Block a user
[Reading Journey][UX] Covers-only uniform shelf + responsive AVIF cover variants + book quick-view + blog-about-this-book (parent-gated)
bug(blog): comment endpoints are anonymous and comment author identity is client-spoofable
bug(blog): comment endpoints are anonymous and comment author identity is client-spoofable
Resolved and merged:
- spikersoft-backend PR #437 (merged to master,
5139211a):[Authorize]on both comment endpoints; comments are stamped with the caller's Keycloak sub + claim-derived…
bug(blog): media removal is a placeholder — no backend endpoint, viewer button does nothing
bug(blog): media removal is a placeholder — no backend endpoint, viewer button does nothing
Resolved and merged:
- spikersoft-backend PR #437 (merged to master,
5139211a): newDELETE api/blog/posts/{postId}/media/{mediaId}—[Authorize], owner-or-staff, idempotent **soft…
EPIC: Angular 22 + Nx 23 full-leverage modernization (signal forms, resource APIs, affected CI, remote cache)
E5 wave 1 — employment application-dialog PR open
spikersoft-angular#476 — five FormGroups + four FormArrays migrated; the…
bug(blog): comment endpoints are anonymous and comment author identity is client-spoofable
bug(blog): media removal is a placeholder — no backend endpoint, viewer button does nothing
feature(blog): photography-info icon on blog photos sourced from the Photography gallery
Implemented and merged:
- spikersoft-backend PR #436 (merged to master,
151ac59d):BlogMedia.photographIdprovenance (ownership-validated on every write path) + new viewer endpoint `GET…
feature(blog): photography-info icon on blog photos sourced from the Photography gallery
bug(blog): media 'Confirm Removal' button shown to all viewers + blog update/add-media endpoints missing authorization
bug(blog): media 'Confirm Removal' button shown to all viewers + blog update/add-media endpoints missing authorization
Resolved and merged:
- spikersoft-backend PR #436 (merged to master,
151ac59d): added[Authorize]+ server-derived actor + owner-or-staff enforcement toPUT posts/{id}, `POST posts/{id}/…
EPIC: Angular 22 + Nx 23 full-leverage modernization (signal forms, resource APIs, affected CI, remote cache)
E5 wave 1 — child-account-dialog PR open (COPPA)
Verified nothing else had claimed it (no open PRs / remote branches), then migrated the six-step create/edit child-account dialog: [spikersoft-…
feature(blog): photography-info icon on blog photos sourced from the Photography gallery
bug(blog): media 'Confirm Removal' button shown to all viewers + blog update/add-media endpoints missing authorization
[Nx graph] spikersoft-environment consumer audit: all 18 lib consumers are URL-only (100 call sites); only the app needs full environment — migration report, not yet migrating
[Nx graph] Split platform-activity-tracking into api (facade, 24 dependents) + impl (pipeline, app-registered) so impl churn stops invalidating a third of the graph
[Nx graph] spikersoft-environment consumer audit: all 18 lib consumers are URL-only (100 call sites); only the app needs full environment — migration report, not yet migrating
Audit delivered in the ticket body; the one actionable piece (phantom c/cpp-runner edges) merged in spikersoft-angular PR #472 — env hub is now 19 direct consumers. Recommendation of record: no…
[Nx graph] Split platform-activity-tracking into api (facade, 24 dependents) + impl (pipeline, app-registered) so impl churn stops invalidating a third of the graph
Resolved in spikersoft-angular PR #470 (merged to master). Facade lives in platform-activity-tracking-api (keeps the un-suffixed alias — 86 import sites untouched); pipeline in `platform-activ…
Dungeon-crawler background music keeps playing after navigating to another game