Skip to content

feat(web): filter every league and team list (v0.28.0) - #147

Merged
ralyodio merged 1 commit into
mainfrom
worktree-league-team-filter
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-league-team-filter

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds a filter box above every list of sports, leagues, teams and follows (sports index, sport page, league page, /feeds, /following).

  • All words must match, any order, case-insensitive ("city man" -> Manchester City)
  • Matches on the row name only (data-filter), so "upcoming"/"follow" never match every row
  • Box ships hidden, shown by app.js; re-inits after in-page navigation
  • Tests: test/list-filter.test.jsx (8 pass); full suite has the same 15 pre-existing failures as main
  • Verified in headless Chrome: "UNITED man" leaves only Manchester United

🤖 Generated with Claude Code

A search box above each list of sports, leagues, teams and follows: the
sports index, a sport's leagues, a league's teams, the feeds directory and
Following. Every word typed must appear in the row's name, in any order and
ignoring case ("city man" finds Manchester City). Rendered hidden and shown
by app.js, so no-JS readers never see a dead control; re-initialised after
in-page navigation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 42934ee into main Nov 11, 2026
1 check passed
const end = appSrc.indexOf('\n}\n', start);
return appSrc.slice(start, end + 2);
};
const { listFilterWords, listFilterMatches } = new Function(
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

2 finding(s) in the 7 file(s) this pull request changes.

MEDIUM: 1 | LOW: 1

Severity Rule Location
MEDIUM js-unescaped-html-sink apps/web/public/app.js:2086
LOW js-dynamic-code-execution apps/web/test/list-filter.test.jsx:20
68 pre-existing finding(s) elsewhere in the repository — **HIGH**: 2 | **MEDIUM**: 49 | **LOW**: 17

Not introduced by this pull request.

Severity Rule Location
HIGH secret-database-url .env.example:7
HIGH secret-database-url docker-compose.yml:11
MEDIUM js-dynamic-code-execution apps/web/public/diag.js:174
MEDIUM js-encoded-payload-execution apps/web/public/vendor-vault.js:1
MEDIUM js-encoded-payload-execution apps/web/public/vendor-webauthn.js:1
MEDIUM js-regex-from-input apps/web/src/app.js:333
MEDIUM sql-template-interpolation apps/web/src/lib/leaderboard.js:81
MEDIUM js-unescaped-html-sink apps/web/src/views/Layout.jsx:184
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:35
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:36
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:39
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:40
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:117
MEDIUM js-indirect-code-sink packages/auth/src/vault.js:123
MEDIUM sql-template-interpolation packages/credits/src/cli.js:91
MEDIUM sql-template-interpolation packages/db/src/migrate.js:42
MEDIUM sql-template-interpolation packages/db/src/queries.js:205
MEDIUM sql-template-interpolation packages/db/src/queries.js:222
MEDIUM sql-template-interpolation packages/db/src/queries.js:227
MEDIUM sql-template-interpolation packages/db/src/queries.js:231

…and 48 more; the full set is in the SARIF artifact.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants