash-drift guard prefers the built index.html when present ... Addresses the cold-review LOW: the guard hashed only the committed source web/index.html, so a hypothetical future Vite transform of the inline script would leave the test green while the deployed CSP silently broke the SPA. It now hashes the built wwwroot/app/index.html when it exists (the exact bytes the browser hashes — full coverage on any local build), falling back to the source only in a fresh CI checkout where the built artifact is gitignored/absent. Vite copies the inline script verbatim today, so the two agree. Doc comments + decisions.md synced. Test-and-docs only; no production code change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:41:24 +02:00
timothyandClaude Opus 4.8	873b3e54a5	security(#319): enforcing CSP + Permissions-Policy on the host ... Completes the CSP the #279 baseline-headers middleware deferred. Surfaced by the #314 ZAP baseline (missing CSP/Permissions-Policy WARNs); a #197 exit item. SecurityHeadersMiddleware now also sets Permissions-Policy (deny-all for camera/mic/geolocation/payment/usb) and an enforcing Content-Security-Policy on every response EXCEPT /docs (Scalar) and /openapi — those rely on inline bootstrap scripts/styles a strict policy would break (baseline headers still apply; hardening that admin surface is a #197 follow-up). CSP: default-src 'self'; script-src 'self' + the hash of the SPA's inline theme-bootstrap script (no 'unsafe-inline'/'unsafe-eval'); style-src adds 'unsafe-inline' (React inline styles) + fonts.googleapis.com; font-src adds fonts.gstatic.com; img-src adds data:/blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'. The Google Fonts allowance (the SPA CSS @imports the Geist web font) was caught by live-E2E, which the static recon missed. A guard test hashes the committed web/index.html inline script and fails if it drifts from the middleware constant (the built wwwroot/app is gitignored/absent in CI, and Vite copies the inline script verbatim). Verified: full test pass, live-E2E (SPA renders clean, zero CSP violations), curl (CSP present on /app + /api, absent on /docs + /openapi). Docs: docs/decisions.md entry. fixes #319 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:36:44 +02:00
timothy	fa655053ba	Merge PR #316: #295 PR2 SPA session cutover + #301 side-effecting-GET POST-ification ... #295 PR2: browser SPA authenticates with the session cookie (boot gate: Setup/Login), API key demoted to machine/MCP-only (machine-key management screen), logout. #301: three side-effecting troubleshoot GET/HEAD endpoints + graphics-elements refresh POST-ified so the session-mutation CSRF gate covers them. Reviewed (fork + Codex + Fable reconciliation + fork fix-commit re-review), live-E2E'd (5/5), CI green. Fixes #295 Fixes #301	2026-07-12 20:04:54 +00:00
timothyandClaude Opus 4.8	be9cf5f381	fix(ci): build before GenerateOpenApiDocuments in update-openapi.sh ... The new api-docs gate (#303 H4/H5) runs update-openapi.sh after only `dotnet restore`. The script's `dotnet build -t:GenerateOpenApiDocuments` does not compile the project (OpenApiGenerateDocumentsOnBuild=false), so in a clean tree getdocument fails with 'ErsatzTV.deps.json does not exist' (exit 129). This PR is the first to change the /api surface and thus the first to exercise the gate's regen path, exposing the latent bug. Add a full `dotnet build` before the doc-gen target so the assembly + deps.json exist. Verified: clean-tree regen now succeeds with zero diff. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	105c0ec88a	fix(web): #316 review — playback phase promotion, engine-neutral download test fixtures, 401 signal, AuthSession optional fields ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	ec26e1be5b	fix(api): #316 review — POST-ify graphics-elements refresh, LockedError→409, no-store machine-key ... - GET /api/graphics-elements no longer side-effects; refresh moved to POST /api/graphics-elements/refresh (204), closing a CSRF vector on a GET. - PrepareTroubleshootingPlaybackHandler now returns a typed LockedError from both atomic lock-acquire failures; ApiResults.ToErrorResult maps it to 409 instead of falling through to 422, so a lock lost in the race between the controller's pre-check and the handler's atomic acquire still reports 409. - AuthController.MachineKey sets Cache-Control: no-store + Pragma: no-cache on the 200 response carrying the master API key. - Reworded the stale "subtitleId query parameter" endpoint description now that playback/start takes a JSON body. - Regenerated openapi/v1.json + docs/endpoint-index.md; docs/api-conventions.md updated with the LockedError pattern (§3a) and the ToErrorResult table row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	461c763dc6	docs: #295 PR2 + #301 — decisions entry, api-conventions §9, e2e-local browser flow ... - decisions.md: new entry (SPA cookie-only cutover, boot-gate-not-route, #301 POST-ification rationale, machine-key-read + OIDC-logout residual) + TOC line. - api-conventions §9: #301 resolved (POST-ify) + 'never add a side-effecting GET' standing rule; machine-key endpoint added to the auth surface list; PR2-shipped note. - e2e-local: fix stale 'no key required' claim (fail-closed since #197) + browser setup/login boot-gate flow. (spa-conventions §5e rewrite landed with the SPA-consumers slice.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	a9f1a4f6b5	fix(test): #301 update OpenApiErrorResponseContractTests to POST playback/start route ... Slice A updated OpenApiContractHonestyTests for the troubleshoot GET->POST route change but missed the hardcoded [TestCase] rows in OpenApiErrorResponseContractTests still referencing the removed GET/HEAD /api/troubleshoot/playback.m3u8 409 — the lookup threw KeyNotFound on the regenerated spec. Point them at the new POST /api/troubleshoot/playback/start (404/409/422, all ProblemDetails-documented). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	3c1e694905	fix(web): #295 align MachineKey wire field to server ({ apiKey }, not { key }) ... The server returns MachineKeyResponse(string ApiKey) -> JSON { apiKey }, but the hand-written SPA MachineKey type declared { key } and ApiKeyScreen read result.key, which would be undefined at runtime (blank key + empty copy). Mocked unit tests passed against the wrong shape. Align the type, the screen, and both test mocks to the real { apiKey } contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	de9fc7e8cc	feat(web): #295 PR2 SPA consumers — troubleshoot POST/blob downloads + machine-key screen + password change ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	9348a9938a	feat(web): #295 PR2 SPA session-auth foundation (boot gate, CSRF header, login/setup/logout) ... Replace the API-key SPA model with the session-cookie auth from PR1: - client.ts: stop sending X-Api-Key; attach X-Csrf on mutating verbs (POST/PUT/ PATCH/DELETE); add suppressUnauthorizedSignal to skip the global 401 signal on expected wrong-credentials 401s (login / change-password). - api/auth.ts: hand-written wire types (AuthConfig/AuthSession/MachineKey — the auth surface is IgnoreApi, deliberately not in generated types) + endpoint fns (getAuthConfig/getAuthSession/login/setup/logout/changePassword/getMachineKey); keep the notifyUnauthorized/subscribeUnauthorized 401 signal; add clearLegacyStoredApiKey. Legacy get/set/clearStoredApiKey retained ONLY so the still-shipping ApiKeyScreen (machine-key slice) compiles without a cross-slice conflict — the client no longer reads them. - AuthGate.tsx: boot gate wrapping <App/> outside the shell (mints no URL, deep links survive login). checking -> setup | login | ready | error, with a safe default AuthContext so App.test.tsx renders without a provider; config-fetch failure lands on an explicit error+Retry, never a blank screen. - LoginScreen / SetupScreen: shell-less centered cards; inline 401 / 409 handling; SSO button + local-form gating from AuthConfig. - UnauthorizedBanner: rewritten to prompt re-login (passive; consults the unsaved-changes guard before flipping the gate). - UserMenu: TopBar sign-out (guard -> logout -> signOut), mounted next to ConnectMenu. - main.tsx: wrap <AuthGate><App/></AuthGate> inside StrictMode. Tests: client/auth/AuthGate/LoginScreen/SetupScreen/UnauthorizedBanner/UserMenu (723 pass). Lint + build green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	88d82266b6	feat(api): #301 POST-ify side-effecting troubleshoot GETs + GET /api/auth/machine-key ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	9dc48118d1	chore: re-trigger CI (api-docs runner checkout-cache flake on 5c5a90af; identical tree) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:33:43 +02:00
timothyandClaude Opus 4.8	5c5a90afde	fix(ci): #315 address review nits — drop fragile FAIL_RE, validate --timeout, log image id ... Adversarial review (MERGEABLE-WITH-NITS) findings: - Remove the broad FAIL_RE log-scan (matched benign ErsatzTV startup noise — library scans against absent media mounts, EF connection retries — risking a false-FAIL that blocks a good release). It was also redundant: a failed migration faults the BackgroundService -> default StopHost -> container exit, which the early-exit check already catches reliably (per the reviewer's own analysis). Migration failure is now detected by early container exit + timeout + the post-boot serve probe. - Validate --timeout is a positive integer (was: '--timeout abc' -> 0 -> instant false-FAIL). - Log the resolved image id after (attempted) pull, so a pull-failure that rehearses a stale local :latest is visible to the operator. Re-validated live on bumblebee: :latest vs the 283MB prod-copy -> migrations clean, PASS, image digest logged, no leftover temp dir/container. shellcheck + bash -n clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:23:45 +02:00
timothyandClaude Opus 4.8	4da2b67ab2	feat(ci): #315 migration-on-prod-copy smoke for the release path ... CI's migrations job only proves a migration is well-formed against a fresh, empty DB. It never exercises the migration — or ErsatzTV's startup data steps (DatabaseMigratorService -> DbInitializer + PopulatePathHashes over the real MediaFile table) — against the accumulated prod SQLite, so a migration green on a fresh DB can still fail/corrupt on prod, found only mid-deploy. scripts/migration-smoke.sh rehearses it on a THROWAWAY copy of the latest prod backup: boots the new image against the copy, gates PASS on the "Done applying database migrations" log line (the migrator is a BackgroundService running concurrently with Kestrel, so HTTP readiness alone doesn't prove migrations finished), FAILs on early container exit / migration exception / timeout / not serving afterwards. Always operates on a copy, never the live DB; tears down its container + temp dir (incl. the container's root-owned config files) on exit. Validated live 2026-07-12: :latest vs a copy of the 283MB prod backup -> migrations applied cleanly, app booted+served, temp dir removed. Home split: this repo owns the script + docs; wiring it into the Komodo pre-deploy step is server-management#589 (cross-repo). Docs: docs/ci-cd.md (Migration integrity), docs/decisions.md (new entry, pure insertion). fixes #315 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:18:16 +02:00