Apps initiating login with their own redirect target (e.g.
myice://callback for the mobile app) always ended up on the web
frontend because /callback ignored the requested target and
redirected to FRONTEND_URL.
Store the requested target in an httpOnly cookie at /login, validated
against an ALLOWED_REDIRECT_URIS allowlist, and redirect back to it
at /callback on all paths. Re-validate the cookie value when read to
guard against cookie tossing, drop the '/' prefix that broke deep
links on the error path, and URL-encode error details in redirects.
Bump mypy to 2.3.1 and refresh all pre-commit hooks (ruff 0.16,
markdownlint 0.18). Fix issues surfaced by the new tooling:
- Use lowercase samesite cookie values (mypy 2.x)
- Remove no-op global declarations and address new ruff findings;
ignore rules that would require behavior changes
- Add missing comma in AI system prompt (strings were concatenated)
- Wrap long README lines for MD013
Add documentation about the web interface (index.html and webapi.py) including how to run it and available endpoints. Also document the mobile API functions (mobile-login, mobile, mobile-game) that can be used for debugging or when the web interface is not available.
🛠️ myice/myice.py: Implemented a function to parse the schedule JSON file based on given age groups, improved error handling, enhanced formatting when printing results, added a new command `myice search`
herel