- part_scraper_service.ts: new CACHE_TTL_HOURS (24), isCategoryStale()
checks the most recent scrapedAt for a given ComponentType's mapped
category, ensureFreshCategory() re-scrapes it synchronously if missing
or stale (errors are logged, not thrown, so search still falls back to
whatever is already cached)
- ScrapedPartsController#index: when a typeId filter is provided, the
corresponding category cache is refreshed eagerly if stale before
querying results. Free-text searches without a typeId skip this to
avoid re-scraping every mapped category on every keystroke -
'node ace scrape:parts' still refreshes everything at once on demand
- 4 new tests covering staleness detection (missing cache, <24h, >24h)
and that unmapped types never trigger a scrape/network call
Idealo and PCPartPicker were evaluated and ruled out:
- idealo.fr search pages return 503 (Cloudflare)
- the internal Idealo GraphQL endpoint used by a public scraper
(app.idealo.de/app-backend/api) is protected by Akamai Bot Manager and
silently returns empty data even with mobile app headers
- PCPartPicker's product list/search relies on a session-bound CSRF token
refreshed per page load, against a scraping-hostile ToS
pc-builder.io category pages are server-rendered, include name/price/image
for ~100 products per category, and have no bot protection, so the feature
is built on top of that source only.
- New scraped_parts cache table (type_id, name, price, image_url, source,
source_url, source_ref unique per source) populated by a batch job
rather than scraped live per search, since only ~100 first results per
category are available without reverse-engineering pc-builder.io's
DataTables/CSRF pagination flow
- part_scraper_service.ts: maps our ComponentType names to pc-builder.io
category slugs (SSD -> storage, since pc-builder.io has no separate HDD
category) and parses each category page with cheerio, skipping rows
without a resolved price (generic 'search on Amazon' links)
- node ace scrape:parts: refreshes the cache for every mapped category
(upsert on source+source_ref), runnable manually or later via cron
- GET /scraped-parts (authenticated): search the cache by name (LOWER()
LIKE, avoids a MySQL utf8_bin/utf8mb4 collation mismatch from Lucid's
whereLike) and optional typeId filter
- NewPartSearch.vue: debounced search widget wired into
components/create.vue; clicking 'Import' pre-fills the existing
component creation form (name, price, type, purchase date = today)
instead of creating the Component directly, so the user still reviews
and saves it like any manually entered part
- 3 functional tests covering search by name, filter by typeId, and
unauthenticated access being redirected to login
- Initial scrape run: 989 parts across 10 categories
Adds the ability for an owner to share a computer build via a public,
unauthenticated link, inspired by a feature request from the original
pcbuilder repo (no such feature actually existed there — implemented
from scratch here).
- New columns on computers: share_token (unique, nullable), share_enabled,
share_show_sell_price, share_show_cost
- computer_share_service.ts: generates a non-guessable share token
(crypto.randomBytes, base64url), enables/disables sharing, and supports
rotating the token to invalidate previously distributed links
- ComputerShareController (authenticated, owner-scoped like the rest of
the app): PUT /computers/:id/share to update settings, POST
/computers/:id/share/rotate to rotate the token
- PublicComputerController + GET /share/:token (outside any auth/guest
group, reachable anonymously): resolves only computers with
share_enabled = true, 404 otherwise
- ComputerPublicTransformer: dedicated read-only projection that never
leaks userId, and only includes sellPrice/cost when the owner opted in
via share_show_sell_price / share_show_cost — everything else (title,
scores, state, components, pictures) is always visible on a shared link
- ComputerShareModal.vue: owner-facing UI (toggle sharing, choose which
prices to expose, copy the public link, revoke/rotate it) wired into
computers/show.vue via a new 'Share' button
- share/show.vue: public page rendered with EmptyLayout (no authenticated
header/sidebar)
- Boolean columns use a cast since MySQL returns tinyint(1),
not native booleans, through Lucid
- 6 new functional tests covering: enabling sharing, price visibility
toggles, disabling sharing revokes the link, cross-user protection on
the share settings endpoint (404), token rotation invalidating the old
link, and anonymous access to a shared computer
Untracking .env.production (commit 3cc189c) breaks the 'cat .env.production'
step in this pipeline, since the job clones a fresh copy of the repo. This
is intentional: the file contained plaintext secrets and should never have
been committed. Documented inline:
- the deploy step will fail until secrets are migrated to Gitea Actions
secrets and the .env file is generated at deploy time
- the sshpass/sudo -S pattern for NASPASS should be replaced with a
dedicated SSH key and scoped passwordless sudo
Not changing the workflow itself: no access to the NAS to reconfigure
SSH/sudo or verify a fix end-to-end from this environment.
- Add @japa/api-client devDependency (was missing despite being required
for the 'client' fixture used in functional tests)
- Wire up sessionApiClient/authApiClient/shieldApiClient plugins in
tests/bootstrap.ts so tests can authenticate (loginAs) and pass CSRF
validation (withCsrfToken)
- Wrap each functional test in a global DB transaction (withGlobalTransaction)
for isolation and rollback
- Add .env.test with SESSION_DRIVER=memory: the cookie session driver used
in dev/prod is incompatible with Japa's session test client, which needs
a store it can read/write by session id
- tests/functional/computers.spec.ts: covers owner can update; a user
cannot update/delete another user's computer (404); a user cannot
attach another user's component via componentsId (404); two components
of the same unique type cannot be attached (422); deleting a computer
detaches its components instead of destroying them
- tests/functional/components.spec.ts: covers owner can update; a user
cannot update/delete another user's component (404); an unauthenticated
request cannot delete a component (redirects to /auth/login)
All 10 tests pass, exercising the security fixes from commit 3cc189c.
Security config (3.1):
- config/session.ts: cookie.secure now follows app.inProduction instead of
being hardcoded to false
- config/shield.ts: enable CSP with baseline directives compatible with
Vite dev server and Inertia (self + @viteDevUrl/@viteHmrUrl)
Frontend typing (3.2):
- Replace 'any' props with concrete types (Computer, Component, ComponentType,
ComputerState) across computers/*.vue and components/*.vue, using the
existing inertia/pages/types/UITypes.ts definitions
- Fix UITypes.ts: export ComponentType/ComputerState, switch from interface
to type (interfaces are never assignable to Inertia's ComponentProps index
signature), drop the stale componentTypeId/componentStateId fields that
didn't match the actual Lucid schema (real field is typeId, no component
state exists)
- Add an asPageProp() boundary cast in the two controllers: Lucid's
serialize() returns a loosely typed ModelObject that isn't structurally
assignable to the concrete page prop shapes (and the inertia/** tree is
excluded from the backend tsconfig, so real types can't be imported
directly across that boundary)
UTF-8 mojibake fixes (3.3):
- Repair broken accented characters (├®/├á/├┤ -> é/à/ô, Ôé¼ -> €) left over
from a bad encoding during the GWT->Inertia migration, across
ComponentEditor.vue, ComputerComponentsTable.vue, SimpleGallery.vue,
TableComponent.vue, isAdminMode.ts and the custom directives
Misc cleanup (3.5):
- computer.ts: replace console.warn with the app logger (includes
computerId) when .cost is accessed without preloading components
- Remove dead registerValidator (Auth/register.ts), unused since signupValidator
is the one actually wired to NewAccountController
- computers/create.vue: switch to useForm() + @submit.prevent so the form
submits on Enter and shows a processing state, matching components/create.vue
- components/edit.vue: drop the 'origin' field, which was never provided by
the backend (edit() never shared it) and therefore always undefined
- Extract FilterDropdown.vue and reuse it in ComponentsViewer/ComputersViewer,
removing ~80 lines of duplicated dropdown markup/logic and fixing duplicate
HTML ids (id="used" appeared twice in ComputersViewer)
- Move MIGRATION_*.md artifacts into docs/migration-history/
- Scope update/destroy queries by userId (Computers & Components), matching
the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
committed); local file kept on disk
Kevin L'Hereec