getLists() returned the common list via MAX(id) grouped across both
users' rows, so the id handed back could belong to either partner.
remove()/markWatched() scope by (id, user_id), so whenever it picked
the partner's id, the query silently matched zero rows while still
reporting success.
Now each user's own is_common=1 rows are returned directly, so the id
is always theirs. Also fixes the frontend never recognizing common
movies as "already added" (see watchgether-web).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
watchgether-web has no PHP runtime of its own (static files served by
a plain nginx container), so it reuses this repo's PHP/nginx to receive
its Gitea webhook and git-pull the separate watchgether-web checkout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
UserController::login() always echoed a generic "wrong credentials"
message on failure, discarding whatever User::login() returned - so a
locked-out account got the same message as a plain typo, with no way
to tell the user to wait instead of retrying immediately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- User::login() locks an account for 15 min after 5 failed attempts
- CORS now restricted to an explicit origin whitelist instead of *
- display_errors disabled in production (errors still logged server-side)
- webhook.php now checks Gitea's actual signature header (X-Gitea-Signature,
raw hex) instead of GitHub's format, which never matched on this Gitea instance
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add missing MovieController::remove/markWatched (routes called undefined methods)
- Fix linkPartner(): commit() was unreachable after an early return, so partner
linking was never actually persisted in the DB
- Add missing removeMovie/markWatched functions in app.js
- webhook.php now verifies a GitHub HMAC signature before running git reset --hard
- Move TMDB API key server-side via a new TmdbController proxy (tmdb-search/tmdb-details)
instead of exposing it in client-side JS
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Whykioh
Noah