| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
| |
The refresh endpoint accepted a ?redirect query param and, when
present, called redirect(303, "/") instead of returning the refreshed
token as JSON. The target was hardcoded to "/" regardless of the
param's value, so the feature was dead — and the pattern of reading
a "redirect" param invited future open-redirect bugs if someone wired
the value through to redirect() directly.
The sole in-tree caller (feeds/activity-notifications) reads the JSON
response, so always return JSON and drop the redirect import.
|
| |
|
|
|
|
|
| |
The onMount cleanup removed resize and scroll listeners that were
never actually registered — the only live side effect is the
updatePosition interval. Drop the two dead removeEventListener calls
so the cleanup only matches what the component actually sets up.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The public variant of mediaListCollection chained data.MediaListCollection
.lists with no null check, so any AniList error response (rate limit,
private list, nonexistent user) threw a TypeError.
Mirror the guard used by the authenticated sibling: if any of data,
MediaListCollection, or lists is missing, return an empty array.
The function currently has no in-tree callers; noting that it may be
a candidate for removal in a follow-up.
|
| |
|
|
|
|
|
|
|
|
| |
The ParallaxImage alternativeText prop was passed as the literal
string "selectedBadge.description" (quoted attribute syntax) instead
of the expression, so every badge image rendered with that identifier
name as its alt text.
Switch to the expression form with a nullish-coalescing fallback so
badges without a description render empty alt rather than the literal.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The seasonal schedule collector pushed page 1 outside the while-loop,
then re-pushed the current page on every loop iteration. That meant
every multi-page season duplicated its first page's media, and the
same bug ran a second time when includeLastSeason was set.
Restructure into a shared collectAllSchedulePages helper with a single
push-then-check-hasNextPage loop, so each page is pushed exactly once.
Verified against AniList for SPRING 2026 with includeLastSeason=true:
210 media, 0 duplicates.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The PUT ?incrementClickCount path ran before any auth guard, letting
unauthenticated callers spam-increment arbitrary badges. Require the
request Origin to match appOrigin() so legitimate in-browser clicks
(authenticated or not) still count while direct scripted calls are
rejected.
Also convert the shared `unauthorised` Response singleton into a
factory. The singleton's body was consumed on first use, so subsequent
401 paths returned a `Response body is locked` error instead of the
intended "Unauthorised" body.
|
| |
|
|
|
|
|
| |
The `tz` query value was interpolated raw into the upstream URL, letting
callers append arbitrary query segments (e.g. `tz=foo&f=hax`). Wrap the
value in encodeURIComponent and rename the local variable away from the
banned `tz` abbreviation.
|
| | |
|
| |
|
|
|
|
| |
Showing "0" in the list title next to a "No anime/manga to display"
empty-state message duplicates information. Treat an empty media list
the same as dummy mode and suppress the count.
|
| |
|
|
|
|
|
|
| |
If a user's persisted filter references a custom list that no longer
exists on any media (renamed or deleted on AniList), the select falls
back to showing "All" but the underlying state still filters to an
empty set. Detect the stale value and reset it, clearing the StateBin
entry so the fix survives a reload.
|
| |
|
|
|
|
| |
Previously the link rendered "Toggle follow for ..." and was clickable
with an empty submission. Only render once the input has content so
there is no dead affordance.
|
| |
|
|
|
|
| |
Rouletting a single item is deterministic, so the affordance adds
nothing. Require at least two items before showing the button on both
anime and manga lists.
|
| |
|
|
|
|
| |
If every custom list contains every displayed media item, each option
yields the same result, so the picker is noise. Gate the select on a
reactive check that any list excludes at least one item.
|
| |
|
|
|
|
|
|
|
| |
Replaces one-shot boolean revalidateAnime with a counter store so
multiple components can subscribe without race conditions. Adds
revalidateManga store and reactive refresh blocks to DueAnimeList
and MangaListTemplate. Extracts shared invalidateListCaches function
used by both the command palette action and the debug settings button.
Renames palette item to "Refresh" and debug button to "Invalidate".
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|