amber-backend/pb_public
Claude 5a4112f41f Dashboard writes were silently GETs
Publishing a notice did nothing and said it had worked. `api()` took only
`path` and dropped the options object every caller passes, so
`api(path, {method: "POST", body: ...})` fetched the URL. The read
succeeded -- notices are publicly listable -- so the page printed
"zveřejněno" over a collection that had not changed. Switching a notice
on or off is a PATCH and went the same way.

It takes method and body now, and reports what PocketBase said rather
than a bare status, so a permissions problem cannot look like an outage.

Found because the owner tried to tell the family that the anime tab is
down -- AniList have disabled their API, and every call returns 403 with
"The AniList API has been temporarily disabled due to severe stability
issues" -- and the notice never reached anyone.
2026-09-02 21:50:21 +02:00
..
index.html Mint the download token when the button is pressed 2026-08-12 22:18:33 +02:00
status.html Dashboard writes were silently GETs 2026-09-02 21:50:21 +02:00