Repository navigation
Release 1.0.0 - #15
Merged
Merged
Conversation
AdventureLog 0.13.1 removed the middleware that read X-Session-Token and now checks CSRF on login, so login answered 403 and every other request ran anonymous. Requests to the signed-in server now carry the session as a sessionid cookie, a made-up csrftoken pair (Django's double-submit check) and a same-origin Referer. X-Session-Token stays for older servers. Images send the cookie too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copies the Play upload keystore into gitignored signing/, checks its certificate against the Play draft AAB, then sets the four secrets the release job needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
versionName 1.0.0 (versionCode 10). The release job also builds the bundle and attaches it beside the APK; a version with a suffix such as 1.1.0-beta is still published as a pre-release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The all-in-one image (upstream's default install since 0.13) routes /api and /auth through the SvelteKit frontend, whose proxy drops every Set-Cookie, adds its own CSRF token and redirects trailing slashes, so the app could not sign in there. - Log in through allauth's app client, which returns the session in the body; it is a Django session key, sent as the sessionid cookie. - Probe /csrf/ once per server: JSON means Django directly, HTML means the frontend's proxy. - Behind the proxy send only the session cookie and an Origin, and no trailing slash (a 308 drops a POST; SvelteKit refuses form posts from another origin). - Sign-out stays on the browser route: the app client's DELETE leaves the session alive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(network): sign in on server 0.13.1, including the all-in-one install
chore(release): 1.0.0, and publish the AAB Play needs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 1.0.0: everything merged into develop since 0.0.9-alpha.
/csrf/probe, proxy mode).Merging this runs "Create Release": a signed APK and AAB attached to the
v1.0.0release (not a pre-release).🤖 Generated with Claude Code