From cf7c71b8a3488c4015d273416702f330dac784cb Mon Sep 17 00:00:00 2001 From: Davide Scaini Date: Thu, 9 Apr 2026 09:19:48 +0200 Subject: [PATCH] (opus assessment) Fix auth wall flash, broken multi-user write API, and single-user redirect loop Auth wall (Base.astro): set data-auth-pending on at SSG time and hide it with inline CSS before any JS runs; remove the attribute after /api/me resolves. Eliminates the flash of protected content on private instances. Multi-user write API (serve/server.py): the previous _apply_sidecar_edit and strava_sync imports from bincio.edit.server were broken (those names don't exist as module-level exports) and the Strava sync mutated a global data_dir, making concurrent requests from different users racy. Fix: extract both operations into bincio/edit/ops.py as pure functions that take data_dir explicitly. Both edit/server.py and serve/server.py now import from there. Security: add rate limiting to POST /api/register (5 attempts / 15 min / IP, separate bucket from login). Add _check_id() activity ID validation to both GET and POST /api/activity/{id} in serve/server.py. Single-user mode: _write_root_manifest now forces instance.private=false when no instance.db exists, even if a previous run wrote true. Prevents the auth wall from firing and redirecting to /login/ when bincio serve isn't running. ActivityFeed: skip filterHandle when profileIndexUrl is set (per-user profile pages load the right shard directly; activities have no handle tag at that point, so the filter was producing an empty feed). Fix handle links to point to /u/{handle}/ instead of /{handle}/. Fix -inside- Svelte warning by converting the inner handle link to a {/if}

{a.title} diff --git a/site/src/layouts/Base.astro b/site/src/layouts/Base.astro index a80ffa1..d5e3889 100644 --- a/site/src/layouts/Base.astro +++ b/site/src/layouts/Base.astro @@ -52,12 +52,21 @@ try { }); - + {instancePrivate && !isPublicPage && ( + )} @@ -132,6 +141,7 @@ try {