From 5acf8a2e1eea230ffb502fa466f950046bd92f55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=CA=9C=C9=AA=C9=B4=E1=B4=87=C9=AA=20N=E1=B4=8F=E1=B4=9C?=
 =?UTF-8?q?=E1=B4=A2=E1=B4=87=C9=B4?=
 <157171073+Shineii86@users.noreply.github.com>
Date: Thu, 25 Jun 2026 09:56:58 +0530
Subject: [PATCH] =?UTF-8?q?Fix=20diagnostic=20sweep=20bugs=20=E2=80=94=20t?=
 =?UTF-8?q?ags,=20random,=20404s,=20security=20headers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Tags: data.TagCollection→data.MediaTagCollection (was returning empty array)
- Random: Math.random()*50→crypto.randomInt(1,500) for true randomness
- Character/Staff: return 404 instead of 500 on not-found
- Security: added X-XSS-Protection header
- All 44 endpoints tested in full diagnostic sweep
---
 server.js               |  1 +
 src/helpers/anilist.js  |  2 +-
 src/routes/apiRoutes.js | 11 +++++++----
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/server.js b/server.js
index 49052d4..466ddd0 100644
--- a/server.js
+++ b/server.js
@@ -113,6 +113,7 @@ app.use((req, res, next) => {
 app.use((req, res, next) => {
   res.setHeader("X-Frame-Options", "DENY");
   res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-XSS-Protection", "1; mode=block");
   res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
   res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
diff --git a/src/helpers/anilist.js b/src/helpers/anilist.js
index 27f8343..0682b54 100644
--- a/src/helpers/anilist.js
+++ b/src/helpers/anilist.js
@@ -609,7 +609,7 @@ const getAllGenres = async () => {
 const getAllTags = async () => {
   const gql = `query { MediaTagCollection { name description category isGeneralSpoiler isMediaSpoiler isAdult } }`;
   const data = await anilistQuery(gql);
-  return data.TagCollection;
+  return data.MediaTagCollection;
 };
 
 // ══════════════════════════════════════════════════════════════
diff --git a/src/routes/apiRoutes.js b/src/routes/apiRoutes.js
index 119058b..4a1228e 100644
--- a/src/routes/apiRoutes.js
+++ b/src/routes/apiRoutes.js
@@ -320,8 +320,9 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
   // ---- FEATURE: Random anime of the day ----
   router.get("/random", async (req, res) => {
     try {
-      // NOTE: Get random page from trending to ensure variety
-      const randomPage = Math.floor(Math.random() * 50) + 1;
+      // NOTE: Use crypto for better randomness in serverless + wider range for variety
+      const crypto = require("crypto");
+      const randomPage = crypto.randomInt(1, 500);
       const data = await anilist.getCollection("POPULARITY_DESC", null, randomPage, 1);
       const anime = data.results[0];
 
@@ -505,7 +506,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });
 
@@ -524,7 +526,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });