- middleware re-verifies the username against users.json per request:
deleted accounts' signed cookies are rejected immediately
- set_cookie/delete_cookie honor the Secure flag; run.sh sets
ANIWEB_SECURE=1 so sessions only work through the HTTPS proxy
login.html/app.js now resolve fetch targets relative to the page's
directory (BASE), so the app works served at / or under a path prefix
(https://host/ani/) as long as the proxy strips the prefix.
- server/users.py replaces credentials.py: users.json (0600), PBKDF2,
one-time migration of the legacy single password to user admin
(history.json -> history/admin.json)
- accounts are CLI-managed only: python -m server.users add|rm|list
(no self-signup on an internet-exposed app); /signup route removed,
login page back to username + password
- per-user 30-day signed session cookie (payload carries the
username), per-user lockout, GET /api/me, POST /account/delete
- per-user watch history: server/data/history/<user>.json; ANIWEB_DATA
env override for the data dir
- header chip: logged-in user, logout, delete account
- tests/: throwaway-server suite (port 8399, temp data dir) — 9 HTTP
tests + 2 Playwright browser tests (login UI, real video playback
behind auth); runs via python tests/run.py
- POST/GET /api/history: JSON file in data/history.json (50 entries
kept, top 5 shown on home), upsert per (anime, episode)
- watch position saved every ~10s of playback + on pause/unload
- resume: opening an anime seeks to the saved position unless
>=95% through (then starts fresh); position shown on home items
- drops localStorage; server is the source of truth (verified:
fresh watch -> new session resumes at saved pos -> home lists it)
- no ?ep= param: resume last watched ep of the season from history,
else start at ep 1 (verified in headless Chromium, no click needed)
- if the browser blocks autoplay (no user gesture yet), show a
'click to play' overlay instead of a silent black screen
- no-store on everything except /stream: stale cached app.js (old CDN
hls.js ref) was the cause of the black screen — video plays fine in a
real Chromium once the fresh JS loads (verified via playwright)
- synopsis moved under the episode grid
- jsdelivr CDN was a silent single point of failure (Hls undefined ->
unhandled rejection -> black screen with no feedback)
- play() now catches API errors; hls fatal + video media errors render
'Stream error: ...' under the player
- server now binds 0.0.0.0 (LAN access); was 127.0.0.1 only
jozamudi