12 Commits
Author SHA1 Message Date
Shinei Nouzen a8f1917ce7 feat: v2.2.0 — Modularize codebase, unify mirror fallback, harden security
Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor

New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()

Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks

Code Quality:
- All files follow strict documentation style (box headers, section separators,
  feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history
2026-07-28 19:28:21 +05:30
Shinei Nouzen 5ca688ab45 feat: add creator info middleware from MiruroAPI
- Add src/middleware/creatorInfo.js (ESM adapted)
- Injects creator attribution (name, GitHub, Telegram, timestamp) into every JSON response
- Updates server.js to use addCreatorInfo middleware
- Updates CHANGELOG.md, README.md, and docs/architecture.md
2026-07-04 15:31:59 +05:30
Shinei Nouzen fe51275db0 feat: upgrade to v2.0.0 with multi-mirror fallback, new endpoints, and LRU cache
- Add multi-mirror fallback system with 5 mirror domains
- Add LRU cache with configurable TTL per endpoint
- Add response compression (gzip)
- Add Seasons endpoint (/api/seasons/:id)
- Add Watch Order endpoint (/api/watch-order/:id)
- Add Latest Updated endpoint (/api/latest-updated)
- Add Download endpoint (/api/download)
- Add cache stats endpoint (/api/cache/stats)
- Add mirror status/reset endpoints (/api/mirrors, /api/mirrors/reset)
- Add configurable rate limiting with X-RateLimit headers
- Add request timeouts and entity too large handling
- Update documentation with all new endpoints
- Update CHANGELOG.md with v2.0.0 entry
- Update package.json version to 2.0.0
- Add 6 AI agent prompts for development
2026-07-04 15:07:07 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 30feda703a fix: CORS header missing when ALLOWED_ORIGINS env not set
Browser blocks cross-origin requests from AniKotoWeb because
Access-Control-Allow-Origin was never set when ALLOWED_ORIGINS
was undefined on Vercel. Changed condition to allow all origins
when env var is not configured.
2026-06-09 11:05:16 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 100b9f9414 v1.9.0: Full diagnostic sweep - 42 issues fixed
Critical fixes (7):
- Added global Express error handler (returns JSON instead of HTML)
- Removed caching from random endpoint (defeated purpose)
- Renamed share.jpg to share.png (MIME type mismatch)
- Fixed OG image dimensions (630 → 601)
- Fixed manifest.json icon sizes (192x192 → 512x512)
- Fixed implicit global event variable in console
- Added 9 missing endpoints to docs/endpoints.md

High fixes (12):
- Imported version from package.json (no hardcoded drift)
- Added dynamic endpoint count in stats
- Added input sanitization for mapper API (SSRF prevention)
- Added homepage caching (reduced 5 duplicate HTTP requests)
- Added rate limiting (100 requests/minute per IP)
- Added rel="noopener noreferrer" to all target="_blank" links
- Fixed trailing slash inconsistency in console
- Added noindex meta to 404.html
- Fixed docs/architecture.md controller filenames and dependency versions
- Fixed README.md dependency versions
- Added 12 missing endpoint tests

Medium fixes (22):
- Added escapeHtml helper for error messages
- Consistent favicon across all pages
- Added meta descriptions to privacy.html and tos.html
- Added OG/Twitter meta tags to privacy.html and tos.html
- Added aria-label to playground inputs
- Added aria-hidden to decorative SVGs
- Synced Twitter description with OG description
- Fixed robots.txt to disallow /api
- Added PWA fields to manifest.json
- Removed 5 unused imports
- Removed unused cookie-parser dependency
- Fixed inconsistent error handling in extractors
- Fixed resolvedSlug returning numeric ID
- Added /watch endpoint to streaming docs
- Improved test assertions and status code validation
- Deleted orphaned og-image.svg and logo.png

Low fixes (11):
- Removed redundant try/catch from extractPages
- Added max size eviction to cache
- Added cache key sorting in filter controller
- Added author meta tag
- Fixed favicon.svg font

Version bumped to 1.9.0
2026-06-09 06:00:37 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 5ad3189b8a v1.8.0: Full diagnostic sweep - 20 bugs fixed
Critical fixes:
- extractPages.helper.js: Pagination URL bug (?page → &page)
- package.json: Fixed invalid dep versions (axios, dotenv, express)
- privacy.html + tos.html: Broken footer links (//tos → /tos)
- manifest.json: Invalid icon purpose (any maskable → maskable)

High fixes:
- server.js: Removed duplicate CORS middleware (triple → single)
- search.controller.js: Cache key collision with suggestion controller
- apiRoutes.js: Dynamic endpoint count (was hardcoded 27)
- vercel.json: Removed duplicate CORS header

Medium fixes:
- header.config.js: Updated User-Agent to Chrome 130
- dataUrl.js: Removed redundant domain from ALT_DOMAINS
- category.extractor.js: Removed unused cheerio import
- server.js: Added __dirname, removed unused cors import

Documentation:
- CHANGELOG.md: Added v1.8.0 entry
- README.md: Updated version badges (1.8.0, Express 4.21)
- test.js: Fixed status endpoint (currently-airing → airing)
2026-06-09 05:14:56 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ e9b0fba22b feat: add health, stats, OpenAPI, security headers, tests
- /api/health — uptime, version, memory usage
- /api/stats — request count, error rate, cache info
- /api/openapi — OpenAPI 3.0.3 specification
- Security headers: X-Frame-Options, X-Content-Type-Options, X-XSS-Protection
- Request counter middleware
- CONTRIBUTING.md — contribution guidelines
- test.js — integration test suite (18 endpoints)
2026-06-08 22:08:38 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 445b6f7c71 fix: clean URLs — /tos and /privacy instead of /tos.html and /privacy.html
- Added Express routes for /tos and /privacy
- Updated all internal links (index.html, privacy.html, tos.html)
- Updated sitemap.xml URLs
- Updated README and docs architecture
2026-06-08 21:21:55 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ b1eb899aa9 v1.7.0: Rebrand AniKatoAPI → AniKotoAPI
BREAKING: Complete project rebrand across 66 files
- AniKatoAPI → AniKotoAPI (project name)
- AniKato → AniKoto (brand references)
- anikato.vercel.app → anikoto.vercel.app (URLs)
- anikototv.to preserved (source website domain)
- Updated: README, package.json, server.js, all controllers,
  extractors, configs, routes, public pages, legal docs
2026-06-08 19:41:00 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 6f75bab281 fix: use process.cwd() for public dir + simplified routes
- Changed publicDir to use process.cwd() for Vercel compatibility
- Simplified vercel.json routes: API -> server.js, everything else -> server.js
- Express.static will serve files from public/ directory
2026-06-08 18:06:29 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 0034617c3b v1.5.0: Complete documentation rewrite - 50+ files with AlisaReactionBot style
- Box-style header comments (Project, Author, License) on every file
- Section headers using double-line box decorators
- Feature markers (// ---- FEATURE: XYZ ----) before every major function
- JSDoc comments for EVERY function with @param, @returns, @example
- Inline notes (NOTE, WARNING, TIP) for non-obvious logic
- Footer END markers on every module
- Matched code style to AlisaReactionBot repository
- All files now searchable by feature name via grep

Author: Shinei Nouzen <157171073+Shineii86@users.noreply.github.com>
2026-06-08 16:14:01 +05:30
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ 3815521b0d feat: initial project setup for AniKatoAPI
- Express.js server with Vercel deployment support
- Complete API endpoints for anikototv.to anime data
- Home, search, info, episodes, stream, schedule endpoints
- Category filtering and genre support
- Caching system with 5-minute TTL
- CORS configuration
- Public documentation page
- Docker and Render deployment configs
- MIT License
2026-06-08 15:08:22 +05:30