Drift audit 2026-06-02 — 26 findings shipped #75

Merged
bvandeusen merged 11 commits from dev into main 2026-06-02 19:21:53 -04:00
3 changed files with 21 additions and 1 deletions
Showing only changes of commit 413d729711 - Show all commits
+12 -1
View File
@@ -462,7 +462,18 @@ $effect.root(() => {
_radioRefreshInFlight = true;
const seed = _radioSeedId;
const exclude = _queue.map((t) => t.id).join(',');
// Drift #554: cap the exclude list so a multi-hour radio session
// doesn't grow the query string past common 8KB limits and start
// 414-ing /api/radio. The .catch() below would silently swallow
// that failure and the player would stop topping up — a dead
// radio. The server's RecentlyPlayedHours filter already handles
// broader history dedup, so the request-side exclude only needs
// to cover the visible queue's recent tail.
const RADIO_EXCLUDE_CAP = 100;
const exclude = _queue
.slice(-RADIO_EXCLUDE_CAP)
.map((t) => t.id)
.join(',');
api
.get<RadioResponse>(
`/api/radio?seed_track=${encodeURIComponent(seed)}&exclude=${exclude}`
@@ -4,6 +4,11 @@ import { redirect } from '@sveltejs/kit';
// always renders the active sub-page. Bare hits go to the default tab
// (Artists, matching Android's LibraryScreen default). 308 = permanent
// + preserve method, so SPA navigations and direct loads behave the same.
//
// Drift #559: this was a +page.server.ts which DOES NOT run in
// production — the app is configured as adapter-static + ssr=false
// (see +layout.ts). +page.ts (universal load) runs client-side, which
// is what the SPA actually executes when a route is hit.
export const load = () => {
throw redirect(308, '/library/artists');
};
@@ -5,6 +5,10 @@ import { redirect } from '@sveltejs/kit';
// still lives here at /routes/playlists/[id]/+page.svelte — that URL
// matches the server API shape and is unchanged.
// 308 = permanent + preserve method; old bookmarks land on the new URL.
//
// Drift #559: this was a +page.server.ts which DOES NOT run in
// production (adapter-static + ssr=false, see +layout.ts). +page.ts
// universal load runs client-side and IS what the SPA executes.
export const load = () => {
throw redirect(308, '/library/playlists');
};