215 Commits

Include renames

Author	SHA1	Message	Date
peter	7360339039	fix(api): a non-finite number in a JSON body is refused with a 422, not a 500 ... The JSON parser under FastAPI accepts `Infinity`/`NaN`, and both progress checkpoints truncate the position with `int()` — a hand-written checkpoint came back as a 500 with a traceback. Their bodies now refuse non-finite floats, and the app's validation handler — FastAPI's own shape — echoes a non-finite input by name: the default one failed to serialise its own error (JSON has no NaN), which was a 500 by another route. Sibling of the subtitle routes' non-finite query parameters.	2026-09-11 03:18:17 +02:00
peter	473d9f02f2	fix(plex): subtitle windows land where the full pass does, and the extractor stops re-reading, respawning and outliving the process ... Deep-review round 2 of the 2026-09 bug hunt, over the round-1 fix diff. - A window was LATE by the distance to the keyframe its input seek landed on, and then doubled for good once the full pass merged in: a cue already running at the window's start came out at a negative time, and the webvtt muxer's default shifted the whole output so it sat at 0. Measured on the real Westworld S01E06 at 25:00: every window cue +5.005 s, 682 cues merged instead of 608. `-avoid_negative_ts disabled` keeps the times exact (the parser reads ffmpeg's signed-field spelling of a negative time); now 608/608 on that file, and a real-ffmpeg test pins it. - A full pass that failed was re-armed every minute while the viewer watched what it did publish — a whole-container read per minute. It now backs off for an hour; windows keep running meanwhile. - A failed WINDOW set the track's failure memo, so any uncovered position read "failed" — a final answer that ends the player's poll, even with the full pass about to deliver, and one any account could plant with an absurd `at`. It now marks only the span it failed to read; "failed" is given once the full pass AND a window there have both failed. - Windows join by what they COVER, not a bucketed identity: a backward seek no longer waits behind a window that cannot cover it, and a playhead crossing a bucket edge no longer queues a second read. The queue is bounded per track and overall. - shutdown() sets a flag a worker checks before it spawns ffmpeg (one still in its Plex lookup used to start a read after the kill sweep); queued-job cancellation and the lifespan call are now tested. - A window starts where ffmpeg is told to seek (rounded to the ms it gets), a rounded-up millisecond carries into the minute (no more `00:00:60.000`), a key's first publish claims nothing before its VTT lands, and `at`/`offset`/`start`/`aoff` refuse non-finite values (`at` also an absurd one).	2026-09-11 03:18:08 +02:00
peter	d2ba65e383	fix(plex): the subtitle poll backs off on errors, a failed <track> is replaced, and a resume asks for the right window ... Deep-review R2, plus one defect found while verifying it on localdev. - The status poll re-armed every second after a FAILED request: `data` stays empty on an error, so it read as "still preparing" for as long as the player was open — and the request was not quiet, so a persistent 500 re-opened the global error dialog every second. It now backs off to 10 s (a blip still heals on its own) and is quiet; the player already shows the failure inline. - A <track> whose own VTT fetch failed never fetched again: with the server's answer unchanged its key was unchanged, so React kept the dead element — silently blank subtitles. The key (now built in the hook, where it is tested) carries a failed-load count; after two remounts the track is reported as unavailable instead. - Found in UAT: until the first timeupdate `abs` is 0, so after a resume every poll said at=0 and the first window was cut around the head of the film (a resume at 20:00 polled at=0 for as long as it stayed paused). The poll reports the session's start until playback ticks. And the window's dedup identity is the track plus a window-length bucket of its start — keyed on the track alone (R1), the right window queued behind that wrong one. The poll's start/stop rules finally have tests (every earlier one resolved a single fixed answer). Verified on localdev against Westworld S1E6 resumed at 20:00: the polls carried at=1197, one subtitle line on screen at 21:02, the poll stopped at `ready`; the real file's window (56 cues) + full pass (608) merged to 608 — the old merge would have served 664. 11 mutations, all red.	2026-09-11 01:08:27 +02:00
peter	cf7ec5e9ec	fix(plex): the subtitle extractor's seams — doubled cues, a truncated track cached as whole, a poll that respawned ffmpeg ... Deep-review of the bug-hunt round (R1). The background extractor from ed4ab4e1 held, but its seams did not: - Window + full pass doubled every cue in the first hour. merge_vtt de-duplicated on the raw timing text, and the two passes spell a timestamp differently (shift_vtt writes HH:MM:SS.mmm, ffmpeg's webvtt muxer drops the hour below 1 h; shift_vtt(-0.0) never normalised the full pass). Timing is now parsed and re-emitted canonically, keyed with the cue text so two cues sharing a time survive. - A full pass that exited non-zero was published as complete: "ready" forever, subtitles ending where ffmpeg died, and no eviction to ever retry. It now covers only up to its last cue, is never complete, and records the failure memo. - The window's dedup identity held the live playhead, so every 1 s poll queued another read of the file. It is keyed on the track now, and a queued job re-checks coverage before reading anything. - A sidecar track waited behind an unrelated embedded full pass (the full job is per item). Its window job now fetches it whole — one small request. - The <track> fetch ran the scheduler at position 0: an unrequested window over the head of the file, and a refusal of a window that was on disk. It is a pure read of the cache now. - publish() is serialised (a lost update became permanent once complete was set); the pool is shut down and running ffmpeg children killed at app shutdown (they held interpreter exit for minutes); ?at=inf is a 422, not a 500; and both subtitle routes use current_user instead of the cookie-only poster gate, which let a suspended or epoch-revoked session keep scheduling reads (pre-existing). _extract_and_publish finally has tests of its own — every earlier test stubbed it out. 19 mutations, each red on the assertion that names it.	2026-09-11 00:52:59 +02:00
peter	889d2acf52	feat(plex): the collection page sorts, and a linked collection has a name ... Two halves of the same report ("Collectionben nem működik a rendezés?"). The pasted browse URL sorts correctly — that part was working. What did not: The Collection INFO page had no sort control at all and a hardcoded release-year-ascending order. It now shows the browse grid's Sort control, with the browse grid's vocabulary, because a second sort vocabulary on a neighbouring surface is exactly the kind of drift this repo keeps paying for: `PLEX_SORT_KEYS` is now one tuple in `plex/query.py`, and a test pins BOTH implementations to it — browse's key→column map (extracted from the handler to be reachable) and the collection page's key→member map. A key added to the vocabulary without teaching one of them fails the gate instead of putting a dead option in the menu. Ordering a collection cannot be a single ORDER BY: its two legs are different tables, so the merged member list is sorted in Python. Members with no value for the key sink to the END in both directions (a movie with no rating is not "the worst rated" — the browse grid's `nullslast()`), and ties always resolve title-ascending, so flipping the direction reverses the ranking rather than the alphabet inside it. `lastwatched` needed the show leg's `resumed_at`, so the page now takes ONE rollup pass that yields both the badge status and the recency instead of the status alone — without it that menu entry would have ordered every show as never-watched. The default stays release-year ascending: a franchise reads in release order, and that is what the page did before. The other half: a shared Plex link carries the collection filter as bare rating_keys, so a link opened cold had no name for them — the sidebar token rendered `17045` and the chip could only say "Collection". `GET /api/plex/collections` takes a `keys=` CSV now, and a display-only hook resolves just the missing ids. It deliberately does NOT write them into `collectionTitles`: that map is hashed into the Plex query keys, so storing a resolved label there would split the cache from the identical state and refetch the grid for a piece of text. Verified in the browser on localdev against the real Plex library: the movie collection's menu offers Length and the show collection's does not (the same scope rule as browse); rating-ascending reorders 8.1/7.4/7.2/6.6/6.5 correctly; `lastwatched` on a show collection brings the in-progress shows up; the choice survives a reload (it is a server pref, on its own key so opening a collection never re-sorts the library behind it); and the reported URL now reads "Pirates of the Caribbean Collection" in both the sidebar and the chip. 12 pytest + 8 vitest, mutation-checked against 14 mutations (direction ignored, nulls first, no stable tiebreak, unknown key untouched, wrong default, show recency dropped, empty `keys=` falling through to everything, a key missing from either sort map, every id refetched, ids unsorted, fetched titles unmerged, the chip ignoring them, the hook's result never reaching the builder) — each red on exactly the test that names it.	2026-09-10 22:05:39 +02:00
peter	5a42d76e8a	feat(plex): an off-by-default loudness normalisation toggle for playback ... Bug hunt 2026-09, item 14 — "how does the multichannel downmix work, and is it normalised?" It isn't: `plex/stream.py` has always encoded `-c:a aac -ac 2 -b:a 192k`, i.e. fixed stereo with ffmpeg's default downmix matrix and no loudness handling at all, which is why a film mastered for a cinema arrives with whispered dialogue and deafening action. New admin knob `plex_audio_loudnorm` (Configuration → Plex), DEFAULT OFF: it makes a film markedly louder and narrows its dynamic range, which is a taste call rather than a fix. It sits at the end of the Plex group, after the software-transcode knobs — it is an audio concern, not one of the libx264 ones. -af aformat=channel_layouts=stereo,loudnorm=I=-16:TP=-1.5:LRA=11,aresample=48000 Three things about that chain are load-bearing and each has a test: * the downmix is FORCED FIRST rather than left to `-ac 2` — measuring 5.1 and folding it down afterwards would normalise something other than what is heard; * the trailing resample is not decoration: `loudnorm` runs its own resampler at 192 kHz internally, which the AAC encoder will not take; * one `-af`, no stream index, so EVERY audio rendition of a multi-audio file is normalised — not just the first. The knob is also part of the session directory name (`…_multi-ln_+0.00`), because it changes the audio the segments contain, and a session left over from before the admin flipped it must not be mistaken for one that honours it. The suffix is appended with a DASH: `_SESSION_DIR_RE` treats the tag as one underscore-free field, and that regex is the only thing keeping the orphan sweep off what may be a shared scratch path. A test pins both halves — the name changes, and the sweep still recognises it. Measured end-to-end on the app's own HLS segments (a real 5.1 AC3 file, same item, same 160 s offset, same ten segments): OFF -35.2 LUFS, ON -17.2 LUFS. On a 60 s bench: I -27.6 → -16.6 LUFS with LRA 13.3 → 9.8 LU. A/V sync is untouched — under this pipeline's own `-copyts` the audio start PTS is identical with and without the filter, so the 3 s lookahead desyncs nothing. Direct-played files are served untouched and stay so; a 5.1 mix is always `remux`, so the reported case is fully covered.	2026-09-10 20:02:06 +02:00
peter	ed4ab4e13c	fix(plex): subtitles stop blocking the request, and stop re-reading the file ... Bug hunt 2026-09, items 8 and 12 — the two things the Plex player was measurably lying about. Item 8: picking a subtitle track showed nothing for a long time, and the reported workaround was to stop/start until it suddenly worked. Measured on prod against a 17.06 GB MKV with two embedded SubRip tracks: full pass, one track 154 s full pass, both tracks in ONE run 111 s -c:s copy (no WebVTT conversion) 143 s from 1:00:00 to the end of file 66 s a 630 s window at 1:00:00, both 8 s So the conversion was never the cost: ffmpeg streams every byte of the container between its seek point and its stop point, and the array delivers ~140 MB/s. The only lever is reading less. Three changes follow from that: * a window around the playhead is extracted and published FIRST (seconds), and the full pass completes behind it; * every embedded text track rides that same single read — picking Hungarian used to cost a full pass and then switching to English cost another one; * none of it happens inside a request any more. The endpoint answers 202 while a background worker extracts, the player polls /status (carrying its position, so the window follows the viewer), and one ffmpeg run finally has a timeout. -copyts is deliberately absent from a windowed pass: with it ffmpeg ignores -t and reads the whole container anyway (measured — a [0, 600 s] window still took the full 145 s), so a window comes back on a zero-based clock and is shifted to absolute time here. Cached tracks written by older builds have no coverage sidecar and count as complete, so nothing is re-extracted after the upgrade. The <track> is no longer mounted before the server has something to put in it; a "Preparing subtitles: …" notice stands in, and a track that can never be shown says why instead of leaving the viewer to conclude the picker does nothing. Item 12: "Bitrate" read a constant 211 kbps on every remux, because it was the master playlist's BANDWIDTH — which ffmpeg derives from the one stream whose rate it knows, the -b:a 192k AAC track, plus 10%. It is a measurement now: bytes per second of MEDIA from hls.js FRAG_LOADED, accumulated per fragment type and summed (a multi-audio session's video and audio renditions cover the same media seconds, so pooling them would report half the truth), and an honest dash until the first fragment lands. The panel also finally names the audio and subtitle track in play. Verified in the browser against the real Plex library, and every new test mutation-checked.	2026-09-10 19:31:05 +02:00
peter	b8bff504d8	fix(plex): "Clear resume point" now tells Plex about an in-progress item ... The button deletes the local row and mirrors the un-mark to Plex, but it decided whether to push from the previous STATUS alone (prev_status != "new") — and an in-progress item's row is status="new" carrying a position, which is exactly how the importer maps a bare viewOffset. So for the single case the button exists for, nothing was ever sent to Plex: the offset stayed, and the next pull imported it straight back. The user cleared Protector twice and it returned to Continue watching at 92s both times. Push now when Plex holds anything to clear — a view count, or a resume point. "hidden" stays Siftlode-only and pushes nothing, which is what this endpoint's docstring always claimed and the status-only guard contradicted. One unscrobble clears BOTH viewCount and viewOffset — measured against the live server from a watched+offset state and an offset-only one, so the push itself needed no change. The client docstring that claimed "clears viewCount" is what sent the first diagnosis down a wrong path (a timeline write with time=0, which does not clear an offset at all); it now records what the server actually does. Verified end to end on the real Plex server: the button leaves viewCount=None viewOffset=None, and a full 44,885-item re-import brings back no row for it.	2026-09-09 23:55:51 +02:00
peter	e4ffd59ca7	fix(e24): review round 2 — a buried history entry, a stale hero, and a spinner that was not ours ... Nine of the round's ten surviving findings. The tenth (a failed shelf reorder leaving an order the server rejected on screen) is on ROADMAP.md: its obvious remedy reintroduces the overlapping-move defect the code already documents, so it wants a design, not a review edit. - `navigateOverOverlays` buried the live overlay entries before knowing whether the navigation pushed one. `setPage` no-ops when the page is already current and Home is the default landing page, so Shift+W over a player ON Home marked its entry buried under a push that never happened: the unmount consumed the mark instead of reclaiming the entry, and the next browser Back was a press that did nothing. `setPage` now reports whether it navigated, and one `buryUnder` rule serves both entry points — `closeThenNavigate` takes the same no-op navigation from a palette command for the page you are already on. - The hero could answer a new time budget with the previous one's pick. The chip row resets seed/seen/press but cannot reset an answer that already resolved, and `keepPreviousData` chained through the disabled seed-0 query — so a reroll under "10 perc" showed the film picked for "Bármennyi" while it loaded, and kept it if the request failed. `lastPick` now carries the server's own budget echo, and the placeholder is scoped to the budget. - The reroll button spun and swallowed clicks after mark-watched, bookmark, pin and shelf moves: the pick key sits under the invalidated `discover` prefix on purpose, so raw `isFetching` was true for background refetches. It now means "a press of mine is outstanding" — which still covers the first press, where there is no placeholder. - Failed writes on Home toasted the page's LOAD-failure string over a fully loaded page; they get their own key (HU+EN). The empty-state reroll had no `loading`, so the press was unacknowledged and a second click skipped a tier. `danger` moved into the shared unpin row so the same command is not red on the shelf and neutral in the rail below it. - Two comments claimed things the code does not do: the `exclude` cap guards no "unbounded scan" (it never reaches SQL), and the route test that named the cap sends three keys. Tests: the burial rule gets its own file (it is the one assertion that lets a reconcile issue a real programmatic back()); App's keymap wiring gets a source contract, because dropping it left all 818 tests green; `add_pin`'s IntegrityError arm was reached by nothing. Every new test mutation-checked red, both edges where the predicate has two. Gate: ruff, ruff format, 3x tsc, eslint (0 errors), prettier, knip, vitest 822, pytest 1005.	2026-09-09 00:12:53 +02:00
peter	3709b71a94	fix(e24): the review's low findings — dead constants, honest labels, a 500 that should be a 404 ... `add_pin`'s IntegrityError handler assumed the unique constraint was the only way in and re-raised otherwise, so a target row pruned between `resolve_ref` confirming it and the INSERT (a Plex sync dropping a removed item) tripped the FK and handed the user a 500. Semantically that is the same "no such thing" the pre-check already returns. Untested: the race needs two concurrent transactions. The five per-kind unique constraints had no test at all — the route's own dedupe returns before reaching the DB, and the migration drift check filters constraint diffs out as noise, so they could go missing with every lane green. Frontend, all from the same review: the shelf's unpin row is now `danger` like every other destructive row in the app; the hero's artwork button says what it will actually do and names the item instead of always announcing "Play"; the empty-budget message offers a reroll rather than `StateMessage`'s "Retry", which promised a re-run of something that had not failed; `setState` and the watch-later toggle catch their rejections instead of leaving an unhandled promise and a click that silently does nothing. `StateMessage` gained a `compact` rung, which retires the frontend's only two `!important` overrides — they existed to beat the primitive's own padding from the call site, and were the copyable idiom for the next surface that wanted a compact empty state. Dead vocabulary removed or made load-bearing: `DISCOVER_BUDGETS` was exported, re-exported and consumed by nothing while `Home.tsx` re-typed the same four bands (a `readonly DiscoverBudget[]` accepts any subset, so a fifth band would have typechecked green and rendered no chip); `PIN_KINDS`' value export had no consumer at all; `useComfortPin` no longer publishes `pinIdOf`/`toggle`, which nothing outside the module calls. Three comments corrected against the code they describe: a pointer to a `resolve.py` that was never written, the file header's claim that Home defines no card component of its own, and the `seen` window still quoting the 8 that was measured and abandoned for 32. The rest of the review's survivors are logged on ROADMAP.md under "Deferred — E24 epic-end deep-review (2026-09-08)" — the ones whose dissent was substantive, and the ones whose fix is wider than the finding.	2026-09-08 03:23:59 +02:00
peter	cedebe0ffb	test(e24): close the review's coverage gaps, and correct a comment that was untrue ... `test_only_a_show_row_pays_for_a_resolution` seeded no watch state, so every rail query inner-joined its way to zero rows and the loop body — with it the assertion — never ran. It now seeds a video, a movie and an episode, and asserts all three kinds are present before the loop, so it cannot go vacuous again. The Plex half of the surprise rail had no test for either of its promises: every test that reached `plex_surprise` passed budget="any" against a library with no state rows, so the duration bounds and the already-started exclusion could both be deleted with the suite green. The YouTube half has had tests for the same two rules since S1 — the asymmetric half of one principle. `plex_item` and `plex_show` — two of the five pinnable kinds — were pinned by no test at all, leaving the rating_key → internal-id translation and both shelf arms uncovered, including the self-reference cycle that once 500'd the shelf. And `GET /api/discover/pick` was exercised only through its domain function, so the route's own query-string translation could regress silently; the new test excludes all three candidates, which is what proves the whole list parsed rather than one unsplit string. `PIN_COLUMNS`/`PIN_KINDS` claimed in a comment to be the one place the pin vocabulary is spoken and had no readers anywhere: `resolve_ref` re-spelled the column names and the route re-typed the kind list. Both now drive off the constants. The `_NO_TS` sentinel was introduced as a crash fix and is not one. The key it replaced, `(ts is not None, ts)`, cannot raise — tuple comparison finds the first UNEQUAL element via `==`, so two null keys compare equal and `None < None` is never reached; three independent runs confirmed it over every permutation. The rationale now says what the sentinel actually buys, lives once in `plex.rollup`, and the third rail that was still on the older spelling has been swept to match. Its test is renamed and re-scoped to the mutation it does catch. Frontend: the reroll's second press asserted `expect.any(Array)`, which cannot tell an accumulating exclusion window from a replacing one — both that and SEEN_WINDOW = 1 (each reinstating the measured nine-card cycle) left the suite green. And `onInfo`'s jump type was untested while `onPlay`'s was pinned twice, so pointing the ⓘ affordance at the player typechecked and shipped green. All eight fixes mutation-checked; every mutant died on its intended test.	2026-09-08 03:14:21 +02:00
peter	84f4b20e5a	fix(e24): the review's three backend defects — blocklist, shelf order, next episode ... The resume rail built its own SELECT instead of going through `filtered_query` and copied only three of its predicates, so it dropped the per-user channel blocklist the module docstring claims it inherits. Blocking a channel never touches `video_states`, so a half-watched video from it kept its resume position and headed the rail — and, at the default budget with the resume tier leading, became the landing page's hero: the app answering "what should I watch" with the thing the user had just banned. The clause is now `feedquery.not_blocked_cond`, shared with `filtered_query` rather than copied a second time; the feed's SCOPE clauses stay deliberately unapplied, for the reason `yt_video_row` already gives. `next_position` returned the shelf's row COUNT while nothing ever renumbers positions — `remove_pin` deletes, and every FK cascade removes a pin when its target disappears. Past the first hole the count under-counts, so a new pin landed in the middle of the shelf and, past the second, on a position another pin already held. `max(position) + 1`, the idiom `routes/playlists` already uses. `next_episode` took the FIRST in-progress episode in broadcast order while `plex.rollup`, which drives the show page's Resume button, takes the last. One show therefore had two different "continue watching" answers, with the Home tile ranking it by its most recent touch and then offering the episode abandoned weeks earlier. The new test asserts the two implementations against each other rather than against a literal. All three mutation-checked: each new test goes red for the defect it names.	2026-09-08 02:32:08 +02:00
peter	82914b56ca	fix(e24): the Home surface's three UAT findings — Back, the reroll, and a show card ... All three were measured before they were touched, and the diagnosis moved twice. **Back from a Plex title played off Home landed on the Plex module's root.** One click pushed three history entries: the page navigation, the sub-view opened by the `jumpTo` hand-off, and — under StrictMode, whose effect body runs twice before `setJumpTo(null)` re-renders — that same sub-view a second time. So the first Back visibly did nothing and the second stranded the user on a Discover page they had never visited. A cross-module hand-off is the CONTINUATION of the navigation that brought you there, not a second navigation, so it now REPLACES the page entry instead of stacking on it (`useHistorySubview.open(view, {replace})`, asked for by the jump target). Replacing is also idempotent, which is what disarms the StrictMode double-run. The intent rides on `PlexJumpTarget` rather than being inferred, because the header typeahead jumps from INSIDE the module, where the entry being replaced would be a sub-view the user really was looking at. **"Mást kérek" cycled nine cards and never left the resume tier.** Measured: twelve presses, nine distinct titles, period nine, every one `tier: "resume"` — the shelf and the surprise tier were unreachable by pressing the button. Two causes multiplied: the tiers were tried in a fixed priority order over a 20-row resume rail, so the button just walked down it; and the client's rolling exclusion window of 8 guaranteed the wrap. The press count now rotates which tier answers first (`start`), so each press offers a different KIND of answer — the user's call, given the choice between that, a wider window, and a surprise-only reroll. The fallthrough is kept, so a press does not come back empty because the tier it led with had nothing. The window is matched to the server's own cap rather than a smaller number of ours. **A half-watched series on Home opened the show page.** A movie already went straight to the player; only shows did not — and the comfort shelf and the hero both resolved a show to its next episode while this rail alone did not, handing back six seasons to choose between. The rail row now carries `next`, and the client already played `next ?? card`, so this is a backend fix. Affording it needed `queries.next_episode` to stop loading every episode of the show into Python to pick one of them (236 rows for Friends, 227 for JAG) — three ordered LIMIT 1 probes instead. The show→episode rule now lives in ONE function (`rails.playable`), which is what the shelf, the hero and the rail all call; two implementations are how they came to disagree. Ten mutations run, all ten red for the right test — including a first pass where the press count reached `api.discoverPick` and stopped there, invisible because every Home test mocks that module. The slice now has its own URL test. Verified in a clean browser tab against the live account: one Back returns to Home, the rotation gives resume/comfort/surprise across nine presses with no repeat, and Westworld opens at S1E1 rather than at its show page.	2026-09-06 05:38:28 +02:00
peter	f3c0b7be23	feat(e24): the Home surface — one question, one answer, both sources ... E24 S2. A new `home` module in layout C+ (the mockup the owner picked): the time-budget chips on top, one large hero that answers them, then the comfort shelf and a cross-source resume rail. Home is the landing — deliberately OVER the remembered last module, since landing on whatever you happened to close the app on is the habit this epic exists to replace; `LS.startOnHome = "0"` opts an account back out (Settings toggle lands in S4). No third card component: each unified card carries the native feed / Plex payload, so the rails render through the existing VideoCard (`cardsSmall`) and PlexPosterCard, and `aspect` decides the tile shape without branching on source. Plex playback hands off to the Plex module via a new `jumpTo` type — the player lives there with its lazy hls.js and its provider tree, and mounting a second one on the landing page to save one hand-off would be the expensive way round. Four defects found by driving it in a real browser against the live account, each now pinned by a mutation-checked test: - **The reroll gave the same card back.** A new seed only re-draws the SURPRISE tier; the resume tier deterministically returns the most recently progressed thing that fits, so anyone with something half-finished pressed a dead button. `/pick` now takes an `exclude` list of `<source>:<id>` keys and the client keeps a rolling window of 8. Excluding a SHOW also excludes the episode it resolves to — otherwise the same suggestion comes back wearing a hat. - **"Nothing to suggest yet" flashed over a full library** whenever a reroll was in flight: the new query key has no data for a beat. An empty state standing in for a loading one is the dishonesty the house rules name outright. The hero now falls back to the loaded payload while a pick is pending, and only trusts a null once the pick has RESOLVED. - **A budget change replaced the page — chips included — with a spinner**, so the control you just clicked vanished under your cursor. `keepPreviousData`, the same reason the feed uses it. - **The hero printed twice**, once as itself and once as the first resume tile. Two smaller UI calls made from the same session: the budget caption sits NEXT to its chips rather than in SegmentedToggle's justify-between mode, which on an 80rem page throws the answers to the far edge; and the feed takes the YouTube mark its own toolbar already uses, since Home now owns the house icon. Gate green: ruff, ruff format, 3x tsc, eslint, prettier, knip, vitest 780, pytest 989. Verified end to end on localdev against the real account: budget chips re-answer (matched on REMAINING time — a 51-minute video with 2:46 left is a ten-minute answer), the reroll walks three distinct heroes, and a Plex show tile opens its drill-down in the Plex module.	2026-09-06 04:14:14 +02:00
peter	53b50231ff	feat(e24): the Home surface read-model — hero, resume rail, comfort shelf ... E24 S1. The anti-paralysis answer layer, served from our own Postgres with no upstream call: one hero suggestion, one CROSS-SOURCE resume rail, and the user's own comfort shelf. Survey first, because the roadmap line was wrong about the starting point: Plex already ships the whole trio (E5's Discover rails, including a reshuffling Surprise me), the YouTube side ships none of it, and nothing anywhere answers the question across both. The data already existed on both sides — VideoState and PlexState are structurally identical, the feed has an `in_progress` filter and a seeded shuffle, and the YT player already resumes position. - app/discover/budget.py — the time bands. "How much time do you have" (10 perc / 30 perc / egy este / mindegy) replaces 15/D's mood questionnaire: deterministic, answerable from a column we have, and it picks the source for free. Matched against REMAINING time, so a film with 8 minutes left is a ten-minute answer. An unknown runtime fits only the unbounded band. - app/discover/cards.py — a thin unified card that carries the NATIVE feed / Plex payload, so the page renders with the existing card components instead of a third one. `aspect` is the one new field: a rail needs to know poster from 16:9, and that is a property of the artwork, not of the module. - app/discover/queries.py — the SQL, reusing feedquery and plex.rollup rather than the Plex Discover ROUTE, whose LibraryFilters narrowing belongs to a surface that has a sidebar. One seed drives both halves so a reroll moves them together. - app/discover/hero.py — resume -> comfort -> surprise, with the chosen tier in the payload so the client labels it honestly instead of guessing. - comfort_pins (0083): five nullable CASCADE-ing FKs under num_nonnulls(...) = 1 rather than a flag or a polymorphic string ref. A flag cannot order a shelf or hold a channel; a string ref would let a deleted library item leave a dead tile on the one surface whose whole job is to be reliable. Two honest-state rules the tests pin: the surprise draw excludes anything already started (the resume tier may have skipped it for not fitting, and offering it back as "Meglepetés" would contradict the question), and which source leads the draw follows the seed, so the Plex library can actually answer "egy este". Gate green: ruff, ruff format, 3x tsc, eslint, prettier, knip, vitest 770, pytest 987.	2026-09-06 03:31:26 +02:00
peter	013f19faca	refactor(plex): move content_libs down into the query layer ... The browse scope is a pure DB query with no request state, but it lived in routes/plex/_shared.py. E24's Home surface needs the same scope from a domain package, and a domain package importing from routes/ inverts the one-way dependency CLAUDE.md draws. Moved to app/plex/query.py and renamed to content_libs (public — it is a domain helper now). Swept all five call sites and both tests in one go rather than leaving a re-export shim: the canonical-patterns table already names the routes.admin re-export as the anti-pattern.	2026-09-06 03:31:02 +02:00
peter	b28be682fe	feat(e10): make "move a video to another list" one atomic request ... The one-step move S2 needs has no honest client-side shape: "add to the target, then remove from the source" leaves the video in BOTH lists whenever the second call fails, and the reverse order loses it entirely. So it is one endpoint in one transaction — POST /api/playlists/{id}/items/{video_id}/move — which re-parents the existing item row (so `added_at` survives), recomputes `dirty` on both sides, and is idempotent when the target already holds the video. Also publishes `updated_at` on the playlist summary, and bumps it explicitly for the edits that only write `playlist_items` (add / remove / reorder / move). UpdatedAtMixin's `onupdate` fires on an UPDATE of the playlist row, so without `_touch` the rail's coming "recently changed" sort would have seen renames and nothing else.	2026-09-05 19:59:41 +02:00
peter	fc56f514b3	fix(e12): the restart hint pointed at the one command that undoes a rollback ... Round three, on round two's diff. The trend across the loop is 47 -> 34 -> 15 raw findings; the ops half kept producing the sharpest ones because the gate cannot run it. **`docker compose start` ignores a newly pinned IMAGE_TAG.** Round two removed the automatic restart because it re-ran `alembic upgrade head` — and then told the operator to run that exact command by hand, in both scripts and the docs. `start` relaunches the container that already exists, which still carries the tag being rolled back FROM, so pinning 0.79.0 and following the printed instruction brings 0.80.0 back up and re-applies its migrations. Verified against a real daemon: after changing the pinned tag, `start` kept the old image and only `up -d` picked up the new one. Both scripts and the doc now say `up -d`, with the pin-first caveat where the operator reads it. **The reset flag outlived its token.** Reverting round one's "each link clears the other" went one step too far: a `#verify=` link pasted over a standing reset notice replaces the whole fragment, so the reset token is gone — but `resetPending` stayed true, and being checked first it hid the confirmation while promising a recovery that signing out could no longer complete. The flag is now cleared when the fragment it describes is gone, which is narrower than what was reverted and does not blank the signed-out card. **A test that could not fail.** The shared-asset regression test seeded the asset as `pending`, and `_reset_asset_pending` only acts on `downloading` — so the release half was a no-op and deleting it kept the suite green. Seeded as the worker actually leaves it now. Also: the malformed-URL guard answers with urlguard's structured detail rather than a bare English string, so both halves of one typo class get the same localized copy, and the third site in that module handing user input to `urlparse` was swept with it; the asset is released after the job is terminal, not before; the Stats 403 toast gets the wizard handle its own comment claimed it had; the pasted Windows recipe sets `$ErrorActionPreference` inside the block (a scriptblock inherits the caller's, so a `SilentlyContinue` profile swallowed every throw) and cleans up the container-side dump on the failure path too; the restore warning moved to the warning stream so a `> log` redirect cannot file it away; and two comments narrowed to what the code does. Gate green: vitest 685, pytest 950.	2026-09-05 04:18:33 +02:00
peter	358d722ce9	fix(e12): close what round one broke, and revert two fixes that overreached ... Round two of the review loop, on round one's own diff. Two of its findings were regressions the fixes themselves introduced, which is exactly what the loop is for: **A per-user refusal was writing onto a shared row.** MediaAssets are deduped across users, and the generic failure handler puts the message on the asset — right for an upstream failure, wrong for "your storage is full". Two users queuing the same video share one asset, so the first user hitting their cap failed the second user's job with the first one's private reason, telling someone with an empty library to free up space. The refusal now raises `_OwnerRefused`, caught separately: the job fails, the asset goes back to `pending` for whoever else holds it. Pinned by a test that drives `_download` directly — the refusal happens before extraction, so nothing needs stubbing. **The restore scripts restarted the app, undoing the restore.** `docker compose start` re-runs the container command, and that runs `alembic upgrade head` — so on the rollback path this documents as recommended (restore the dump, THEN pin the older tag) the newer image immediately re-applied the migrations the restore had just undone, and on a FAILED restore it put the app back on a half-restored schema. Both are the opposite of why the stop was added. Nothing is restarted automatically now; the scripts say what to run and when, and the docs' snippets say the same. **Reverted rather than patched:** the OnboardingWizard toast (the wizard already renders that failure inline, next to a Retry button — three recoveries for one failure), and `useVerifyEntry`'s "each new link clears the other". The latter blanked the signed-out card's only banner, where nothing renders the reset flag to replace it. The two states are independent again; what changes is that `dismiss` peels ONE layer, which is what the original finding was actually about. Also: `Stats` uses the YouTube helper rather than the bare one, so the route's English 403 detail no longer beats the translated fallback under a Hungarian UI; `urlparse` guarded alongside `.port` (an unclosed bracket raised just as late), the reason renamed `malformed` since "bad port" misdescribes it; three docstrings narrowed to what the code actually does (the worker's byte check is per-job, not an aggregate ledger, and not on the edit path; the redirect residual leaks a reachability oracle, which the note had denied; the invalidation helper does not cover suspend); the pasted Windows recipe wrapped so `throw` can stop it; the bash one-liner's failure branch no longer exits 0; and the tests that were missing for the round-one fixes — the account panel's error paths, the invalidation set, and the shared-asset case above. Gate green: vitest 685, pytest 950.	2026-09-05 04:02:57 +02:00
peter	fe38dfbcca	fix(e12): close the eighteen findings the E12 review round left standing ... The deep review of the branch raised 47 findings, 18 of which survived adversarial verification. Grouped by what they actually were: **The size ceiling inverted at its boundary.** `remaining_bytes` clamped to 0 for a user already at their storage cap, and `build_ydl_opts` reads 0 as "no limit" — so the one user over quota was the only one downloading with no ceiling at all. `check_enqueue` could not catch it: it ran while the job was queued and the user was still under the cap. The arithmetic moves into `quota.remaining_bytes` (where every other max_bytes decision lives, and where it can be tested), and the worker now fails the job outright rather than proceeding unbounded — as a non-retryable `quota_exceeded`, since retrying cannot help until space is freed. **Silent failures in the new account panel.** All three actions went through `quiet: true` endpoints, which suppress the global error dialog on the promise that the caller reports inline — with no `onError`, that promise was broken and a refusal rendered as nothing. On the broken-SMTP instance this panel exists for, an admin would read silence as "the mail went out". The co-invalidation set and the email-off predicate move to `lib/adminUsers`, shared with the pending-access queue, so the two copies of these mutations cannot drift apart again — which is how half of this was lost in the first place. **A rollback recipe that destroyed data without working.** `alembic downgrade -1` steps back one migration, but a release routinely ships several (0.80.0 shipped four): it drops the newest one's columns and leaves the schema at a revision the older image also cannot resolve, i.e. the crash loop it was meant to escape, minus the data. The dump restore is now the recommended path, and the alembic route asks the target version for its own head revision instead of counting backwards. Also: redirects named in the urlguard docstring beside the DNS-rebinding residual they share a fix with (SEC-17); a malformed port refused as `bad_port` instead of escaping as a 500; the pull cooldown extended to the sibling route spending the same QuotaAction; restore stops the app before dropping its tables; the PowerShell cleanup can no longer decide the script's verdict on 5.1, nor report the wrong exit code; the documented one-liners hardened to match the scripts; the registry's retention window stated where pinning is advertised; the two banners made mutually exclusive so neither can shadow the other; `hover:bg-hover` (a utility this project never generated) replaced by the `selectable` recipe; the clipboard helper reused; and the sync cooldown's copy swept to the two callers that discarded it. Verified: gate green (vitest 678, pytest 949), and the panel, the row hover and the reset banner UAT'd on localdev.	2026-09-05 03:41:58 +02:00
peter	f98b060e2b	feat(admin): an account panel, and a set-password link that needs no email ... Design option C, chosen by the user 2026-09-05. Nothing in the admin UI ever showed an account's GATE STATE: an admin could see a "Pending approval" chip but not whether the address was confirmed, whether SEC-10 had cleared the password, or which Google account was attached — so every support conversation started by guessing. Clicking a row now opens a drawer that says which gate the person is actually stuck behind, with the recovery actions under that readout rather than in the row. The drawer is `Modal placement="drawer"`, not a second dialog: the layer stack, ESC, the focus trap, Back-to-close and the scroll lock are the hard parts, and duplicating them is how two shells drift apart. It slides in, and honours prefers-reduced-motion like the rest. The link itself (SEC-15, SEC-16, and the everyday "no SMTP and someone forgot theirs") reuses the existing token machinery and the SAME `#reset=` entry the mailed link uses, so the signed-out card consumes it with no new flow. It is a distinct token KIND for one reason: a mailed reset arrives in the mailbox, so completing it proves ownership and confirms the address; an admin-issued link proves nothing about the mailbox — the admin hands it over by whatever means they choose — so it must not satisfy the email gate. Claiming otherwise would be the same false attestation SEC-15 is about. Issuing does not revoke the current password: a misclick must not lock anyone out. USING it rewrites the hash and bumps the session epoch, which is what evicts a squatter — SEC-16's actual remedy. Spending either kind burns the siblings of both, so a completed reset cannot leave a live admin link behind. The non-consuming probe learned the new kind too, or every admin link would have opened onto "this link is spent". The audit log records that a link was issued, by whom, for whom — never the link, which is a live credential-setting secret and the last thing that belongs in a long-lived log a human reads. Not gated on account state on purpose: it is useful for a pre-empted address, a revoked password, a Google-only account that wants one, and a plain forgotten password. Narrowing it would only make it refuse exactly when the admin needs it. The shared demo account is the one exception. Verified on localdev, both languages, end to end: issue from the panel -> the signed-in tab shows the honest "reset links open in a signed-out window" banner with the token still in the address bar -> signing out draws the "Set a new password" form, which is only possible because the probe recognises the new kind. Gate: pytest 925 -> 942, vitest 676.	2026-09-05 01:46:58 +02:00
peter	bc9e34d0ae	fix(auth): close the three leftovers E9.5 logged but kept out of its diff ... DX-17, three one-liners the epic's canonical sweep did not reach: `routes/setup.py::setup_admin` still resolved the wizard's admin by literal `User.email ==`. The wizard can be re-run, and E9.5's premise is that two spellings of one Gmail mailbox are one person — so a second run under the other spelling would have created exactly the duplicate admin row the epic exists to prevent. `routes/admin.py::_decide` hand-rolled `db.get` + 404 where the file's newer endpoints use `get_or_404`. There were TWO such sites, not the one the review named; both are converted, per the house rule that a principle gets fixed everywhere in one sweep. `useVerifyEntry`'s `hashchange` listener recognised `#verify=` but not `#reset=`, so pasting a reset link into a tab already running the app was silently ignored — the same silence that made the verify half a bug. It now notices, and says out loud that reset links need a signed-out window; the fragment is still deliberately left in the address bar (review round 4), so signing out from that tab recovers it. DX-16: `.catch(() => setOutcome("invalid"))` could not tell a spent token from a 502 mid-deploy or a dropped connection, and by then the fragment is cleared — so a network blip was reported as "that link is no longer valid", pushing the user to request a fresh one on the strength of a false statement. Only a 400 carrying {code:"verify"} is the server's verdict now; everything else gets its own outcome, with no resend CTA, because the token is untouched and retrying it works. The rule was already written one file away for the reset-link probe: "a network blip must never be cached as 'this link is dead'". Two existing tests asserted the old conflation by rejecting with a bare Error("400"); they now reject with the real HttpError. The errors are built inside the rejection, not hoisted: mountAt calls vi.resetModules(), so an HttpError imported earlier is a different class identity and `instanceof` would quietly miss. Gate: vitest 671 -> 676, pytest 924 -> 925.	2026-09-05 01:35:09 +02:00
peter	0cc450d1c9	fix(downloads,sync): bound what one user can make the server fetch, download and spend ... SEC-12: the download box accepts an arbitrary http(s) URL and yt-dlp fetches it from the WORKER, so any approved user could aim the server at the compose network, the LAN or a cloud metadata endpoint — and read the result off job.error, where "connection refused" vs "HTTP Error 401" vs "timed out" is a port scanner. downloads/urlguard.py refuses a URL whose host resolves to a loopback/private/link-local/reserved address, at enqueue AND again in the worker (DNS can move in between, and the worker is where the socket opens). A network-class failure on a `url` job now reports one fixed sentence instead of the raw transport text; the error CODE is still classified from the original, so the localized explanation is unchanged. DNS rebinding is explicitly NOT closed — that needs the connection gated inside yt-dlp — and the module says so rather than implying more than it does. SEC-13: `noplaylist` only demotes a video-inside-a-playlist URL to that video, so a URL that is purely a playlist or channel still expanded into every entry — one enqueue, unbounded downloads. `playlist_items` pins it to one. Size was unbounded too: `check_enqueue` compares the CURRENT footprint against the cap, and a download's size is unknown until it lands, so one job could overshoot by any amount; the owner's remaining budget is now handed to yt-dlp as `max_filesize`, applied AFTER the adapter merge so no source adapter can raise a limit the quota layer set. A join's cut-list is capped at 100: an accurate join emits two filters per segment into one ffmpeg filter_complex. SEC-14: the YouTube budget is instance-wide, so one user holding down a manual sync spent the day for everyone. Per-user (not per-IP — the cost belongs to the account) 3-per-10-minutes limiters on the two bulk pulls, subscriptions and playlists, with separate budgets so one does not close the other. The review also listed /rss, /backfill and /enrich; E3 deleted them, and search stays unlimited on purpose — it is interactive, not a bulk pull. Gate: pytest 896 -> 924 (none skipped), vitest 671.	2026-09-05 01:03:24 +02:00
peter	3dc14402b0	test(auth): pin what rounds 1 and 2 left unpinned (E9.5 review round 3) ... Three low findings, all in what the review rounds themselves wrote. The comment on `test_approving_an_unverified_account_keeps_its_password` still asserted the argument rounds 1 and 2 refuted — that dropping the approval-time revoke was safe because `password_login` reads `email_verified` first — while the docstrings on the two functions it describes now say the opposite. Two contradictory "why" records for one rule is how the round-1 takeover primitive got reasoned into existence in the first place, so the test comment now carries the corrected account and names SEC-16. `test_a_later_registration_leaves_a_link_already_in_flight_alive` asserted a subset relation that is vacuously true on an empty set, and the guard that made it non-empty had gone out with the revert. It now pins both halves: the old link survives, and exactly one new one appears. Round 2's own fix — activation moved to after a successful send — was unpinned; putting it back above the send left the suite green. The failed-invitation test now also asserts the account was not activated by a request the UI reported as a failure.	2026-09-04 23:04:09 +02:00
peter	540ca244c8	revert(auth): the newest registration does not own an unverified account (E9.5 review round 2) ... Round 1 fixed the address pre-emption chain by letting a later registration replace the password on an unverified account and delete its outstanding verify tokens. Round 2 read that code and showed it was worse than what it fixed, so it goes back out. It closes nothing. The rule is symmetric and an attacker can simply register last — on a timer, inside the five-per-five-minutes budget — while the owner registers once. What it does add is two primitives an unauthenticated caller did not have: overwrite a real registrant's chosen password, and delete the confirmation link already sitting in their inbox (the approval mail's 7-day token is an ordinary verify token, so the blanket delete took that too). Worst of all it fired on the rows SEC-10 left stripped — password_hash NULL, password_revoked_at set, active — installing an attacker's password where the entire state means "there is none", and clearing the stamp that is the only reason password-reset still accepts them. That is a straight takeover which did not exist before, in the code written to prevent one. The owner's recourse needed no new primitive and already worked: password-reset accepts a pre-empted account, proves the mailbox, rewrites the hash and bumps the session epoch. What remains is the bounded window between a confirmation click and that reset, which is SEC-16 — logged with this attempt written down, so the next person does not reach for it again. Two smaller round-2 findings go with it. `upsert_pending_invite`'s new exact-spelling tie-break ran before any status preference, so it could deterministically pick a DENIED sibling over a pending one and reopen it — the very outcome its comment claimed to prevent; the status preference now comes first. And `send_invitation` activated the account before the send it might have to report as failed, so a request the UI called a failure had quietly let someone in; activation now follows a mail that actually left. The verify token minted to render that mail still commits either way — it is single-use, expires on its own and was mailed nowhere, and the note says so rather than leaving the next reader to wonder whether it was missed.	2026-09-04 22:54:52 +02:00
peter	563fa0513d	fix(auth): close what the epic's own review found (E9.5 review round 1) ... Eleven findings survived adversarial verification; these are the fixes. **Address pre-emption.** S1 dropped the approval-time password revoke, arguing `password_login` refuses an unverified account before it reads `is_active`. Two verifiers showed that holds only while the address stays unverified — and S6's approval mail exists to get the real owner to end that state, at which point the squatter's password works. While an address is unverified the NEWEST registration now owns it: the password is replaced and every outstanding verify token deleted, so the owner takes the row back simply by registering, and a link already in flight cannot confirm it for anyone else. The residual (an owner who confirms and neither registers nor resets) is logged as SEC-16 beside SEC-15, where the re-attestation path it needs already lives. The comments that asserted the old, false invariant now say what actually guards this. **The entry URL.** S2 moved `clearEntryUrl()` out of the signed-out auth card into a hook App mounts unconditionally, and it blanket-stripped the whole query string, the fragment and `history.state` on the FIRST commit. That broke first-run setup outright — the wizard mounts only after its query resolves and then finds no `?token=` — and silently ate `?link=`/`?oauth=` (no toast, no refetch after connecting Google), `?v=`/`?chan=` deep links, and scroll restoration. It now clears only the fragment and the two one-time flags it owns, and preserves `history.state`. **The env allow-list.** S3 canonicalised the Invite branch of `is_allowed` and left the ALLOWED_EMAILS/ADMIN_EMAILS fallback matching literally — the 2026-09-03 lockout with a different source of truth, plus a shadowing trick where an unauthenticated request under a sibling spelling permanently masked an env grant. Canonical on both sides now, and the same for the delete dialog's warning and the ADMIN_EMAILS role bootstrap. **Honest states.** `send_invitation` stamped "I already wrote to them" before a fail-soft background send; it sends inline and records only what left. The admin-side resend answered `{ok: true}` for a dropped mail; it now says so. Both also activate/serialize consistently with the other decide paths. **Correctness sweep.** The 7-day approval link said "expires in 168 hours" — durations render in days once there is more than one. `_register_account`, `upsert_pending_invite` and `add_invite` picked among canonical siblings with no ORDER BY and no exact-spelling tie-break, so which account got the re-send, and whether a denied row was reopened over a pending one, was up to Postgres. `purge_user` deleted every canonically-equal invite, revoking a surviving sibling account's access. `ConfirmProvider` wrapped its ReactNode message in a `<p>`. Approving no longer leaves the stuck-sign-ups list stale. The refusal panels announce and take focus. **Tests.** Three mailers rewritten this epic never rendered in any test; every `send_*` now renders in both languages. The orphan-key guard could not fail (it scanned the catalog that defines the keys) and had no reverse direction. Newly pinned: canonical activation, the surviving sibling's grant, a failed invitation and resend, an expired reset link, a throttled login's silence, the per-language admin fan-out, and that the entry URL keeps what it does not own.	2026-09-04 22:42:15 +02:00
peter	10c0ca4cf7	feat(email): write to people in their own language (E9.5 S7) ... Twelve mails carried hardcoded English while the app itself has enforced HU/EN parity since E5. A mail is the one user-facing surface nobody can re-render by switching the UI language: it arrives once, in whatever language we picked, and stays that way. That made the epic's own headline mail — "one mail, one click" — English for a Hungarian reader. The text moved to a catalog (`mailtext.py`) with a `text(key, lang, **vars)` renderer, and the parity rule is now a test rather than a habit: every key must carry both languages AND the same `{placeholders}`. A translation that drops `{link}` sends a mail with no link in it; one that invents a placeholder raises inside a background task nobody is watching. Both are silent in production. Every `send_*` takes the language as its second argument, resolved by the REQUEST handler and never inside the mail — these all run as background tasks, after the request's session is gone, which is the same reason the approval mail computes its link in the handler. Where the language comes from, in order: the account's own preference; failing that, the language the person asked us in; failing that, English. The middle one is new — `invites.lang`, migration `0082` — because the mails an access request produces go to an address that usually has no account yet, and the signal does exist: the page their form was submitted from, or the locale Google reported for a sign-in we refused. Captured rather than derived, for the third time in this epic (`google_email` in S3, `preferences.language` in S6 taught the same lesson): a signal that exists only in one moment cannot be backfilled later. So the admin is asked in exactly one place — the invitation to an address they typed in themselves, where nobody has ever told us anything. That send is now a dialog rather than a bare click, which is also where the "you already wrote to them" warning belongs — it used to live only in a tooltip the admin may never hover, guarding the one action whose failure mode is mailing a real person twice. S6's registration `lang` field turned out to be dead on arrival: the backend accepted it, the frontend never sent it, so every account has been storing nothing. The request builders now stamp the UI language themselves — a signal that has to be passed in by every caller is one every caller can forget, which is exactly how it shipped unset. Admins are notified one mail per language group instead of one blast to everyone. They are people with their own UI language; a single message would have to pick one of them and be wrong for the rest. Also removes a duplicated `invited_at` column declaration on `Invite` (two identical definitions landed in S6).	2026-09-04 20:29:33 +02:00
peter	a76bab9b34	feat(auth): one mail, one click — the approval mail carries the confirmation link (E9.5 S6) ... The funnel's common ordering made a person open TWO messages: one saying their access was approved, another asking them to confirm their address. The approval mail now branches on what they actually still have to do — carry the confirmation link, point at sign-in, or say a confirmation mail follows once they register — so the usual case is one mail and one click. A mail that guesses wrong is worse than a plain one: telling someone to sign in while their address is unconfirmed contradicts the screen that will refuse them. That embedded link lives 7 days rather than the usual 24 hours. Nobody sits waiting for an approval — it can easily be read on Monday after a weekend, and an expired link spends the one-mail promise and puts them back on two. The risk is small: the token only ever confirms an address; it signs nobody in and sets no password. The most likely root cause of the 2026-09-03 report that a confirmation mail "never arrived" is here too, and it was never a delivery failure: re-registering an address that already had an unconfirmed account returned in SILENCE — same cheerful "check your inbox", no mail sent at all. It now re-sends the link. Nothing new leaks: the response and its timing are unchanged, and the public verify/resend already does exactly this for the same input. Whitelisting stays silent, and that is a decision, not an omission. The operator opens a door as a possibility — usually already agreed with the person — and a row can sit approved for weeks with nobody registering; a mail fired automatically there would be nudging someone who never asked. Telling them is its own act on its own button, `invited_at` records it so a second click is a decision rather than an accident, and the button only appears where nobody is behind the address yet: "the door is open, come in" is meaningless to someone already inside. Two things UAT caught that no test would have. Every fresh registration appeared in BOTH admin lists at once, because the stuck-sign-ups filter keyed on "unconfirmed" — the rule is now "the address may sign in, and this account still can't", which leaves an undecided request with the queue that owns it. And the invitation button was offered on every approved row, half of which are existing users. Also: the confirmation mail finally says what its link's rules are (once, 24 hours) — the reset mail always has, while this one left the reader to discover both by meeting a dead link. The card's "didn't get the email?" moves up under the form, and the three waiting messages name the spam folder, which is where a first message to a fresh recipient sometimes lands. Registration now records the language the sign-up page was in. Nothing reads it yet — the bilingual templates are S7 — but it is the only moment that choice exists anywhere the server can see, and a preference nobody recorded cannot be backfilled later. UAT on localdev: re-registering re-sent the link (one token became two, one account); approval issued a 7-day token and moved the account into the stuck list with only a re-send; whitelisting mailed nobody; the invitation recorded itself and the row then warned that sending again would write twice. Test data removed.	2026-09-04 04:05:28 +02:00
peter	7acdf5d577	feat(admin): surface the sign-ups that are stuck outside, and let an admin finish letting them in (E9.5 S5) ... Approve an address BEFORE the person registers and their sign-up produces no queue row at all — `_decide` only takes a still-pending invite — so the Access-requests screen sat empty, the tab badge read zero, and the only working move was re-typing the address into the whitelist box. Nobody would guess that, and on 2026-09-03 nobody did. This is roadmap UX-25, where two earlier attempts were reverted after review. Both moved AUTHORITY: auto-activating on registration turns a standing whitelist entry into a bearer grant for whoever registers the address first, and reopening the approved invite to `pending` lets an anonymous sign-up REVOKE a standing approval. What was actually missing was visibility, so this changes nothing about what an unauthenticated caller can cause — the admin could already do exactly this by re-entering the address; they just had no way to know they had to. The section lists every account that cannot sign in yet and says WHICH gate is shut, because the two dead ends look the same from the admin's chair: waiting for activation, or waiting on a confirmation mail. Naming the unconfirmed ones is not decoration — on a no-SMTP instance that is the difference between the owner and whoever registered the address first (SEC-15), and an admin about to let someone in should see it. A person the queue above already covers is deliberately NOT listed here; two buttons for one person is worse than one. Activate is gated on `is_allowed` — the same function the sign-in paths consult, in core, so the button that appears and the badge that counts cannot disagree. Without that gate it would manufacture an inconsistent account: password sign-in only checks `is_active` and would let them in, while their Google sign-in would be turned away and silently reopened as a fresh access request. Letting in someone with no approved invite stays the whitelist box's job, which says so out loud. The badge counts activations SEPARATELY from pending invites rather than widening an existing field's meaning, and only counts what genuinely waits on the admin: an unconfirmed account waits on its owner, so it is listed with a re-send but does not nag. The admin-side resend says plainly what happened, including refusing when the instance has no working SMTP — mail is fail-soft everywhere else, and that silence is exactly what left the 0.78.5 sign-ups with nothing to fall back on. `send_verification_link` is now one function with three callers (registration, the public resend, this one), so the link's shape and TTL cannot drift by who triggered it. UAT on localdev, both languages: the UX-25 shape reproduced end to end (approve the address, then register), the badge counting it, Activate letting them in and dropping the badge, the row losing its Activate but keeping the re-send, a fresh token issued by the re-send, and both actions in the audit log. Test data removed.	2026-09-04 03:27:48 +02:00
peter	b1086e05dc	fix(auth): stop drawing a reset form the link can no longer fill (E9.5 S4) ... Reported from UAT: delete an account, then open its password-reset link. The card drew the full "set a new password" form — because a `#reset=` fragment was present, and nothing more — and only after the user had typed a password did the server answer 400. Measured first: no security hole. A user's tokens cascade away with the row, so nothing can be set on a deleted or a re-created account. What was left is a dead end of exactly the kind this epic exists to remove, and it is not rare: a reset link lives one hour, mail is slow or lands in spam, and whoever got two mails clicks the older one. password-reset/check answers whether a link is still usable WITHOUT spending it, so asking can never cost the user their one real attempt — the property the tests pin hardest. It gets its own limiter, because opening a link must not eat the budget for requesting one, and a throttled caller is told "ok", never "dead": this check may only ever save someone a wasted form, so when it cannot answer it degrades to the old behaviour instead of declaring a live link finished. The confirm endpoint stays the authority, and its failure raises the same named screen, since the token can die between the two calls or the probe itself may have failed. A too-short password is deliberately NOT that screen. The length check runs before the token is spent, so a typo costs the link nothing, and the card tells the two 400s apart by `reason` so only one of them takes the form down. Both email-link confirmations (verify, password-reset/confirm) now answer in the {code, reason} shape S4 introduced. They were the last refusals a user meets by simply clicking an old link while still being answered in hardcoded English under a bilingual UI. The seven remaining bare strings in this module (register, request-access, the demo guards, set-password) sit behind client-side validation the UI does first; they are logged as a follow-up rather than swept in silently here. One bug found by the UAT itself, in the new code: the check went out FOUR times per opened link — StrictMode double-invokes effects and the shell remounts the card as the session probe settles. Harmless per request, but against a per-IP limit it would exhaust the budget in two reloads and then silently fall back to drawing the form unchecked: nothing errors, the feature just stops working. Deduped in a module-level map holding the in-flight promise (a ref dies with the remount that causes it); a failed probe drops itself so a blip is never cached as "dead". The test renders the card twice, because with one render the guard would rot undetected. UAT on localdev: the reported scenario end to end (delete the account, open the link) shows the named screen and no form; a live link still opens the form and completes; the CTA lands on the request-a- link form; one probe per opened link. Throwaway accounts removed.	2026-09-04 02:38:01 +02:00
peter	ed91c83dd7	fix(auth): name the state and the address behind a refused sign-in (E9.5 S4) ... "Your account is awaiting admin approval." was true and useless. It never said WHICH mailbox the account was on, and on 2026-09-03 that silence hid a Gmail alias mismatch for a day: a registration as np.temu@gmail.com met a Google claim of nptemu@gmail.com, and every screen in the funnel agreed to say nothing about it. Every refusal password-login can answer with now uses the codebase's structured {code, reason} detail, built in one helper. The three that arrive AFTER the password is proven carry the address on the account plus both gate flags; the two that answer before it (invalid, rate_limited) carry nothing, so a wrong password and an unknown account stay byte-identical. The frontend renders the first three as a named screen in place of the form — there is nothing to retype once the password is correct — with an icon, the two-gate checklist, the address in monospace, and a resend CTA where one helps. Reporting each gate from its own flag is the payoff of S1: approved-but-unverified is a real state now, and a screen that assumed a sequence would send that user off to wait for an admin who has already decided. The Google access-request notice names the address too, and says so when the request was already on file under ANOTHER spelling of the same mailbox — the honest version of "we didn't open a second one", stated only when it applies. It moved from the query string to the fragment: the notice now carries an address, and a query string lands in every reverse-proxy access log. Same reasoning that put the verify/reset tokens there, and the same owner already clears it. urlencode, not an f-string, because URLSearchParams reads a bare + in a fragment as a space and would mangle exactly the +tag addresses this epic exists to protect. upsert_pending_invite returns the row it settled on beside the is-new flag, since the row's stored address is what the notice has to name and what mail will go to. Deviation from the PendingScreen mockup, deliberately: no "Sign out" button and no separate "Not your address?" link. The mockup drew the panel in the app shell; the accepted decision (a) keeps the pending user session-less, so there is no session to end, and the address is named directly above a "Back to sign in" that answers the same question. UAT on localdev, both languages: all three refusals with the typed spelling deliberately differing from the stored one (the panel named the stored one), the resend CTA carrying the typed address into the resend form, and both access-request banners with a +tag address surviving the fragment round trip. Throwaway accounts and the language switch reverted.	2026-09-04 01:56:55 +02:00
peter	a614ee2435	feat(auth): show the Google address beside the one the account registered with (E9.5 S3) ... An account can now hold two true addresses: the one its owner typed, which a Google sign-in no longer overwrites, and the one Google answers with. Only the first was stored, so Settings could say 'Connected' without saying connected AS WHOM -- exactly what someone who registered with a +tag needs to know. users.google_email (migration 0080) records Google's answer at sign-in and at an in-app link. /api/me exposes it ONLY when it differs from the account address, so the comparison lives in one place and the majority, whose two addresses are the same string, see no change at all. Rendered in the account menu as a muted third line under the identity, and in the Settings sign-in row under the existing hint. A short 'Google' label rather than a brand glyph: the app draws one icon set (lucide), and a generic mail icon next to an email address says nothing. It also reads to a screen reader, which an unlabelled logo would not. No backfill is possible -- Google's answer is only known at sign-in -- so accounts linked earlier stay NULL until their owner next signs in with Google.	2026-09-04 01:23:11 +02:00
peter	c74487fbb3	fix(auth): keep the address the user registered with, and let it sign them in (E9.5 S3) ... Two halves of one rule: the address someone typed is theirs to keep, and it must be the one that gets them back in. A plus-tagged or dotted Gmail is often a deliberate choice -- registering as me+siftlode@gmail.com is how you find out later which site leaked your address. The Google callback overwrote it with the account's primary, which can never contain a '+', so the tag vanished on the first Google sign-in and, because sign-in matched the stored address, took their chosen address with it. The rewrite line is older than this epic, but S3 made it reachable here by matching adoption across spellings. It now runs only when the mailbox GENUINELY changed, and lives in a named helper rather than inline, so the rule has one home. The three lookups that resolve a typed address -- password login, password reset, verify resend -- go through find_user_by_email: exact spelling first, then the unique canonical candidate, and None when several accounts share a mailbox rather than guessing which one a password should open. Reset and resend previously answered a different spelling with silence (they reply uniformly by design), which was a dead end with no way out. Their mail now goes to the address on the account, never the one typed into the form.	2026-09-04 01:07:54 +02:00
peter	876cece881	fix(auth): match identity on a canonical email, so one Gmail mailbox is one account (E9.5 S3) ... Gmail delivers x.y@, xy@ and xy+tag@ to one inbox; the invite gate only lowercased. On 2026-09-03 that turned an approved user's Google sign-in into a silent SECOND access request -- OAuth returns the account's stored primary, which need not be the spelling they typed -- and left prod with two user rows for one mailbox (ids 13, 14). The +tag case fails every time: a Google account cannot contain +, so OAuth can only ever answer with the base address. Mail still goes to the address AS TYPED; only identity matching uses the canonical form. utils.canonical_email is the single definition, and a model validator derives users.email_canonical / invites.email_canonical on every write, so no call site can forget it. Scope is narrow on purpose: dots are significant on most providers and the Gmail rule does not hold for Workspace custom domains. Swept every sibling of the same principle, not just the reported one: is_allowed, upsert_pending_invite, the Google-callback adoption, _register_account (so no new duplicate pair can be created), _activate_user_by_email, admin _accounts_for (an invite backing a live user under another spelling used to look deletable) and add_invite, plus purge_user, which now erases every canonically-equal invite instead of leaving one behind that still grants access. Migration 0079 backfills both columns and indexes them NON-uniquely: prod already carries canonical duplicates (approved invite pairs since 2026-06-16), and merging accounts is a judgement call about people's data, not something a migration does on its own. A test pins the backfill SQL against the Python helper.	2026-09-04 00:14:12 +02:00
peter	c134b514c1	fix(auth): confirm an emailed verification link wherever it is opened (E9.5 S2) ... The token was only ever consumed inside Welcome.tsx, which App renders ONLY when there is no session. Opening the emailed link in a browser that already held a Siftlode session posted nothing, the fragment was then stripped, and the user got no signal at all -- the link simply did nothing. Incognito worked, which is why it survived. Confirmation now happens in App, above that branch: signed out the outcome still drives the auth card's banners, signed in it drives a top-of-app bar. The entry URL is snapshotted once at import time (lib/entryUrl) instead of per component, so no future URL writer can strip a token before whoever needs it has read it -- that ordering race is what broke this in the first place. POST /auth/verify now names the address it confirmed, which matters when the browser holds a session for a different account; the same reasoning as password_reset_required already covers the disclosure. Also here, from the 2026-09-02 review tail: the dead GET /auth/verify goes (both senders emit the fragment form, and the last query-token link expired 24h after the 0.78.7 deploy), a spent #verify=/#reset= fragment is cleared while signed in, and the auth-card banners get role=status. The verifyOkReset copy no longer blames admin approval, which E9.5 S1 made false.	2026-09-03 23:45:31 +02:00
peter	243869401a	fix(auth): stop discarding a legitimate password on admin approval (E9.5 S1) ... SEC-10 revoked any password set while an account's email was unverified, on both the Google-adoption and the admin-approval path. On the approval path that was redundant: password_login refuses an unverified account before it ever reads is_active, so approval hands a pre-emptor's password nothing it could use. All the revoke achieved there was destroying the password a legitimate registrant had just chosen -- and since the admin normally decides before the user reads their mail, 'your password was cleared for security' was the DEFAULT experience, not an edge case. The guard stays on the Google-adoption path, where the real owner does attest ownership. password_reset_required and the ok_reset banner stay: accounts stripped on prod before this change have no other way back in. Two existing tests pinned the old rule, so they are rewritten rather than deleted, and the SEC-10 recovery pack now builds the revoked state through the surviving producer.	2026-09-03 23:32:34 +02:00
peter	7019e3afdf	fix(email): give every mail an HTML alternative so its link is clickable ... The bodies are text/plain only, so whether the URL in a verification or password-reset mail is a link at all was the client's decision. Gmail, Outlook and Apple Mail linkify plain text; lighter web clients render the body verbatim and leave the link as dead text — in a message whose entire purpose is that one link. _send now attaches an HTML part generated from the SAME plain body, rather than per-template HTML that would have to be kept in sync with it: one converter, all eleven templates, and text/plain stays the primary part and the source of truth. Escaping runs before linkification — bodies interpolate untrusted values (a requester's address, the operator contact) — so no caller can inject markup, and a query string's `&` is already `&amp;` when it reaches the href, which is what an HTML attribute wants. Sentence-final punctuation is trimmed out of the href while url-safe token characters (`-`, `_`) are left alone. Inline styles only, no images, no external CSS, no tracking.	2026-09-02 03:13:23 +02:00
peter	3ac3d382e7	fix(auth): stop the address-bar mirror eating emailed auth tokens, and unlock revoked accounts ... Two independent bugs made an email+password registration unrecoverable in prod. The verification link did nothing. urlWithParams/clearParams rebuilt the URL as pathname+query and dropped the fragment — but the one-time auth tokens ride the fragment (#verify=/#reset=, SB3), and the providers that mirror nav params (useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE the lazily-loaded <App> in main.tsx. Their mount effect replaceState'd the token away before the auth card's chunk had loaded, so the card read an empty hash: the link opened a bare sign-in page, no request, no banner. Both helpers now carry the fragment over. The account was then locked out for good. SEC-10 nulls password_hash when an unverified account is attested (here: admin approval landing before the user could verify — which the bug above made impossible). That is indistinguishable from a Google-only account, and reset eligibility keyed off password_hash alone, so no reset link was ever issued: no password to sign in with, and no way to get one. users.password_revoked_at records the revocation, reset eligibility honours it, and setting a password again (reset-confirm or set-password) clears it. An account that never had a password stays ineligible on purpose — its owner adds one from Settings. /auth/verify now also answers password_reset_required so the card can say why the registered password stopped working, instead of leaving the user at the uniform "Invalid email or password". Telling the holder of a valid verify token leaks nothing: they have already proved they own the mailbox. The 0078 migration backfills the stamp for rows carrying the exact lockout signature (local, non-demo, no password, unverified), so existing victims recover unaided.	2026-09-02 01:28:45 +02:00
peter	1fe24d374a	docs(tests): correct the deny-vs-delete rationale in the invites test file ... Round 4's only finding: the file header and one comment still said Deny stops a refused person re-asking. It does not — upsert_pending_invite reopens a denied row as pending — and the delete_invite docstring in the same branch already says so. The real difference is that Deny records an auditable decision and mails the requester; Delete forgets the address.	2026-09-02 00:15:21 +02:00
peter	2cba6b9fca	docs: round-3 copy corrections, and pin the two behaviours nothing was guarding ... Round 3's correctness/security pass came back clean; what was left said more than the code does. - emailOff promised the access-request list is where sign-ups show up. A sign-up on an address that is already approved or already pending adds nothing to it (roadmap UX-25), and "only" was falsified by this release's own inbox notice. - deleteConfirm claimed the admin was dropping "an approval you already gave" — it is the confirmation for pending and denied rows too. - sendFailed blamed the mail server for rejecting a message; the reason covers connect, DNS, TLS and login failures alike, so it now describes the symptom and leaves the diagnosis to the log. - ADMIN_EMAILS re-promotion happens in the Google callback only, not on any sign-in. Tests: the decided-list copy of the delete affordance was never rendered (both new cases fail if that branch is dropped), and the throttle release — a deliberate behaviour the notes advertise — was asserted by nothing; a drop with no admin yet, or with a failing write, must not silence the following hour.	2026-09-02 00:06:01 +02:00
peter	8d7aaad9a8	fix: warn before the delete, not after — plus round-2 copy and a11y corrections ... Round 2 on the feature diff (15 → 12): - still_allowed_by_env now rides the invite LIST as well as the delete response, so the confirmation warns while the admin can still change their mind. It mattered most for a DENIED row on an env-allow-listed address: deleting it silently converted a refusal into a grant, and the only warning arrived after the irreversible click. - Both inbox bodies claimed to name "the most recent" dropped message. The throttle records the FIRST of each hour and never updates it, so they now say "one of them", and the not-configured body finally names where to fix it. - settings.invites.emailOff told the admin they "get no notice when someone signs up" — rendered directly above the queue that shows exactly that. Only the email is lost, and it now says so. - The disabled delete buttons put their reason out of reach: `disabled` drops a control from the tab order and suppresses its title. Switched to aria-disabled + preventDefault, the pattern Playlists.tsx already established for the same reason. - deleteInvite is quiet, so the 409 the UI handles with a translated toast no longer also raises the server's English detail as a modal. - After a completed password reset, Back landed on the reset form again with a consumed token — the history change made that state reachable. The token is cleared on success so the reset view stops being the card's root. - The hu deleteHasAccount named a tab that renders under a different label. Tests: a dom test for the Access-requests panel covering both has_account variants and all three delete outcomes, /api/me flag cases, an ADMIN_EMAILS case, and the env-allowlist test now patches the raw setting so the parsing stays under test.	2026-09-01 23:50:29 +02:00
peter	85043013f0	fix: address the feature review — accurate copy, reachable controls, real coverage ... Round 1 on the feature diff found 15; the substantive ones: - The delete control VANISHED on any invite whose address had registered, which is the ordinary sign-up shape (register writes the User and the pending invite together). The guard stays broad — that row is the account's approval gate, and orphaning it strands someone who can then neither sign in nor be approved — but the control is now a disabled button carrying the reason, on both lists, so an admin never sees a row silently missing a button its neighbours have. - Deleting an entry is not always a revoke: is_allowed falls back to the env ALLOWED_EMAILS / ADMIN_EMAILS lists once no row exists, and an ADMIN_EMAILS address is force-promoted on its next Google sign-in. The route now reports still_allowed_by_env and the UI says so instead of claiming access was removed. - "Deny keeps the row so they can't immediately re-ask" was simply false — upsert_pending_invite reopens a denied row. Corrected everywhere it was stated. - The Configuration warning reads me.email_configured, which save() did not invalidate, so it kept warning about fields the admin had just filled in. - The read-only variant was an aria-hidden span explained only by a Tooltip that the hints toggle can switch off; now a disabled button with title + aria-label. - The delete error path threw away the 409's reason (the stale-list case) and left the stale row on screen. - The throttle window was spent even when no notice was written, silencing the next hour on the path whose job is to stop silent drops. - email_enabled() opened a second session and decrypted the SMTP password on every /api/me poll; it now takes the caller's session. - welcomeMode.dom.test.ts never rendered the card, so reverting the history wiring to useState left it green. A render test now drives the real links and fails on that revert (verified). Plus /api/me flag tests, the registration-shaped pending case, the env-allowlist case, and a release note that matches what the code does.	2026-09-01 23:31:49 +02:00
peter	44f626f732	feat(admin): delete a whitelist entry, and stop hiding a broken mail setup ... Three operator gaps, all found the same way — a person could not sign up and the app showed nobody anything. - DELETE /api/admin/invites/{id} with a delete control on both the pending requests and the previously-decided list. Deny keeps the row so the person cannot immediately re-ask; delete forgets the address. Refused with 409 while a User row exists for it, because is_allowed reads that row and removing it would revoke a live user's access with no other sign — the list ships has_account so the UI withholds the button instead of offering one that fails. - Email is fail-soft by design, which had come to mean invisible. _send() now records an email_undelivered notification for every admin when a message is skipped or rejected, naming the message that was lost, throttled to one an hour. /api/me carries email_configured, driving a standing warning on Configuration → Email / SMTP and above the access-request list. - The sign-in card's Create account / Forgot password / Didn't get the email views are history entries (useHistorySubview), so Back returns to the previous view instead of only moving the address bar. Also: the per-test rate-limiter reset sweeps every loaded app.* module rather than a hand-kept list of three — this change added a limiter outside it.	2026-09-01 23:09:25 +02:00
peter	24c93cbb83	docs: name the Configuration tab as it is rendered, drop an unused fixture ... Round 6's two remaining nits. The operator note said "Configuration → Email" but the group renders as "Email / SMTP" in both locales, and test_an_admin_can_activate_a_pre_approved_registrant requested make_user without using it — a leftover from the reverted rounds that made the test look like it seeded an admin when it did not.	2026-09-01 22:15:56 +02:00
peter	cb1f4f00b0	docs(auth): correct the last round of over-claiming comments and notes ... Round 5's correctness/security pass came back clean; what was left was text that said more than the code does. - The register-path notify comment (and its test) claimed the admin "is still told". The call fires, but on a no-SMTP instance _send drops it — which is the open half of the problem, not something this branch fixed. Both now say so. - The release notes tell admins what to actually do: an account whose address was whitelisted in advance has no pending request to approve, so the whitelist box is what activates it. That instruction only existed in the roadmap and in chores, which the dialog does not render. - "That one line is the whole production change" now accounts for the test-only RateLimiter.reset() that also ships. - The rate-limiter test claimed to pin that blocked attempts are not counted, on an assertion that held either way. Replaced with one that drives the clock across the window boundary and fails if hammering extends it.	2026-09-01 22:02:43 +02:00
peter	f6e1d1e69f	fix(auth): keep the admin notice unconditional on the register path ... Round 4 showed the `inv is not None` gate added in b5a1002 removed a signal that matters: for an address the admin had already approved, that email is their only notice that someone has now created an account on it — the invite is not pending so nothing lands in the Access-requests queue either. Suppressing it left the registrant at "awaiting admin approval" with the admin unaware they existed. The duplicate it avoided (Request access, then sign up) is mild noise by comparison. The production change is now one db.commit(), which is all the reported bug ever needed. Release notes corrected again: a previously-denied address was also unaffected, the pending-request case never lost its queue entry (only the account behind it), and the test inventory was missing a guard.	2026-09-01 21:48:40 +02:00
peter	b64c3f514d	fix(auth): drop the invite reopen — keep the fix to the lost account alone ... Round 3 of the review killed the reopen from b5a1002: flipping an approved invite back to pending let an unauthenticated POST /auth/register REVOKE a standing approval for any whitelisted-but-unclaimed address, which then fails is_allowed() and locks the real owner out of Google sign-in — the primary way people get in here. It also re-armed the pre-emption window it was meant to close, because with no SMTP email_verified is set True and the SEC-10 guard the design leaned on never fires. Two attempts at fixing the stranded-account UX in the same change both came back worse than the wart. What remains is the narrow, real bug: the account was silently rolled back and is now committed. An admin still binds the approval to the account, exactly as before this branch. UX-25 in the roadmap records the follow-up and both dead ends so they are not retried. Also from round 3: the upsert docstring no longer claims the admin UI cannot reach these accounts (re-entering the address in the same panel's whitelist box does, and a test now pins it), the release notes are scoped to what the diff actually changes with the operator note moved where the dialog renders it, and RateLimiter has unit tests so reset() is not production code only a fixture calls.	2026-09-01 21:34:38 +02:00
peter	b5a1002412	fix(auth): reopen a pre-dated approval instead of auto-granting it ... Replaces the activation added in ea931dc, which round 2 of the review showed was a real weakening: on a no-SMTP instance it made a standing whitelist entry a bearer grant — the first anonymous party to register an approved-but-unclaimed address got an immediately usable account under that identity, with no attestation, no admin action and no signal anywhere. The verify-time activation had the same shape one step removed, and neither site ran the SEC-10 preset- password guard or left an audit trail. Keep a human in the loop instead. An approval granted before any account existed was a decision about the ADDRESS, so registration reopens the invite (upsert_pending_invite gains revive_approved, used only by the register worker). The request lands in the Access-requests queue, approving it runs _activate_user_by_email — and with it revoke_preset_password_if_unverified — and the account activates. One mechanism, already audited, no new grant path, and the "awaiting admin approval" copy is honest again. The explicit commit from the previous commit still matters: with an invite already pending, upsert returns without committing and _issue_token is gated on SMTP, so a no-SMTP registration was still being rolled back. Also from round 2: gate the admin notice on a fresh decision (matching the two other upsert callers) so a retry no longer re-pings every admin, and reset the module-level rate limiters between tests — the suite pooled every login into one 300s window and was two logins short of failing an unrelated test with a 429.	2026-09-01 21:18:14 +02:00
peter	ea931dca30	fix(auth): honour an approval granted before sign-up instead of parking the account ... Follow-up to the commit fix, from the deep-review. Persisting the account was only half the story: when the admin had approved the address BEFORE the person registered, the account landed is_active=False against an invite that is no longer pending — absent from the Access-requests queue, and approve_invite 409s on an already-decided invite. The sign-up worked and still could not sign in. Derive activation from is_allowed() at the moment ownership is attested: - verify_email_confirm activates a pre-approved account when the emailed link is confirmed (only the mailbox owner can follow it), so SEC-10 stays intact; - _register_account activates only when there is no SMTP to verify with, where the admin whitelist is by design the sole gate — the same one add_invite already activates on. Tests: the pre-approved no-SMTP case and the verify-activates case are real regression tests (both fail without this change); guards cover the unknown-email and denied->pending branches, verification of an unapproved account, and the first end-to-end coverage of the /auth/register route and its allow_registration gate. Release notes rewritten — the previous entry miscounted its regression tests and advertised an email fix this release has no code for.	2026-09-01 20:56:43 +02:00
peter	d954e71a77	fix(auth): commit the account on registration so a pre-approved sign-up isn't lost ... _register_account() flushed the new User but relied on someone else to commit: upsert_pending_invite() commits only when it actually writes an invite row, and _issue_token() runs only when SMTP is enabled. For an email an admin had ALREADY approved, on an instance where email is unavailable, neither fired — the session closed and the account was rolled back. The would-be user got the uniform "ok" and no account, could not sign in, and re-registering was a silent no-op. Commit explicitly after the invite upsert (a no-op when upsert already committed the same transaction). Three DB-lane regression tests cover the pre-approved no-SMTP path (fails without the fix), the unknown-email path that always worked, and the pre-approved path with SMTP on.	2026-09-01 16:25:05 +02:00