Files

T

sulthan c62c3bb07b chore: drop asuracomic.net from the userscript, CORS allowlist and docs (#97 )

Closes #96.

## What

Removes every reference that still invites a Reader onto `asuracomic.net`.
The domain's deep links 301 to the `asurascans.com` **root**, discarding the
path (re-checked 2026-07-25), so a page on it never yields a series document
client-side and a stored address on it never yields a series page server-side.
#95 already pinned each Site to one hostname, so the backend rejects such an
address cleanly; this is the cleanup around that.

| File | Change |
|---|---|
| `userscript/manga-bookmark.user.js` | drops the `@match`, narrows the asura adapter to `/(^\|\.)asurascans\.com$/` |
| `userscript/test/logic.test.js` | new test pinning the narrowed host match |
| `.env.example`, `docker-compose.yml` | origin dropped from the `ALLOWED_ORIGINS` default |
| `DEPLOY.md` | same, and the sample list gains the two novel origins it was missing |
| `backend/api_test.go` | CORS fixtures and round-trip seed move to `asurascans.com` |
| `README.md`, `AGENTS.md` | notes say the host is dropped, not "stays matched" |

## Behaviour

- A Reader landing on `asuracomic.net` gets no userscript UI. Previously the
  script loaded and could do nothing useful — the redirect had already
  discarded the path.
- A request whose `Origin` is `https://asuracomic.net` is no longer reflected
  by a deployment using the shipped defaults.
- No backend logic changed: the CORS rule, the address gate and the poller are
  untouched. `AllowedOrigins` is data, not code.

## Security invariant preserved

CORS still reflects `Origin` only when it appears in `ALLOWED_ORIGINS`, with
`GET,PUT,DELETE,OPTIONS` and a `204` preflight — `TestCORSPreflight` and
`TestCORSDisallowedOrigin` still pin both halves, now against a live origin.
This change only removes a value from the allowlist, which is a narrowing.

## Verification

- `go test ./...` — full backend suite green (real Postgres per package).
- `node --test test/*.test.js` — 66/66 green, up one from the new match test.

## Deploy note (does not happen on merge)

The live allowlist comes from the VPS `.env`, not from these defaults, so the
origin must be dropped there in the same deploy. The one-off row repair for any
stored `asuracomic.net` address is in #96.

Reviewed-on: #97
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

2026-08-12 05:53:17 +07:00

37 KiB

Raw Blame History

Graph Report - mangaBookmark (2026-08-12)

Corpus Check

110 files · ~267,791 words
Verdict: corpus is large enough that graph structure adds value.

Summary

1621 nodes · 3242 edges · 233 communities (63 shown, 170 thin omitted)
Extraction: 90% EXTRACTED · 10% INFERRED · 0% AMBIGUOUS · INFERRED: 312 edges (avg confidence: 0.77)
Token cost: 0 input · 0 output

Graph Freshness

Built from commit: 8ae98816
Run git rev-parse HEAD and compare to check if the graph is stale.
Run graphify update . after code changes (no API cost).

God Nodes (most connected - your core abstractions)

testConfig() - 53 edges
newWebTestServer() - 49 edges
newTestStore() - 42 edges
newTestStore() - 41 edges
e() - 33 edges
Handler - 29 edges
ne() - 28 edges
De() - 28 edges
Open() - 27 edges
se() - 27 edges

Surprising Connections (you probably didn't know these)

Browser Sidecar Service --semantically_similar_to--> Browser Sidecar (BROWSER_WS_URL) [INFERRED] [semantically similar] chrome/docker-compose.yml → backend/AGENTS.md
el() --indirect_call--> c() [INFERRED] userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js
el() --indirect_call--> c() [INFERRED] userscript/novel-bookmark.user.js → backend/internal/web/static/htmx.min.js
latestChapterFromAnchors() --indirect_call--> re() [INFERRED] userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js
el() --indirect_call--> k() [INFERRED] userscript/manga-bookmark.user.js → backend/internal/web/static/htmx.min.js

Import Cycles

None detected.

Hyperedges (group relationships)

Batch Ticket Implementation Pipeline — _claude_skills_implement_tickets_skill_implement_tickets, _omp_agents_ticket_implementer_ticket_implementer, _omp_agents_ticket_implementer_cr_spec, _omp_agents_ticket_implementer_cr_standards [INFERRED 0.85]
Subagent-Driven Development Pipeline — _opencode_agent_implementer_implementer, _opencode_agent_reviewer_reviewer, _opencode_agent_implementer_subagent_driven_development [INFERRED 0.85]
Go HTML Template Family — backend_internal_web_templates_app_doc, backend_internal_web_templates_card_doc, backend_internal_web_templates_list_doc, backend_internal_web_templates_chrome_doc, backend_internal_web_templates_login_doc, backend_internal_web_templates_setup_doc, backend_internal_web_templates_readers_doc, backend_internal_web_templates_icons_doc [INFERRED 0.95]
htmx Fragment Swap Flow — backend_internal_web_templates_app_doc, backend_internal_web_templates_card_doc, backend_internal_web_templates_chrome_doc, backend_internal_web_templates_setup_doc, backend_internal_web_templates_readers_doc [INFERRED 0.95]
Backend owns the truth (single-writer ownership of shared facts) — docs_adr_0003_series_shared_and_poll_owned_poll_owned_writes, docs_adr_0004_wire_format_does_not_mirror_the_schema_flat_wire_contract, docs_adr_0007_backend_hosts_cover_bytes_server_side_covers [INFERRED 0.85]
Headless browser infrastructure (sidecar, on-demand, home deployment) — docs_adr_0005_on_demand_browser_headless_shell, docs_adr_0005_on_demand_browser_cdp, docs_adr_0005_on_demand_browser_on_demand_start, docs_adr_0006_browser_on_the_home_machine_home_machine_rationale [INFERRED 0.85]
lightnovelworld series-identity investigation and fix — docs_research_lightnovelworld_chapter_vs_series_slug_issue_77, docs_research_lightnovelworld_chapter_vs_series_slug_unscoped_regex, docs_adr_0008_series_identity_is_discovered_not_derived_discovered_identity [INFERRED 0.85]

Communities (233 total, 170 thin omitted)

Community 0 - "HTMX Library Internals"

Cohesion: 0.08 Nodes (101): A(), ae(), an(), at(), B(), be(), bn(), bt() (+93 more)

Community 1 - "Cover Fetch Test Helpers"

Cohesion: 0.10 Nodes (84): floatPtr(), testConfig(), getCover(), Cookie, Handler, ResponseRecorder, T, TestListRendersAcquiredCover() (+76 more)

Community 2 - "Manga Userscript Adapters"

Cohesion: 0.06 Nodes (76): adapterFor(), anchorsFromDocument(), anchorsFromHTML(), apiDelete(), apiGet(), apiPut(), applyFabPos(), applyLatestChapterIfChanged() (+68 more)

Community 3 - "Novel Userscript Adapters"

Cohesion: 0.06 Nodes (79): adapterFor(), anchorsFromDocument(), anchorsFromHTML(), apiDelete(), apiGet(), apiPut(), applyFabPos(), applyLatestChapterIfChanged() (+71 more)

Community 4 - "Series Acquisition Tests"

Cohesion: 0.10 Nodes (67): bookmarkNewKaganeSeries(), bookmarkNewNovelfullSeries(), bookmarkNewSeries(), Context, Store, T, newAcquirer(), readBookmark() (+59 more)

Community 5 - "Bookmarks API Tests"

Cohesion: 0.08 Nodes (67): auth(), getBookmarks(), Handler, Request, Store, T, newTestServer(), newTestStore() (+59 more)

Community 7 - "Cover & Acquire Internals"

Cohesion: 0.09 Nodes (31): Addr, Context, Store, defaultCoverResolver(), fetchCoverBytes(), Client, Context, NewCoverFetcher() (+23 more)

Community 8 - "System Architecture Concepts"

Cohesion: 0.10 Nodes (26): Confirm-Gated Destructive Actions, Discord OAuth & Guild-Membership Gate, Lifecycle Buckets (reading/archived/finished), Reader-Owned Store, HMAC-Derived Reader Credentials, Web Package (Browser UI + Templates), app.html — App Shell Template, Manga/Novel Library Switch (+18 more)

Community 9 - "Session Middleware"

Cohesion: 0.07 Nodes (35): ClearCookie(), ClientIP(), Duration, Mutex, Request, ResponseWriter, Time, isHTTPS() (+27 more)

Community 10 - "Go Test Helpers"

Cohesion: 0.05 Nodes (39): Test Helpers, Test Timeout, Basic Handler Test, HTTP Handler Testing, Query Parameters and Headers, Docker Compose Fixture, Integration Testing, SQL Schema Fixture (+31 more)

Community 11 - "Store Tests"

Cohesion: 0.07 Nodes (79): M, TestMain(), M, TestMain(), M, Main(), start(), URL() (+71 more)

Community 12 - "Bookmarks API Handler"

Cohesion: 0.08 Nodes (33): Handler, Request, ResponseWriter, Store, Healthz(), writeJSON(), Auth(), compressible() (+25 more)

Community 13 - "Web UI Handlers"

Cohesion: 0.06 Nodes (24): coverRelativePath(), coverSourceAddress(), displayChapter(), Store, currentLib(), currentTab(), filterBookmarks(), Client (+16 more)

Community 14 - "Go Error Handling"

Cohesion: 0.06 Nodes (33): Creating Errors, Custom Error Types, Custom types that wrap other errors, Decision table: which error strategy to use, Error Creation, Error String Conventions, Errors as Values, errors.New — static error messages (+25 more)

Community 15 - "CDP Browser Client"

Cohesion: 0.08 Nodes (31): awaitPromise(), browserConnectionLost(), classifyBrowserError(), Action, Context, Mutex, jsString(), kaganeAPIURL() (+23 more)

Community 17 - "Go Code Style Guide"

Cohesion: 0.08 Nodes (23): Code Style Details, Extract Complex Conditions, Value vs Pointer Arguments, Code Organization Within Files, Complex Conditions & Init Scope, Composite Literals, Control Flow, Cross-References (+15 more)

Community 20 - "I/O Performance Patterns"

Cohesion: 0.11 Nodes (18): Avoid io.ReadAll for large payloads, Batch Operations, Buffered I/O, Cgo Overhead, Channel: batch processing from a stream, Concurrent Multi-Stage Pipelines, Connection pooling, Database: batch inserts over row-by-row (+10 more)

Community 21 - "CPU Optimization"

Cohesion: 0.13 Nodes (15): Cache Locality, Contiguous 2D allocation, CPU Optimization, False Sharing, Function Inlining, Handling CPU-specific instruction sets, Instruction-Level Parallelism, Monotonic Time (+7 more)

Community 22 - "Caching Patterns"

Cohesion: 0.13 Nodes (14): Algorithmic Complexity, Avoid iterator chains, Caching Patterns, Compiled Pattern Caching, Early returns and short-circuit loops, LRU caches, Map lookups over slice scanning, Precomputed lookup tables (+6 more)

Community 23 - "Browser Entrypoint"

Cohesion: 0.35 Nodes (14): browser_alive(), connection(), connection_signal(), finish_connection(), has_connections(), lock(), reaper(), entrypoint.sh script (+6 more)

Community 24 - "Memory Allocation & GC"

Cohesion: 0.13 Nodes (15): Allocation Rate Reduction, Ballast pattern (pre-Go 1.19), Garbage Collector Tuning, GC pacing, GC Profiling and Diagnostics, GODEBUG=gctrace=1, GOGC (default: 100), GOMAXPROCS in Containers (+7 more)

Community 25 - "Cover Fetcher Tests"

Cohesion: 0.33 Nodes (12): coverResponse(), Request, T, TestCoverFetcherCanonicalisesJpgAlias(), TestCoverFetcherFetchesPublicHTTPSImage(), TestCoverFetcherRefusesUnsafeDestinationsBeforeRequest(), TestCoverFetcherRejectsNonImage(), TestCoverFetcherRejectsOversizedBody() (+4 more)

Community 26 - "readSeries"

Cohesion: 0.13 Nodes (28): asuraLatestChapter(), browserOnlyCoverURL(), comixCoverEntry(), comixCoverURL(), comixLatestChapter(), comixSeriesID(), coverFrom(), demonicLatestChapter() (+20 more)

Community 27 - "Find Skills Guide"

Cohesion: 0.14 Nodes (13): Common Skill Categories, Find Skills, How to Help Users Find Skills, Step 1: Understand What They Need, Step 2: Check the Leaderboard First, Step 3: Search for Skills, Step 4: Verify Quality Before Recommending, Step 5: Present Options to the User (+5 more)

Community 28 - "Allocation Patterns"

Cohesion: 0.14 Nodes (14): Allocation Patterns, Backing Array Leaks, Direct indexing vs append, Eliminate redundant map lookups, Interface boxing, Map never shrinks, Map size hints, Memory Optimization (+6 more)

Community 29 - "Observability & Alerting"

Cohesion: 0.22 Nodes (9): Alerting rules (examples), CPU saturation, GC pressure, Goroutine leaks, Grafana Dashboards, Memory leaks, Prometheus Metrics for Go, PromQL Queries for Performance Diagnosis (+1 more)

Community 31 - "Memory Layout"

Cohesion: 0.40 Nodes (5): Map of pointers for large, frequently updated structs, Memory Layout, Pointer receivers for large structs, Struct field alignment, Zero-size field at end of struct

Community 33 - "Go Testing Guide"

Cohesion: 0.20 Nodes (10): CI Regression Detection, Common Mistakes, Core Philosophy, Cross-References, Decision Tree: Where Is Time Spent?, Deep Dives, Go Performance Optimization, Iterative Optimization Methodology (+2 more)

Community 34 - "Session Store"

Cohesion: 0.28 Nodes (4): Duration, Store, Time, Session

Community 35 - "Web UI Filter Logic"

Cohesion: 0.31 Nodes (5): closeCardPanels(), setActiveTab(), toggleChapterForm(), toggleConfirmRow(), togglePanel()

Community 37 - "Product & Security Context"

Cohesion: 0.17 Nodes (11): Accessibility & Inclusion, Brand Commitments, Capabilities and Constraints, Evidence on Hand, Operating Context, Platform, Positioning, Product (+3 more)

Community 38 - "novel-logic.test.js"

Cohesion: 0.33 Nodes (5): ADR-0009: A Site answers fixed questions; an unusual Site owns its own fetch, Consequences, Considered options, Decision, Why

Community 39 - "UI Critique 2026-07-26A"

Cohesion: 0.29 Nodes (6): Design Health Score, Design Specificity Verdict, Minor Observations, Persona Red Flags, Priority Issues, Questions to Consider

Community 40 - "UI Critique 2026-07-26B"

Cohesion: 0.29 Nodes (6): Design Health Score, Design Specificity Verdict, Minor Observations, Persona Red Flags, Priority Issues, Questions to Consider

Community 45 - "Go Perf Alert Rules"

Cohesion: 0.50 Nodes (4): Prometheus Alerting Rules (Go Performance), GoroutineLeak Alert, HighGCPauseTime Alert, MemoryNearLimit Alert

Community 46 - "Userscript Display Logic"

Cohesion: 0.07 Nodes (27): 1. Summary answer table, 2. The two reference pages, 3. Chapter page → series URL: every in-page pointer, in priority order, 4.1 Sample method, 4.2 Divergence results, 4.3 Is there a derivable rule? No., 4.4 The split case — a slug can change mid-series, 4. The reverse direction, and how common divergence is (+19 more)

Community 47 - "Go Perf Skill Docs"

Cohesion: 0.22 Nodes (5): Continuous Profiling, Production Observability for Performance, Pyroscope pull mode (via Grafana Alloy), Pyroscope push mode, Real-Time Visualization (Development)

Cohesion: 0.67 Nodes (3): Fantasy Sword, Fiery Volcanic Scene, Login Art: Sword in Volcanic Rock

Community 49 - "BookmarkManager Logo"

Cohesion: 1.00 Nodes (3): Mirrored Double Bookmark Mark, Ember Flame Accent, BookmarkManager Logo

Community 103 - "bookmark-api Service"

Cohesion: 0.24 Nodes (10): Backend Go Service (stdlib net/http), Browser Sidecar (BROWSER_WS_URL), Browser Sidecar Service, CDP Endpoint (Tailnet-Bound :9222), Persistent Chrome Profile Volume, chrome/docker-compose.yml — Browser Deployable Unit, bookmark-api Prod Override, CDP Never on Shared Proxy Network (+2 more)

Community 104 - "AGENTS.md"

Cohesion: 0.12 Nodes (14): Agent skills, Architecture, Commands, Comments, Design system, Domain docs, Forge: Gitea, not GitHub, graphify (+6 more)

Community 105 - "reviewer.md"

Cohesion: 0.12 Nodes (15): Assessment, Calibration, Critical (Must Fix), Do Not Trust the Report, Important (Should Fix), Inputs, Issues, Method (+7 more)

Community 106 - "Redeploy runbook"

Cohesion: 0.12 Nodes (15): 0. Preflight, 1. Back up the database, 2. Pull the new code, 3. Rebuild and restart, 4. Verify the deploy, 5. Smoke-test the full loop, 6. Rollback, 7. The whole thing, as one block (+7 more)

Community 107 - "1. Backend"

Cohesion: 0.13 Nodes (14): 1. Backend, 2. Userscript, Adapter reference (verified live 2026-07-24), Config (env), Deploy behind your reverse proxy, Desktop iteration (optional), Develop / test, Endpoints (+6 more)

Community 108 - "Deployment"

Cohesion: 0.14 Nodes (13): 0. Prerequisites, 1. Configure .env, 1b. Web UI, 2. Build + start, 3. Verify over HTTPS, 4. Configure the userscript, 5. Install on Bromite, 6. Smoke-test the full loop (+5 more)

Community 109 - "Cinder — BookmarkManager design system"

Cohesion: 0.20 Nodes (9): 1. The one idea, 2. Tokens, 3. Type, 4. Components (web UI), 5. Components (userscript panel), 6. Motion, 7. Accessibility floor (not negotiable), 8. Adding something new — checklist (+1 more)

Community 110 - "Implement tickets"

Cohesion: 0.22 Nodes (8): 1. Collect the tickets, 2. Plan the batch, 3. Get the plan approved, 4. Run a wave, 5. Land the wave, 6. Close the batch, Implement tickets, Ticket # —

37 KiB Raw Blame History