refactor: convert to bun workspaces monorepo

- Move web app into apps/web/ - Create packages/shared/ with shared types - Create plugins/decky-vault/ scaffold - Root package.json manages workspaces only
2026-06-28 05:20:28 +08:00
parent c4bede20d4
commit cd72b7a948
345 changed files with 488 additions and 126 deletions
@@ -0,0 +1,31 @@
+---
+title: "Landing Page, SteamDB Version Sync, and Security Hardening"
+date: "2026-05-14"
+version: "2026.0.101"
+summary: "Discover trending games on the new landing page, auto-fetch latest game versions from SteamDB, and enjoy improved API security."
+---
+
+### New Landing Page
+
+The homepage now showcases what's happening in the DeckyVault community:
+
+- **Recently Added Benchmarks** — games with the newest benchmark submissions
+- **Trending This Week** — games with the most benchmarks, comments, and upvotes in the last 7 days
+- **Most Tested Games** — the most benchmarked games across all devices
+
+Each section shows compact game cards with cover art, **playability badges** (with readable status labels), **performance tags** (Raw Performer / Poor Performance), and average FPS. Click any card to jump straight to the game's detail page.
+
+### SteamDB Version Auto-Fetch
+
+When submitting a benchmark, the wizard now automatically checks SteamDB for the latest game version and build ID. If found, it appears as a recommended option at the top of the version selector — no more guessing which version you're on.
+
+This feature is best-effort and can be disabled via the `STEAMDB_SCRAPING_ENABLED` environment variable.
+
+### API Security Hardening
+
+We've tightened up the API with several layers of protection:
+
+- **Tiered rate limiting** — different limits for authentication, reads, writes, and public forms
+- **Comment anti-spam** — duplicate detection, size limits, and hourly caps
+- **Submission validation** — FPS must be within realistic bounds, settings payloads have size caps
+- **Content sanitization** — comment content is cleaned server-side before storage