Repository navigation
Conversation
|
Thanks for the submission. The current schedule/feed and public code show real utility. A deeper review of upstream commit 3b7ed3d found issues that need clarification before inclusion:
The cron authorization and several proxy restrictions were genuinely applied; I am not alleging a generic auth bypass or arbitrary-host SSRF. Source/deployment equivalence and production exploitation were not tested. Please respond with changes/evidence for these points; this remains on hold. |
|
Thanks for the thorough review. All four points are addressed in a3065ab (branch
Typecheck, lint, the test suite (666 tests) and the production build pass. |
…rden push alerts (#20) Answers the awesome-f1 review (subinium/awesome-f1#12). - License: the code is MIT (LICENSE, package.json). The README notes that it covers the code only, not the data the site shows. - FIA Documents: the PDFs are no longer fetched or relayed. Document links (/<series>/documents/<round>-<number>) redirect to the PDF on fia.com, so the link still never spells out a spoiler, and /documents/<file>.pdf from older links redirects the same way. An earlier Round's link is found in fia_documents. The PDF.js viewer and pdfjs-dist are gone. - F2 and F3 schedules come from the MIT-licensed sportstimes dataset instead of fiaformula2.com and fiaformula3.com, whose terms forbid extraction. - ADR 0001 records the basis for every source: which are licensed, and how the unlicensed ones are read. - undici 7.30.0 -> 7.30.2: npm audit --omit=dev reports no vulnerabilities. - New push subscriptions are saved only after the push service accepts a confirmation push, and at most 10 new devices per client an hour (keyed by an HMAC of the IP address, kept for a day). - Alerts claims are leases (CLAIM_LEASE_MS, the route's 300 s maxDuration) instead of permanent marks, and Schedule Change and Document Alert fan-out saves its progress every PUSH_CHUNK pushes, so a run that stops loses nothing it claimed. Migration 0004 adds the columns and the sign-up table.
Adds motorsportsinfo.app to the Calendar section, after F1 Calendar.
It's a free, non-commercial site that shows every session for F1, F2, F3, WEC, Formula E, IndyCar and MotoGP in the visitor's time zone (or the circuit's local time), with a live countdown to the next one. Each session has a weather forecast for the circuit, and F1 also gets a rain radar. Visitors can turn on web push reminders before the session types they follow and get another push when a session is moved. There's also a subscribable .ics feed that stays current when times change. FIA documents for F1, F2 and F3 appear in an in-page viewer, and F1 results and telemetry are spoiler-safe.
Data comes from OpenF1, Open-Meteo and the FIA, and it's actively maintained with current 2026 data. The source is on GitHub.