timothyandClaude Opus 4.8
37155c866b
Backend of #197 Bundle A (auth posture). Owner decisions: single API key; Api:RequireKeyForReads defaults true (whole /api surface gated; /iptv streaming + guide unaffected — outside the filter's /api scope). - #280 S1: writes are fail-closed. New IApiKeyProvider resolves the key once (Api:WriteKey config, else persisted /config/api.key, else a generated 256-bit key written 0600). The empty-key open branch is gone; there is no open mode. - #282 S3/S5: reads under /api require the key when Api:RequireKeyForReads (default true) or the endpoint carries the new [RequiresApiKey]. Applied [RequiresApiKey] to Troubleshoot/Logs/Settings/Maintenance so the sensitive tier stays gated even if reads are opened. OPTIONS preflight is exempt. - #281 S2: delete SortController (dead Blazor SortableJS residue; SPA uses PUT /api/collections/{id}/custom-order) and AccountController (dead OIDC logout) — both non-/api persistent surfaces that bypassed the key. - #284 S6: replace CORS AllowAll with an opt-in exact-origin allowlist (Api:CorsAllowedOrigins; permits X-Api-Key/If-Match, exposes ETag). Default is no cross-origin (SPA is same-origin). - #285 S7/S10: gc GET->POST (spec regenerated); ForwardedHeaders trust configurable via ForwardedHeaders:KnownProxies/KnownNetworks (warns when unrestricted); ScannerController gains [LocalhostOnly] (scanner always calls back over localhost). Filter unit tests rewritten for fail-closed + read-gating + tier + OPTIONS; ApiControllerSecurityTests assert the sensitive tier + scanner-loopback reflectively. search/all-items paging deferred (SPA add-all coupling) — exposure closed by read-gating. Refs #197 #280 #281 #282 #284 #285 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs/ — reading order
Purpose: index of docs/ so a fresh contributor/agent knows what to read and in what order.
Update this doc in the same PR that adds, removes, or retitles a doc below.
Read in this order at session start:
CLAUDE.md(repo root) — project intro: architecture, layout, dev commands, conventions.docs/contributing.md— established code patterns (CQRS/MediatR, LanguageExt, the ChicoryTV SPA, EF Core dual-provider migrations, FFmpeg pipeline, analyzers, testing). Read before any non-trivial change.docs/domain-model.md— what the app IS: entity glossary, channel→playout→schedule/block concept map, where each concept is edited in the SPA.docs/api-conventions.md— checklist for adding/changing a/api/*endpoint (controllers, DTOs, error mapping, auth, OpenAPI regen, tests).docs/spa-conventions.md— playbook for adding a screen to the ChicoryTV React SPA.docs/e2e-local.md(+scripts/e2e-local.sh) — how to run a live local instance for manual or Playwright-MCP verification.docs/testing.md— testing map: what each*.Testsproject /websuite covers, golden-file nets, the timezone-independence rule, how to run subsets, the per-PR verification gate.docs/blazor-route-parity.md— historical record of the completed #91 phase (b) cutover: the Blazor Server UI is removed and every legacy route now 302-redirects to its SPA equivalent (or falls through to the catch-all →/app). Read it for the full legacy→SPA route inventory.docs/decisions.md— append-only "why" log. Check here before challenging an existing convention.docs/ci-cd.md— build/test/release pipeline, versioning, dependency management.
Also present in docs/:
docs/rest-api.md— REST API design doc for ersatztv#2 (goals, conventions, per-slice plan). Largely superseded day-to-day bydocs/api-conventions.md; read this for the original rationale.docs/channels.md— Channel entity field reference.docs/m3u-xmltv.md— M3U/XMLTV generation overview (ChannelPlaylist,GetChannelGuideHandler).docs/fork-strategy.md— divergence policy vs upstream ErsatzTV.docs/design-sync.md— Claude Design ↔ repo screen workflow (#92).docs/endpoint-index.md— generated REST endpoint index (method/path/operationId/summary per OpenAPI tag). Do not edit by hand; regenerated byscripts/generate-endpoint-index.py/scripts/update-openapi.sh.docs/handoffs/chicorytv-issue-queue.md— static session kickoff prompt + workflow lore. Queue state (goal, arc, what's in flight/next) lives in the pinned Gitea tracker ersatztv#237 — read that, not this file, for current state (protocol: decisions.md 2026-07-11).docs/handoffs/rest-api.md— original handoff prompt for kicking off the REST API work (#2).