Public viewable binders by hiddenbanana · Pull Request #308 · Git-Romer/pokecollector

hiddenbanana · 2026-07-25T08:54:08Z

Summary

Adds an admin-controlled global switch for public profiles and shared binders. It is disabled by default, and only admins can change it.
Lets each user opt their own public profile in or out independently, with market values hidden unless the user explicitly enables them.
Derives public URLs from the trainer name (for example /u/audit-trainer) with reserved-name, invalid-character, collision, migration, and concurrent-claim protection.
Adds the anonymous public directory at /u, public profile pages, and public collection-binder pages.
Keeps anonymous serializers privacy-safe: private/wishlist binders, purchase prices, costs, P&L, usernames, auth data, and other owner-only fields are excluded.
Enforces collection-only sharing at the write boundary. Wishlist binders cannot be published, and changing binder type always requires a fresh sharing decision.
Uses grouped public card tiles with per-variant quantities, real stacked card artwork, a badge legend, and deterministic shine priority: First Edition → Special → Reverse Holo → Holo → Other → Normal.
Keeps private collection binders ungrouped while adding variant badges, an amount badge and legend, variant-specific shine, and sorting by recent, number, name, price, quantity, or variant.
Consolidates the application onto one non-stacking, variant-specific shine system everywhere variant data is available, including reduced-motion support.
Adds consistent public navigation: shared back-button styling and one persistent, clickable Pokéball home control.
Handles public-link clipboard failures instead of reporting false success.
Updates the application version to 1.26.0.

Public response behavior

Successful anonymous responses use public, max-age=0, must-revalidate.
Disabled, opted-out, missing, and other privacy-sensitive failure responses use no-store.
The public client never attaches an Authorization header, including when an expired token exists in local storage.

Validation

Deliberately out of scope

A public dashboard was discussed but intentionally excluded to keep this PR focused.
Languages without new dedicated strings continue to use the existing English fallback.

Public profile (custom handle) exposing owner-shared binders, viewable anonymously and discoverable in-app. Dedicated unauthenticated /api/public namespace with whitelist serializers so purchase price / cost / P&L cannot leak; market values shown only on owner opt-in. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

11 TDD tasks: data model + migrations, handle validation, whitelist serialization, unauthenticated public API, owner controls, per-binder toggle, leaderboard discovery, frontend pages/routes + token-less client, owner UI, cache/rate-limit. Backend unittest + frontend vitest throughout. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…aded installs

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude <noreply@anthropic.com>

- Add is_public field to BinderUpdate schema (Optional[bool] = None) - Add is_public field to BinderResponse schema (bool = False) - Include is_public in _binder_response() constructor - Persist is_public updates in update_binder() - Add BinderPublicToggleTests test class Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…t public

…lient Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… frontend) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Adds PublicProfile and PublicBinderView pages consuming the Task 8 publicClient, a shared formatEur(value) helper (returns null for hidden/non-numeric values so callers can conditionally render), and wires /u/:handle and /u/:handle/binder/:binderId as siblings in the top-level Routes, before the /* catch-all, so they render outside ProtectedRoutes for anonymous visitors. Co-Authored-By: Claude <noreply@anthropic.com>

…rboard links Add GET /api/profile/ to hydrate the public-profile columns (they live on User, not the settings key/value store), plus client.js helpers, a Settings.jsx "Public Profile" section (handle input with debounced availability check, public/show-values toggles, copy link), a per-binder "Share publicly" toggle in Binders.jsx, and a public-profile link on Leaderboard rows that have a handle. Co-Authored-By: Claude <noreply@anthropic.com>

Add Cache-Control: public, max-age=300 to both public GET endpoints (get_public_profile, get_public_binder) via a test-safe defaulted response: Response = None param, so Task 4's direct-call unit tests (no response arg) keep passing. Rate limiting: no per-route @limiter.limit decorator added. main.py's existing Limiter(default_limits=["60/minute"]) + SlowAPIMiddleware already applies globally to these routes, and importing that limiter into api/public.py would create an import cycle (main.py imports api.public). Documented via code comment instead. Co-Authored-By: Claude <noreply@anthropic.com>

…iants Public binder view returned cards in arbitrary DB order and omitted the variant, so cards were unordered and variant prints were indistinguishable (and mispriced when values were shown). - _binder_cards: order by added_at desc (matches owner's binder view) and eager-load card/set/collection_item to avoid N+1 - _serialize_card: expose variant (from the linked collection item) and use it for effective_market_price; summary total_value now variant-correct - PublicCard schema gains variant; PublicBinderView renders VariantPills - tests: variant presence, variant-absent default, added_at ordering Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The public binder listed cards newest-added-first (matching the owner's app view), but collectors expect card-number order. Sort by set, then natural card number (1, 2, 10 — not 1, 10, 2), then variant so same-number prints group. - extract natural_card_number_key into services/card_numbers.py (shared); api/sets.py now imports it instead of a private duplicate - public_profile._binder_cards sorts in Python via that key - test asserts 1, 2, 10 ordering regardless of add order Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

public,max-age=300 pinned a stale browser copy for up to 5 minutes, so owner edits (unshare, value toggle) and card-order/variant fixes appeared not to take effect until the cache expired. Drop to public,max-age=30,must-revalidate so changes surface within seconds while still blunting load bursts. Dedupe the two header assignments into _set_public_cache and pin the value with tests (set on success, absent on 404). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

PublicBinderView imported ../components/VariantPills, which was never added on this branch - build has been failing standalone. VariantPills was unified into CardStateIndicators and merged upstream as part of v1.24.0 (PR Git-Romer#295), so pull that component plus its cardVariants.js dependency straight from upstream/main instead of reintroducing the old deploy-only component. Also brings in groupCardsByPrint (grouped, stacked-tile rendering) already proven on the deploy branch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

engelben · 2026-07-27T13:20:48Z

This may be a challenge for instances hosted behind some other auth mechanism. Right now I am using forward auth via Authentik. I was thinking of adding proper OIDC support but haven't gotten to it yet. This may impact that. Will have a look later this week.

Git-Romer · 2026-07-27T16:05:06Z

Hi @hiddenbanana 👋

Thank you very much for this PR! Public profiles and shareable binders are a great addition, and your implementation gave me a strong foundation to build on.

After testing it, I made several follow-up adjustments to align it with the rest of the application:

• Added an admin-controlled global switch, disabled by default.
• Derived public URLs automatically from trainer names.
• Added the public trainer directory at /u.
• Strengthened privacy, validation, collision handling, and wishlist restrictions.
• Polished the public and private binder interfaces, navigation, badges, legends, sorting, mobile layout, and variant-specific card effects.
• Fixed several smaller edge cases discovered during real-browser testing.

The final version passed 276 backend tests, 64 frontend tests, PostgreSQL migration tests, Docker builds, desktop/mobile browser workflows, and two independent review passes.

The PR is now ready from my side. Thanks again for contributing this feature. I really appreciate the time and work you put into it! 🙌

hiddenbanana · 2026-07-27T16:06:13Z

Amazing 🔥

hiddenbanana · 2026-07-27T17:25:02Z

just pulled 1.26.0 to my deploy... youve done some tweaks i was honestly considering :D the stacking looks awesome and the legend is awesome :D

Git-Romer · 2026-07-27T21:05:06Z

@engelben, you were right to flag forward-auth setups here. PokéCollector treats the public routes as anonymous, but Authentik still sees and protects those requests before they reach the app.

I added a follow-up in #315 with the exact routes needed for the public pages, API data, card images, trainer sprites, frontend bundles, and fallback assets. It includes separate Authentik examples for single-application and domain-level forward auth, plus a checklist to confirm that collection, settings, and admin routes remain protected.

This gives existing Authentik installations a safe setup for public profiles. Native OIDC would still be separate work.

Git-Romer · 2026-07-27T21:10:48Z

just pulled 1.26.0 to my deploy... youve done some tweaks i was honestly considering :D the stacking looks awesome and the legend is awesome :D

Really happy to hear that 😄 The stacking took a few rounds to get right, but it makes mixed variants much easier to understand without filling the card with more labels. The legend ties the badges together nicely too. Funny that you were already considering some of the same changes. Your original binder implementation made them much easier to add.

engelben · 2026-07-28T07:18:54Z

can only add the same - stacking is a super idea. Also thanks for the forward auth additions

hiddenbanana and others added 26 commits July 25, 2026 08:51

feat(public-binders): add profile handle + public flags data model

9038756

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(public-binders): enforce NOT NULL on new boolean columns for upgr…

d5b719d

…aded installs

feat(public-binders): handle validation + reserved words

2de712c

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(public-binders): profile resolution + whitelist serialization

c434927

Co-Authored-By: Claude <noreply@anthropic.com>

feat(public-binders): unauthenticated public profile + binder API

0a22d6d

Co-Authored-By: Claude <noreply@anthropic.com>

feat(public-binders): owner profile controls (handle + toggles)

b35f866

Co-Authored-By: Claude <noreply@anthropic.com>

feat(public-binders): expose public_handle on leaderboard rows

0f38cd8

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test(public-binders): assert leaderboard hides handle when profile no…

9ec3e89

…t public

feat(public-binders): frontend handle validator + token-less public c…

17aa012

…lient Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs: revise Task 9 to pure formatEur test (no DOM test infra on this…

e2081a2

… frontend) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs: design for stacked variant tiles in public binder view

1f2f7c1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Merge current main for PR 308 review

53fe7a2

feat: harden public profiles and add admin gate

4f58d71

Polish public profile sharing

f6680b9

Polish binder card indicators

5101a0c

Fix binder legend and collection shine

1266677

Git-Romer added 3 commits July 27, 2026 15:27

Use variant-specific card shine

e719c36

Strengthen variant-specific card shine

2f45195

Balance variant shine intensity

d88f102

Git-Romer added 4 commits July 27, 2026 16:15

Improve grouped public card stacks

a458be7

Keep public home button fixed across routes

b5a7641

Keep public home button clickable

8d3aab5

Harden binder sharing invariants

bf0af90

Git-Romer merged commit ccae7de into Git-Romer:main Jul 27, 2026
2 checks passed

hiddenbanana deleted the feature/public-binders branch July 27, 2026 17:09

Git-Romer mentioned this pull request Jul 27, 2026

Document forward auth setup for public profiles #315

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Public viewable binders - #308

Public viewable binders#308
Git-Romer merged 33 commits into
Git-Romer:mainfrom
hiddenbanana:feature/public-binders

hiddenbanana commented Jul 25, 2026 •

edited by Git-Romer

Loading

Uh oh!

engelben commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

Uh oh!

hiddenbanana commented Jul 27, 2026

Uh oh!

hiddenbanana commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

engelben commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

hiddenbanana commented Jul 25, 2026 • edited by Git-Romer Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Public response behavior

Validation

Deliberately out of scope

Uh oh!

engelben commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

Uh oh!

hiddenbanana commented Jul 27, 2026

Uh oh!

hiddenbanana commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

Git-Romer commented Jul 27, 2026

Uh oh!

engelben commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hiddenbanana commented Jul 25, 2026 •

edited by Git-Romer

Loading