s8n/ARRFLIX
s8n/ARRFLIX
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

doc 04 §3b: triple-logo fix re-applied (sibling POST overwrote first attempt)

Browse source 
Branding endpoint accepts full-object POSTs only — no field-level merge,
no ETag locking. Concurrent agents writing to /System/Configuration/branding
race; last writer wins. Lock-in: branding-CSS POST must be the final POST
in any sequence touching that endpoint.
This commit is contained in:
s8n 2026-05-08 03:26:19 +01:00
parent 514dcb6ffc
commit ba4c281ce0
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
docs/04-theming-and-users.md
View file

@ -231,6 +231,29 @@ Cast/crew hide rule, Cineplex `@import`, `LoginDisclaimer` and
`/web/index.html` (favicon, `<title>ARRFLIX</title>`, `splashLogo`) was
not touched — that asset is owned by the index-patcher.
### 3b. ARRFLIX logo override fix re-applied 2026-05-08 (second time)
Re-curling `/System/Configuration/branding` after §3a was applied showed
the broken three-selector / dual-property rule was back: `.adminDrawerLogo
img, .imgLogoIcon, .pageTitleWithLogo { content: url(...); background-image:
url(...); }`. The §3a fix had been silently overwritten by a sibling agent
that POSTed a full branding payload (LoginDisclaimer + SplashscreenEnabled +
its own stale CustomCss) without first GETting the latest CustomCss. Because
the Jellyfin branding endpoint takes a complete object on every POST and
has no field-level merge, whichever POST lands last wins — there is no
locking, no ETag, no patch semantics. Fix re-applied surgically (split
selectors, drop `.imgLogoIcon`, preserve the data-URL bytes verbatim,
preserve the cast/crew hide, Cineplex `@import`, Quick Connect hide, and
both LoginDisclaimer/SplashscreenEnabled values) and re-verified via
`/Branding/Configuration`. **Operational rule:** any agent or script touching
`/System/Configuration/branding` must (a) GET first, (b) edit only the
fields it owns, (c) POST the full object, and the branding-CSS POST must
be the **last** POST in any sequence that touches this endpoint — otherwise
a later sibling POST will silently re-stack the logo. If you find yourself
about to POST branding for any reason, GET `/System/Configuration/branding`
first and confirm the override block matches the §3a skeleton before
sending.
---
## 4. Multi-user UX prep