fix: audit P0-P1 — T03-T07, D01-D08, U01-U02 (#1788956171115)

apps/api/app/activity.py

@@ -56,7 +56,7 @@ def activity_rows(
         activity = round(55 * min(1, weighted / 12) + 25 * min(1, len(players) / 6) + 20 * min(1, trophies / 3))
         average_confidence = sum(r.source_confidence for r in items) / len(items)
         confidence = round(45 * min(1, len(items) / 10) + 35 * min(1, len(players) / 5) + 20 * average_confidence / 100)
-        latest = max(_aware(r.caught_at or r.reported_at) for r in items)
+        latest = max(_aware(r.reported_at) for r in items)
         baits = Counter(r.bait.name for r in items if r.bait)
         freshness_text = _freshness_text(now - latest)
         result.append(ActivityOut(

apps/api/app/community_importer.py

@@ -9,7 +9,7 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from .community_review import publish_observation
-from .models import DataSource, ExternalEntityAlias, ExternalObservation, ModerationStatus
+from .models import DataSource, ExternalEntityAlias, ExternalObservation, ModerationStatus, Waterbody
 
 
 SOURCE_DEFAULTS = {
@@ -107,7 +107,6 @@ def _auto_publish(session: Session, observation: ExternalObservation) -> bool:
         observation.status not in {"staged", "mapped", "ready"}
         or not observation.source.enabled
         or observation.fish_external_id is None
-        or observation.waterbody_external_id is None
         or observation.x is None
         or observation.y is None
         or observation.weight_g is None
@@ -118,15 +117,27 @@ def _auto_publish(session: Session, observation: ExternalObservation) -> bool:
         ExternalEntityAlias.entity_type == "fish",
         ExternalEntityAlias.external_id == observation.fish_external_id,
     ))
+    if fish_alias is None or fish_alias.fish is None:
+        return False
+    # Waterbody: prefer external alias, fall back to exact name match
+    waterbody = None
+    if observation.waterbody_external_id is not None:
         waterbody_alias = session.scalar(select(ExternalEntityAlias).where(
             ExternalEntityAlias.source_system == observation.source_system,
             ExternalEntityAlias.entity_type == "waterbody",
             ExternalEntityAlias.external_id == observation.waterbody_external_id,
         ))
-    if fish_alias is None or fish_alias.fish is None or waterbody_alias is None or waterbody_alias.waterbody is None:
+        if waterbody_alias and waterbody_alias.waterbody:
+            waterbody = waterbody_alias.waterbody
+    if waterbody is None:
+        # Fallback: exact name match
+        waterbody = session.scalar(
+            select(Waterbody).where(Waterbody.name_ru == observation.waterbody_name)
+        )
+    if waterbody is None:
         return False
     observation.fish = fish_alias.fish
-    observation.waterbody = waterbody_alias.waterbody
+    observation.waterbody = waterbody
     observation.status = "ready"
     observation.review_note = "Automatically matched by previously reviewed source aliases"
     publish_observation(session, observation)

apps/api/app/community_scheduler.py

@@ -27,12 +27,18 @@ def retry_delay(statuses: list[str]) -> int:
     return min(settings.community_import_interval_seconds * (2 ** max(0, failures - 1)), MAX_BACKOFF_SECONDS)
 
 def configured_sources():
+    with SessionLocal() as session:
+        enabled_keys = {
+            s.key for s in session.scalars(select(DataSource).where(DataSource.enabled.is_(True)))
+        }
     return {
+        k: v for k, v in {
             "rf4db": SOURCES["rf4db"],
             "rf4stat-fishing": SOURCES["rf4stat-fishing"],
             "rf4stat-post": (SOURCES["rf4stat-posts"][0], SOURCES["rf4stat-posts"][1]),
             "rf4map": (settings.rf4map_point_url, parse_rf4map_point),
             "rf4posts-spot": (settings.rf4posts_spot_url, parse_rf4posts_spot),
+        }.items() if k in enabled_keys
     }
 
 def oldest_site_source(source_system: str, latest_by_source: dict[str, datetime]) -> str:

apps/api/app/main.py

@@ -27,7 +27,7 @@ from .logging_config import configure_logging
 from .models import Bait, BaitKind, CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
 from .readiness import readiness_report
 from .public_cache import public_cache
-from .schemas import ActivityOut, AdminCatchReportOut, BaitOut, CatchOut, CatchReportAccepted, CatchReportCreate, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, FishOut, ImportRunOut, ModerationUpdate, OfficialRecordOut, PublicObservationOut, SourceStatusOut, SpotOut, WaterbodyOut
+from .schemas import ActivityOut, AdminCatchReportOut, BaitOut, CatchOut, CatchReportAccepted, CatchReportCreate, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, FishOut, ImportRunOut, ImportRunPublicOut, ModerationUpdate, OfficialRecordOut, PaginatedActivityOut, PublicObservationOut, SourceStatusOut, SpotOut, WaterbodyOut
 from .storage import ScreenshotError, client as storage_client, delete_screenshot, signed_screenshot_url, upload_screenshot
 
 
@@ -87,6 +87,7 @@ def ready(db: Db) -> JSONResponse:
     is_ready, components = readiness_report(
         db, storage_client(), import_required=settings.official_import_required,
         import_interval_seconds=settings.import_interval_seconds,
+        community_import_interval_seconds=settings.community_import_interval_seconds,
     )
     return JSONResponse(
         status_code=200 if is_ready else 503,
@@ -120,14 +121,14 @@ def public_spot_pages(db: Db, limit: int = Query(500, ge=1, le=500), offset: int
         (f"/spots/{water}-{x}x{y}", f"/waterbodies/{water}/{fish}")]
 
 
-@app.get("/api/v1/activity", response_model=list[ActivityOut])
+@app.get("/api/v1/activity", response_model=PaginatedActivityOut)
 def activity(
     db: Db, response: Response, hours: int = Query(24),
     waterbody: str | None = None, fish: str | None = None,
     method: str | None = None,
     sort: Literal["activity", "confidence", "freshness"] = "activity",
     limit: int = Query(20, ge=1, le=100), offset: int = Query(0, ge=0),
-) -> list[ActivityOut]:
+) -> PaginatedActivityOut:
     if hours not in {6, 12, 24, 72}:
         raise HTTPException(status_code=422, detail="hours must be one of: 6, 12, 24, 72")
     response.headers["Cache-Control"] = "no-store"
@@ -138,14 +139,16 @@ def activity(
         response.headers["X-Cache"] = "HIT"
         return cached
     rows = activity_rows(db, hours=hours, waterbody=waterbody, fish=fish, method=method)
+    total = len(rows)
     keys = {
         "activity": lambda r: (r.activity_score, r.confidence_score, r.last_confirmed_at, str(r.spot_id)),
         "confidence": lambda r: (r.confidence_score, r.activity_score, r.last_confirmed_at, str(r.spot_id)),
         "freshness": lambda r: (r.last_confirmed_at, r.activity_score, r.confidence_score, str(r.spot_id)),
     }
     rows.sort(key=keys[sort], reverse=True)
+    page = rows[offset:offset + limit]
     response.headers["X-Cache"] = "MISS"
-    return public_cache.set(cache_key, rows[offset:offset + limit], generation=generation)
+    return public_cache.set(cache_key, PaginatedActivityOut(items=page, total=total, limit=limit, offset=offset), generation=generation)
 
 
 def _spot_or_404(db: Session, spot_id: UUID) -> Spot:
@@ -218,19 +221,18 @@ def _report_source(report: CatchReport) -> str:
 @app.get("/api/v1/community-observations", response_model=list[PublicObservationOut])
 def community_observations(
     db: Db, limit: int = Query(12, ge=1, le=50), offset: int = Query(0, ge=0),
+    waterbody: str | None = None, fish: str | None = None,
 ) -> list[PublicObservationOut]:
-    items = list(db.scalars(
-        select(ExternalObservation)
-        .join(ExternalObservation.source)
-        .options(joinedload(ExternalObservation.source))
-        .where(
+    query = select(ExternalObservation).join(ExternalObservation.source).options(joinedload(ExternalObservation.source)).where(
         ExternalObservation.catch_report_id.is_(None),
         ExternalObservation.status != "rejected",
         DataSource.enabled.is_(True),
     )
-        .order_by(ExternalObservation.last_seen_at.desc(), ExternalObservation.id.desc())
-        .offset(offset).limit(limit)
-    ))
+    if waterbody:
+        query = query.where(ExternalObservation.waterbody_name == waterbody)
+    if fish:
+        query = query.where(ExternalObservation.fish_name == fish)
+    items = list(db.scalars(query.order_by(ExternalObservation.last_seen_at.desc(), ExternalObservation.id.desc()).offset(offset).limit(limit)))
     result: list[PublicObservationOut] = []
     for item in items:
         missing = []
@@ -318,7 +320,7 @@ def admin_diagnostics(db: Db, _: Annotated[str, Depends(_admin)]) -> JSONRespons
     return JSONResponse(payload, headers={"Content-Disposition": "attachment; filename=rf4spotter-diagnostics.json"})
 
 
-@app.get("/api/v1/imports", response_model=list[ImportRunOut])
+@app.get("/api/v1/imports", response_model=list[ImportRunPublicOut])
 def imports(db: Db, limit: int = Query(20, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[OfficialRecordImport]:
     return list(db.scalars(select(OfficialRecordImport).order_by(OfficialRecordImport.started_at.desc(), OfficialRecordImport.id.desc()).offset(offset).limit(limit)))
 
@@ -448,7 +450,7 @@ def admin_reject_external_observation(
 def create_catch_report(payload: CatchReportCreate, request: Request, db: Db) -> CatchReportAccepted:
     if payload.website:
         raise HTTPException(status_code=400, detail="invalid submission")
-    _check_rate_limit(request.client.host if request.client else "unknown", db)
+    _check_rate_limit(request, db)
     fish = db.scalar(select(Fish).where(Fish.slug == payload.fish_slug))
     waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == payload.waterbody_slug))
     if fish is None or waterbody is None:
@@ -536,9 +538,14 @@ def delete_report(report_id: UUID, db: Db, moderator: Annotated[str, Depends(_ad
     return Response(status_code=204)
 
 
-def _check_rate_limit(client: str, db: Session) -> None:
+def _check_rate_limit(request: Request, db: Session) -> None:
     now = datetime.now(timezone.utc)
     cutoff = now - timedelta(minutes=10)
+    # Extract real client IP from forwarded headers
+    client = request.client.host if request.client else "unknown"
+    forwarded = request.headers.get("x-forwarded-for")
+    if forwarded:
+        client = forwarded.split(",")[0].strip()
     client_hash = hmac.new(settings.rate_limit_secret.encode(), client.encode(), hashlib.sha256).hexdigest()
     if db.get_bind().dialect.name == "postgresql":
         lock_key = int(client_hash[:16], 16) & 0x7FFF_FFFF_FFFF_FFFF

apps/api/app/readiness.py

@@ -6,12 +6,13 @@ from typing import Any
 from sqlalchemy import select, text
 from sqlalchemy.orm import Session
 
-from .models import ImportStatus, OfficialRecordImport
+from .models import CommunityImportRun, ImportStatus, OfficialRecordImport
 
 
 def readiness_report(
     session: Session, s3: Any, *, import_required: bool,
-    import_interval_seconds: int, now: datetime | None = None,
+    import_interval_seconds: int, community_import_interval_seconds: int = 1800,
+    now: datetime | None = None,
 ) -> tuple[bool, dict[str, dict[str, object]]]:
     current = now or datetime.now(timezone.utc)
     components: dict[str, dict[str, object]] = {}
@@ -58,4 +59,26 @@ def readiness_report(
         if import_required:
             ready = False
 
+    # Check community scheduler: look for recent import runs
+    try:
+        latest_community = session.scalar(
+            select(CommunityImportRun)
+            .order_by(CommunityImportRun.started_at.desc())
+            .limit(1)
+        )
+        if latest_community is None:
+            components["community_scheduler"] = {"status": "not_started"}
+        else:
+            started = latest_community.started_at
+            if started.tzinfo is None:
+                started = started.replace(tzinfo=timezone.utc)
+            stale = started < current - timedelta(seconds=community_import_interval_seconds * 2)
+            healthy = latest_community.status == "success" and not stale
+            components["community_scheduler"] = {
+                "status": "ready" if healthy else ("stale" if stale else latest_community.status),
+                "last_started_at": started.isoformat(),
+            }
+    except Exception:
+        components["community_scheduler"] = {"status": "unknown"}
+
     return ready, components

apps/api/app/schemas.py

@@ -50,6 +50,13 @@ class ActivityOut(BaseModel):
     sources: list[str]
 
 
+class PaginatedActivityOut(BaseModel):
+    items: list[ActivityOut]
+    total: int
+    limit: int
+    offset: int
+
+
 class CatchOut(BaseModel):
     id: UUID
     fish: str
@@ -125,6 +132,18 @@ class ImportRunOut(BaseModel):
     not_modified: bool
 
 
+class ImportRunPublicOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: UUID
+    started_at: datetime
+    finished_at: datetime | None
+    status: str
+    rows_seen: int
+    rows_created: int
+    rows_updated: int
+    not_modified: bool
+
+
 class CatchReportCreate(BaseModel):
     fish_slug: str
     waterbody_slug: str

apps/web/src/lib/api.ts

@@ -6,6 +6,13 @@ export type Activity = {
   explanation: string; sources: string[];
 };
 
+export type PaginatedActivity = {
+  items: Activity[];
+  total: number;
+  limit: number;
+  offset: number;
+};
+
 export type Spot = { id: string; waterbody_slug: string; waterbody: string; x: number; y: number; description: string | null; catches_24h: number; catches_3d: number; catches_7d: number; top_baits: string[] };
 export type Catch = { id: string; fish: string; weight_g: number; bait: string | null; player_name: string | null; caught_at: string | null; reported_at: string; retrieve_method: string | null; retrieve_speed: number | null; source_system: string; source_url: string | null };
 export type DictionaryItem = { id: string; slug: string; name_ru: string };

apps/web/src/pages/api/report-screenshot.ts

@@ -11,7 +11,7 @@ export const POST: APIRoute = async ({ request, redirect, cookies }) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(reportId) || !uploadToken || !(screenshot instanceof File) || screenshot.size === 0) return redirect(`/report?state=screenshot_error&report_id=${encodeURIComponent(reportId)}`, 303);
   try {
     const upload = new FormData(); upload.set("screenshot", screenshot);
-    const response = await fetch(`${base}/api/v1/catch-reports/${reportId}/screenshot`, { method: "POST", headers:{"X-Upload-Token":uploadToken}, body: upload });
+    const response = await fetch(`${base}/api/v1/catch-reports/${reportId}/screenshot`, { method: "POST", headers:{"X-Upload-Token":uploadToken}, body: upload, signal: AbortSignal.timeout(60_000) });
     if (response.ok) cookies.delete(cookieName, {path:"/"});
     return redirect(response.ok ? "/report?state=screenshot_sent" : `/report?state=screenshot_error&report_id=${encodeURIComponent(reportId)}`, 303);
   } catch { return redirect(`/report?state=screenshot_error&report_id=${encodeURIComponent(reportId)}`, 303); }

apps/web/src/pages/api/report.ts

@@ -1,14 +1,19 @@
 import type { APIRoute } from "astro";
 const base = process.env.API_INTERNAL_URL || import.meta.env.API_INTERNAL_URL || "http://localhost:8000";
 export const POST: APIRoute = async ({ request, redirect, cookies }) => {
-  const form = await request.formData();
+  let form: FormData;
+  try {
+    form = await request.formData();
+  } catch {
+    return redirect("/report?state=create_error", 303);
+  }
   const text = (name: string) => String(form.get(name) || "").trim() || null;
   const number = (name: string) => text(name) ? Number(text(name)) : null;
   const payload = { fish_slug: String(form.get("fish_slug") || ""), waterbody_slug: String(form.get("waterbody_slug") || ""), x: Number(form.get("x")), y: Number(form.get("y")), weight_g: Number(form.get("weight_g")), bait_name: text("bait_name"), fishing_method: text("fishing_method"), retrieve_method: text("retrieve_method"), retrieve_speed: number("retrieve_speed"), player_name: text("player_name"), comment: text("comment"), website: String(form.get("website") || "") };
   let createdId: string | null = null;
   let uploadToken: string | null = null;
   try {
-    const response = await fetch(`${base}/api/v1/catch-reports`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(payload) });
+    const response = await fetch(`${base}/api/v1/catch-reports`, { method: "POST", headers: { "content-type": "application/json", "X-Forwarded-For": request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown" }, body: JSON.stringify(payload), signal: AbortSignal.timeout(30_000) });
     if (!response.ok) return redirect("/report?state=create_error", 303);
     const created = await response.json() as { id?: unknown; screenshot_upload_token?: unknown };
     if (typeof created.id !== "string" || typeof created.screenshot_upload_token !== "string") return redirect("/report?state=create_error", 303);
@@ -17,7 +22,7 @@ export const POST: APIRoute = async ({ request, redirect, cookies }) => {
     const screenshot = form.get("screenshot");
     if (screenshot instanceof File && screenshot.size > 0) {
       const upload = new FormData(); upload.set("screenshot", screenshot);
-      const uploaded = await fetch(`${base}/api/v1/catch-reports/${created.id}/screenshot`, { method: "POST", headers: {"X-Upload-Token": created.screenshot_upload_token}, body: upload });
+      const uploaded = await fetch(`${base}/api/v1/catch-reports/${created.id}/screenshot`, { method: "POST", headers: {"X-Upload-Token": created.screenshot_upload_token}, body: upload, signal: AbortSignal.timeout(60_000) });
       if (!uploaded.ok) {
         cookies.set(`rf4-upload-${created.id}`, created.screenshot_upload_token, {httpOnly:true, sameSite:"strict", secure:import.meta.env.PROD, path:"/", maxAge:3600});
         return redirect(`/report?state=screenshot_error&report_id=${encodeURIComponent(created.id)}`, 303);

apps/web/src/pages/index.astro

@@ -4,7 +4,7 @@ import ActivityCard from "../components/ActivityCard.astro";
 import FishingIcon from "../components/FishingIcon.astro";
 import SourceBadge from "../components/SourceBadge.astro";
 import SignalFeed from "../components/SignalFeed.astro";
-import { activityLevel, ago, api, kg, plural, type Activity, type DictionaryItem, type PublicObservation } from "../lib/api";
+import { activityLevel, ago, api, kg, plural, type Activity, type DictionaryItem, type PaginatedActivity, type PublicObservation } from "../lib/api";
 
 const params = Astro.url.searchParams;
 const hours = params.get("hours") ?? "24";
@@ -14,17 +14,22 @@ const sort = params.get("sort") ?? "activity";
 const requestedSignalLimit = Number(params.get("signals") ?? 12);
 const signalLimit = Number.isInteger(requestedSignalLimit) ? Math.min(48, Math.max(12, requestedSignalLimit)) : 12;
 let items: Activity[] = [], signals: PublicObservation[] = [], fishes: DictionaryItem[] = [], waterbodies: DictionaryItem[] = [];
-let hasMoreSignals = false;
+let hasMoreSignals = false, totalItems = 0;
 const filterError = !["6", "12", "24", "72"].includes(hours) || !["activity", "confidence", "freshness"].includes(sort);
 let unavailable = false;
 try {
   let signalRows: PublicObservation[] = [];
-  [fishes, waterbodies, signalRows] = await Promise.all([api<DictionaryItem[]>("/api/v1/fishes"), api<DictionaryItem[]>("/api/v1/waterbodies"), api<PublicObservation[]>(`/api/v1/community-observations?limit=${signalLimit + 1}`)]);
+  const signalParams = new URLSearchParams({ limit: String(signalLimit + 1) });
+  if (waterbody) signalParams.set("waterbody", waterbody);
+  if (fish) signalParams.set("fish", fish);
+  [fishes, waterbodies, signalRows] = await Promise.all([api<DictionaryItem[]>("/api/v1/fishes"), api<DictionaryItem[]>("/api/v1/waterbodies"), api<PublicObservation[]>(`/api/v1/community-observations?${signalParams}`)]);
   hasMoreSignals = signalRows.length > signalLimit;
   signals = signalRows.slice(0, signalLimit);
   if (!filterError) {
-    const query = new URLSearchParams({ hours, waterbody, fish, sort });
-    items = await api<Activity[]>(`/api/v1/activity?${query}`);
+    const query = new URLSearchParams({ hours, waterbody, fish, sort, limit: "20", offset: "0" });
+    const paginated = await api<PaginatedActivity>(`/api/v1/activity?${query}`);
+    items = paginated.items;
+    totalItems = paginated.total;
   }
 } catch { unavailable = true; }
 const leaderLevel = items.length > 1 && items[0] ? activityLevel(items[0].activity_score) : null;
@@ -49,25 +54,28 @@ const datasetJsonLd = {
   <section class="filters-wrap"><form class="filters content-grid" method="get" action="/#results">
     <label>Водоём<select name="waterbody"><option value="">Все водоёмы</option>{waterbodies.map(x => <option value={x.slug} selected={waterbody === x.slug}>{x.name_ru}</option>)}</select></label>
     <label>Рыба<select name="fish"><option value="">Любая рыба</option>{fishes.map(x => <option value={x.slug} selected={fish === x.slug}>{x.name_ru}</option>)}</select></label>
-    <details class="filter-advanced" open><summary>Период и порядок <span>{periodLabel}</span></summary><div class="advanced-fields">
-      <label>Период<select name="hours"><option value="6" selected={hours === "6"}>6 часов</option><option value="12" selected={hours === "12"}>12 часов</option><option value="24" selected={hours === "24"}>24 часа</option><option value="72" selected={hours === "72"}>72 часа</option></select></label>
-      <label>Сначала<select name="sort"><option value="activity" selected={sort === "activity"}>Активные</option><option value="confidence" selected={sort === "confidence"}>Надёжные</option><option value="freshness" selected={sort === "freshness"}>Свежие</option></select></label>
-    </div></details>
+    <label class="filter-advanced-field">Период<select name="hours"><option value="6">6 часов</option><option value="12">12 часов</option><option value="24" selected={hours === "24"}>24 часа</option><option value="72">72 часа</option></select></label>
+    <label class="filter-advanced-field">Сначала<select name="sort"><option value="activity" selected={sort === "activity"}>Активные</option><option value="confidence" selected={sort === "confidence"}>Надёжные</option><option value="freshness" selected={sort === "freshness"}>Свежие</option></select></label>
     <button>⌕ Найти клёв</button>
   </form></section>
   <div class="active-filters content-grid" aria-label="Применённые фильтры"><span>{selectedWaterbody}</span><span>{selectedFish}</span><span>{periodLabel}</span><span>{sortLabel}</span>{filtersChanged && <a href="/#results">Сбросить</a>}</div>
-  <section class="dashboard content-grid" id="results"><div class="results-column"><div class="section-heading"><div><span class="overline">За выбранный период</span><h2>Горячие точки</h2></div><span class="result-count">{items.length} {plural(items.length, ["точка", "точки", "точек"])}</span></div>{filterError ? <div class="state error-state"><h2>Некорректные фильтры</h2><p>Выберите период и сортировку из предложенных значений.</p><a href="/">Сбросить фильтры</a></div> : unavailable ? <div class="state"><h2>Источник временно недоступен</h2><p>Не показываем устаревшие догадки. Попробуйте позже.</p></div> : items.length ? <div class="spot-list">{items.map(item => <ActivityCard item={item} />)}</div> : <div class="state"><h2>Пока нет свежих данных</h2><p>Для выбранных фильтров нет одобренных наблюдений. Расширьте период или выберите другой водоём.</p></div>}</div>
+  <section class="dashboard content-grid" id="results"><div class="results-column"><div class="section-heading"><div><span class="overline">За выбранный период</span><h2>Горячие точки</h2></div><span class="result-count">{items.length} из {totalItems} {plural(totalItems, ["точка", "точки", "точек"])}</span></div>{filterError ? <div class="state error-state"><h2>Некорректные фильтры</h2><p>Выберите период и сортировку из предложенных значений.</p><a href="/">Сбросить фильтры</a></div> : unavailable ? <div class="state"><h2>Источник временно недоступен</h2><p>Не показываем устаревшие догадки. Попробуйте позже.</p></div> : items.length ? <><div class="spot-list">{items.map(item => <ActivityCard item={item} />)}</div>{items.length < totalItems && <a class="load-more" href={`/?${new URLSearchParams({ ...Object.fromEntries(params), offset: String(items.length) }).toString()}#results`}>Показать ещё <span>{items.length} из {totalItems}</span> ↓</a>}</> : <div class="state"><h2>Пока нет свежих данных</h2><p>Для выбранных фильтров нет одобренных наблюдений. Расширьте период или выберите другой водоём.</p></div>}</div>
   {items[0] && leaderLevel && <aside class="detail-card"><div class="detail-head"><div><span class="overline">Лидер активности</span><h2>{items[0].waterbody} <em>{items[0].x}:{items[0].y}</em></h2></div><a href={`/spots/${items[0].spot_id}`} aria-label="Открыть точку"><FishingIcon name="arrow"/></a></div><div class="source-strip">{items[0].sources.map(source => <SourceBadge source={source}/>)}</div><div class="detail-score"><div class="float-gauge" style={`--level:${items[0].activity_score}%`} aria-label={`Индекс активности: ${items[0].activity_score} из 100`}><span class="float-gauge__line"></span><span class="float-gauge__water"></span><span class="float-gauge__bob"><i></i></span><strong>{items[0].activity_score}</strong><small>из 100</small></div><div><span>Индекс активности</span><strong data-activity-level={leaderLevel.short}>{leaderLevel.description}</strong><p>{items[0].explanation}</p></div></div><div class="metric-grid"><div><span><FishingIcon name="ripple"/></span><small>Уверенность</small><strong>{items[0].confidence_score}%</strong></div><div><span><FishingIcon name="angler"/></span><small>{plural(items[0].unique_players, ["Игрок", "Игрока", "Игроков"])}</small><strong>{items[0].unique_players}</strong></div><div><span><FishingIcon name="clock"/></span><small>Последний</small><strong>{ago(items[0].last_confirmed_at)}</strong></div><div><span><FishingIcon name="scale"/></span><small>Средний вес</small><strong>{kg(items[0].average_weight_g)}</strong></div></div><div class="best-lure"><span class="overline">Лучшая связка</span><div><FishingIcon name="lure" size={25}/><strong>{items[0].best_bait ?? "Не указана"}</strong><span>{items[0].catches} {plural(items[0].catches, ["улов", "улова", "уловов"])}</span></div></div><p class="confidence-note"><span>✓</span><span><strong>Оценка объяснима.</strong> Один игрок не может искусственно поднять уверенность.</span></p></aside>}
   </section>
   {signals.length > 0 && <SignalFeed signals={signals}/>}
   {hasMoreSignals && signalLimit < 48 && <a class="signal-more" href={moreSignalsHref}>Показать ещё <span>{signalLimit} из доступных</span> ↓</a>}
   <section class="how-it-works content-grid"><div><span class="overline">Как читать данные</span><h2>Не обещаем рыбу.<br/>Показываем факты.</h2></div><div class="principles"><article><span>01</span><h3>Свежесть</h3><p>Чем старше сообщение, тем меньше оно влияет на активность.</p></article><article><span>02</span><h3>Разные игроки</h3><p>Десять уловов одного человека не равны десяти подтверждениям.</p></article><article><span>03</span><h3>Уверенность</h3><p>Каждая оценка объясняет, сколько данных за ней стоит.</p></article></div></section>
   <script>
-    const advancedFilters = document.querySelector<HTMLDetailsElement>(".filter-advanced");
+    const advancedFields = document.querySelectorAll<HTMLElement>(".filter-advanced-field");
     const compactFilters = window.matchMedia("(max-width: 720px)");
     const syncFilters = (event: MediaQueryList | MediaQueryListEvent) => {
-      if (event.matches) advancedFilters?.removeAttribute("open");
-      else advancedFilters?.setAttribute("open", "");
+      advancedFields.forEach(field => {
+        if (event.matches) {
+          field.classList.add("filter-compact-hidden");
+        } else {
+          field.classList.remove("filter-compact-hidden");
+        }
+      });
     };
     syncFilters(compactFilters);
     compactFilters.addEventListener("change", syncFilters);

apps/web/src/pages/spots/[id].astro

@@ -14,7 +14,7 @@ try {
     ? await api<Spot>(`/api/v1/spots/resolve?waterbody=${encodeURIComponent(readable[1])}&x=${readable[2]}&y=${readable[3]}`)
     : await api<Spot>(`/api/v1/spots/${id}`);
   if (!readable) return Astro.redirect(`/spots/${spotResult.waterbody_slug}-${spotResult.x}x${spotResult.y}`, 301);
-  const [catchResult, activityRows] = await Promise.all([api<Catch[]>(`/api/v1/spots/${spotResult.id}/catches`), api<Activity[]>("/api/v1/activity?hours=24&limit=100")]);
+  const [catchResult, activityRows] = await Promise.all([api<Catch[]>(`/api/v1/spots/${spotResult.id}/catches`), api<Activity[]>(`/api/v1/activity?hours=24&waterbody=${encodeURIComponent(spotResult.waterbody_slug)}&limit=100`)]);
   spot = spotResult; catches = catchResult; activity = activityRows.find(item => item.spot_id === spotResult.id) ?? null;
   timeline = await api<typeof timeline>(`/api/v1/spots/${spotResult.id}/timeline`);
 } catch (error) {

apps/web/src/styles/global.css

@@ -6,7 +6,7 @@
 .skip-link{position:fixed;z-index:100;left:12px;top:12px;padding:12px 16px;background:var(--lime);color:var(--deep);font-weight:750;transform:translateY(-150%)}.skip-link:focus{transform:none}:focus-visible{outline:3px solid #7da529;outline-offset:3px}.topbar nav a[aria-current="page"]{font-weight:750}.notice:focus{outline:3px solid #9d3529;outline-offset:3px}
 .topbar{height:86px;width:min(1480px,calc(100% - 48px));margin:auto;display:grid;grid-template-columns:1fr auto 1fr;align-items:center;gap:28px}.brand{display:flex;align-items:center;gap:12px;text-decoration:none;min-width:max-content}.brand-mark{width:42px;height:42px;display:grid;place-items:center;border:1px solid #9eb0a7;border-radius:50%;background:var(--deep);color:var(--lime);font-size:28px}.brand-name{display:flex;flex-direction:column;font:17px/.95 Georgia,serif}.brand-name strong{font-size:20px;font-style:italic}.topbar nav{height:100%;display:flex;gap:23px;align-items:center}.topbar nav a{height:100%;display:flex;align-items:center;gap:7px;padding:0 8px;text-decoration:none;color:#526461;font-size:14px;border-bottom:3px solid transparent}.topbar nav a.active{color:var(--deep);border-color:var(--deep)}.live-badge{justify-self:end;display:flex;align-items:center;gap:9px;color:#60716e;font-size:13px}.live-badge>span{width:8px;height:8px;border-radius:50%;background:#83b83a;box-shadow:0 0 0 5px #83b83a20}
 .eyebrow,.overline{text-transform:uppercase;letter-spacing:.14em;font-size:12px;font-weight:750;color:#657673}.eyebrow{display:flex;align-items:center;gap:10px}.eyebrow b{display:grid;place-items:center;min-width:41px;height:25px;padding:0 8px;border:1px solid #9aaa9f;border-radius:20px;color:var(--deep);letter-spacing:.05em}.intro{padding:74px 0 42px;display:grid;grid-template-columns:.92fr 1.08fr;align-items:end;gap:70px}.intro h1,.records-hero h1,.form-hero h1,.spot-hero h1{margin:18px 0 22px;font:400 clamp(58px,6.3vw,102px)/.87 Georgia,"Times New Roman",serif;letter-spacing:-.065em}.intro h1 em,.records-hero h1 em,.form-hero h1 em{color:#497074;font-weight:400}.intro-copy>p{font-size:18px;line-height:1.55;color:#586a68;max-width:560px}.lake-card{position:relative;border-radius:18px;overflow:hidden;height:326px;box-shadow:0 24px 70px #173c3f24}.lake-card img{width:100%;height:100%;object-fit:cover;display:block}.lake-card:after{content:"";position:absolute;inset:0;background:linear-gradient(180deg,transparent 35%,#041c20d9)}.lake-overlay{position:absolute;z-index:2;inset:auto 24px 22px 26px;display:flex;justify-content:space-between;align-items:end;color:#fff}.lake-overlay .overline{color:#d2dedb;display:block;margin-bottom:7px}.lake-overlay strong{font:400 21px Georgia,serif}.pulse-orb{width:45px;height:45px;border:1px solid #ffffff7d;border-radius:50%;display:grid;place-items:center}.pulse-orb span{width:9px;height:9px;border-radius:50%;background:var(--lime);box-shadow:0 0 0 8px #c9f45b25}
-.filters-wrap{background:var(--deep);padding:24px 0;position:sticky;top:0;z-index:20;box-shadow:0 10px 35px #08222620}.filters{display:grid;grid-template-columns:repeat(4,1fr) auto;gap:12px;align-items:end}.filters label,.report-form label,.record-filters label{color:#9fb0ad;font-size:12px;text-transform:uppercase;letter-spacing:.1em;font-weight:700}.filters select{display:block;width:100%;height:48px;margin-top:7px;padding:0 13px;border:1px solid #ffffff29;border-radius:10px;background:#ffffff0c;color:#f5f8f3}.filters option{color:var(--ink)}.filters button,.report-form button,.record-filters button{height:48px;padding:0 24px;border:0;border-radius:10px;background:var(--lime);color:var(--deep);font-weight:750}.filter-advanced{display:contents}.filter-advanced summary{display:none}.advanced-fields{display:contents!important}.active-filters{min-height:56px;display:flex;align-items:center;gap:8px;padding-top:10px}.active-filters span{padding:6px 10px;border:1px solid #c8d3cb;border-radius:20px;background:#f8faf5;color:#526662;font-size:12px}.active-filters a{margin-left:auto;color:#4d625e;font-size:13px;text-underline-offset:3px}
+.filters-wrap{background:var(--deep);padding:24px 0;position:sticky;top:0;z-index:20;box-shadow:0 10px 35px #08222620}.filters{display:grid;grid-template-columns:repeat(5,1fr);gap:12px;align-items:end}.filters label,.report-form label,.record-filters label{color:#9fb0ad;font-size:12px;text-transform:uppercase;letter-spacing:.1em;font-weight:700}.filters select{display:block;width:100%;height:48px;margin-top:7px;padding:0 13px;border:1px solid #ffffff29;border-radius:10px;background:#ffffff0c;color:#f5f8f3}.filters option{color:var(--ink)}.filters button,.report-form button,.record-filters button{height:48px;padding:0 24px;border:0;border-radius:10px;background:var(--lime);color:var(--deep);font-weight:750}.filter-advanced-field{display:contents}.active-filters{min-height:56px;display:flex;align-items:center;gap:8px;padding-top:10px}.active-filters span{padding:6px 10px;border:1px solid #c8d3cb;border-radius:20px;background:#f8faf5;color:#526662;font-size:12px}.active-filters a{margin-left:auto;color:#4d625e;font-size:13px;text-underline-offset:3px}
 .dashboard{display:grid;grid-template-columns:minmax(0,1.45fr) minmax(360px,.75fr);gap:26px;padding:66px 0 104px;align-items:start}.section-heading{display:flex;justify-content:space-between;align-items:end;margin:0 0 23px}.section-heading h2,.detail-head h2,.how-it-works h2{font:400 38px Georgia,serif;margin:6px 0 0;letter-spacing:-.04em}.result-count{border:1px solid #b9c6bf;color:#667875;font-size:13px;padding:7px 11px;border-radius:20px}.spot-list{display:flex;flex-direction:column;gap:12px}.spot-card{position:relative;display:grid;grid-template-columns:45px 1fr 190px;gap:18px;padding:22px 48px 22px 20px;border:1px solid #d5ded7;border-radius:16px;background:#fbfcf9;text-decoration:none;transition:.22s ease}.spot-card:hover{transform:translateY(-2px);border-color:#7d9488;box-shadow:0 18px 40px #14333812;background:#fff}.spot-rank{width:36px;height:36px;border:1px solid #cad4cd;border-radius:50%;display:grid;place-items:center;font:italic 14px Georgia,serif;color:#788985}.spot-topline{display:flex;align-items:center;gap:12px;color:#687a77;font-size:13px}.activity-pill{display:inline-flex;align-items:center;gap:6px;padding:5px 9px;border-radius:30px;background:#e6f7c3;color:#426315;font-size:11px;font-weight:750}.activity-pill i{width:6px;height:6px;border-radius:50%;background:#6d9f32}.spot-main h3{font:400 25px Georgia,serif;margin:8px 0}.spot-meta{display:flex;gap:16px;color:#71817f;font-size:13px}.bait-line{display:flex;gap:11px;align-items:center;margin-top:18px;padding-top:15px;border-top:1px solid #e2e8e2}.lure-dot,.best-lure i{display:block;width:12px;height:28px;border-radius:50% 50% 43% 43%;background:var(--orange);transform:rotate(22deg);box-shadow:inset -4px 0 #091e2250}.bait-line div{display:flex;flex-direction:column;gap:2px}.bait-line div span{color:#82908e;font-size:11px;text-transform:uppercase;letter-spacing:.09em}.bait-line strong{font-size:14px}.spot-stats{border-left:1px solid #e2e8e2;padding-left:18px;display:grid;grid-template-columns:1fr 1fr;gap:18px 10px;align-content:center}.spot-stats div{display:flex;flex-direction:column}.spot-stats strong{font:400 20px Georgia,serif}.spot-stats span{font-size:9px;text-transform:uppercase;letter-spacing:.08em;color:#7c8d89}.card-arrow{position:absolute;right:18px;top:50%;transform:translateY(-50%);font-size:28px;color:#91a09c}
 .detail-card{position:sticky;top:116px;margin:0;background:var(--deep);color:#f5f8f3;border:0;border-radius:18px;padding:27px;overflow:hidden}.detail-card:before{content:"";position:absolute;width:420px;height:420px;border:1px solid #ffffff0f;border-radius:50%;left:48%;top:-210px;box-shadow:0 0 0 48px #ffffff08,0 0 0 96px #ffffff05}.detail-card>*{position:relative;z-index:1}.detail-head{display:flex;justify-content:space-between}.detail-head .overline,.best-lure .overline{color:#a7b6b3}.detail-head h2{font-size:30px}.detail-head h2 em{color:var(--lime);font-size:22px}.detail-head>a{width:40px;height:40px;display:grid;place-items:center;border:1px solid #ffffff34;border-radius:50%;text-decoration:none}.detail-score{display:grid;grid-template-columns:126px 1fr;gap:20px;align-items:center;padding:34px 0 29px}.score-ring{width:122px;height:122px;display:grid;place-items:center;border-radius:50%;background:conic-gradient(var(--lime) var(--score),#ffffff16 0);position:relative}.score-ring:after{content:"";position:absolute;inset:8px;background:var(--deep);border-radius:50%}.score-ring>div{z-index:1;text-align:center;display:flex;flex-direction:column}.score-ring strong{font:400 39px/1 Georgia,serif}.score-ring span{color:#a9b8b5;font-size:10px;text-transform:uppercase}.detail-score>div>span{color:#a9b8b5;font-size:11px;text-transform:uppercase;letter-spacing:.1em}.detail-score>div>strong{display:block;margin:5px 0 8px;font:400 24px Georgia,serif;color:var(--lime)}.detail-score p{color:#b7c3c0;font-size:13px;line-height:1.5;margin:0}.metric-grid{display:grid;grid-template-columns:1fr 1fr;border:1px solid #ffffff1c;border-radius:12px;overflow:hidden}.metric-grid>div{min-height:91px;padding:15px;display:grid;grid-template-columns:23px 1fr;gap:3px 8px;border-bottom:1px solid #ffffff1c}.metric-grid>div:nth-child(odd){border-right:1px solid #ffffff1c}.metric-grid>div:nth-last-child(-n+2){border-bottom:0}.metric-grid>div>span{grid-row:1/3;color:var(--lime)}.metric-grid small{color:#9cadaa;text-transform:uppercase;font-size:9px}.metric-grid strong{font:400 17px Georgia,serif}.best-lure{margin-top:28px}.best-lure>div{display:grid;grid-template-columns:18px 1fr auto;gap:11px;align-items:center;padding:15px 0;border-bottom:1px solid #ffffff17}.best-lure>div span{color:var(--lime);font-size:12px}.confidence-note{display:flex;gap:10px;padding:16px;background:#ffffff0a;border-radius:10px;margin-top:22px;font-size:12px;line-height:1.45;color:#aebcba}.confidence-note>span:first-child{color:var(--lime)}.confidence-note strong{color:#fff}
 .data-quality{padding:4px 8px;border-radius:20px;background:#fff0c7;color:#73550c;font-size:10px;font-weight:750}.data-note{margin:12px 0 0;color:#667875;font-size:12px;line-height:1.45}.state{min-height:240px;display:grid;place-items:center;align-content:center;text-align:center;border:1px dashed #b9c7bf;border-radius:16px;color:#71817f}.state h2{font:400 28px Georgia,serif;color:var(--deep);margin:0}.state p{max-width:560px;line-height:1.5}.error-state{border-color:#d8aaa1}.error-state a{color:#842f25}.compact-state{min-height:180px}.how-it-works{border-top:1px solid #cfd8d1;padding:85px 0 105px;display:grid;grid-template-columns:.8fr 1.2fr;gap:70px}.how-it-works h2{font-size:47px;line-height:1.05}.principles{display:grid;grid-template-columns:repeat(3,1fr);gap:18px}.principles article{padding-top:24px;border-top:2px solid #294b4e}.principles article>span{font:italic 16px Georgia,serif;color:#82928f}.principles h3{margin:28px 0 8px;font:400 22px Georgia,serif}.principles p{font-size:14px;line-height:1.55;color:#657572}
@@ -15,7 +15,7 @@
 .moderation-app{width:min(1120px,calc(100% - 64px));margin:0 auto 100px}.admin-login{display:flex;gap:14px;align-items:end;padding:25px;background:var(--deep);border-radius:16px}.admin-login label{flex:1;color:#a8b7b4;font-size:12px;text-transform:uppercase;letter-spacing:.1em;font-weight:700}.admin-login input{display:block;width:100%;margin-top:7px;padding:13px 14px;border:1px solid #ffffff29;border-radius:9px;background:#ffffff0c;color:#fff}.admin-login button,.moderation-actions button{height:48px;padding:0 24px;border:0;border-radius:9px;background:var(--lime);color:var(--deep);font-weight:750}.moderation-app>.privacy{margin:10px 4px 25px}.moderation-app>.notice{width:100%}.moderation-list{display:grid;gap:18px}.moderation-card{display:grid;grid-template-columns:1fr 300px;gap:25px;padding:25px;background:#fff;border:1px solid #d4ddd6;border-radius:16px}.moderation-summary h2{font:400 32px Georgia,serif;margin:12px 0 4px}.moderation-summary>p{color:#647572;margin:0 0 20px}.moderation-summary dl{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin:0}.moderation-summary dl div{border-top:1px solid #e1e8e2;padding-top:10px}.moderation-summary dt{font-size:10px;text-transform:uppercase;color:#7a8a87}.moderation-summary dd{margin:3px 0 0}.moderation-summary blockquote{margin:18px 0 0;padding:13px;border-left:3px solid var(--lime);background:#f2f6ef;color:#566865}.moderation-proof img,.no-proof{width:100%;height:210px;object-fit:cover;border-radius:11px}.no-proof{display:grid;place-items:center;background:#edf2ec;color:#71817f}.moderation-actions{grid-column:1/-1;display:flex;align-items:end;gap:14px;border-top:1px solid #e1e8e2;padding-top:18px}.moderation-actions label{flex:1;color:#60716e;font-size:12px;text-transform:uppercase;letter-spacing:.08em}.moderation-actions textarea{display:block;width:100%;margin-top:6px;padding:10px;border:1px solid #d4ddd6;border-radius:8px;resize:vertical}.moderation-actions>div{display:flex;gap:8px}.moderation-actions .reject{background:#f0d4ce;color:#842f25}.moderation-actions .delete{background:transparent;color:#842f25;border:1px solid #d8aaa1}.moderation-actions button:disabled{opacity:.55}
 footer{min-height:118px;background:var(--deep);color:#dbe4df;padding:28px max(32px,calc((100vw - 1360px)/2));display:grid;grid-template-columns:1fr 1fr auto;align-items:center;gap:28px}footer .brand-mark{border-color:#ffffff32}footer p{font-size:12px;color:#92a4a0}footer>span{font:italic 16px Georgia;color:var(--lime)}
 @media(max-width:1040px){.content-grid{width:min(100% - 36px,900px)}.topbar{width:calc(100% - 36px);grid-template-columns:1fr auto}.live-badge{display:none}.intro{grid-template-columns:1fr;gap:34px;padding-top:54px}.lake-card{height:280px}.dashboard{grid-template-columns:1fr}.detail-card{position:relative;top:auto}.how-it-works{grid-template-columns:1fr}.records-hero,.form-hero{display:block}.records-hero>div:last-child,.form-hero>p{margin-top:25px}}
-@media(max-width:720px){.content-grid,.records-hero,.form-hero,.record-filters,.record-table,.official-note,.report-form,.spot-hero,.periods,.detail-grid{width:calc(100% - 28px)}.topbar{width:100%;padding:13px 14px 0;display:flex;flex-wrap:wrap;height:auto}.topbar .brand{flex:1}.topbar nav{order:2;width:100%;height:46px;overflow-x:auto}.topbar nav a{flex:0 0 auto;font-size:13px}.intro h1,.records-hero h1,.form-hero h1{font-size:55px}.intro{padding:30px 0 25px}.intro h1{font-size:47px;margin:13px 0 12px}.intro-copy>p{font-size:15px;margin:0}.lake-card{display:none}.filters-wrap{position:relative;padding:17px 0}.filters{grid-template-columns:1fr 1fr}.filter-advanced{display:block;grid-column:1/-1;border-top:1px solid #ffffff1d;padding-top:10px}.filter-advanced summary{display:flex;justify-content:space-between;color:#d5dfdc;font-size:12px;cursor:pointer;list-style:none}.filter-advanced summary::-webkit-details-marker{display:none}.filter-advanced summary:before{content:"＋";margin-right:7px;color:var(--lime)}.filter-advanced[open] summary:before{content:"−"}.filter-advanced summary span{margin-left:auto;color:#9fb0ad}.advanced-fields{display:grid!important;grid-template-columns:1fr 1fr;gap:12px;padding-top:12px}.filter-advanced:not([open]) .advanced-fields{display:none!important}.filters button{grid-column:1/-1}.active-filters{min-height:0;overflow-x:auto;padding:10px 14px 0;width:100%;scrollbar-width:none}.active-filters span{flex:0 0 auto}.active-filters a{position:sticky;right:0;padding:6px 10px;background:var(--paper)}.dashboard{padding:28px 0 74px;scroll-margin-top:10px}.spot-card{grid-template-columns:34px 1fr;padding:18px 18px 18px 14px;gap:10px}.spot-stats{grid-column:2;border:0;border-top:1px solid #e2e8e2;padding:13px 0 0;grid-template-columns:repeat(4,1fr)}.card-arrow{display:none}.detail-score{grid-template-columns:105px 1fr}.score-ring{width:100px;height:100px}.principles{grid-template-columns:1fr}.record-filters{display:grid}.record-row{grid-template-columns:1fr 1fr}.record-head{display:none}.record-row>*:nth-child(even){text-align:right}.form-grid,.detail-grid{grid-template-columns:1fr}.spot-hero{padding:28px}.spot-hero h1{font-size:48px}.pin{display:none}footer{grid-template-columns:1fr auto;padding:30px 20px}footer p{grid-column:1/-1;order:3}}
+@media(max-width:720px){.content-grid,.records-hero,.form-hero,.record-filters,.record-table,.official-note,.report-form,.spot-hero,.periods,.detail-grid{width:calc(100% - 28px)}.topbar{width:100%;padding:13px 14px 0;display:flex;flex-wrap:wrap;height:auto}.topbar .brand{flex:1}.topbar nav{order:2;width:100%;height:46px;overflow-x:auto}.topbar nav a{flex:0 0 auto;font-size:13px}.intro h1,.records-hero h1,.form-hero h1{font-size:55px}.intro{padding:30px 0 25px}.intro h1{font-size:47px;margin:13px 0 12px}.intro-copy>p{font-size:15px;margin:0}.lake-card{display:none}.filters-wrap{position:relative;padding:17px 0}.filters{grid-template-columns:1fr 1fr}.filter-advanced-field{display:none}.filter-compact-hidden{display:contents!important}.filters button{grid-column:1/-1}.active-filters{min-height:0;overflow-x:auto;padding:10px 14px 0;width:100%;scrollbar-width:none}.active-filters span{flex:0 0 auto}.active-filters a{position:sticky;right:0;padding:6px 10px;background:var(--paper)}.dashboard{padding:28px 0 74px;scroll-margin-top:10px}.spot-card{grid-template-columns:34px 1fr;padding:18px 18px 18px 14px;gap:10px}.spot-stats{grid-column:2;border:0;border-top:1px solid #e2e8e2;padding:13px 0 0;grid-template-columns:repeat(4,1fr)}.card-arrow{display:none}.detail-score{grid-template-columns:105px 1fr}.score-ring{width:100px;height:100px}.principles{grid-template-columns:1fr}.record-filters{display:grid}.record-row{grid-template-columns:1fr 1fr}.record-head{display:none}.record-row>*:nth-child(even){text-align:right}.form-grid,.detail-grid{grid-template-columns:1fr}.spot-hero{padding:28px}.spot-hero h1{font-size:48px}.pin{display:none}footer{grid-template-columns:1fr auto;padding:30px 20px}footer p{grid-column:1/-1;order:3}}
 @media(max-width:720px){.moderation-app{width:calc(100% - 28px)}.moderation-card{grid-template-columns:1fr}.moderation-proof{grid-row:2}.moderation-actions{grid-column:1;display:block}.moderation-actions>div{margin-top:12px}.admin-login{display:block}.admin-login button{width:100%;margin-top:12px}}
 @media(max-width:480px){.filters{grid-template-columns:1fr 1fr}.spot-stats strong{font-size:16px}.topbar nav{gap:4px}.topbar nav a{padding:0 5px}.brand-name{font-size:14px}.brand-name strong{font-size:17px}.moderation-actions>div{display:grid}.moderation-actions button{width:100%}}
 @media(prefers-reduced-motion:reduce){*{scroll-behavior:auto!important;transition-duration:.01ms!important}}
@@ -37,4 +37,5 @@ footer{min-height:118px;background:var(--deep);color:#dbe4df;padding:28px max(32
 .signal-section{padding:0 0 100px}.signal-heading{display:flex;align-items:end;justify-content:space-between;gap:35px;padding-top:68px;border-top:1px solid #cbd6ce;margin-bottom:25px}.signal-heading h2{font:400 46px/.95 Georgia,serif;letter-spacing:-.045em;margin:8px 0 10px}.signal-heading p{max-width:700px;color:#4d605d;line-height:1.55;margin:0}.signal-count{padding:7px 12px;border:1px solid #c2cec5;border-radius:999px;color:#526662;font-size:12px;white-space:nowrap}.signal-grid{display:grid;grid-template-columns:repeat(3,1fr);gap:13px}.signal-card{position:relative;overflow:hidden;padding:20px;border:1px solid #d6cda9;border-radius:15px;background:linear-gradient(145deg,#fffdf5,#f8f5e9);box-shadow:0 10px 25px #443d1a0a}.signal-card:after{content:"";position:absolute;width:80px;height:80px;right:-40px;bottom:-40px;border:1px solid #bdac6b55;border-radius:50%;box-shadow:0 0 0 13px #bdac6b14}.signal-card__top{display:flex;justify-content:space-between;align-items:center;gap:8px}.quality-chip{display:inline-flex;align-items:center;gap:5px;color:#76570c;font-size:10px;font-weight:750}.quality-chip i{width:18px;height:18px;display:grid;place-items:center;border-radius:50%;background:#f2d77e;font-style:normal}.signal-card h3{font:400 24px Georgia,serif;margin:17px 0 3px}.signal-card>p{margin:0;color:#576966;font-size:13px}.signal-card dl{display:grid;grid-template-columns:repeat(3,1fr);gap:8px;margin:18px 0}.signal-card dl div{padding-top:9px;border-top:1px solid #d9d3b9}.signal-card dt{color:#776f56;font-size:9px;text-transform:uppercase;letter-spacing:.08em}.signal-card dd{margin:4px 0 0;font:400 14px Georgia,serif}.signal-card .missing-note{position:relative;z-index:1;padding:9px 11px;border-radius:8px;background:#efe5bd;color:#6b550f;font-size:11px}.missing-note span{font-weight:800}
 @media(max-width:1040px){.signal-grid{grid-template-columns:repeat(2,1fr)}}
 @media(max-width:720px){.signal-heading{display:block;padding-top:45px}.signal-count{display:inline-block;margin-top:14px}.signal-grid{grid-template-columns:1fr}.signal-card__top{align-items:flex-start}.source-strip{margin-bottom:4px}}
+.load-more,.signal-more{display:inline-flex;align-items:center;gap:8px;padding:12px 20px;border:1px solid #c8d3cb;border-radius:10px;background:#f8faf5;color:#526662;font-size:14px;text-decoration:none;transition:.2s ease}.load-more:hover,.signal-more:hover{background:#eef2ec;border-color:#a8b8af}.load-more span,.signal-more span{color:#82908e;font-size:13px}
 .not-found{min-height:calc(100vh - 204px);display:flex;flex-direction:column;align-items:flex-start;justify-content:center;padding-block:70px}.not-found__float{width:130px;height:130px;display:grid;place-items:center;position:relative;margin-bottom:28px;border:1px solid #b8c8be;border-radius:50%;color:#55751e;box-shadow:0 0 0 16px #dce7d722}.not-found__float strong{position:absolute;right:-18px;bottom:5px;padding:5px 9px;border-radius:20px;background:var(--deep);color:var(--lime);font:italic 14px Georgia,serif}.not-found h1{margin:14px 0 22px;font:400 clamp(58px,8vw,105px)/.88 Georgia,serif;letter-spacing:-.06em}.not-found h1 em{color:#497074;font-weight:400}.not-found p{max-width:600px;color:#4d605d;font-size:17px;line-height:1.6}.not-found>a{display:flex;align-items:center;gap:10px;margin-top:18px;padding:14px 18px;border-radius:10px;background:var(--deep);color:#fff;font-weight:750;text-decoration:none}.not-found>a .fish-icon{color:var(--lime)}

compose.production.yaml

@@ -191,7 +191,7 @@ services:
     depends_on:
       api: {condition: service_healthy}
     command: ["python", "-m", "app.community_scheduler"]
-    networks: [backend]
+    networks: [backend, edge]
     security_opt: [no-new-privileges:true]
     logging: *default-logging
     deploy:

deploy/Caddyfile

@@ -5,6 +5,7 @@
 
 {$SITE_DOMAIN} {
   encode zstd gzip
+  body_limit 10M
 
   @immutable path /_astro/*
   header @immutable Cache-Control "public, max-age=31536000, immutable"

deploy/monitor.sh

@@ -39,7 +39,7 @@ fail() {
 }
 
 running=$($compose ps --status running --services 2>/dev/null) || running=""
-for service in proxy db minio api web; do
+for service in proxy db minio api web community-scheduler; do
   printf '%s\n' "$running" | grep -qx "$service" || fail "service:$service"
 done
 

deploy/test-production-bootstrap.sh

@@ -21,7 +21,7 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM
 
-$compose up --build -d --wait db minio api web
+$compose up --build -d --wait db minio api web proxy community-scheduler
 curl -fsS "http://127.0.0.1:$BOOTSTRAP_API_PORT/ready" >/dev/null
 curl -fsS "http://127.0.0.1:$BOOTSTRAP_WEB_PORT/" >/dev/null
 curl -fsS -D - -o /dev/null "http://127.0.0.1:$BOOTSTRAP_API_PORT/health" | grep -qi '^x-frame-options: DENY'

rf4_research/community_cli.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+import fcntl
 import json
 import os
 import sys
@@ -31,6 +32,13 @@ DETAIL_SOURCES = {
 USER_AGENT = "RF4-Spotter/0.1 (authorized data integration)"
 MIN_FETCH_INTERVAL_SECONDS = 30 * 60
 DEFAULT_STATE_FILE = Path(".cache/community-fetch-state.json")
+ALLOWED_HOSTS = frozenset({
+    "download.rf4db.com", "rf4db.com",
+    "rf4-stat.ru",
+    "rf4map.ru",
+    "rf4-posts.com",
+})
+MAX_RESPONSE_BYTES = 5 * 1024 * 1024  # 5 MB
 
 
 def fetch_site_key(url: str) -> str:
@@ -47,10 +55,12 @@ def enforce_fetch_interval(
     source: str, *, state_file: Path, now: float | None = None,
 ) -> None:
     now = time.time() if now is None else now
+    with open(state_file, "r") as f:
+        fcntl.flock(f, fcntl.LOCK_SH)
         try:
-        state = json.loads(state_file.read_text(encoding="utf-8"))
-    except (FileNotFoundError, json.JSONDecodeError, OSError):
-        state = {}
+            state = json.loads(f.read(encoding="utf-8"))
+        finally:
+            fcntl.flock(f, fcntl.LOCK_UN)
     last_fetch = state.get(source)
     if isinstance(last_fetch, (int, float)) and now - last_fetch < MIN_FETCH_INTERVAL_SECONDS:
         wait = int(MIN_FETCH_INTERVAL_SECONDS - (now - last_fetch))
@@ -59,23 +69,35 @@ def enforce_fetch_interval(
 
 def mark_fetch(source: str, *, state_file: Path, now: float | None = None) -> None:
     now = time.time() if now is None else now
+    state_file.parent.mkdir(parents=True, exist_ok=True)
+    with open(state_file, "r+") as f:
+        fcntl.flock(f, fcntl.LOCK_EX)
         try:
-        state = json.loads(state_file.read_text(encoding="utf-8"))
-    except (FileNotFoundError, json.JSONDecodeError, OSError):
+            try:
+                state = json.loads(f.read(encoding="utf-8"))
+            except (json.JSONDecodeError, ValueError):
                 state = {}
             state[source] = now
-    state_file.parent.mkdir(parents=True, exist_ok=True)
-    temporary = state_file.with_suffix(".tmp")
-    temporary.write_text(json.dumps(state, sort_keys=True), encoding="utf-8")
-    temporary.replace(state_file)
+            f.seek(0)
+            f.truncate()
+            f.write(json.dumps(state, sort_keys=True))
+        finally:
+            fcntl.flock(f, fcntl.LOCK_UN)
 
 
 def fetch_html(url: str, *, timeout: float = 30) -> str:
     request = Request(url, headers={"User-Agent": USER_AGENT, "Accept": "text/html"})
     with urlopen(request, timeout=timeout) as response:
+        final_url = response.url
+        hostname = (urlsplit(final_url).hostname or "").lower()
+        if hostname not in ALLOWED_HOSTS:
+            raise ValueError(f"URL hostname {hostname} not in allowlist")
         if response.headers.get_content_type() != "text/html":
             raise ValueError(f"expected text/html, got {response.headers.get_content_type()}")
-        return response.read().decode(response.headers.get_content_charset() or "utf-8")
+        data = response.read(MAX_RESPONSE_BYTES + 1)
+        if len(data) > MAX_RESPONSE_BYTES:
+            raise ValueError("response exceeded 5MB limit")
+        return data.decode(response.headers.get_content_charset() or "utf-8")
 
 
 def main(argv: list[str] | None = None) -> int: