JakeBreath
16907c39ca
- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS, CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS; same-origin traffic is unaffected and a disallowed origin gets no CORS headers. Token auth needs no cookies, so credentials stay off by default. - TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply X-Forwarded-Proto/Host for correct absolute URLs. - API media URLs (raw/thumbnail/upload/similarity/staged previews) are now absolute, built from the request host, so <img>/<video>/fetch() keep working when the SPA is served from another origin. Signed URLs are still per-user; nothing is stored in the DB. - The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by a small apiUrl() helper used for XHR/fetch and the few URL fallbacks. Verified with a throwaway instance: preflight and GET responses carry the allowed origin, foreign origins get nothing, media GETs include CORS for cross-origin fetch(), and payload URLs use the request host (dev :8000 unchanged).
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
Use the venv on backend/venv/
|
|
|
|
DO NOT mess with the system's python
|
|
|
|
For Frontend work:
|
|
|
|
read both Frontend Design related Markdown files on the frontend/ folder
|
|
|
|
For anything touching e621 endpoints or payloads (posts, pools, tags, users,
|
|
favorites, IQDB, blacklists, uploads), consult the e621 OpenAPI spec first:
|
|
https://e621.wiki/openapi.yaml
|
|
|
|
Download it once per session (it is ~450 KB YAML), then grep it for the exact
|
|
path/parameter/schema names instead of guessing:
|
|
|
|
curl -sL https://e621.wiki/openapi.yaml -o /tmp/opencode/e621-openapi.yaml
|
|
grep -n "^ /pools.json" /tmp/opencode/e621-openapi.yaml
|
|
|
|
Notes learned from the spec (verify before trusting):
|
|
- Index endpoints often return a bare array (e.g. GET /pools.json) while the
|
|
show endpoint returns the object directly (e.g. GET /pools/{id}.json) — not
|
|
always wrapped in a named key.
|
|
- Pools index supports search[order] (id_asc, id_desc, name, created_at,
|
|
post_count), search[name_matches], search[category], search[is_active].
|
|
- Own settings (including user[blacklisted_tags]) are updated with
|
|
PATCH /users/{id}.json as form-encoded data; /users/me.json returns the user
|
|
object at the top level.
|
|
|
|
Project constraints (do not regress):
|
|
- Backend is Django 6 + DRF with token auth (no session auth on the API);
|
|
MariaDB/Redis come from docker-compose.yml.
|
|
- Deployment will be Docker-based (compose); do not add systemd/cron unit
|
|
files for scheduling — use the container setup for timers/workers.
|
|
- Same-origin and cross-origin frontends both work: the SPA uses relative
|
|
URLs unless built with VITE_API_BASE, the backend allows extra origins
|
|
via CORS_ALLOWED_ORIGINS (plus CSRF_TRUSTED_ORIGINS for the admin), and
|
|
API media URLs are absolute (built from the request host), so signed
|
|
files load cross-origin too. TRUST_PROXY_HEADERS=true is required behind
|
|
a TLS-terminating proxy.
|
|
- No server-side media processing: the home server cannot handle it.
|
|
Compression/optimization runs client-side (WebCodecs + WASM in a worker)
|
|
and the server only applies the result via POST /api/files/J-x/optimize/.
|
|
- Do not use imgdd; perceptual hashing is imagehash server-side.
|
|
- Chat/messaging features are out of scope.
|