soulsync/webui
Broque Thomas d9529fc801 Token leak round 2: artist endpoint + playlist sync + URL-encoded redaction
The first token-leak fix scrubbed the artwork URL fixer's own log
calls. This catches three more sites that ALSO leaked tokens, plus
one upstream gap that let URL-encoded tokens slip through the
redactor.

Three sites in `web_server.py` (artist endpoint at line 8765-8773):

- "Artist image before fix: '...'" -- logged the raw image_url with
  the auth token in plain form.
- "Artist image after fix: '...'" -- logged the URL-encoded form
  after it had been wrapped in the image proxy
  (`/api/image-proxy?url=<percent-encoded-token>`).
- "Final artist data being sent: {...}" -- dumped the entire
  artist_info dict on every render, including the image_url field.

All three were dev-time debug noise. Removed entirely. The "No
artist image URL found" warning at line 8770 stays (no URL, just
the artist name).

One site in `core/discovery/sync.py:402`:

- "[PLAYLIST IMAGE] image_url=..." -- logged the playlist poster URL
  during sync. Same auth-token leak risk for Plex / Jellyfin
  playlists. Changed to log only `has_image=True/False`.

Upstream gap in `_redact_url_secrets`:

- The original regex only matched plain query params (`?key=value`).
  When an auth-bearing URL gets wrapped inside another URL's query
  string (our `/api/image-proxy?url=<encoded>` flow) the auth params
  end up percent-encoded -- `%3FX-Plex-Token%3D...` -- and slipped
  through.
- New second pattern catches the URL-encoded form. Both passes run
  on every redact call; idempotent.

Verified manually:
  /api/image-proxy?url=...%3FX-Plex-Token%3DABC...
  -> /api/image-proxy?url=...%3FX-Plex-Token%3D***REDACTED***

6 artwork tests pass.
2026-05-15 09:33:15 -07:00
..
src Normalize issues schema naming 2026-05-13 22:26:26 +03:00
static Token leak round 2: artist endpoint + playlist sync + URL-encoded redaction 2026-05-15 09:33:15 -07:00
tests Keep Issues and artist detail history stable 2026-05-13 22:26:24 +03:00
.gitignore Initial Vite app scaffolding & issues page impl 2026-05-13 22:24:46 +03:00
.oxfmtrc.json Split webui tooling into separate configs 2026-05-13 22:26:25 +03:00
.oxlintrc.json Split webui tooling into separate configs 2026-05-13 22:26:25 +03:00
index.html Dashboard bento grid redesign + responsive breakpoints 2026-05-14 19:16:46 -07:00
package-lock.json Unify issues validation and metadata 2026-05-13 22:26:26 +03:00
package.json Unify issues validation and metadata 2026-05-13 22:26:26 +03:00
playwright.config.ts Initial Vite app scaffolding & issues page impl 2026-05-13 22:24:46 +03:00
README.md Move shared shell chrome into bridge 2026-05-13 22:26:26 +03:00
tsconfig.json Split webui tooling into separate configs 2026-05-13 22:26:25 +03:00
vite.config.ts Split webui tooling into separate configs 2026-05-13 22:26:25 +03:00
vitest.config.ts Split webui tooling into separate configs 2026-05-13 22:26:25 +03:00
vitest.setup.ts Add MSW-backed issue API tests 2026-05-13 22:26:24 +03:00

WebUI Hybrid Rendering

SoulSync's web UI is in a transition phase:

  • most pages still render through the legacy vanilla JS shell
  • /issues is rendered by the new React app
  • a small shell bridge keeps both runtimes aware of the active page, profile context, and navigation state

How It Fits Together

flowchart LR
    Browser["Browser parses /webui/index.html"]
    Legacy["Legacy shell scripts\n(core.js -> ... -> init.js)"]
    Bridge["shell-bridge.js\nwindow.SoulSyncWebShellBridge"]
    React["Vite React app\nsrc/app/main.tsx"]
    Router["TanStack Router\nwindow.SoulSyncWebRouter"]

    Browser --> Legacy
    Browser --> React
    Legacy --> Bridge
    React --> Router
    Router --> Bridge
    Bridge --> Legacy

Runtime Roles

  • webui/static/init.js

    • boots the legacy shell
    • selects the active profile
    • handles the legacy page loading flow
  • webui/static/shell-bridge.js

    • owns the browser-side bridge object
    • exposes window.SoulSyncWebShellBridge
    • owns the shared page chrome and route handoff helpers
  • webui/src/app/main.tsx

    • mounts the React app
    • binds window.SoulSyncWebRouter
  • webui/src/platform/shell/route-controllers.tsx

    • listens for bridge readiness
    • keeps React pages aligned with the shell

Load Order

The current order in index.html matters:

  1. legacy shell scripts load first
  2. init.js sets up the shell runtime
  3. shell-bridge.js publishes the bridge and shared chrome helpers after the shell state exists
  4. the Vite React app is injected through {{ vite_assets('body') }} and boots as a module after parsing

That order avoids load-time references to missing globals and keeps the React side able to react to bridge readiness events. The React entry can start fetching early, but the shell bridge and legacy globals are already available by the time the React runtime starts acting on them.

Notes

  • The bridge is intentionally small and browser-only.
  • This is the start of the migration, not a full replacement of the legacy shell.
  • When adding another React page, check whether it needs:
    • a route entry in webui/src/platform/shell/route-manifest.ts
    • bridge typings in webui/src/platform/shell/globals.d.ts
    • a legacy fallback path in webui/static/init.js
    • bridge glue or handoff logic in webui/static/shell-bridge.js

Folder Layout

The React webui uses a small set of predictable folders so route slices stay easy to extend, test, and understand.

webui/src/
  app/         React bootstrap, router, query client, shared API client
  components/  Shared UI primitives
  platform/    Shell bridge and browser/platform integration
  routes/      Route-local code and TanStack Router pages
  test/        Shared test utilities and setup helpers

Route Slices

  • Keep route-specific code inside webui/src/routes/<route>/.
  • Put the routing entry in route.tsx.
  • Put route-local UI in a -ui/ folder.
  • Prefix non-routing files with - so TanStack Router ignores them.
  • Keep the route slice small and cohesive.
  • Prefer a few files with clear responsibilities over many tiny files with overlapping names.

Example:

webui/src/routes/issues/
  route.tsx
  -issues.types.ts
  -issues.api.ts
  -issues.helpers.ts
  -issues.api.test.ts
  -issues.helpers.test.ts
  -ui/
    issues-page.tsx
    issue-detail-modal.tsx
    issue-domain-host.tsx

The initial issues slice is the model to follow:

  • -issues.api.ts holds request code and query options
  • -issues.helpers.ts holds pure normalization and formatting
  • -issues.types.ts holds shared types
  • -ui/ holds the page, modal, and legacy handoff UI

Shared Code

  • Put reusable UI in webui/src/components/.
  • Put shell integration in webui/src/platform/.
  • Put bootstrap and app-wide wiring in webui/src/app/.
  • Move code up a level only when it is genuinely shared.
  • Avoid creating new conventions that overlap with existing ones.

Testing Choices

We have a lot of testing tools available, but we do not need all of them for every feature.

  • Use plain unit tests for pure functions and small transforms.
  • Use React component or route tests when the behavior lives in the UI or router.
  • Use MSW-backed tests when request shape, response handling, or error handling matters.
  • Use Playwright when the behavior is best proven end-to-end with the server and browser together.
  • Prefer the smallest test setup that still proves the thing that can regress.

Development

The repo root now owns the full local-dev instructions. Start there for the portable launcher and backend/frontend setup:

  1. README.md for the end-to-end dev flow
  2. npm run check and npm run fix for React-side linting and formatting