robin/music-hub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20 Commits 1 Branch 0 Tags
c949d6b829c787408a74c74aec2345577b49143a
Commit Graph

4 Commits

Author SHA1 Message Date
Robin Choice
c949d6b829 fix: security hardening and stem multi-select 
- Remove public /migrate endpoint (startup migration handles it)
- Add membership + canUpload check to POST /versions/track/:trackId
- Add membership check to stream-url, download-url, waveform endpoints
- Scope member PATCH/DELETE to projectId to prevent cross-project mutation
- Add auth + membership check to POST /comments/:id/resolve
- Add secure: true to session cookie in production
- Hash magic link tokens before storing (was plaintext)
- Return generic error message instead of err.message
- Fix stem multi-file-select: replace hidden attr with CSS offscreen
  (Safari/WebKit drops multiple selection on display:none file inputs)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-16 21:04:22 +02:00
Robin Choice
ccd7ed3a93 refactor: simplify stem code per review 
- async zip() instead of zipSync (non-blocking for large files)
- null check for track in DELETE endpoint (was non-null assertion)
- formatFileSize extracted to format.ts, imported in StemList
- Stem type exported from StemList, removed duplicate in +page.svelte
- files[idx].progress = p direct Svelte 5 mutation (no spread)
- remove narrative comments from stems.ts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-13 18:44:12 +02:00
Robin Choice
e63dc30a7f fix: remove ContentLength from presigned URL, fix macOS multi-select 
- ContentLength in PutObjectCommand causes XHR upload failures (browser
  does not send matching Content-Length header in presigned PUT requests)
- Change accept to audio/* so macOS Finder allows multi-file selection
- Add step prefix to errors ([URL]/[S3]/[DB]) for easier debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-13 18:30:50 +02:00
Robin Choice
9530add1ff feat: add STEM file support per track 
- DB: stems table with trackId FK, fileKey, sortOrder, createdById
- API: GET/POST/DELETE stems, presigned upload URL, ZIP download via fflate
- Web: StemUploadDropzone (multi-file, batch upload, progress bars)
- Web: StemList with download-all-ZIP and per-stem delete
- Web: STEMs tab in track detail view
- Icon: add 'music' icon to inline set
- Auto-migration runs stems table creation on boot

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-13 18:13:01 +02:00