time-bandit/src/ at main · chris.pardy.family/time-bandit · Tangled

chris.pardy.family / time-bandit

0

This repository has no description

0

time-bandit / src

9 folders 4 files

at main

Chris Pardy Stop purging server sessions on 401 (sign-out cascade fix) 10d ago

Stop purging server sessions on 401 (sign-out cascade fix) purgeStoredSession assumed client.logout() would 401 with dead tokens, but Caddy's injected X-Client-Secret flips HappyView's DELETE /oauth/sessions/{did} into the confidential branch, which delete-alls every device session without checking tokens. Any transient 401 on one device signed out every other device, and each of those re-fired the delete. Purge is now local-only: clear the SDK's localStorage keys and never touch the server. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Surface auth failures: any 401 prompts a re-login Every authenticated XRPC call funnels through parse() in sync/xrpc.ts, so a 401 there now flips auth into a new session-expired state instead of failing silently into local-only mode. The login screen explains what happened and prefills the handle. markSessionExpired() also purges the SDK's persisted session so a reload doesn't restore dead tokens and loop: client.logout() DELETEs the server session before clearing local storage and itself 401s on dead tokens (the DPoP delete-all logout bug), so fall back to removing the SDK's localStorage keys directly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Initial commit: atproto time-log PWA on HappyView permissioned spaces Personal time-tracking app: multiple concurrent timers with arbitrary string tags, a nestable boolean filter/predicate system with per-filter colors, and a mobile-first "Momentum" UI. Data is stored as private records in each user's HappyView permissioned data space (atproto Proposal 0016), not the public PDS. IndexedDB is a local-first cache; a sync layer pushes local writes and polls the space (listRecords cid-diff -> getRecord) to reconcile server state. - Auth: HappyView OAuth (DPoP) browser client; per-user space provisioned on first login. Confidential client key/secret injected server-side by Caddy, never shipped in the bundle. - Records keyed by their canonical ats:// space record URI. - Deploy: Caddy (public SPA + reverse proxy) + HappyView under /hv via docker-compose, mirroring the intended two-app Fly.io topology. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

3 weeks ago

Tombstone deletes so the sync push propagates them The x button called deleteEntry(), a hard IndexedDB delete, so no deleteRecord ever reached the space and the next pull resurrected the entry. removeEntry() marks synced rows deleted+dirty for the existing tombstone push path; never-synced rows are still dropped outright. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2 weeks ago

Surface auth failures: any 401 prompts a re-login Every authenticated XRPC call funnels through parse() in sync/xrpc.ts, so a 401 there now flips auth into a new session-expired state instead of failing silently into local-only mode. The login screen explains what happened and prefills the handle. markSessionExpired() also purges the SDK's persisted session so a reload doesn't restore dead tokens and loop: client.logout() DELETEs the server session before clearing local storage and itself 401s on dead tokens (the DPoP delete-all logout bug), so fall back to removing the SDK's localStorage keys directly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Initial commit: atproto time-log PWA on HappyView permissioned spaces Personal time-tracking app: multiple concurrent timers with arbitrary string tags, a nestable boolean filter/predicate system with per-filter colors, and a mobile-first "Momentum" UI. Data is stored as private records in each user's HappyView permissioned data space (atproto Proposal 0016), not the public PDS. IndexedDB is a local-first cache; a sync layer pushes local writes and polls the space (listRecords cid-diff -> getRecord) to reconcile server state. - Auth: HappyView OAuth (DPoP) browser client; per-user space provisioned on first login. Confidential client key/secret injected server-side by Caddy, never shipped in the bundle. - Records keyed by their canonical ats:// space record URI. - Deploy: Caddy (public SPA + reverse proxy) + HappyView under /hv via docker-compose, mirroring the intended two-app Fly.io topology. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

3 weeks ago

Stop purging server sessions on 401 (sign-out cascade fix) purgeStoredSession assumed client.logout() would 401 with dead tokens, but Caddy's injected X-Client-Secret flips HappyView's DELETE /oauth/sessions/{did} into the confidential branch, which delete-alls every device session without checking tokens. Any transient 401 on one device signed out every other device, and each of those re-fired the delete. Purge is now local-only: clear the SDK's localStorage keys and never touch the server. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago

Rebuild the frontend in React + Tailwind v4 + shadcn/ui Replace the vanilla TS/innerHTML UI layer with React 19 components: main.ts -> App.tsx + components/ (board, timer cards, entry rows, log sheet, login screen, filter legend + predicate editor). The IndexedDB store, sync layer, OAuth controller, predicate tree model, and the PiP puck stay framework-free. The Momentum design carries over by mapping its tokens onto shadcn's CSS variables in src/index.css. Tag autocomplete and the add-condition menu now use portalled Radix popovers/menus, replacing the old fixed-position clipping workarounds. Vite 5 -> 8 (Node 22 in the web Dockerfile to satisfy Vite 8's engine range). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 week ago