Fix Streambert review findings

index.js

@@ -230,6 +230,7 @@ function createWindow() {
       additionalArguments: ["--js-flags=--max-old-space-size=256 --expose-gc"],
     },
   });
+  playerIpc.registerWindowStateListeners(mainWindow);
 
   // Force long-lived disk caching for TMDB images in the default session.
   session.defaultSession.webRequest.onHeadersReceived(

package.json

@@ -33,6 +33,9 @@
     "terser": "^5.46.0",
     "vite": "^7.3.1"
   },
+  "overrides": {
+    "esbuild": "^0.28.1"
+  },
   "build": {
     "appId": "com.truelockmc.streambert",
     "productName": "Streambert",

src/App.jsx

@@ -1025,6 +1025,7 @@ export default function App() {
                 onMarkWatched={markWatched}
                 onMarkUnwatched={markUnwatched}
                 onRemoveHistory={removeHistory}
+                apiKey={apiKey}
               />
             )}
             {page === "settings" && (

src/components/UpdateModal.jsx

@@ -446,9 +446,11 @@ export default function UpdateModal({
     return () => window.electron.offUpdateProgress(handler);
   }, []);
 
-  const assetUrl = format && assets?.[format];
+  const asset = format ? assets?.[format] : null;
+  const assetUrl = typeof asset === "string" ? asset : asset?.url;
+  const assetDigest = typeof asset === "string" ? null : asset?.digest;
   const canInstall =
-    format && assetUrl && activeDownloads === 0 && phase === "idle";
+    format && assetUrl && assetDigest && activeDownloads === 0 && phase === "idle";
 
   const handleInstall = async () => {
     if (!canInstall) return;
@@ -461,6 +463,7 @@ export default function UpdateModal({
       const result = await window.electron.downloadAndInstallUpdate({
         url: assetUrl,
         format,
+        digest: assetDigest,
       });
       if (cancelRef.current) return;
       if (!result.ok) throw new Error(result.error || "Update failed");
@@ -707,6 +710,25 @@ export default function UpdateModal({
             </div>
           )}
 
+          {format && assetUrl && !assetDigest && phase === "idle" && (
+            <div
+              style={{ fontSize: 12, color: "var(--text3)", marginBottom: 12 }}
+            >
+              This release asset does not include a checksum. Use the{" "}
+              <a
+                href={url}
+                onClick={(e) => {
+                  e.preventDefault();
+                  window.electron?.openExternal(url);
+                }}
+                style={{ color: "var(--red)", cursor: "pointer" }}
+              >
+                GitHub releases page
+              </a>{" "}
+              to download manually.
+            </div>
+          )}
+
           {/* Progress bar */}
           {(phase === "downloading" || phase === "installing") && (
             <div style={{ marginBottom: 14 }}>

src/ipc/downloads.js

@@ -719,7 +719,7 @@ function register(getMainWindow) {
 
   ipcMain.handle("get-downloads", () => downloads);
 
-  ipcMain.handle("delete-download", (_, { id, filePath }) => {
+  ipcMain.handle("delete-download", (_, { id }) => {
     try {
       const dlEntry = downloads.find((d) => d.id === id);
       if (activeProcs.has(id)) {
@@ -728,9 +728,9 @@ function register(getMainWindow) {
         } catch {}
         activeProcs.delete(id);
       }
-      if (filePath) {
+      if (dlEntry?.filePath) {
         try {
-          if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+          if (fs.existsSync(dlEntry.filePath)) fs.unlinkSync(dlEntry.filePath);
         } catch {}
       }
       for (const sp of dlEntry?.subtitlePaths || []) {

src/ipc/player.js

@@ -7,9 +7,40 @@ const fs = require("fs");
 const https = require("https");
 const http = require("http");
 const os = require("os");
+const crypto = require("crypto");
 
 let _updateAbortController = null;
 
+function normaliseSha256Digest(digest) {
+  if (typeof digest !== "string") return null;
+  const trimmed = digest.trim().toLowerCase();
+  const match =
+    trimmed.match(/^sha256:([a-f0-9]{64})$/) ||
+    trimmed.match(/^([a-f0-9]{64})$/);
+  return match ? match[1] : null;
+}
+
+function sha256File(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash("sha256");
+    const stream = fs.createReadStream(filePath);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", () => resolve(hash.digest("hex")));
+  });
+}
+
+function registerWindowStateListeners(win) {
+  if (!win || win.isDestroyed()) return;
+  const pushMaximized = (v) => {
+    if (!win.isDestroyed()) win.webContents.send("window-maximized", v);
+  };
+  win.on("maximize", () => pushMaximized(true));
+  win.on("unmaximize", () => pushMaximized(false));
+  win.on("enter-full-screen", () => pushMaximized(true));
+  win.on("leave-full-screen", () => pushMaximized(false));
+}
+
 function register(getMainWindow, { writeSecretMigration }) {
   // ── Open file at specific timestamp in mpv / VLC ─────────────────────────
   ipcMain.handle(
@@ -113,19 +144,6 @@ function register(getMainWindow, { writeSecretMigration }) {
     return mw ? mw.isMaximized() : false;
   });
 
-  // Push maximize state to the renderer so WindowTitlebar doesn't need to poll
-  const pushMaximized = (v) => {
-    const mw = getMainWindow();
-    if (mw && !mw.isDestroyed()) mw.webContents.send("window-maximized", v);
-  };
-  const mwForEvents = getMainWindow();
-  if (mwForEvents) {
-    mwForEvents.on("maximize", () => pushMaximized(true));
-    mwForEvents.on("unmaximize", () => pushMaximized(false));
-    mwForEvents.on("enter-full-screen", () => pushMaximized(true));
-    mwForEvents.on("leave-full-screen", () => pushMaximized(false));
-  }
-
   ipcMain.handle("quit-app", () => {
     const mw = getMainWindow();
     if (mw && !mw.isDestroyed()) mw.close();
@@ -208,14 +226,19 @@ function register(getMainWindow, { writeSecretMigration }) {
     return null;
   });
 
-  ipcMain.handle("download-and-install-update", async (_, { url, format }) => {
+  ipcMain.handle("download-and-install-update", async (_, { url, format, digest }) => {
     try {
 
       const ALLOWED_FORMATS = ["exe", "deb", "pacman", "dmg", "dmg_arm64", "appimage"];
       if (!ALLOWED_FORMATS.includes(format)) {
         return { ok: false, error: "Invalid format" };
       }
 
+      const expectedSha256 = normaliseSha256Digest(digest);
+      if (!expectedSha256) {
+        return { ok: false, error: "Missing or invalid update checksum" };
+      }
+
       const TRUSTED_ORIGIN   = "https://github.com";
       const TRUSTED_PATH     = "/truelockmc/streambert/releases/download/";
       // Domains that are allowed as redirect targets (GitHub CDN).
@@ -340,6 +363,24 @@ function register(getMainWindow, { writeSecretMigration }) {
 
       if (signal.aborted) return { ok: false, error: "Cancelled" };
 
+      const sendVerifying = () => {
+        const mw = getMainWindow();
+        if (mw && !mw.isDestroyed()) {
+          mw.webContents.send("update-progress", {
+            percent: 100,
+            label: "Verifying…",
+          });
+        }
+      };
+      sendVerifying();
+      const actualSha256 = await sha256File(destPath);
+      if (actualSha256 !== expectedSha256) {
+        try {
+          fs.unlinkSync(destPath);
+        } catch {}
+        return { ok: false, error: "Update checksum verification failed" };
+      }
+
       // ── Helper: send "Installing…" to renderer ──────────────────────────────
       const sendInstalling = () => {
         const mw = getMainWindow();
@@ -520,4 +561,4 @@ function register(getMainWindow, { writeSecretMigration }) {
   });
 }
 
-module.exports = { register };
+module.exports = { register, registerWindowStateListeners };

src/ipc/subtitles.js

@@ -507,18 +507,31 @@ function register({ getDownloads, saveDownloads }) {
   // ── Delete a single subtitle file ─────────────────────────────────────────
   ipcMain.handle("delete-subtitle-file", (_, { downloadId, subtitlePath }) => {
     try {
-      if (subtitlePath && fs.existsSync(subtitlePath))
-        fs.unlinkSync(subtitlePath);
-      if (downloadId) {
-        const downloads = getDownloads();
-        const idx = downloads.findIndex((d) => d.id === downloadId);
-        if (idx >= 0) {
-          downloads[idx].subtitlePaths = (
-            downloads[idx].subtitlePaths || []
-          ).filter((sp) => sp.path !== subtitlePath);
-          saveDownloads();
-        }
+      if (!downloadId || !subtitlePath) {
+        return { ok: false, error: "Missing subtitle record" };
       }
+
+      const downloads = getDownloads();
+      const idx = downloads.findIndex((d) => d.id === downloadId);
+      if (idx < 0) return { ok: false, error: "Download not found" };
+
+      const requestedPath = path.resolve(subtitlePath);
+      const subtitlePaths = downloads[idx].subtitlePaths || [];
+      const stored = subtitlePaths.find((sp) => {
+        const p = typeof sp === "string" ? sp : sp?.path;
+        return p && path.resolve(p) === requestedPath;
+      });
+      if (!stored) return { ok: false, error: "Subtitle path not registered" };
+
+      const storedPath = typeof stored === "string" ? stored : stored.path;
+      if (storedPath && fs.existsSync(storedPath)) {
+        fs.unlinkSync(storedPath);
+      }
+      downloads[idx].subtitlePaths = subtitlePaths.filter((sp) => {
+        const p = typeof sp === "string" ? sp : sp?.path;
+        return p && path.resolve(p) !== requestedPath;
+      });
+      saveDownloads();
       return { ok: true };
     } catch (e) {
       return { ok: false, error: e.message };

src/pages/HomePage.jsx

@@ -70,7 +70,7 @@ export default function HomePage({
     [inProgress, trending, trendingTV, recommendedItems, topRatedItems],
   );
 
-  const { ratingsMap, ageLimitSetting } = useRatings(allItems);
+  const { ratingsMap, ageLimitSetting } = useRatings(allItems, apiKey);
 
   const getRating = useCallback(
     (item) => getRatingForItem(item, ratingsMap),

src/pages/LibraryPage.jsx

@@ -16,12 +16,13 @@ export default function LibraryPage({
   onMarkWatched,
   onMarkUnwatched,
   onRemoveHistory,
+  apiKey,
 }) {
   const allItems = useMemo(
     () => [...inProgress, ...saved],
     [inProgress, saved],
   );
-  const { ratingsMap, ageLimitSetting } = useRatings(allItems);
+  const { ratingsMap, ageLimitSetting } = useRatings(allItems, apiKey);
 
   const [sort, setSort] = useState(
     () => storage.get(STORAGE_KEYS.LIBRARY_SORT) || "manual",

src/utils/updates.js

@@ -52,19 +52,26 @@ export async function checkForUpdates() {
   const url =
     data.html_url || `https://github.com/${GITHUB_REPO}/releases/latest`;
 
+  const toAssetInfo = (asset) => ({
+    url: asset.browser_download_url,
+    digest: asset.digest || null,
+    name: asset.name,
+    size: asset.size || null,
+  });
+
   // Map release assets to install formats
   const assets = {};
   for (const asset of data.assets || []) {
     const name = asset.name.toLowerCase();
     if (name.endsWith(".appimage"))
-      assets.appimage = asset.browser_download_url;
-    else if (name.endsWith(".deb")) assets.deb = asset.browser_download_url;
+      assets.appimage = toAssetInfo(asset);
+    else if (name.endsWith(".deb")) assets.deb = toAssetInfo(asset);
     else if (name.endsWith(".exe"))
-      assets.exe = asset.browser_download_url;
+      assets.exe = toAssetInfo(asset);
     else if (name.endsWith(".pacman"))
-      assets.pacman = asset.browser_download_url;
+      assets.pacman = toAssetInfo(asset);
     else if (name.endsWith(".dmg"))
-      assets.dmg = asset.browser_download_url;
+      assets.dmg = toAssetInfo(asset);
   }
 
   return {

src/utils/useRatings.js

@@ -5,7 +5,7 @@ import {
   getAgeLimitSetting,
   getRatingCountry,
 } from "./ageRating";
-import { storage, getApiKey } from "./storage";
+import { storage } from "./storage";
 
 const CACHE_KEY = "ratingsCache";
 const CACHE_TTL = 1000 * 60 * 60 * 24 * 7; // 7 days
@@ -41,13 +41,12 @@ function evictStale(cache) {
 /**
  * Hook that fetches + caches age ratings for an array of items.
  */
-export function useRatings(items) {
+export function useRatings(items, apiKey) {
   const [ratingsMap, setRatingsMap] = useState({});
   // Read stable settings once — these only change when user visits Settings,
   // which unmounts/remounts affected pages anyway, so useState(init) is correct.
   const [ageLimitSetting] = useState(() => getAgeLimitSetting(storage));
   const [ratingCountry] = useState(() => getRatingCountry(storage));
-  const [apiKey] = useState(() => getApiKey());
 
   const itemsKey = useMemo(() => {
     if (!items?.length) return "";