nginx.conf is now an nginx template, so connect-src takes
AUTH_HOST and API_HOST from the container env. The image
sets both to empty by default, so nginx still starts
without them. Report-only until production shows no
violation. Also nosniff, Referrer-Policy and
Permissions-Policy.
Manifest, gamepad icon (also the new favicon, instead of
the Vite logo), iOS meta tags and the tab title
ToBePlayed. No service worker, so a deploy never meets
an old cached bundle. The title bar color follows
light and dark mode. The README also lists adding a
game by name.
The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.
Captures the Frontend UX slices of the cross-service product roadmap:
backlog tracking UI (status chips, filter bar, drag-reorder, game
detail), "what to play next" page, achievement views, public profile
route, friends + compare-backlogs, PWA / mobile, and UX details
(search, optimistic updates, keyboard shortcuts, empty states).
Cross-links to the umbrella roadmap in ToBePlayed-Deployment.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
lobo
