fix(release): URL-encode release asset names #5

2026-08-20T04:48:44Z

adrianbonpin commented

2026-08-20 04:48:44 +00:00

Fix the release asset filename so the '+' in the signed xpi name survives URL decoding.

adrianbonpin added 6 commits 2026-08-20 04:48:45 +00:00

feat(v1.4.0): CSV/Excel/JSON/NextUp exports + hybrid smart year standing 53d5ca6d04

- Export modules (export-csv/json/xlsx) mirroring the PDF layout, plus a
  Next Up import CSV matching the raycast/nextup column contract.
- Hybrid Year Level: View Grades history (exact per-semester standing),
  falling back to units math (prospectus total - lacking), then profile.
  Popup adds a year-mode setting (auto/custom/off).
- On-page button row now offers PDF / CSV / Excel / JSON / Next Up.
- Bump version to 1.4.0.
- Tag-only build workflow with an optional AMO sign step for a signed .xpi;
  separate ci.yml keeps tests on pushes/PRs.
- Tests: year-standing parser tests + export tests (CSV quoting, JSON schema,
  XLSX structure); CI validates XLSX via openpyxl.

ci: run tests on v1.4.0 feature branch

ci / test (push) Successful in 2m9s

Details

ci / test (pull_request) Successful in 42s

Details

3067335274

fix(year-level): prefer units-passed standing over calendar-year history count

ci / test (push) Successful in 2m21s

Details

ci / test (pull_request) Successful in 38s

Details

90e4107bf0

The grade-history method counted distinct academic years, which over-advanced
standing for students who repeated/failed a year (e.g. showing Year 5 when the
student is genuinely Year 4, since a partial 2025 year didn't advance them).

Reorder the hybrid so the UNITS math (total prospectus units minus still-lacking
units = units actually passed) is primary, and View Grades history is only a
fallback when units data is unavailable.

feat(progress): live status bar + % complete during exports

ci / test (push) Successful in 39s

Details

ci / test (pull_request) Successful in 44s

Details

eb7087d506

Adds a progress bar below the export buttons showing the current step
(reading table, fetching course descriptions i/N, profile, year level,
building file) with a 0-100% fill. Threads an onProgress callback through
scrapeStudyLoad and resolveYearLevel. Buttons disable during export to
prevent double-triggers; bar clears ~3s after success.

feat(security): encrypt profile passwords at rest with AES-GCM

ci / test (push) Successful in 57s

Details

ci / test (pull_request) Successful in 52s

Details

7adad7cbc8

Passwords are now encrypted with Web Crypto AES-GCM (256-bit) before being
stored in browser.storage.local. The random key is persisted so it survives
browser/service-worker restarts (otherwise old ciphertext could never be
decrypted). Encryption/decryption happen in the background via
encrypt-password/decrypt-password messages; autoLogin decrypts on the fly and
falls back to a legacy plaintext password for pre-encryption profiles. The
popup never reveals a stored password and preserves it when editing with a
blank field.

Removes the plaintext-password-at-rest smell flagged in the design review.
Note: this is at-rest obfuscation-level security (the key ships with the
extension); the extension only talks to the school portal.

fix(release): URL-encode release asset names

ci / test (pull_request) Successful in 44s

Details

43ee3e035e

The release upload passed basename() raw in the name= query param, so a '+'
in the signed xpi filename (ismis-helper-1.4.0-an+fx.xpi) was URL-decoded to a
space ('ismis-helper-1.4.0-an fx.xpi'). Encode the name with
urllib.parse.quote before the request.

adrianbonpin closed this pull request

2026-08-20 04:48:53 +00:00

adrianbonpin deleted branch fix/release-asset-name-encoding

2026-08-20 04:48:53 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adrianbonpin/ismis-helper#5