[3.2] - 2025-01

Backend

Features

• Added WebAuthn Passkey passwordless login support
  • Register, authenticate, and manage Passkey credentials
  • Multi-device credential backup detection (iCloud Keychain, etc.)
  • Clone attack protection (sign_count verification)
  • Authentication strategy pattern unifying password and Passkey login interfaces
• Added first-run setup wizard
  • 7-step guided configuration: account, downloader, RSS source, media path, notifications
  • Downloader connection test, RSS source validation
  • Optional steps can be skipped and configured later in settings
  • Sentinel file mechanism (config/.setup_complete) prevents re-triggering
  • Unauthenticated setup API (only available on first run, returns 403 after completion)
• Added calendar view with Bangumi.tv broadcast schedule integration
• Added downloader API and management interface
• Full async migration
  • Database layer async support (aiosqlite) for non-blocking I/O in Passkey operations
  • UserDatabase supports both sync/async modes for backward compatibility
  • Database context manager supports both with (sync) and async with (async)
  • RSS engine, downloader, checker, and parser fully converted to async
  • Network requests migrated from requests to httpx (AsyncClient)
• Backend migrated to uv package manager (pyproject.toml + uv.lock)
• Server startup uses background tasks to avoid blocking (fixes #891, #929)

Changes

• Upgraded WebAuthn dependency to py_webauthn 2.7.0
• _get_webauthn_from_request prioritizes browser Origin header, fixing verification issues in cross-port development environments
• auth_user and update_user_info converted to async functions
• TitleParser.tmdb_parser converted to async function
• RSSEngine methods fully async (pull_rss, refresh_rss, download_bangumi, add_rss)
• Checker.check_downloader converted to async function
• ProgramStatus migrated from threading to asyncio (Event, Lock)

Bugfixes

• Fixed aaguid type error (now str in py_webauthn 2.7.0, no longer bytes)
• Fixed missing credential_backup_eligible field (replaced with credential_device_type)
• Fixed verify_authentication_response receiving invalid credential_id parameter causing TypeError
• Fixed program startup blocking the server (fixes #891, #929, #886, #917, #946)
• Fixed search interface export not matching component expectations
• Fixed poster endpoint path check incorrectly intercepting all requests (fixes #933, #934)
• Fixed OpenAI parser security issue
• Fixed database tests using async sessions with sync code mismatch
• Fixed config field conflicts when upgrading from 3.1.x to 3.2 causing settings loss (fixes #956)
  • program.sleep_time / program.times auto-migrated to rss_time / rename_time
  • Removed deprecated rss_parser fields (type, custom_url, token, enable_tmdb)
  • Fixed ENV_TO_ATTR environment variable mapping pointing to non-existent model fields
  • Fixed DEFAULT_SETTINGS inconsistency with current config model
• Fixed version upgrade migration logic errors (all upgrades calling 3.0→3.1 migration)
  • Added version-aware migration dispatch based on source version
  • Added from_31_to_32() migration function for database schema changes

Frontend

Features

• Complete UI design system redesign
  • Unified design tokens (colors, fonts, spacing, shadows, animations)
  • Light/dark theme toggle support
  • Comprehensive accessibility support (ARIA, keyboard navigation, focus management)
  • Responsive layout for mobile devices
• Added first-run setup wizard page
  • Multi-step wizard component (progress bar + step navigation)
  • Route guard auto-detection and redirect to setup page
  • Downloader/RSS/notification connection test feedback
  • Chinese and English i18n support
• Added Passkey management panel (settings page)
  • WebAuthn browser support detection
  • Automatic device name identification
  • Passkey list display and deletion
• Added Passkey fingerprint login button on login page
• Added calendar view page
• Added downloader management page
• Added Bangumi card hover overlay (showing title and tags)
• Added resolvePosterUrl utility function for unified external URL and local path handling (fixes #934)
• Redesigned LLM settings panel (fixes #938)
• Redesigned settings, downloader, player, and log page styles
• New mobile-first responsive design
  • Three-tier breakpoint system: mobile (<640px), tablet (640-1023px), desktop (≥1024px)
  • Mobile bottom navigation bar (with icons and text labels)
  • Tablet mini sidebar (56px icon navigation)
  • Mobile popups automatically switch to bottom sheets
  • Pull-to-refresh support
  • Horizontal swipe container support
  • Mobile card list replacing data tables (RSS page)
  • CSS Grid responsive layout (Bangumi card grid)
  • Form labels stack vertically on mobile, full-width inputs
  • Touch targets minimum 44px, meeting accessibility standards
  • Safe area support (notched devices)
  • 100dvh dynamic viewport height (fixes mobile browser address bar issue)
  • viewport-fit=cover for full-screen devices

New Components

• ab-bottom-sheet — Touch-driven bottom sheet component (drag to close, max height limit)
• ab-adaptive-modal — Adaptive modal (bottom sheet on mobile / centered dialog on desktop)
• ab-pull-refresh — Pull-to-refresh wrapper component
• ab-swipe-container — Horizontal swipe container (CSS scroll-snap)
• ab-data-list — Mobile-friendly card list (replacing NDataTable)
• ab-mobile-nav — Enhanced bottom navigation bar (icon + label + active indicator)
• useSafeArea — Safe area composable

Changes

• Refactored search logic, removed rxjs dependency
• Search store export refactored to match component expectations
• Upgraded frontend dependencies
• Breakpoint system expanded from single 1024px to 640px + 1024px two-tier
• useBreakpointQuery added isTablet, isMobileOrTablet, isTabletOrPC
• media-query.vue added #tablet slot (falls back to #mobile)
• UnoCSS added sm: 640px breakpoint
• ab-input mobile full-width + increased touch target styling
• Layout uses dvh units instead of vh, supports safe-area-inset

CI/Infrastructure

• CI added build test on PR open (dev branch PRs to main auto-trigger build)
• CI upgraded actions/upload-artifact and actions/download-artifact to v4
• Docker build removed linux/arm/v7 platform (uv image doesn't support it)
• Added CLAUDE.md development guide