Covers Private visibility acceptance, ended-state Watch page shows
"Stream ended" (and omits the "Waiting for the broadcast" placeholder
from the connection JS), channel-name link resolves to the user's
channel URL, chat poll returns messages newer than ?since=, chat send
rejects guests (401), chat send rejects offline streams (422), and
private-stream chat 404s for non-owners.
Also broadens LiveStream::isWatchableBy to keep public/unlisted
streams permalinked after they end — viewers now see the Stream Ended
card and the Watch Replay CTA instead of a hard 404.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Ten tests spanning the eight commits in this branch:
- Player end-screen markup present (overlay + ring + cancel hooks).
- C hotkey binds to #ytpLyricsBtn in the player keydown handler.
- Guest Subscribe button carries ?intended= and encodeURIComponent.
- /@handle/videos 302s to the hash URL; nonsense tabs 404.
- /channel/{username}/videos/more returns a cursor-paginated JSON
payload with items + next_cursor + has_more.
- /studio redirects anonymous visitors to login.
- /studio renders only the signed-in user's videos.
- Studio bulk visibility + bulk delete scope updates to Auth::id().
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Three features that depend on the two additive migrations shipped in
the same commit (safe defaults, cascading foreign keys, no data loss
possible).
## Dislike button
- New video_dislikes table (migration 2026_10_21_000001) with the same
shape as video_likes.
- Video model: dislikes() relation + isDislikedBy() / getDislikeCount
Attribute() helpers mirroring the like pair.
- UserController@toggleDislike: endpoint behind POST
/videos/{video}/toggle-dislike. Mutually exclusive with like — the
toggle*Like / toggle*Dislike controllers detach the opposite state
so a user is in exactly one of {liked, disliked, neither}. YouTube
parity.
- video-actions component: a second thumbs-down button next to the
existing like. Both reconcile in parallel on either response so the
UI pair always reflects the authoritative server state.
## Creator heart + pin
- comments table gains hearted + pinned boolean columns (migration
2026_10_21_000002, both default false, pinned is indexed).
- CommentController@heart + @pin: 403 for anyone but the video owner;
pin() also rejects nested replies (422) and auto-unpins the
previously-pinned top-level comment so the "at most one pinned"
invariant is enforced at the DB level.
- Comment component:
- Pinned comments render ahead of everything else; reorder()
clears the comments() relation's default ->latest() so pinned
DESC becomes the PRIMARY sort instead of a tiebreaker.
- Creator sees heart + pin toggle buttons in the action bar.
- Hearted comments carry a small red heart badge in the meta row.
- Pinned comments carry a "Pinned by {creator}" header and a
red left accent so they're visually distinct from the stream.
## Tests (9 new, 63 total)
- Dislike toggle adds/removes the row.
- Disliking clears an existing like and vice versa.
- Owner can heart; non-owner gets 403.
- Only one comment pinned at a time; replies can't be pinned (422);
non-owner gets 403.
- Pinned comments render before newer unpinned ones.
## Deploy note
Running the migrations against the live DB needs:
php artisan migrate
The two migration files are additive and reversible via `migrate:rollback`.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Four tests covering the post-audit polish commits:
- Match watch page renders the shared .channel-row component.
- Reply-to-reply button carries data-parent-id and data-handle so the
JS can prefill "@author " when the parent reply form opens.
- liked() controller returns a CursorPaginator instance (controller
introspection — avoids a 400 KB view render per assertion).
- video-player component ships the ">" / "<" playback-rate hotkey.
Also cleans up a stale ->onEachSide()->links() call in user/liked.blade
that would blow up now that the controller returns a CursorPaginator
(which doesn't support onEachSide).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Four tests covering the admin polish follow-ups to Phase 7:
- Pagination partial renders both First and Last anchors with the
correct aria-labels and page URLs on a middle-page view.
- Pagination partial degrades to a disabled First span on page 1 so
the admin can't click into an invalid negative page.
- Admin video list strips HTML tags from the description preview
(no "<p>Hello" leaking into the row) and carries the full
title in a title="" tooltip on the ellipsized columns.
- Dashboard stat card now shows "Ready" instead of the misleading
"Live Videos" label the Phase 7 commit renamed.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
ExampleTest hit GET / expecting 200, but had no RefreshDatabase trait,
so the home controller's Video::public()->pluck('id') query hit a
non-existent `videos` table in the testing DB and 500'd. It's been
failing since Phase 1 but was always flagged as "pre-existing,
unrelated" because the test file isn't touched by any audit code.
Now mirrors the Phase-test setup: putenv forces :memory: before
parent::setUp, RefreshDatabase migrates the throwaway DB, and the
assertion passes against an empty home feed. 46/46 green.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Six tests covering:
- Skip-to-content link renders on the home page with href="#main".
- Hamburger menu + mobile search toggle buttons carry aria-label
attributes (regression test for icon-only buttons losing their
accessible name).
- Registration is server-side rejected with a birthday error when
the user is under 13; a 14-year-old passes.
- Gender select on channel settings uses "Select…" for the empty
value instead of a second "Prefer not to say".
- Unknown URL returns 404 with the branded body ("Error 404").
The <title> format test for the 404 page is captured in the deploy
checklist instead of here because the exception handler in the
testing env bypasses layouts.app's head and makes the DOM-level
<title> assertion unreliable; curl -I against /no-such on the live
site confirms "Page not found | TAKEONE".
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Also tightens stat/post-video rendering so "0" prints as "0" and not
"0.0" (Number::abbreviate(0, precision: 1) stringifies as "0.0", which
leaked into the About tab's Total Views card and post-video badges).
Four tests covering:
- /@username opens the matching channel.
- /@invalid url (space) 404s.
- Owner view shows id="postForm"; preview?preview=1 hides it.
- Zero-view playlist doesn't render "bi-eye … 0.0"; "1 videos" never
renders in place of "1 video".
Fixed a Blade dupe-declaration fatal that only fired in feature tests
(two requests in one PHP process would redeclare notifVal()). Guarded
with function_exists.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Five tests:
- /shorts/{id} renders the vertical feed with data-id matching the
target short and includes the scrollIntoView bootstrap.
- /shorts/{id} 404s when the id resolves to a non-short video.
- Home page shows .home-shorts-shelf when at least one short exists,
with a link to /shorts/{id} for every shelf card.
- Home page omits the shelf entirely when no shorts exist.
- An unknown URL returns 404 with the branded view, not the bare
framework stacktrace.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
- All three type-specific watch templates (generic / music / match)
were still rendering the Up Next list as <div onclick="recGoTo(...)">
— only show.blade.php had been converted in the earlier commit.
Convert each to <a href> so middle-click / right-click / cmd-click
open-in-new-tab work, keeping the SPA swap on normal left-click via
an onclick guard that lets modified clicks fall through.
- 9 feature tests covering: singular/plural comment counts, top-level
vs reply separation, ?lc= permalink HREFs, markdown header
promotion in HtmlSanitizer::render(), passthrough of plain text,
download access gate for both MP4 and MP3 at disabled + registered
tiers, and sidebar anchor-card presence.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Six feature tests:
- Trending accepts hours=24|168|720, snaps garbage input to 24.
- Trending ranks by in-window views then likes; videos with zero
in-window views are dropped.
- Music feed opens on the newest video (regression test for the
skipped-->latest() call in VideoController@index).
- Old /videos/search?q=... returns a 301 to /search?q=...
- /search matches on video title, channel name, and playlist name
separately; each surfaces in its own Section.
- Empty /search?q= redirects to /videos browse.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Seven feature tests covering:
- the per-card edit modal is gone (id="editVideoModal{slug}" and the
.cute-edit-modal class),
- owner sees Edit/Delete and no Report/Not-interested,
- non-owner sees Report/Not-interested and no Edit/Delete,
- card thumbnail img carries width/height and loading="lazy",
- feedMore returns JSON with items + next_cursor + has_more,
- feedMore rejects unknown filters by returning an empty slice,
- comments component ships the reply <template>, not inline forms.
While wiring these up I also deleted the 300-line .cute-edit-modal CSS
block that was still shipping in card-styles.blade.php even though its
markup was removed in the previous commit — the CSS was pointing at
IDs that no longer exist.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Seven feature tests, run against an in-memory SQLite forced via putenv
in setUp (keeps the shared dev DB safe). Covers:
- Reserved-identifier rule rejects admin / super_admin / takeone /
support / etc, matches both name and email local-part only, and
lets normal names through.
- SafeNotifier swallows a notification throw without re-raising.
- Identical comments within 60s collapse to the first row.
- X-Idempotency-Key returns the first comment on retry.
- Owner viewing their own video does not insert a video_views row.
AppServiceProvider stops force-upgrading the scheme in the testing env
so the HTTP test client isn't 302'd before reaching the controller.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
