aboutsummaryrefslogtreecommitdiff
path: root/src/routes/api
Commit message (Collapse)AuthorAgeFilesLines
* fix(api): await setShadowHidden in badges PUTFuwn2026-04-181-1/+4
| | | | | | | setShadowHidden is async and hits Supabase. The PUT handler called it without await, so the handler could respond before the database write landed (and any error was silently lost). Add the missing await so the response only goes out after the update settles.
* fix(api): drop unused redirect query param from oauth refreshFuwn2026-04-181-3/+1
| | | | | | | | | | | | The refresh endpoint accepted a ?redirect query param and, when present, called redirect(303, "/") instead of returning the refreshed token as JSON. The target was hardcoded to "/" regardless of the param's value, so the feature was dead — and the pattern of reading a "redirect" param invited future open-redirect bugs if someone wired the value through to redirect() directly. The sole in-tree caller (feeds/activity-notifications) reads the JSON response, so always return JSON and drop the redirect import.
* fix(api): gate badge click-count on Origin and fix 401 response reuseFuwn2026-04-181-9/+11
| | | | | | | | | | | | | The PUT ?incrementClickCount path ran before any auth guard, letting unauthenticated callers spam-increment arbitrary badges. Require the request Origin to match appOrigin() so legitimate in-browser clicks (authenticated or not) still count while direct scripted calls are rejected. Also convert the shared `unauthorised` Response singleton into a factory. The singleton's body was consumed on first use, so subsequent 401 paths returned a `Response body is locked` error instead of the intended "Unauthorised" body.
* fix(api): encode subsplease timezone to prevent query-param injectionFuwn2026-04-181-5/+6
| | | | | | | The `tz` query value was interpolated raw into the upstream URL, letting callers append arbitrary query segments (e.g. `tz=foo&f=hax`). Wrap the value in encodeURIComponent and rename the local variable away from the banned `tz` abbreviation.
* fix(auth): ignore malformed user cookiesFuwn2026-03-286-24/+54
|
* fix(api): keep preferences publicly readableFuwn2026-03-271-4/+1
|
* refactor(supabase): move app access to service roleFuwn2026-03-272-40/+56
|
* refactor: centralise site origin usageFuwn2026-03-2210-55/+37
|
* refactor(effect): add request body schema decoders to api routesFuwn2026-03-034-5/+36
|
* refactor(effect): migrate api auth cookie decodingFuwn2026-03-034-57/+18
|
* refactor(effect): migrate core auth decode boundariesFuwn2026-03-032-18/+6
|
* chore(biome): drop formatter style overridesFuwn2026-03-0121-530/+563
|
* chore(biome): re-enable noDoubleEquals ruleFuwn2026-03-011-1/+1
|
* deps(sveltekit): Migrate to SvelteKit 2Fuwn2026-01-222-2/+2
|
* fix(api:birthdays): Update HTML parser for primary sourceFuwn2025-12-071-3/+3
|
* fix: Throw redirectsFuwn2025-12-012-2/+2
|
* deps(SvelteKit): Migrate to SvelteKit 2Fuwn2025-06-092-2/+2
|
* fix(birthdays): Send cookie to bypass bot detectionFuwn2025-04-271-1/+4
|
* fix(wrapped): li::marker consistent colouringFuwn2024-12-241-3/+3
|
* refactor(authorised): move authorised user functionality to moduleFuwn2024-11-181-5/+5
|
* chore(prettier): use spaces instead of tabsFuwn2024-10-0919-356/+356
|
* feat(badges): move badge operations to graphqlFuwn2024-10-061-129/+128
|
* feat(notifications): fingerprint for multiple grantsFuwn2024-08-242-6/+8
|
* refactor(Data): rename database referencesFuwn2024-08-249-9/+9
|
* refactor(Database): move Supabase user modules to User moduleFuwn2024-07-256-6/+6
|
* refactor(Database): separate providersFuwn2024-07-259-9/+9
|
* feat(notifications): allow unsubscribeFuwn2024-07-251-0/+26
|
* refactor(trigger): v2 -> v3Fuwn2024-07-241-8/+0
|
* feat: background notificationsFuwn2024-07-242-0/+34
|
* refactor(Birthday): rename modulesFuwn2024-07-222-0/+0
|
* feat(badges): click counter for badgesFuwn2024-05-271-1/+8
|
* fix(match): delayed and subtitled time compatibilityFuwn2024-05-241-121/+122
|
* fix(badges): shadow hide refreshFuwn2024-05-211-1/+1
|
* fix(badges): use correct id when hidingFuwn2024-05-211-1/+1
|
* feat(badges): individual badges shadow hidingFuwn2024-05-201-111/+121
|
* feat(badges): use array for pinned categoriesFuwn2024-05-051-7/+4
|
* feat(user): drag and drop pinned categoriesFuwn2024-05-051-1/+12
|
* feat(user): pinned category uiFuwn2024-05-041-1/+12
|
* feat(badges): allow awc badges hidingFuwn2024-04-281-1/+9
|
* fix(badges): shadow hide authorisation toggleFuwn2024-04-191-1/+1
|
* fix(badges): hide shadow hidden badgesFuwn2024-04-191-1/+1
|
* feat(badges): admin shadow hideFuwn2024-04-191-1/+9
|
* fix(badges): empty fieldsFuwn2024-04-151-5/+5
|
* feat(badges): source and designer fieldsFuwn2024-04-151-1/+3
|
* feat(badges): hide category buttonFuwn2024-04-141-0/+26
|
* feat(badges): badge hidingFuwn2024-04-131-3/+4
|
* feat(user): biography optionFuwn2024-04-131-5/+15
|
* feat(badges): custom cssFuwn2024-04-021-3/+28
|
* feat(badges): migrate category modeFuwn2024-03-011-1/+10
|
* fix(preferences): add preferences when not setFuwn2024-02-181-31/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 22:19:10 +0000