peter
e7f38396a2
Deep-review round 3 over main..improvement/watch-background-audio. Account boot - The notification history and settings, and the hints toggle, are read when their modules load, which in a new tab (bookmark, typed URL) is before BootGate pins the account: they read as nobody's, and the tab's first notice replaced the account's stored history (up to 100 entries) with a one-item list. They now read again when the tab is pinned (onAccountPinned, run by setActiveAccount); a notice raised before the pin stays, after the history. - A tab pinned to an account still in this browser's wallet but whose session ended (suspended, deleted, or revoked by "log out everywhere") got "signed out" from /api/me while the default account was still signed in, and signing in again as anyone else left it there. A refused per-tab account now leaves the wallet, and the probe answers as the default, so the tab reloads onto it. Share page (/watch) - The password unlock is limited per viewer (link + client IP), under a per-link ceiling that counts only wrong passwords. Keyed on the link alone, ten wrong guesses every five minutes locked out every viewer, the ones with the password included. client_ip moves to app.ratelimit so the public routes can key on it. - Its failure messages and the load-failure screen are announced (role=alert, the password input described by its error). The sign-in, passphrase, password-change and setup form errors get role=alert too. Comments that still described removed machinery are corrected: App's collapse flags, SettingsPanel's Save bar, ConfigPanel, authed_format_sig. Tests: the account's history and hints across the pin; a revoked and a suspended pinned account; the per-viewer limit and the ceiling; the limiter's exhausted(); the share page's announced failures; a share link's feed filters persisted. Each mutation-checked RED for its own reason.
19 lines
1002 B
Bash
19 lines
1002 B
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
echo "Applying database migrations..."
|
|
alembic upgrade head
|
|
|
|
echo "Starting Siftlode API..."
|
|
# --timeout-keep-alive 75: keep idle upstream connections alive longer than the reverse
|
|
# proxy's idle-reuse window. uvicorn's default (5s) is shorter than Caddy's pooled-keepalive
|
|
# timeout, so Caddy would reuse a connection uvicorn had just closed -> broken pipe / reset
|
|
# on the next request -> 502. Non-idempotent POSTs (the player's progress/state writes,
|
|
# fired every 5s) can't be auto-retried by the proxy, so those 502s reached the user.
|
|
#
|
|
# SECURITY: do NOT add --proxy-headers / --forwarded-allow-ips here. ratelimit.client_ip trusts
|
|
# X-Forwarded-For only when the TRUE socket peer is a configured proxy (TRUSTED_PROXY_IPS); those
|
|
# flags would make uvicorn overwrite request.client from the forgeable XFF, defeating that check and
|
|
# reopening the rate-limit bypass (SA3).
|
|
exec uvicorn app.main:app --host 0.0.0.0 --port 8000 --log-config log_config.json --timeout-keep-alive 75
|