T

Lucas WintherandClaude Opus 5.5 5f7d54b805 fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

- API writes pass token:<name> for Bearer requests and "user" for sessions.
- X-Requested-With: sttracker on every non-Bearer write, login and register included.
- JSON-body routes reject non-JSON content types with 415.
- A malformed stt_session cookie counts as no cookie (401), not 500.
- DELETE me/tokens/:id is 404 for unknown or foreign ids; admin/invites is admin-only.
- Bun.serve development mode only with NODE_ENV=development or --hot.
- OpenAPI documents multipart fields.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 21:30:43 +01:00

.claude

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

.codex

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

.gemini

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

apps

fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

2026-10-30 21:30:43 +01:00

docs

docs: server architecture, API decisions, follow-ups

2026-10-30 21:17:18 +01:00

packages

fix(core): token writes keep their actor in history but are user-owned in field_sources

2026-10-30 21:29:38 +01:00

plugins

fix(core): job failure semantics, stale-lock reaper, run-scoped context, reload

2026-10-30 20:52:51 +01:00

.gitignore

chore: ignore agent worktree directory

2026-10-30 19:37:04 +01:00

AGENTS.md

feat(db): initial schema

2026-10-30 15:39:14 +01:00

bun.lock

chore: workspace package stubs with approved dependencies

2026-10-30 15:30:49 +01:00

CLAUDE.md

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

DESIGN.md

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

GEMINI.md

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

package.json

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

PRODUCT.md

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

README.md

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

tsconfig.json

chore: bootstrap agent-ready docs, rules and Bun workspace

2026-10-30 15:06:58 +01:00

README.md

STTracker

A self-hosted meta tracker for everything you read, watch, play and listen to. It keeps your own permanent copy of your data from Hardcover, Trakt, MangaBaka, ListenBrainz, Last.fm and more.

Product spec: docs/specs/001-sttracker-v1-design.md
Contributing (humans and agents): AGENTS.md