PHPUnit was flagging 18-19 tests per run as "did not close its own
output buffers". The leaks come from Blade — a @once block, a @push,
or a view that throws mid-render leaves ob_start()'ed buffers open
when the test method returns.
Capture ob_get_level() in setUp, then unwind back to that depth in
tearDown. Suite is now green AND clean: 46/46, 0 failures, 0 risky.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
ExampleTest hit GET / expecting 200, but had no RefreshDatabase trait,
so the home controller's Video::public()->pluck('id') query hit a
non-existent `videos` table in the testing DB and 500'd. It's been
failing since Phase 1 but was always flagged as "pre-existing,
unrelated" because the test file isn't touched by any audit code.
Now mirrors the Phase-test setup: putenv forces :memory: before
parent::setUp, RefreshDatabase migrates the throwaway DB, and the
assertion passes against an empty home feed. 46/46 green.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Six tests covering:
- Skip-to-content link renders on the home page with href="#main".
- Hamburger menu + mobile search toggle buttons carry aria-label
attributes (regression test for icon-only buttons losing their
accessible name).
- Registration is server-side rejected with a birthday error when
the user is under 13; a 14-year-old passes.
- Gender select on channel settings uses "Select…" for the empty
value instead of a second "Prefer not to say".
- Unknown URL returns 404 with the branded body ("Error 404").
The <title> format test for the 404 page is captured in the deploy
checklist instead of here because the exception handler in the
testing env bypasses layouts.app's head and makes the DOM-level
<title> assertion unreliable; curl -I against /no-such on the live
site confirms "Page not found | TAKEONE".
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
A11y:
- Skip-to-content link lands first in the body and jumps to #main
past the header + sidebar for keyboard users.
- aria-label on the icon buttons that previously carried only an
icon: hamburger menu (+ aria-controls="sidebar"), mobile search
toggle, account menu (also drops the duplicate alt on the avatar
since the button name already speaks the user's name).
Admin:
- Dashboard stat card renamed "Live Videos" → "Ready" (matches the
DB status column; nothing on this card is actually live).
Settings:
- Duplicate "Prefer not to say" option on the Gender select — the
empty placeholder shared the same label as the real option.
Placeholder is now "Select…"; the real "Prefer not to say" option
stays unchanged.
- Birthday picker caps the Year dropdown at (this year − 13) and
the server-side register validation requires the same, so a
client bypass can't let a <13 user through.
Titles:
- Admin layout uses "{Page} | TAKEONE" to match the frontend format
(was "{Page} — TAKEONE"). User pages that said "| TAKEONE" literal
now interpolate config('app.name'). Shorts and Welcome moved from
" - " to " | " separator.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Also tightens stat/post-video rendering so "0" prints as "0" and not
"0.0" (Number::abbreviate(0, precision: 1) stringifies as "0.0", which
leaked into the About tab's Total Views card and post-video badges).
Four tests covering:
- /@username opens the matching channel.
- /@invalid url (space) 404s.
- Owner view shows id="postForm"; preview?preview=1 hides it.
- Zero-view playlist doesn't render "bi-eye … 0.0"; "1 videos" never
renders in place of "1 video".
Fixed a Blade dupe-declaration fatal that only fired in feature tests
(two requests in one PHP process would redeclare notifVal()). Guarded
with function_exists.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- New /@handle route (channel.handle name) that maps to UserController@channel,
so YouTube-style profile URLs work. Handle is the existing username
slug for now; a dedicated `handle` column can land later if we want
the two to diverge. {handle} is constrained to [A-Za-z0-9][A-Za-z0-9._-]*
so arbitrary paths don't match this route.
- Composer on the Wall tab used Auth::id() === $user->id directly,
which bypassed the $isOwner flip-to-false that preview-as-visitor
does. The composer now also checks !$preview so previewing an
owner's channel hides the post box as a visitor would see it.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Playlist cards on the channel page used Number::abbreviate for the
view count, which prints "0.0" (precision=1) when the playlist has
never been viewed. Hide the whole view-count row for zero-view
playlists; still show "1.2K" / "2.3M" when there's traffic.
- "N videos" counts (header meta row + per-playlist count) now use
Str::plural so "1 video" renders correctly instead of "1 videos".
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Five tests:
- /shorts/{id} renders the vertical feed with data-id matching the
target short and includes the scrollIntoView bootstrap.
- /shorts/{id} 404s when the id resolves to a non-short video.
- Home page shows .home-shorts-shelf when at least one short exists,
with a link to /shorts/{id} for every shelf card.
- Home page omits the shelf entirely when no shorts exist.
- An unknown URL returns 404 with the branded view, not the bare
framework stacktrace.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Any URL that doesn't resolve to a known route or model now renders a
page that matches the app shell: header, sidebar, dark theme. The
page explains what happened in one sentence and offers three next-
step buttons — Home, Browse Videos, Watch Shorts. Previously /shorts/1
(and every other unknown URL) rendered the bare framework 404 with no
header, no navigation and no theme.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The home grid used to interleave shorts with regular videos ordered by
upload date, so a cluster of 60-second portrait clips could fill the
first row and push the non-shorts off the fold. Split them:
- The main feed grid now excludes shorts (notShorts() filter).
- A horizontally-scrolling Shorts shelf renders above the grid with
up to 12 latest shorts, each a real <a href> to /shorts/{id} so
tapping it deep-links the vertical feed to that short.
- "See all" link in the shelf header jumps to the full /shorts feed.
- Shelf is skipped entirely when there are no shorts to show.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- New route /shorts/{video} opens the feed scrolled to that short.
Controller aborts 404 when the id doesn't resolve to a short or
isn't viewable by the current viewer, so bad links land on the
branded 404 (added in the next commit) rather than loading an
empty feed.
- The IntersectionObserver that detects the active short now
history.replaceState()s the URL to /shorts/{id} so copy-paste of
the address bar works, without pushing a navigation entry — the
back button still exits the feed in one step.
- Mute state is persisted in localStorage (shortsMuted = '0' | '1')
so unmuting once sticks across sessions. Default remains muted
to satisfy autoplay policies on first load.
- Mouse-wheel navigation moves one short per gesture with a 450 ms
debounce. Trackpad flicks no longer skip five shorts at once.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- All three type-specific watch templates (generic / music / match)
were still rendering the Up Next list as <div onclick="recGoTo(...)">
— only show.blade.php had been converted in the earlier commit.
Convert each to <a href> so middle-click / right-click / cmd-click
open-in-new-tab work, keeping the SPA swap on normal left-click via
an onclick guard that lets modified clicks fall through.
- 9 feature tests covering: singular/plural comment counts, top-level
vs reply separation, ?lc= permalink HREFs, markdown header
promotion in HtmlSanitizer::render(), passthrough of plain text,
download access gate for both MP4 and MP3 at disabled + registered
tiers, and sidebar anchor-card presence.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
AI-generated descriptions ("Letra" / "Chorus" / "Translation") landed
in the DB with markdown prefixes that the sanitiser treated as plain
text — so viewers saw literal "## Letra" and "### Chorus" instead of
headings.
HtmlSanitizer::render() now promotes `##` / `###` at the start of a
line into <h2>/<h3> before sanitising, so the existing allowlist
accepts them and the reader sees real headings. Only touches lines
whose entire content is a heading — markdown mid-sentence is left
alone to avoid false positives.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
A video with two audio tracks sharing the same language (common when
an upload was retried before the first attempt finished syncing) used
to show both rows in the player's language picker, leaving the viewer
guessing which one to pick. Dedupe keeps the first occurrence per
(language, label) pair — so legit variants like "en — Original" and
"en — Director's cut" still coexist, but bare duplicates collapse.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Header count now reads "N Comments · M replies" with correct
pluralisation ("1 Comment", "1 reply" — never "1 Comments"). The
old "N comments" number silently folded replies into the main
figure, overstating conversation depth.
- Every timestamp is a permalink. href="?lc=<id>#comment-<id>" lands
on the exact comment or reply when opened — the init handler
auto-expands the parent thread for nested replies, scrolls the
target into view, and pulses a soft red highlight for 2.8s so the
reader sees where they landed.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- VideoController@show now scores the newest 200 public ready videos
against the one being watched: +4 same type, +3 same language, +2
any tag overlap, +1 same channel. Sort by score desc then by newest.
Replaces the plain "latest 20 excluding self" list that was often
dominated by whatever happened to be uploaded last, with no regard
to what the viewer actually chose.
- Sidebar cards are real <a href> elements again, so middle-click,
right-click, cmd-click and screen readers all work. The SPA click
interceptors in types/{music,generic}.blade.php still fire via
data-rec-url for a soft-swap when the user left-clicks normally.
- loading="lazy" + width/height on the sidebar thumbnails so a long
Up Next list doesn't blow the critical path.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
@json() with a multi-line arrow function whose body is an array literal
confuses Blade's directive parser — it reads the inner '[' as an
unmatched bracket and bails out with "Unclosed '[' on line 744 does
not match ')'". Precompute the array in a plain @php block and hand
the already-evaluated collection to @json() instead.
The bug has been dormant because the compiled view was cached. It
surfaced the moment the view cache got cleared.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Six feature tests:
- Trending accepts hours=24|168|720, snaps garbage input to 24.
- Trending ranks by in-window views then likes; videos with zero
in-window views are dropped.
- Music feed opens on the newest video (regression test for the
skipped-->latest() call in VideoController@index).
- Old /videos/search?q=... returns a 301 to /search?q=...
- /search matches on video title, channel name, and playlist name
separately; each surfaces in its own Section.
- Empty /search?q= redirects to /videos browse.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Add a dedicated SearchController that matches the query against video
title / description / tags / primary language AND any secondary audio
track language (so "arabic" surfaces videos that carry an Arabic track
even if the primary language is English), plus channel name / username
/ bio, plus playlist name / description. Public visibility only.
Results reuse the videos/index view so every card gets the same
component the browse feeds use. A new Channels section renders above
the Videos grid when channel hits exist.
/videos/search is kept as a 301 redirect to /search so bookmarks and
external links stay valid; both the desktop header and mobile overlay
search forms now point at the canonical route, both carry a visually
hidden <label>, both get role="search" and both preserve the current
query in their input.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- 'New to You' promised personalised recommendations the chip did not
deliver — it was simply filter=latest, the newest videos regardless
of viewer. Renamed to 'Recent' so the label matches the behaviour.
- Every active chip now carries aria-current='page' so a screen reader
knows which filter is live without having to infer from the visual
'active' class. role='navigation' + aria-label on the bar.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The main match scoreboard overlay used to render the literal strings
"CLUB LOGO" and "FLAG" inside the per-corner slots whenever the match
had no club logo or flag assigned yet. The slots were there as a visual
design cue, but the text was leaking into cards (via the mini scorebar
overlay that already got removed in Phase 2) and showing up on the
scoreboard itself while a match was being set up.
Both slots are now empty by default. The script.blade.php logic that
replaces them with a real <img> or SVG background on load is unchanged
— when real data is present the output is identical. aria-hidden on
the empty boxes so a screen reader doesn't announce the gap.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Trending: window options are now 24 / 168 / 720 h (Today / This Week
/ This Month) and the controller snaps the ?hours param to one of
those values instead of clamping to [24, 168] — which silently made
the "This Month" tab show one-week data. Ranking is pure in-window
view count, with likes and newest createdAt as the tiebreaks (not
the old weighted sum of views + velocity + recency bonus + likes,
which was impossible to reason about and hid videos that genuinely
led the window).
- Music + /videos?filter=music: previously the branch skipped the
latest() call so Eloquent fell back to id ASC and the music tab
opened on the oldest uploads. Now both branches share one
->latest() call.
- Channel Popular sort: order by views desc, likes desc, created_at
desc so two equally-viewed videos no longer flip order between
loads.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Audit fixes against /channel/{slug}:
1. Fluid video grid — repeat(auto-fill, minmax(260px, 1fr)) replaces
the three fixed breakpoints (3/2/4 cols at 1101/1500/… px) that
produced different card widths and could overflow 390 / 1280 /
1920. min-width:0 on every grid child so a long unbroken title
(CJK, "SPARTAWORRIOR") can't widen its track past 1fr.
2. Scoreboard thumbnail — stop including vs-mini + scorebar-mini on
match cards. Those partials leaked fighter names, "AKA/AO",
"ROUND 1", "0:00" into the card DOM, showing stale 0-0 for
finished matches and breaking title layout at narrow widths. The
regular <img> above is the thumbnail now; VS intro + live scorebar
still render on the full match player page where they belong.
3. Sort pills — Latest/Popular/Oldest now append #videos so the page
stays on the Videos tab after reload instead of jumping to Wall.
4. Shorts tab — always render for the owner (so the "My Shorts"
sidebar link always lands somewhere), with an empty-state card
when no shorts exist. Visitors still see it only when shorts > 0.
5. Subscriptions sidebar link — href="#" replaced by a real
/feed/subscriptions route backed by UserController@subscriptionsFeed
that reuses the videos/index view with the subscription feed.
6. Header view count — totalViews now sums video_views over public
videos for visitors (owner still sees the full total). Previously
leaked unlisted and private video view counts.
7. Card redundancy — new hideChannelInfo prop on <x-video-card/>
suppresses the per-card avatar + channel-name row. The channel
page passes it; everywhere else keeps the row.
9. Decorative logo — the second <img alt="Play"> in the responsive
header pair now has alt="" so a screen reader doesn't announce
"Play Play". ⋮ menu button gets aria-label="More actions".
10. Privacy — age, gender, location and horoscope strip now only
render to the owner on the channel header (horoscope strip is
also allowed when the compatibility match-up is being shown to
a signed-in visitor). Joined-month stays public.
11. Notifications dropdown — initial state is "No notifications"
not an indefinite "Loading…". Opening the panel now shows a
spinner while fetching, surfaces a Retry button on error, and
bails out of the "Loading…" state on non-ok HTTP responses.
Title clamp — .yt-video-title is now a 2-line box with
overflow-wrap:anywhere so CJK titles and long words wrap mid-word
and can't widen the card past its track.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Context: on 2026-10-21 the dev SQLite DB was wiped because an early
revision of Phase 1 tests called RefreshDatabase before the per-test
config() swap had been applied, so migrate:fresh ran against the real
database file. Restored from data/backups/db-20261020-033001.sqlite
(24 users, 72 videos, 32 comments recovered); anything created between
Oct 20 03:30 and Oct 21 08:25 needs manual rebuild from NAS.
Two layers of defense added so this cannot recur:
1. .env.testing — forces DB_CONNECTION=sqlite and DB_DATABASE=:memory:
at the earliest bootstrap stage, before any trait setUp hook runs.
Also carries the APP_KEY and testing-safe defaults for mail/queue
/session.
2. TestCase::assertSafeTestDatabase() — a belt-and-braces guard that
aborts the whole phpunit run (exit code 2) if the resolved default
DB target is anything other than :memory: or a /testing/ or /tmp/
path. The abort happens BEFORE any query can execute.
Running the suite with a bad DB target now prints a stderr banner and
stops instantly; the dev file is safe even if someone writes a new
test that forgets to override the connection.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Seven feature tests covering:
- the per-card edit modal is gone (id="editVideoModal{slug}" and the
.cute-edit-modal class),
- owner sees Edit/Delete and no Report/Not-interested,
- non-owner sees Report/Not-interested and no Edit/Delete,
- card thumbnail img carries width/height and loading="lazy",
- feedMore returns JSON with items + next_cursor + has_more,
- feedMore rejects unknown filters by returning an empty slice,
- comments component ships the reply <template>, not inline forms.
While wiring these up I also deleted the 300-line .cute-edit-modal CSS
block that was still shipping in card-styles.blade.php even though its
markup was removed in the previous commit — the CSS was pointing at
IDs that no longer exist.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The reply form used to render ~13 lines of hidden markup under every
top-level comment, so a 50-comment video shipped roughly 650 lines of
inert DOM to every signed-in viewer. Replaced with a single
<template id="ytc-reply-form-tpl"> plus a per-comment slot div; the
first click on Reply clones the template, wires the IDs
(replyForm{id}, replyBody{id}, data-parent-id, data-video-id) and
appends it, so toggle behavior stays identical from the user's side.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Add VideoController@feedMore -> JSON { items, next_cursor, has_more }
that pages the current filter (all / shorts / match / music / lang:xx)
with Laravel's cursorPaginate(24). Cursor is stable across inserts, so
scrolling never duplicates or skips a video when something is uploaded
mid-session.
Client side: a #feed-sentinel + IntersectionObserver (rootMargin
400px) appends the next page of cards to the existing grid without a
page reload. A Load More button is always wired as the fallback when
IO is unavailable or a fetch fails. Both reuse the existing
<x-video-card/> component, so the newly fetched cards get the same
singleton edit modal + width/height thumbs as the server-rendered ones.
The initial 60-card server render stays, so the first viewport is
unchanged. The limit(60) and limit(50) caps in index() can now be
treated as "first page size" rather than a hard ceiling.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Delete the per-card "cute" edit modal (lines 242-341) and the three
dead handlers that drove it (openEditVideoModal, closeEditVideoModal,
the type/privacy/thumbnail/submit document-level delegators). The
singleton at layouts/partials/edit-video-modal.blade.php already
defines a global window.openEditVideoModal that always won the
last-definition race, so clicking Edit was already going through
the singleton. Card is 547 -> 308 lines; a 60-card feed drops
~14 000 lines of modal markup.
- "Not interested", "Don't recommend channel", "Report" are now gated
on @unless($isOwner) — they're meaningless on your own video.
- All dropdown items that were <a href="javascript:void(0)" onclick>
are now real <button type="button">, including the save-to-playlist
and share slots (tag="button").
- Thumbnail img gains width="320" height="180" so the browser reserves
layout space before the image decodes — removes layout shift on
slow connections. The actual rendered size still comes from
.yt-video-thumb's aspect-ratio: 16/9.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Seven feature tests, run against an in-memory SQLite forced via putenv
in setUp (keeps the shared dev DB safe). Covers:
- Reserved-identifier rule rejects admin / super_admin / takeone /
support / etc, matches both name and email local-part only, and
lets normal names through.
- SafeNotifier swallows a notification throw without re-raising.
- Identical comments within 60s collapse to the first row.
- X-Idempotency-Key returns the first comment on retry.
- Owner viewing their own video does not insert a video_views row.
AppServiceProvider stops force-upgrading the scheme in the testing env
so the HTTP test client isn't 302'd before reaching the controller.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Insert is skipped entirely when the authenticated viewer owns the
video. Owners re-watching, previewing an edit, or impersonating no
longer inflate their own view counts.
- Dedupe window drops 1h -> 30min for both auth and guest paths.
- Auth-path dedupe now also matches on device fingerprint / device_id
cookie, so signing out and back in during the same session doesn't
double-count a single viewer.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Collapse historical duplicate comments produced before the 60-second
dedupe guard landed. Keeps the earliest row in each cluster, reparents
nested replies onto it, moves comment_likes rows, deletes the rest.
Default --window=60 matches the server guard; --dry-run shows the plan
without touching the DB. Transactional per group so a partial failure
does not leave orphaned likes.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Server window raised from 5s to 60s so slow double-fires (observed
on /videos/CRKAf: same body saved 3-7 times, seconds to minutes
apart) collapse into one comment.
- X-Idempotency-Key honored: the client sends a per-attempt UUID; the
server caches the resulting comment id for 5 minutes under that key.
A retry with the same key returns the first-written comment without
touching the DB a second time.
- Comment and reply submit JS both send the key via fetch().
The existing _busy flag + disabled submit button already covers the
fast double-click case on the client; this hardens the server side so
duplicates can't slip through even when the client guard is bypassed.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Drop /login throttle from 10/min to 5/min per IP.
- After every failed login, count user.login.failed audit entries for
the same email in the last 10 minutes. If >=5, fire a one-shot
(cache-deduped) BruteForceLoginAlert notification to every super
admin via database + mail channels.
- Alert carries the email, originating IP, failure count and window
so the admin can decide whether to force a reset.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Resend the verification link to one user (--user=<id|email>) or every
unverified user (--all-unverified), with a --dry-run preview. Uses
User::sendEmailVerificationNotification() which is already Throwable-
guarded, so SMTP hiccups during a bulk flush log instead of aborting.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Add App\Support\SafeNotifier that wraps $notifiable->notify() in a
Throwable guard with a logged warning, so SMTP outages (the current
Gmail 535 errors) no longer propagate as a 500 to the user. Apply to
the two hot paths that were still unprotected: CommentController
(new comment, reply, like) and RegisteredUserController (super-admin
registration alert). User::sendEmailVerificationNotification() is
wrapped inline for the same reason.
Also add docs/mail-setup.md covering the three delivery options:
Gmail app password (quick), Mailgun, Postmark — with the exact .env
keys for each.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Add App\Rules\ReservedIdentifier for name + email local-part so users
cannot impersonate staff (admin, superadmin, support, root, takeone, …).
Separators are collapsed so "super_admin"/"super-admin"/"superadmin"
all match. Rule wired into RegisteredUserController@store.
email_verified_at is already absent from User::$fillable so only the
signed verification route can flip it — audited, no code change needed.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Checklist across security, performance/DOM, feeds/search/trending,
watch page, Shorts, channel/studio/live, and admin/a11y. Branch per
phase; backup tag backup/pre-audit-2026-10-21 at 5058eaf.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Three bugs made merge destructive and unrecoverable:
1. Primary-track slide paths were only prefix-swapped {sourceDir} → {targetDir}.
The promoted primary track got a NEW folder name
tracks/{lang}-{newTrackId}, but the slide filename kept the old
tracks/{lang}-{srcVideoId} segment, pointing at a folder that no longer
existed. Rewrite is now computed from the owning track's updated path, so
it survives regardless of what the stored filename used to look like.
2. Legacy-layout sources (primary audio directly at {sourceDir}/audio.ext,
slides at {sourceDir}/slides/) were silently skipped. The old code
hard-coded tracks/{lang-id}/ as the source location. Merge is now
layout-aware: it reads dirname($source->path) to pick between folder-move
(new layout) and per-file moves (legacy — audio, slides/ dir, thumb).
3. Lyrics were lost on legacy sources. {sourceDir}/lyrics/primary.json and
{sourceDir}/lyrics/track-{id}.json are now explicitly moved into the
target's per-track folders as lyrics.json, matching the new layout the
LyricsService reads from.
Added moveFile() helper (mirrors moveFolder on NAS + local, queues to
pending_nas_moves when NAS is unreachable). Verified against six scenarios
including new-layout, legacy, target-with-existing-extras, minimal, 2-extras
with slides and reversed-position lyrics source: all broken-file counts are
zero and slide position order is preserved verbatim.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Track-form unification: the "Add Language Track" dialog in the edit modal now
clones the same #um-track-form-template partial that the create modal uses, so
future tweaks to markup/CSS/behaviour show up in both flows automatically.
Added window.cloneTrackFormTemplate() + window.initTrackFormNode() as the
shared cloner+init. updateTrackCard() writes to both um-tc-*-{id} and
edit-tc-*-{id} ids so one helper serves both modals. Dropped the dead
#edit-extra-track-tpl and the custom editHandleTrackAudio (handleTrackAudio
auto-fills title identically).
Cover slides cropper fixes (both modals):
- Second batch no longer hangs. _slidesCropLoadNext now calls
openCropperModal_* BEFORE tcPreload_*; previously preloading first measured
canvas.clientWidth=0 against a display:none overlay and left _st.ready
false so Save silently returned.
- Reorder no longer loses thumbnails. Create flow stored raw Files and
spawned a FileReader per slide per render; under memory pressure some
readers failed silently. Now stores {file, url} with URL.createObjectURL
called once per slide, and renderSlidesStrip assigns img.src = url
directly. Removal revokes the URL; clear revokes everything it drops.
- Reset .value on the slides input after processing so re-selecting the
same filename still fires change.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Comments get a Translate button that calls the active LLM provider in Admin → AI
settings. Each commenter shows a small country flag inferred from their
video_views + profile_visits history (falls back to users.nationality); that
inferred country drives the language hint passed to the LLM so Portuguese
"Linda, linda, linda" translates to "Beautiful" instead of pass-through.
Description boxes get a line-paired translation grid: a shared Translate button
flips #vdbDescSplit into a two-column CSS grid where every source line sits
next to its translation on the same row. Backend splits by newline and asks
the LLM for a JSON map keyed by index so counts always match.
LlmLyricsService now has translate() + translateLines() with echo-retry (if the
model returns the input unchanged while source != target, retry once with a
stronger directive) and keeps the Ollama model resident via keep_alive=1h.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Between 992px and 1300px the left nav (240px) and the 300px side rail left
the video column under ~700px. Up Next titles collapsed into a ~124px
channel and the match About card broke its VS row apart, so a window that
was not full-screen lost information instead of reflowing.
Add one additive @media (max-width: 1300px) block per video type that fires
the SAME stacking the <=991px layout already did, just earlier: layout goes
column, video section and sidebar go full width. Match also collapses
fighters-row to 1fr and stacks the event header.
Nothing is removed. >=1301px is byte-for-byte the old desktop layout, and
the <=991px block still owns the phone treatment (thumb-on-top cards, match
review view, bottom sheet).
Verified by headless render at 1600/1360/1200/1050/960/820/700/420: no
horizontal overflow at any width, desktop unchanged, and a music video still
plays (readyState 4, stream advancing) per the match-type-only rule.
Generic could not be checked visually - there are no generic videos in the
database - but its block is identical to music's.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The point-capture and coach-review strips have a forcePause helper that
pauses the video (and re-pauses 30ms later to beat HLS.js's async
resume) whenever the slider is grabbed or scrubbed. It wasn't being
called from the frame-step buttons or the typed-timestamp commit, so
using the ± nudge to land on an exact moment while the video was
playing would happily keep the video playing and drift past the target.
Expose forcePause on both _pcbCtx and _rcbCtx and call it from:
- pcbNudge / rcbNudge (frame-step buttons)
- commitTimeInput / _rcbCommitTimeInput (typed timestamp on Enter)
- _rcbSetActiveSlot (switching start/end slot re-scrubs the video)
Playback now resumes only on an explicit play press.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Sports match share links now show the full VS composition (fighters,
flags, event, weight class, referee/court/match chips) in WhatsApp /
Telegram / Facebook / Twitter previews instead of the raw video frame.
- Browsershot + puppeteer-bundled Chromium screenshots a dedicated
1200x675 (true 16:9) render of the vs-mini composition. Chrome runs
through a small wrapper (bin/browsershot-node.sh) that raises the fd
limit and reads its full env, since PHP-FPM's stripped env otherwise
makes Chromium fail to launch.
- Render is JPEG @ q85 (~100 KB) instead of PNG (~700 KB) — WhatsApp
silently drops OG images above roughly 300 KB, which is why music
thumbnails always showed and match cards didn't.
- SportsMatchController@store/update renders synchronously so the
picture is guaranteed to exist before the user copies the share URL;
edits regenerate and old stamped variants are cleaned. The og:image
URL carries a ?v={updated_at} stamp so scrapers recache on edit.
- accessShare() (/s/{token}) now detects scraper user agents and serves
the video page HTML inline instead of a 302 — some crawlers don't
follow redirects when building link previews.
- og:description / twitter:description built from headerData(): flag
emoji + fighter names (blue vs red), event, weight, match#, court,
referee, view count, upload date.
- Fixed 3-dot menu on video cards being hidden behind the next card
(:has(.dropdown-menu.show) promotes the active card above siblings
and lifts the overflow:hidden clip on .yt-video-info).
- vs-mini: skip the entrance animation on touch devices and expose a
.vs-mini-static class so the OG render always captures the final
frame instead of a random mid-animation moment.
Also adds an admin gallery at /admin/og-previews for spot-checking the
generated preview JPEGs.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- SportsMatchController syncs Video.title with SportsMatch.title on
store/update so the "Match title" field drives the video's display
title everywhere.
- headerData(): "championship" now prefers event_name (event title)
and adds a dedicated "stage" key sourced from SportsMatch.title
(shown between the yellow lines above the weight class in both the
in-player VS overlay and the vs-mini gallery card).
- Video cards render match titles with flags + corner colours
("FINALS – 🇧🇭 Blue vs 🇧🇭 Red (-61 kg)"), matching the video
page header, and clip long titles to one line.
- Video gallery grid uses repeat(N, minmax(0, 1fr)) + grid-auto-rows:1fr
so every card thumbnail renders at exactly the same size; hover-preview
videos use object-fit:cover to stop portrait sources looking smaller.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Match player + preview
- Rebuild VS intro as a 1920×1080 scaled canvas (arena design from drafts/):
angled RED/BLUE panels with clip-paths, slam-in VS with pulse+shine,
event/stage/weight header, Match/Court/Referee chips, per-fighter
Record/Rank/Stats chip row. Every placeholder from the artifact is
always in the DOM; empty ones are hidden by `.vs-nullable:empty`
and `.vs-nullable-hide` so the layout adapts without losing the
design's HTML shape. Country codes always render as full country
names (via new App\Data\Countries::name()).
- Real-time 6s countdown Skip button; video pinned at t=0 while
the intro runs, released to play at zero or on Skip.
- Standalone preview page at /videos/{video}/vs-preview.
Video cards (home + everywhere)
- Match cards get a `vs-mini` overlay of the same arena design
(fixed canvas, per-card ResizeObserver, animations replay every
time the mouse leaves the thumb). On hover the mini explodes
outward (panels fly out, VS scales+blurs+fades) and the hover
video plays over the cleared thumb.
- Match cards also render a `scorebar-mini` overlay (verbatim of
the full-player msb-scale scorebar + msb-feed) that shows
during hover playback. Live-scoring is wired per-card via a
data-sbm-state payload of rounds+points; RED/BLUE score, round
label, per-round clock, and the top-right Live Scoring ticker
(4 entries, sport-aware Yuko/Waza-ari/Ippon or Punch/Body
kick/… labels) all update from the mini video's timeupdate.
Bug fixes
- Hover video wasn't playing sound: dropped the `muted` attribute
I'd added while debugging match previews.
- White flash strobing on the left of match cards: removed the
`.vs-mini-flash` element (intro-only flourish that fired on
every mouseleave replay).
- Sports-match modal was showing "Please complete the required
fields" when saving basic info for match videos that had no
SportsMatch row yet: the submit gate only checked matchId, not
the attached videoId; now it correctly skips uploadVideoFirst()
in both edit and attach-existing-video modes.
Country names project-wide
- New helper App\Data\Countries::name($iso2) → full country name.
- Swapped `?? country` fallbacks to `?? Countries::name(country)`
in admin dashboard, video-analytics, video-insights payloads
(VideoController + SuperAdminController), and the VS partials.
Now user-visible country labels always show "Bahrain" instead
of "BH", including chart tooltips and modal titles.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Remove max-height clamps and override portrait/square/ultrawide/theater
variants so the .ytp-wrap box shape never distorts. Portrait content
letterboxes inside the 16:9 frame via object-fit: contain.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Scoreboard scale observes #videoContainer (the .ytp inner box) instead of
#ytpWrap so the overlay tracks the squeezed container when the fullscreen
highlights drawer opens. Score bar + live-scoring feed shift left with the
video and stay fully visible next to the drawer.
- msb-small (auto-hide identity + feed under 700 px) now skipped while
document.fullscreenElement is set — the drawer squeeze on smaller viewports
was dropping the container under 700 and hiding the live feed.
- Player settings panel (#ytpSettingsPanel) is now vertical-scroll capable:
max-height: calc(100vh - 120px) + overflow-y: auto + slim on-brand
scrollbar + overscroll-behavior: contain. Top items (Mini player, Playback
speed) stay reachable when the injected Scoreboard toggles push the
list past the visible area.
- Removed the slow-mo (.slowmo-picker) 1/4x/1/2x/3/4x selector from the
match highlights tab bar.
- Disabled the scoreboard scrim (.msb-scrim { display: none }). The two
linear-gradients were tinting the top and bottom of the video for text
legibility, but every scoreboard text element already carries its own
text-shadow — the tint was showing as permanent shadows over portrait
and landscape videos alike.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Remove VS intro from player and thumbnail VS card from match video cards.
All references (`msb-vs*`, `initVsIntro`, `setVsImg`, `HAS_VS`, `$vs`,
`$msbThumbVs`, `$hasMatchMeta`) are stripped from scoreboard partials,
video-card component, and scoreboard script. Related CSS keyframes
(`msbFadeIn/Out`, `msbDriftA/B`, `msbSweep`) removed.
- Image cropper (resources/views/components/image-cropper.blade.php):
replace unreliable third-party Cropme integration with a DIY cropper.
Pan/zoom/rotate wired directly with pointer + wheel events; on save,
the visible viewport is rendered to an offscreen canvas at the configured
output-width (with circular clip for `shape="circle"`). Also reparent the
overlay to <body> on open to escape any transformed Bootstrap-modal
ancestor's stacking context that clipped it.
- Sports match modal (resources/views/layouts/partials/sports-match-modal.blade.php):
set fighter photo croppers to 3:4 portrait (285x380) to match the VS
card's 228x304 frame; club logos + referee stay 1:1 square.
- SportsMatchController::fillFromRequest (line 174): coerce
`$this->clean($request->input('media', []))` to `[]` when it returns null
so array_merge doesn't crash under PHP 8's stricter types.
- SportsMatch::headerData(): read fighter headshots + club logos from the
canonical media.* keys (participant1_photo / participant2_photo /
club1_logo / club2_logo) that the uploader modal actually saves, with the
older p1_* / p2_* names kept as a secondary fallback.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- Scoreboard overlay driven by video.currentTime (scores/ticker/timeline as pure
functions of playback time; scrub-back removes points; slow-mo doesn't affect).
- Score bar + timeline + VS intro rendered verbatim from the design handoff
(drafts/score-bar.html, drafts/vs-screen.html) — only {{ }} data holes filled.
- Fixed 1150 px design canvas scaled to any player size via ResizeObserver so
the design's pixel-perfect measurements survive at every player width.
- Gear-menu injection adds a "Scoreboard" section with 7 toggle rows (Score bar,
Live scoring feed, Match info, Point timeline, Club logos, Country flags,
Penalties) using a custom 26x14 track/knob toggle matching the design.
Persists per user in localStorage['msb_prefs']; penalties defaults off.
- VS card fades in on first play of a session (skippable by click/tap/key,
2 s hold then 0.5 s fade); skipped entirely when no athlete metadata.
- SportsMatch::headerData() extended to expose sport, headshots, club logos,
division, format, match_date and per-video scoreboard defaults from existing
JSON columns (no schema migration).
- Every missing field hides its element (no "NOT SET" placeholders); athlete
name falls back to RED/BLUE per brief.
- Pushed .replay-badge down from top:2.5cqi to top:8cqi so it clears the
new KARATE KUMITE identity block.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
