5 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 4.8	5a6a95682d	fix(cleanup): library scans survive navigation, reconnect on return ... The transparency / single-color audit cards held the run + poll timer in local component state, so navigating away destroyed both and onMounted never reconnected — the Celery scan kept running and writing LibraryAuditRun, but the UI forgot it. Now each card, on mount, fetches its rule's latest run (GET /api/cleanup/audit?rule=<rule>&limit=1) and rehydrates: shows progress + resumes polling if still running, or shows the completed result (ready/applied/ error) so the operator can act on it after returning. Adds the ?rule= filter to the audit-history endpoint + cleanup store latestAuditForRule(). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-04 16:55:20 -04:00
bvandeusenandClaude Opus 4.7	eebc8e2413	refactor(dry-F2): centralize shared UI primitives (relative-time, toast, download-status) ... - utils/date.js: add formatRelative(iso, {future,nullText}); migrate 6 sites (SourceRow, SubscriptionsTab, SourceHealthDot, SchedulerStatusBar + thin adapters in BackupRunsTable/SystemActivityTab for their '—' null text). PostCard (30d->absolute) and CredentialCard (mo/y buckets) intentionally keep bespoke formatters. - utils/toast.js: toast(opts) wraps the globalThis.window?.__fcToast?.(...) incantation; migrate 63 call sites across 24 files. - utils/downloadStatus.js: single source for the download-event status enum -> label/color/icon; collapse the 3 duplicate maps (DownloadStatChips, DownloadsFilterPopover, DownloadEventRow). Net -33 lines. Platform metadata was already centralized in platformColor.js. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 11:20:07 -04:00
bvandeusen	df6d89cb59	fix(secure-context): full audit — DestructiveConfirmModal.expectedTokenOverride + bulk-delete + min-dim use backend-computed tokens ... Operator-flagged 2026-05-27: walk the whole project for the same shape as the min-dim Delete-button silent failure (crypto.subtle TypeError on plain HTTP). FC runs over plain HTTP per the homelab posture; Secure-Context-gated browser APIs are undefined on the production origin. **Audit results across `frontend/src/`:** crypto.subtle.digest — 2 sites: - MinDimensionCard (fixed 2026-05-27) - BulkEditorPanel (THIS FIX) navigator.clipboard — 1 site, already guarded: - utils/clipboard.js writeText with execCommand fallback serviceWorker / mediaDevices / Push / Web USB|HID|Bluetooth|Serial / cookieStore / queryLocalFonts / WebAuthn / geolocation — NOT USED, nothing to fix Extension scripts (background.js) use crypto.subtle but run from moz-extension:// which IS a Secure Context — left as-is. **BulkEditorPanel double bug** The bulk-delete UI on the gallery selection had been broken since FC-3k shipped, in two ways: 1. `crypto.subtle.digest` swallowed TypeError on plain HTTP — modal never opened. Same symptom as min-dim. 2. Even on HTTPS, the modal's `kind="images-selection"` produced `delete-images-selection-<sha8>` while the backend expected `delete-images-<sha8>`. The two would never match. Fix: - Backend `/api/admin/images/bulk-delete` dry-run response now returns `confirm_token` (the canonical `delete-images-<sha8>` string). Integration test `test_bulk_delete_dry_run_returns_counts` pinned to assert the new field. - DestructiveConfirmModal gains an `expectedTokenOverride` prop. When set, it bypasses the `${action}-${kind}-${runId}` formula and uses the explicit string. This decouples the UI label (`kind`) from the wire-format token (server-provided), so future endpoints can use a kind-specific label without their kind name leaking into the token. - BulkEditorPanel passes `:expected-token-override="bulkProjected?.confirm_token"` — no client-side crypto, no kind-prefix mismatch. - MinDimensionCard refactored to the same explicit pattern (was slicing the 8-char suffix off the backend's token and passing it through `runId`; now passes the full backend token via `expected-token-override` directly). Cleaner; one source of truth. **Banked memory** `feedback_no_secure_context_apis.md` documents the full table of Secure-Context-gated APIs, which ones FC currently uses, and how each is handled. Indexed in MEMORY.md. Sites for the audit also listed in the memory for future drift-checking. No other Secure-Context-gated APIs found in `frontend/src/`. The same shape won't recur unless someone adds a new dependency on one — at which point the banked memory should fire.	2026-05-27 21:17:40 -04:00
bvandeusen	12be188ada	feat(showcase): IR-parity R-key shuffle + stagger entry animation; fix(cleanup): min-dim Delete swallowed crypto.subtle TypeError on plain HTTP ... **showcase R-key + entry animation** Restores two behaviors lost during the FC-2 IR→Vue port. Operator-flagged 2026-05-27. - ShowcaseView listens for keydown 'r'/'R' on window. Triggers `store.shuffle()`. Skips when an input/textarea/contenteditable is focused or a Vuetify overlay is open (the dialog/menu sets `.v-overlay--active` on the body). - MasonryGrid gains an opt-in `animateFromIndex` prop (default `Number.POSITIVE_INFINITY` = off). When set, items with index ≥ the threshold animate in with a stagger fade-in: 12px translateY, 0.25s ease, 60ms per item, capped by `prefers-reduced-motion`. Stagger uses original-items-array index (resolved via an `idxById` Map) so the reading order is preserved even after the masonry distributes items across columns. - ShowcaseView watches `store.images.length`: shrink-or-zero baseline ⇒ `animateFromIndex=0` (animate everything on initial load / shuffle); grow ⇒ baseline=prevCount (animate only the appended tail on infinite-scroll). Other MasonryGrid consumers (ArtistView's Gallery tab) don't pass the prop, so they keep their current no-animation behavior. Direct port of IR's `app/static/js/showcase.js` keyboard handler + `app/static/style.css` itemFadeIn keyframe. **min-dim Delete: crypto.subtle TypeError fix** The Delete button on the Cleanup → Minimum Dimensions card was silently no-op'ing. Root cause: `crypto.subtle` is Secure-Context-gated (undefined on plain-HTTP origins per the homelab posture). The card's `onDeleteClick` computed the Tier-C confirm token via `crypto.subtle.digest('SHA-256', ...)`, which threw TypeError before `showModal.value = true`. The promise rejected, the click handler had no `.catch`, the modal never opened — exactly the operator's reported symptom. Same shape as the v26.05.26.0 `navigator.clipboard` fix on the ErrorDetailModal Copy button. Fix: backend `/api/cleanup/min-dimension/preview` now returns `confirm_token` (the canonical `delete-min-dim-<sha8>` string) in its response. Frontend reads it from the preview response and feeds the 8-char suffix to DestructiveConfirmModal's `runId` prop — no client-side crypto needed. Single source of truth. Integration test `test_min_dimension_preview_returns_count` pinned to also assert `body["confirm_token"]` matches the server-side compute.	2026-05-27 20:59:58 -04:00
bvandeusen	2505b197ae	feat(fc-cleanup): Pinia store + 3 cards + CleanupView + SettingsView tab + TagMaintenanceCard moved from Maintenance + ruff lint fixes — Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 08:16:46 -04:00