Audited on iPhone SE (320px), iPhone 13, Pixel 5 emulations:
- FOUND: login/search inputs at 13.3px (< 16px) -> iOS Safari
auto-zooms the page on focus. Fixed: 16px in style.css AND
login.html (separate page with own CSS).
- FOUND: no touch-action anywhere -> double-tap-zoom tap delay on
buttons. Fixed: touch-action: manipulation on interactive elements
in both stylesheets.
- FOUND: .pl-spin missing from prefers-reduced-motion. Added.
- VERIFIED CLEAN: no horizontal overflow at 320/390/393px, controls
row fits, chip+gauge in viewport, episode grid 66x31 ok,
Tap-to-play gesture flow works on BOTH hls.js and native paths
(simulated iOS autoplay block), toast fits, zero JS errors,
desktop playback regression OK, 18/18 API tests.
assets v=7; login.html is no-store so updates without a bump.
Headless Chromium 151 stops generating animation frames on idle pages,
which stalls Playwright's rAF-based waits (wait_for_function default
polling, click actionability 'stable' check). Fixes:
- wait_for_function: explicit timer polling (100ms/250ms)
- video readyState wait: 120s (cold upstream/CDN starts)
- .card click: force=True
- login: form submit handler (Enter key works, was button-only)
- test asserts the seeded entry, not a section header that only
appeared via an API-test side effect
login.html/app.js now resolve fetch targets relative to the page's
directory (BASE), so the app works served at / or under a path prefix
(https://host/ani/) as long as the proxy strips the prefix.
- server/users.py replaces credentials.py: users.json (0600), PBKDF2,
one-time migration of the legacy single password to user admin
(history.json -> history/admin.json)
- accounts are CLI-managed only: python -m server.users add|rm|list
(no self-signup on an internet-exposed app); /signup route removed,
login page back to username + password
- per-user 30-day signed session cookie (payload carries the
username), per-user lockout, GET /api/me, POST /account/delete
- per-user watch history: server/data/history/<user>.json; ANIWEB_DATA
env override for the data dir
- header chip: logged-in user, logout, delete account
- tests/: throwaway-server suite (port 8399, temp data dir) — 9 HTTP
tests + 2 Playwright browser tests (login UI, real video playback
behind auth); runs via python tests/run.py
jozamudi