Commit Graph

7 Commits

Author SHA1 Message Date
alexei.dolgolyov e0bae394ee feat: comprehensive code review fixes — security, performance, quality
Backend security:
- Reject Gitea webhooks when webhook_secret is empty (was silently skipping)
- Add slowapi rate limiting on login (5/min) and setup (3/min) endpoints
- Add CORS middleware with configurable origins
- Mask telegram_webhook_secret in settings API response
- Protect system-owned command template configs from regular user modification
- Increase minimum password length to 8 characters

Backend performance:
- Batch queries in _resolve_command_context (3 queries instead of 3N)
- Concurrent album fetching with asyncio.gather in immich commands
- Singleton Jinja2 SandboxedEnvironment (reuse instead of per-render creation)
- TTLCache for rate limits (bounded memory, auto-eviction)
- Optional aiohttp session reuse in send_reply/send_media_group

Backend code quality:
- Extract dispatch_helpers.py (shared link_data loading + event filtering)
- Extract database/seeds.py from main.py (490 lines → dedicated module)
- Split immich_handler.py (415 lines) into commands/immich/ subpackage
- Replace bare except blocks with logged warnings
- Add per-provider config validation (Pydantic models)
- Truncate command input to 512 chars
- Expose usage_* and desc_* slots in capabilities and variables API

Frontend security:
- CSS.escape() for user-controlled querySelector in highlight.ts
- Client-side password min 8 chars validation on setup and password change

Frontend code quality:
- Replace any types with proper interfaces across top files
- Decompose targets/+page.svelte into TargetForm + ReceiverSection
- Fix $derived.by usage, $state mutation patterns
- Add console.warn to empty catch blocks

Frontend UX:
- Auth redirect via goto() with "Redirecting..." state
- Platform-aware Ctrl/Cmd K keyboard hint
- Remove stat-card hover transform

Frontend accessibility:
- Modal: role=dialog, aria-modal, focus trap, restore focus
- EntitySelect/IconGridSelect: listbox/option roles, aria-selected/disabled
2026-03-23 01:59:51 +03:00
alexei.dolgolyov 86115f5c75 fix: search palette triggers highlight, restore CSS keyframe blink
- SearchPalette now calls requestHighlight(id) before goto()
- Restore smooth CSS @keyframes cardHighlight (0%→none, 25%→glow,
  75%→glow, 100%→none) instead of JS interval pulse
- Inline style.animation overrides class-based stagger animation;
  cleanup sets animation:'none' (inline beats class, no stagger replay)
2026-03-22 00:13:53 +03:00
alexei.dolgolyov 88e21e41e2 fix: switch highlight to global store instead of URL params
URL param timing was unreliable with SvelteKit client-side routing.
Now CrossLink calls requestHighlight(id) setting a global variable
before goto(), and highlightFromUrl() reads it after data loads.
Double requestAnimationFrame ensures DOM has rendered after loaded=true.
Falls back to ?highlight= URL param for direct links.
2026-03-22 00:11:32 +03:00
alexei.dolgolyov f47df934ed fix: replace CSS keyframe highlight with direct style pulse for reliability
CSS animation was interfering with stagger animation on cards.
Now uses setInterval-based box-shadow pulse with computed primary
color from CSS variables. Pulses glow on/off every 400ms for 2.5s,
then fades out via transition.
2026-03-22 00:06:36 +03:00
alexei.dolgolyov 4b59f40fd5 fix: card highlight animation — kill stagger before highlight, keep animation:none on cleanup 2026-03-22 00:04:52 +03:00
alexei.dolgolyov 4c1d5a892c fix: prevent stagger animation replay after card highlight ends
Use inline style.animation instead of CSS class to avoid triggering
stagger-children fadeSlideIn re-animation when highlight is removed.
Restores original inline styles on cleanup.
2026-03-22 00:01:09 +03:00
alexei.dolgolyov f0f49db21e feat: card highlight system for cross-entity navigation
When clicking a CrossLink, the target entity ID is passed as
?highlight=<id> in the URL. The destination page:
1. Shows a semi-transparent dim overlay (z-index: 10)
2. Finds the card with data-entity-id matching the ID
3. Scrolls to it smoothly (block: center)
4. Applies a pulsing primary-color box-shadow animation (z-index: 11)
5. Cleans up overlay + animation after 2 seconds

If the card isn't in DOM yet (data still loading), a MutationObserver
waits up to 5 seconds for it to appear.

Changes:
- New highlight.ts utility with highlightFromUrl(), MutationObserver,
  dim overlay management
- Card component accepts entityId prop → data-entity-id attribute
- CrossLink accepts entityId prop → appends ?highlight=<id> to href
- All 9 entity pages: Card elements have entityId, highlightFromUrl()
  called after data loads
- CSS: cardHighlight keyframe animation + nav-dim-overlay styles
2026-03-21 23:59:25 +03:00