mirror of
https://github.com/PR0M3TH3AN/VoxVera.git
synced 2026-10-27 09:40:40 +00:00
thePR0M3TH3ANandClaude Opus 4.8
82126d52d6
A flyer could appear on the bulletin board yet fail to open in the viewer. Two causes, both fixed so "if the board shows it, the viewer opens it": - Over-strict view validation. The viewer ran the *authoring* validatePayload on fetched events (in payloadFromEvent and normalizePayload) and threw on length caps, a raw-HTML regex that false-positives on plain text like "value < x >", version, and URL scheme — refusing to render. The renderer already HTML-escapes every field, so the view path is now lenient: it renders what was published and only neutralizes unsafe URL schemes (javascript:/data: become no-link instead of throwing). Strict validation still gates authoring via buildPayloadFromForm, so we never publish junk. The mandatory t=flyer tag is dropped (t=voxvera + a voxvera_flyer payload is enough), matching the board. - Fragile fetch. fetchReplaceable relied on the relay honoring an addressable "#d" tag filter; some relays don't, yet still return the event for a broader query (which is how the board finds it). It now queries by author+kind and matches the d-tag in-page, with a longer timeout. Tests: a fetched flyer with HTML-ish text + a 6k body + a javascript: URL now renders with the URL neutralized; and a flyer served by a relay that refuses "#d" filters still resolves. 180 e2e across all six engines. Co-Authored-By: Claude Opus 4.8 <[email protected]>