FileImporter copied straight to the final path, so a size mismatch or a
crash mid-copy left a truncated ZIP that nothing removed. The mount path
finds any {gameId}-*.zip by prefix and mounts it without verifying the
hash, and because a file exists the re-download branch never runs, so
the game becomes unlaunchable until someone deletes it by hand.
Copy to a .part file in the destination directory, verify the size, then
rename into place, and unlink the partial on failure. Import under the
launcher-convention filename the caller already computed instead of
stamping Date.now(), which hid packs from the direct-path lookup and
left one copy per download attempt on disk.
When a mount fails, hash the ZIP against its recorded sha256 and move it
aside only on a genuine mismatch, then retry once. A hash match means
something else failed and the file is left alone: the Launcher writes
this directory too. Recovery is opt-in so the bulk startup mount cannot
turn a transient storage fault into a library-wide re-download.
Updating Ruffle failed in Docker with "EXDEV: cross-device link not
permitted" because overlay2 cannot rename a directory that still lives
in a read-only image layer, even within one parent directory.
Replace the directory renames with a rename-then-copy fallback, and
empty rather than unlink a path that turns out to be a mount point, so
a volume mounted over the install directory also works. Verify the
copied tree against the extracted one before dropping the backup: an
interrupted copy can leave ruffle.js in place while the rest is
missing, which a bare existence check cannot detect.
Also chown the served frontend directory when PUID moves the app user
off the image build UID, or every write there fails with EACCES before
any of this is reached.
The card owns the radius but never clipped its children, and CardContent
clips to a square box flush with the card's top edge. The skeleton and the
gradient overlay both fill that box, and a hovered image scales into it, so
square corners rendered over the card's rounded ones.
Clip on the card itself, matching PlaylistCard. CardContent keeps its own
overflow-hidden to bound the scaled image to the media area.
LazyImage carried the abort logic but nothing rendered it -- every image in
the app was a plain <img>, so navigating away from a grid left dozens of
thumbnails downloading, holding the six connections and the server I/O the
next page needed. Removing an <img> from the DOM does not cancel its
request; removing the src attribute does.
Rewrite LazyImage around the real element: native lazy loading, internal
loaded and error state, a skeleton prop taking true, false or a node, and a
fallback prop for the error case. Migrate the seven game image sites to it,
each dropping its own loaded/error state. Drop LazyBackgroundImage and
useLazyLoad, which had no consumers either.
Skip the abort while the node is still connected: StrictMode runs effect
cleanups on a live element, and clearing src there blanks every image in
development with nothing to restore it.
A LAN deployment served over plain HTTP logged two console warnings on
every page load. COOP is ignored on origins that are not potentially
trustworthy, and Origin-Agent-Cluster conflicted because /game-proxy and
/game-zip are mounted before helmet -- they must bypass frameguard and the
SPA CSP to be framed -- so game documents carried no header while the rest
of the origin asked for origin-keying.
Send COOP only on connections that used TLS, reusing the X-Forwarded-Proto
detection behind COOKIE_SECURE, and drop Origin-Agent-Cluster so the origin
is uniformly site-keyed.
The upgrade notice sat below the install walkthrough, where an existing
user pulling a new image would never look.
Add an alert directly under the header and move the Upgrading section
above Getting Started, listing what a pre-1.0.32 deployment must change.
Deployments on 1.0.31 or earlier cannot take an image update without
changing their compose file and .env, and nothing in the repo said so.
Document the migration from the two-container setup to the single
flashpoint-web image, the environment variables added, removed, and
changed since 1.0.31, and per-version release notes for 1.0.32-1.0.36.
Link it from the README and both documentation indexes.
The shipped compose mounted the Flashpoint directory read-only, so every write
the app makes to it failed: recording downloaded state in flashpoint.sqlite,
saving downloaded game data under Data/Games, and metadata sync. The Downloaded
page marked nothing and the reconciler warned on every boot.
Drop :ro from both compose files and the README's snippet, and correct the docs
that described the mount as read-only.
Critical: DbQueryPool stranded the caller of any query whose worker died —
pending promises were only rejected when the last worker went, so a single
crash left an HTTP request hanging until the timeout. Track the in-flight
query per slot, reject exactly that caller, and settle queued work when the
pool empties or shuts down.
Security: same-origin acceptance compared host but ignored scheme, so a
plaintext page could claim same-origin against an HTTPS deployment; the
metadata source allowlist accepted http://, where a MITM could rewrite the
game database; and asset paths were built from remote game IDs without
validation, allowing traversal outside the images directory.
Also: the reconciler now derives filenames via GameDataDownloader.getFilename
instead of re-parsing dateAdded (formats that helper normalizes would never
have matched), and warns once instead of failing when the database is
read-only — the state of the shipped compose mount. getYearRange runs through
the worker pool like its siblings rather than blocking the main thread.
Images normally arrive lazily: the proxy fetches one from the CDN when a
browser asks for a game the local mount lacks. That is wrong for an offline
host, where a sync can add thousands of games whose images would only ever
appear for whoever browses to them while online.
Add an opt-in setting (off by default) that, after a sync, fetches logos and
screenshots for exactly the games that sync touched. Runs as its own job with
progress and cancellation, and is never awaited by the sync, so a slow or
failing CDN cannot block or fail a metadata update.
This Vitest version's jsdom environment installed localStorage as a bare object
with no methods, so the auth store's persist middleware threw and took 69 tests
across 6 files down with it. A suite that red hides real regressions.
Install an in-memory Storage for localStorage and sessionStorage, cleared
between tests. That surfaced two failures it had been masking: PlaylistCard
asserted a stale string id in its href, and the MSW mocks lacked a handler for
POST /api/games, which is how search has worked since filter combinations
outgrew the URL length limit.
Frontend suite: 115/115.
better-sqlite3 is synchronous, so a slow read froze the entire server — a
filter-options request over a slow mount was measured blocking it for 167
seconds, during which even /health timed out.
Add DbQueryPool: read-only SQLite connections in worker threads, with
DatabaseService.allAsync routing the full-table scans through them and falling
back in process when workers are unavailable. Filter-options queries now run
concurrently rather than serially. Workers reopen on database reload and stop
on shutdown.
Also set UV_THREADPOOL_SIZE=16: libuv's default of 4 throttled every image and
ZIP read in the process, which dominates on a network mount.
LazyImage and LazyBackgroundImage preload through a detached Image and their
cleanup only set a cancelled flag, so the request kept downloading after
unmount. Navigating away from a grid left dozens of downloads occupying the
browser's six connections and the server's I/O, starving the page the user
actually opened.
Clear the handlers and reset src on cleanup, which is what aborts the request,
and have the image proxy return early when the client has already gone rather
than paying a mount round trip — or a 10s CDN fetch — for nobody.
The server awaited the Ruffle download before listening, so the port stayed
closed for minutes on slow storage and would stay closed indefinitely if the
download stalled. RuffleService also checked frontend/public/ruffle while a
built deployment serves frontend/dist/ruffle, so a fresh container re-downloaded
Ruffle it already shipped.
Install in the background with its own error handling, and target the directory
that is actually served.
Images served from the Flashpoint mount carried no Cache-Control, while the
CDN fallback sent a day of caching, so browsers revalidated every image on
every page view. Over SMB each of those cost four metadata round trips, one of
them a synchronous existsSync that blocked the event loop.
Send the same cache header on both branches, replace existsSync with an async
stat, and resolve the base directory's realpath once instead of per request.
The Ultimate edition ships preferences.json without gameMetadataSources, so
metadata sync was permanently unavailable there with no way to opt in.
Add an admin-only override (metadata.custom_source_enabled / _url) resolved
ahead of preferences, restricted to the two trusted FPFSS hosts and validated
on save. While it is off, the Metadata Update card explains that Ultimate does
not support metadata updates and that updating means a newer full package,
pointing advanced admins at the override. Enabling it requires confirming a
dialog that spells out what a sync rewrites.
Cookies were Secure whenever NODE_ENV=production, so browsers discarded them
on any deployment served over plain HTTP and every login bounced back to the
login page. A fixed flag cannot serve a LAN over HTTP and the internet over
HTTPS from the same instance.
Derive the flag from req.secure, which honours X-Forwarded-Proto from a
trusted proxy, and add COOKIE_SECURE=auto|true|false to override it.
Browsers omit a scheme's default port when serializing Origin, so a page at
http://host:80 sends "http://host". Comparing that to the raw DOMAIN string
rejected every POST from a deployment served on port 80 or 443 — including
same-origin requests under SERVE_FRONTEND, which surfaced as a CORS error on
login with no way to guess the cause.
Compare normalized origins instead, always allow a request whose Origin
matches its own Host, and accept a comma-separated DOMAIN so one deployment
can be reached over both a LAN address and a public domain. Apply the same
normalization to the domains table, which previously built origins without
ports, and reflect the caller's origin on the game-zip admin routes.
Treat `downloaded` as a base cache dimension like platform and library
instead of a dynamic filter. It is two-valued, and every path that can
change presentOnDisk (GameDatabaseUpdater, DownloadedReconciler) plus a
database reload already clear this cache, so the 30-second TTL only forced
the Downloaded page to recompute nine option queries twice a minute.
Pre-warm the downloaded combination at startup so the page is instant on
first visit.
Add a Downloaded page listing games whose data is on disk, a downloaded
filter on the browse pages, and three admin settings controlling the page,
guest access to it, and whether the filter starts on.
Make presentOnDisk trustworthy: the play-path download now records it, a
reconciler rebuilds it from ZIP filenames at startup and after each Launcher
sync (which also backfills earlier play-path downloads), and self-writes no
longer trigger a database reload and cache flush.
Closes#12
Adds the test promised in the design spec's testing section: chip
removal must write an explicit '0' when the admin default is on,
otherwise clearing the URL param would silently re-apply the
downloaded filter. Covers all three removal paths in
GameBrowseLayout (handleRemoveChip, handleRemoveWithChildren,
handleClearAllFilters) against both default states.
Renders GameBrowseLayout with its data hooks (useGames,
useFilterOptions, useFavoriteGameIds, useBatchRatingAggregates,
useFeatureFlags) stubbed out and FilterPanel replaced with a minimal
stand-in exposing the exact callbacks it receives, so the real
handler logic runs without pulling in FilterPanel's own filter-
dropdown machinery or live network calls.
Search Games is a POST with a JSON body (backend/src/routes/games.ts),
not a GET with query params - correct the framing around the new
`downloaded` field. Also fix the presentOnDisk SQL sample in
game-browsing-filtering.md, which defined it as "has any game_data
row" and contradicted both the Downloaded Games section further down
and the real backend logic (EXISTS ... presentOnDisk = 1).
reconcile() called noteSelfWrite() but never cleared GameSearchCache
or the filter options cache. In the post-sync path caches are cleared
at reload and reconcile then runs asynchronously, leaving a window
where a downloaded:true search gets cached without the flags the sync
just wiped. With GameSearchCache's 5-minute TTL and updateAgeOnGet,
a frequently-refreshed Downloaded-page query could stay stale
indefinitely.
markAsDownloaded and markAsNotDownloaded now call
DatabaseService.noteSelfWrite() plus clear the search and filter
options caches themselves, matching the design spec. Previously this
only happened at the gamezipserver.ts call site, so DownloadManager's
Download-button path (non-copy mode) still triggered the file watcher
on every download, causing an unnecessary full reload and cache flush.
Task 2 already narrows filter-option lists on the backend when downloaded
is true, but useFilterOptions never forwarded the field into the query
params or query key, so the backend support was unreachable and the
dropdown/year-range options never narrowed to downloaded games.
Add the public feature flag features.enable_lucky_button (default on)
with an admin switch in Settings > Features. AppShell renders the
floating random-game button only when the flag is enabled.
Unlike the other feature flags, this one is not bypassed for admins:
it controls cosmetic chrome, so an admin hiding it must also stop
seeing it in their own session.
Closes#13
Tighten the Content-Security-Policy the backend sends when it serves the
SPA so injected inline scripts and eval are no longer allowed:
- script-src: 'self' + 'wasm-unsafe-eval' (for Ruffle's WASM) + a SHA-256
hash of index.html's inline theme bootstrap, computed at startup from the
served file. Drops 'unsafe-inline' and 'unsafe-eval'.
- style-src: keep 'unsafe-inline' — Radix/shadcn set inline style attributes
at runtime, which hashes/nonces (style-src-attr) cannot cover.
The inline-script hash normalizes CRLF/CR to LF before hashing because the
HTML parser does the same before matching, so the hash holds on Windows
(CRLF) checkouts too.
Verified: 0 eval/new Function in the bundles; Ruffle loads as an external
same-origin script and only needs wasm-unsafe-eval; the hashed theme script
executes under the strict policy in a real browser with no CSP violation.
Collapse the separate backend (Node) and frontend (nginx) images into
one image where the Express backend serves the built React app in
addition to the API and game content, so deployment is a single
container and one origin.
- Add a root Dockerfile with frontend-builder + backend-builder stages
producing one runtime image; remove backend/ and frontend/ Dockerfiles,
the nginx config, and the frontend entrypoint
- Serve the frontend dist and SPA fallback from Express (config.serveFrontend
/ FRONTEND_DIST_PATH), before auth/maintenance so the shell always loads and
before the API 404 so client routes resolve to index.html
- Port the SPA-oriented CSP from nginx into Helmet, gated on serveFrontend;
keep the strict API-only policy otherwise
- Reduce both compose files to a single flashpoint-web service on WEB_PORT
-> 3100; drop API_PORT, BACKEND_HOST, BACKEND_PORT
- Build one image in the release workflow instead of a two-service matrix
- Update .env.example, README, workflow README, and env var docs
Also add .gitattributes (*.sh eol=lf) and normalize the entrypoint line
endings — without it, Windows checkouts bake CRLF into the image and the
shebang fails with "no such file or directory".
- Use label/fieldset/legend and Checkbox ids so playlist rows are
keyboard- and screen-reader-navigable
- Add aria-live status regions for loading and empty states and
aria-hidden on decorative icons
- Move action buttons into DialogFooter
- Drop the duplicate 'Playlist created' toast already fired by the
create mutation
- Read game paths and NODE_ENV through the config module in
gamezipserver instead of process.env directly
- Harden SQLite cache/mmap parsing with isNaN checks so invalid
values fall back to defaults instead of NaN
- Pass auth, rate-limit, application, and OpenTelemetry variables
through both docker-compose files with documented defaults
- Expand env var documentation and .env examples to match
Add community game ratings with a 5-star system:
- Backend: GameRatingService, /api/ratings routes, and migration
002_game_ratings.sql for the ratings table and aggregates
- Frontend: StarRating and GameRatingSection components, useRatings
hooks, ratings API client, and rating types
- Surface aggregate ratings on game cards, list items, detail view,
and a Highest Rated section on the home page
- Gate the feature behind an enableRatings feature flag with a
settings toggle
- Add --star theme tokens and Tailwind star color
Darkraise