fb81422c54
feat: snipe beta backlog batch (tickets #22/#28/#30/#34/#35/#36/#37/#38)
...
Cloud/session:
- fix(_extract_session_token): return "" for non-JWT cookie strings (snipe_guest=uuid was
triggering 401 → forced login redirect for all unauthenticated cloud visitors)
- fix(affiliate): exclude guest: and anonymous users from pref-store writes (#38 )
- fix(market-comp): use enriched comp_query for market comp hash so write/read keys match (#30 )
Frontend:
- feat(SearchView): unauthenticated landing strip with free-account CTA (#36 )
- feat(SearchView): aria-pressed on filter toggles, aria-label on icon buttons, focus-visible
rings on all interactive controls, live region for result count (#35 )
- feat(SearchView): no-results empty-state hint text (#36 )
- feat(SEO): og:image 1200x630, summary_large_image twitter card, canonical link (#37 )
- feat(OG): generated og-image.png (dark tactical theme, feature pills) (#37 )
- feat(settings): TrustSignalPref view wired to /settings route (#28 )
- fix(router): /settings route added; unauthenticated access redirects to home (#34 )
CI/CD:
- feat(ci): Forgejo Actions workflow (ruff + pytest + vue-tsc + vitest) (#22 )
- feat(ci): mirror workflow (GitHub + Codeberg on push to main/tags) (#22 )
- feat(ci): release workflow (Docker build+push + git-cliff changelog) (#22 )
- chore: git-cliff config (.cliff.toml) for conventional commit changelog (#22 )
- chore(pyproject): dev extras (pytest/ruff/httpx), ruff config with ignore list (#22 )
Lint:
- fix: remove 11 unused imports across api/, app/, tests/ (ruff F401 clean)
2026-04-13 19:32:50 -07:00
e93e3de207
feat: scammer blocklist, search/listing UI overhaul, tier refactor
...
**Scammer blocklist**
- migration 006: scammer_blocklist table (platform + seller_id unique key,
source: manual|csv_import|community)
- ScammerEntry dataclass + Store.add/remove/list_blocklist methods
- blocklist.ts Pinia store — CRUD, export CSV, import CSV with validation
- BlocklistView.vue — list with search, export/import, bulk-remove; sellers
show on ListingCard with force-score-0 badge
- API: GET/POST/DELETE /api/blocklist + CSV export/import endpoints
- Router: /blocklist route added; AppNav link
**Migration renumber**
- 002_background_tasks.sql → 007_background_tasks.sql (correct sequence
after blocklist; idempotent CREATE IF NOT EXISTS safe for existing DBs)
**Search + listing UI overhaul**
- SearchView.vue: keyword expansion preview, filter chips for condition/
format/price, saved-search quick-run button, paginated results
- ListingCard.vue: trust tier badge, scammer flag overlay, photo count
chip, quick-block button, save-to-search action
- savedSearches store: optimistic update on run, last-run timestamp
**Tier refactor**
- tiers.py: full rewrite with docstring ladder, BYOK LOCAL_VISION_UNLOCKABLE
flag, intentionally-free list with rationale (scammer_db, saved_searches,
market_comps free to maximise adoption)
**Trust aggregator + scraper**
- aggregator.py: blocklist check short-circuits scoring to 0/BAD_ACTOR
- scraper.py: listing format detection, photo count, improved title parsing
**Theme**
- theme.css: trust tier color tokens, badge variants, blocklist badge
2026-04-03 19:08:54 -07:00
9e20759dbe
feat: wire cloud session, Heimdall licensing, and split-store DB isolation
...
- api/cloud_session.py: new module — JWT validation (Directus HS256),
Heimdall provision+tier-resolve, CloudUser+SessionFeatures dataclasses,
compute_features() tier→feature-flag mapping, require_tier() dependency
factory, get_session() FastAPI dependency (local-mode transparent passthrough)
- api/main.py: remove _DB_PATH singleton; all endpoints receive session via
Depends(get_session); shared_store (sellers/comps) and user_store (listings/
saved_searches) created per-request from session.shared_db / session.user_db;
pages capped to features.max_pages; saved_searches limit enforced for free tier;
/api/session endpoint exposes tier+features to frontend; _trigger_scraper_enrichment
receives shared_db Path (background thread creates its own Store)
- app/platforms/ebay/adapter.py, scraper.py: rename store→shared_store parameter
(adapters only touch sellers+comps, never listings — naming reflects this)
- app/trust/__init__.py: rename store→shared_store (TrustScorer reads
sellers+comps from shared DB; listing staging fields come from caller)
- app/db/store.py: refresh_seller_categories gains listing_store param for
split-DB mode (reads listings from user_store, writes categories to self)
- web/src/stores/session.ts: new Pinia store — bootstrap() fetches /api/session,
exposes tier+features reactively; falls back to full-access local defaults
- web/src/App.vue: call session.bootstrap() on mount
- web/src/views/SearchView.vue: import session store; pages buttons disabled+greyed
above features.max_pages with upgrade tooltip
- compose.cloud.yml: add CLOUD_MODE=true + CLOUD_DATA_ROOT env; fix volume mount
- docker/web/nginx.cloud.conf: forward X-CF-Session header from Caddy to API
- .env.example: document cloud env vars (CLOUD_MODE, DIRECTUS_JWT_SECRET, etc.)
2026-03-27 02:07:06 -07:00
