After an unlink in Auth, or when a verified link took the ID away, the
nightly job kept syncing the old Steam ID for up to 14 days. A
games-count request without a steamId claim now clears user_seen_at.
steam_id stays, so a later link with another ID still soft-deletes the
old games.
The picker takes mood=SPEEDRUN for backlog games with a speedrun.com
game that has at least one verified run. The game detail returns the
link as speedrunUrl.
speedrun.com has no Steam or IGDB link, so games are matched by name
and, when IGDB knows it, by release year (one year off at most). One
queue serves all users at 1 request per second. Results are kept 30
days in game_speedrun.
Core reads the login token from the tbp_access cookie or a Bearer
header, whichever verifies, and parses it once per request. Unsafe
requests need an X-TBP-Client or Authorization header, CORS allows
only the exact frontend origin, and a missing or expired token
answers 401 instead of 403.
Core finds the key by the token kid and loads the JWKS again for an
unknown kid, at most every 10 s. JWT_PUBLIC_KEY is used only until the
first JWKS load works, so a key removed from the JWKS cannot verify
later. While that key still works, requests do not wait for a slow
Auth.
Achievements were fetched only when a game detail page was opened, and a Steam error was stored as "no achievements" or "hidden". A background run after each library sync now fetches schemas and the unlocks of games with new playtime, one Steam call per second for all runs together, and never overwrites stored data on a Steam error. Adds GET /api/library/achievements/summary, achievement counts on GameDto and the public profile, and migration V7 (playtime_at_refresh).
GET /api/library/picker returns random backlog games for a time budget, HIGH priority first. PUT /games/{appid}/status changes only the status, so the picker does not need the game detail (and its Steam calls) to keep rating, notes and priority.
GET /api/public/profiles/library with X-Profile-Ticket returns totals, status
counts, playing and finished games with rating; never notes, priority or the
Steam ID. Login filters reject the ticket, and Core keeps no copy of the
privacy flag.
Captures the Core slices of the cross-service product roadmap: per-game
tracking schema (status, rating, notes, completion date), picker
endpoint, HLTB integration, achievement aggregation, goals + digest
data, wishlist + sale alerts, library enrichment, and public profile
data. Cross-links to the umbrella roadmap in ToBePlayed-Deployment.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move steam_adapter sources from domain.* to modules.* and rename controller package to api. Update package declarations and imports across SteamTestController, SteamPlayerSummaryResponse, SteamClientConfig, and SteamApiService. Update README to re-label Controller -> API layer and Domain -> Business layer and adjust wording about layer boundaries. Also normalize file endings/newlines in several Java files. No functional logic changes were made.
Add project bootstrap for build, CI/CD, and local development. Introduces Maven Wrapper (mvnw, mvnw.cmd, .mvn/wrapper), multi-stage Dockerfile, docker-compose files (compose.yaml, docker-compose.dev.yml), .env, banner and README. Adds Gitea Actions workflow to build, test and push container images. Update application.yml (port -> 8090, virtual threads, API versioning, management/actuator/prometheus settings, Steam API config) and add application-dev.yml for local overrides. Extend pom.xml with caching, observability (actuator, micrometer/prometheus), testing/dev dependencies (testcontainers, devtools, additional spring test modules) to support CI and local testing.
lobo
Andreas Dahm