Serialize publish-firefox and publish-latest jobs with a 90-second delay
to prevent hitting AMO's rate limit when running in parallel. Ensure
publish-latest still runs even if publish-firefox fails, while
maintaining the job dependency.
Also simplify extension certification notes.
Each provider gets its own page under docs/providers/ with a short description,
what it needs (sign-in, Thingport Grab, FlareSolverr) and its setup steps, with
the provider's icon as an accent. PROVIDER_SETUP.md becomes the overview, with a
dependency and feature table. MakerWorld, Printables and Thingiverse come first
everywhere.
Imports Cults3D models, anyone's likes and the user's own printlists, and
syncs them. Metadata comes from Cults3D's GraphQL API with each user's own
nickname and API key. The API never hands out files, and the site's pages are
behind a Cloudflare check only a browser passes, so Thingport Grab sends the
browser's _session_id and cf_clearance cookies with its User-Agent; with
them the server orders a free model for nothing, as its Download button
does, and follows the download page to the signed file link (CloudFront, or
Cults3D's Scaleway bucket for older models). Paid models download once
bought. A Cloudflare block defers a sync until the next visit with Grab.
Previously, decode errors returned empty string which could clear a
stored session. Now both error paths return undefined to skip sync,
matching snapmakerSession.ts behavior.
- Hide API keys from error messages by stripping query strings
- Validate that category responses contain entries before using them
- Distinguish between unreadable and malformed cookie values with proper types
Imports Thangs models, likes and collections, and syncs them. Metadata is
public; files need the user's own sign-in, which Thingport Grab sends and
Thingport renews from the refresh token. Paid models download once owned;
print-only ones are refused before any download. Free accounts' daily
download limit stops a batch and defers the rest of a sync to its next check.
Profile files often come named alike, so the files on a model read the
same. A profile whose file clashes with another profile's is now named
after its profile, or by its title alone when that already holds the
file's name; profiles with the same title keep the site's name.
Each profile's own picture now becomes its file's thumbnail on Snapmaker
Space, MakerOnline, Creality Cloud and NexPrint too, not just MakerWorld.
Earlier profiles are renamed before the new file is placed, and a preview
render that loses its file to a rename retries from where it went.
- Wrap decodeURIComponent in try-catch to handle malformed percent-encoding
- Add inFlight promise to prevent concurrent callers from reusing single-use refresh tokens
- Require list parameter to be "likes" or "bookmarks" for Snapmaker list URLs
- Update documentation to clarify Snapmaker sign-in renewal and token transmission
Import, collection import and synced collections from MyMiniFactory, alongside MakerWorld,
Printables and Thingiverse.
- Backend: API v2 client with an instance-wide API key for metadata, collections and
authors; files from MyMiniFactory's own download links (free models need no login).
Paid models, and free ones whose files are archives, download as the user from their
MyMiniFactory library through their session (PHPSESSID), fetching the model files
MyMiniFactory unpacked from each archive. Paid models are left out of collection
listings and syncs.
- One migration: MyMiniFactory category ids, username and session columns, plus a data
migration giving existing users' starter categories the new category ids. Category
matching now prefers the most specific site category.
- Frontend: provider everywhere the others appear (badges, Configuration and
Administration providers, sync Browse tab, user menu, link detection, System Health,
category ids), shared instance-key form for Thingiverse and MyMiniFactory, en and lt.
- Thingport Grab: new provider sites are allowed once from the popup (optional
all-sites access, content script registered at runtime), so adding one never makes
the browser disable the extension; captures the signed-in MyMiniFactory username and
session; paid-model notice.
- Docs, website, store assets and screenshots updated.
* feat: expand storage usage reporting with disk breakdown
* feat: add providers admin view
* feat(storage): add background reorganization and admin browser
Adds background-driven storage reorganization for moving model files
when the storage template changes, with an admin interface to preview
changes, check impact, monitor progress, and browse the storage tree
built from plate records rather than filesystem walks.
* feat: new auth admin settings page + OIDC support
* test: fix failing test
* fix(import): stop flagging models that mention robots as a MakerWorld CAPTCHA, and let a manual retry try again
isCaptchaChallenge looked for "captcha" or "robot" in every top-level string of a reply,
design titles and summaries included, so a model named "Robot ..." failed as a CAPTCHA on
every retry and started the 2h cooloff for every other import. Only a captcha key or the
reply's own error, message or msg text counts now.
The cooloff also failed a retry straight away after the user solved the puzzle in the
browser, which is what the error message tells them to do. Starting or retrying a queue job
by hand, a bulk start or retry, and POST /import/jobs/:id/retry now lift it. Automatic
collection syncs still respect it.
* feat(extension): offer "Add to the queue" when MakerWorld blocks an import
A CAPTCHA or the daily download limit won't clear by clicking Import again, so the error
panel lets an admin park the link in the queue with the same collection and profile scope.
* fix(import): let a queue job cut off by a restart be started or retried
A restart marks a running job ERROR with its links still PENDING or RUNNING. The queue page
only offered Start for PAUSED jobs and Retry for jobs with FAILED links, and the API agreed,
so such a job could never run again. The same held for a job whose runner crashed.
Start now takes an ERROR job with links waiting, and a retry reruns links an interrupted
run never reached even when none of them failed.
MakerWorld can leave a design's defaultInstanceId pointing at a print profile that no longer
exists. pickMakerworldInstanceId (extension) and makerworldInstanceIdFromNextData (backend)
returned it unchecked, so the download-link request went to the dead profile and MakerWorld
answered 403 "The client does not have access rights to the content." Use the default only when
it is still one of the design's instances, otherwise the first, as selectMakerworldProfiles
already does.
Fixes#14
Claude-Session: https://claude.ai/code/session_01KGCb65Zhzwd3daF862ZE6R
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
So the web app's Browse tab can list the user's collections there
without asking for a username. Thingiverse's comes from the page
header's own account link; Printables' from its API's `me`, asked with
the session token the way the site does. Sent only when it changes.
Every collection's Sync configuration now works before it's synced: a
Browse tab lists the user's own collections on MakerWorld (through
their cookie, private ones included), Printables and Thingiverse (by a
username asked once), and takes any collection's link. Each provider's
collections are drawn in its own colours and manner.
On Printables and Thingiverse the collection's current models are
imported by the sync's first check. MakerWorld rate-limits bulk
imports, so there only models added from now on come in. Settings can
be picked before turning sync on.
Add POST /collection/:id/items. Thingport Grab uses it to file a
MakerWorld collection's already-imported models instead of one request
per model, falling back on older instances.
A session token outlives a password change, so a stale saved password
only surfaced days later as failing imports. Check the connection by
signing in (at most every 10 minutes) at browser start, before showing
the in-page icon, and when the popup opens.
When it fails, the icon shows a "not connected" badge whose dialog says
whether the credentials were rejected or the instance didn't answer,
and opens the popup's edit form. The toolbar icon gets a badge too.
Concurrent calls with an expired token now share one sign-in.
The collection panel sent one /import/status request per model, all at
once. When any failed it counted the model as new, so a collection
already imported could offer to import almost everything again.
Add POST /import/status/batch and use it, falling back to paced
per-model checks on older instances. A failed check now shows an error
instead of guessing.
