Switch all backend endpoints to api.xmoj-script.uk

[Copilot]

Migrates every backend API reference from the legacy api.xmoj-bbs.me / api.xmoj-bbs.tech domains to the new api.xmoj-script.uk domain.

Changes

XMOJ.user.js

• @connect directives: consolidates api.xmoj-bbs.tech + api.xmoj-bbs.me into single api.xmoj-script.uk
• HTTP request base URL and WebSocket URL updated
• 4× image upload response URLs (assets.xmoj-bbs.me → api.xmoj-script.uk)

messages.html

• API_BASE and ASSET_BASE constants updated

- url: "https://api.xmoj-bbs.me/" + Action
+ url: "https://api.xmoj-script.uk/" + Action

- wss://api.xmoj-bbs.me/ws/notifications
+ wss://api.xmoj-script.uk/ws/notifications

- https://assets.xmoj-bbs.me/GetImage?ImageID=
+ https://api.xmoj-script.uk/GetImage?ImageID=

Summary by Sourcery

Update XMOJ script and web UI to use the new xmoj-script.uk domains and adjust related UX and metadata.

Enhancements:

• Switch backend API, WebSocket, and image asset endpoints from legacy xmoj-bbs domains to api.xmoj-script.uk and assets.xmoj-script.uk.
• Update homepage and support URLs in the userscript metadata to point to the new site and GitHub issue tracker.
• Mark SSO login in the messages UI as in-development and prevent automatic redirect on authorize, keeping the flow disabled.
• Remove the “Alpha” status badge from the short-message web UI navigation link to reflect its maturity.
• Bump project and userscript version metadata from 3.4.5 to 3.4.6.

---

Summary by cubic

Switches all API and WebSocket endpoints to api.xmoj-script.uk and standardizes image URLs to assets.xmoj-script.uk/GetImage. Updates homepage/debug URLs and support link, flags SSO login as in development (redirect disabled), removes the “Alpha” badge in navigation, and bumps to 3.4.6 (prerelease).

• Migration
  • Tampermonkey will ask for api.xmoj-script.uk access on update. Accept it.
  • If you whitelist domains (proxy/CSP), add api.xmoj-script.uk and assets.xmoj-script.uk, and remove the old ones.

^{Written for commit e09ddc3. Summary will update on new commits.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates all frontend script and HTML references from legacy xmoj-bbs domains to the new xmoj-script / assets domains, including API, WebSocket, image, homepage/support, and versioning metadata, and marks SSO as in-development while removing the Alpha badge from the messages page link.

Sequence diagram for messages page using new api.xmoj-script.uk endpoints

sequenceDiagram
    actor User
    participant BrowserMessagesPage
    participant XMOJBackendAPI as api_xmoj_script_uk
    participant AssetsService as assets_xmoj_script_uk
    participant NotificationsWS as ws_api_xmoj_script_uk

    User->>BrowserMessagesPage: Open messages.html
    BrowserMessagesPage->>XMOJBackendAPI: POST API_BASE action (https://api.xmoj-script.uk/)
    XMOJBackendAPI-->>BrowserMessagesPage: Messages data (includes ImageID values)

    loop For each message with image
        BrowserMessagesPage->>AssetsService: GET ASSET_BASE + ImageID (https://assets.xmoj-script.uk/GetImage)
        AssetsService-->>BrowserMessagesPage: Image binary
    end

    User->>BrowserMessagesPage: Enable notifications
    BrowserMessagesPage->>NotificationsWS: Connect wss://api.xmoj-script.uk/ws/notifications
    NotificationsWS-->>BrowserMessagesPage: Push new message events
    BrowserMessagesPage-->>User: Render messages and images

Loading

File-Level Changes

Change	Details	Files
Point all API and WebSocket calls in the userscript to api.xmoj-script.uk and adjust related metadata.	Update GM_xmlhttpRequest API base URL to use https://api.xmoj-script.uk/ in non-debug mode. Update WebSocket notification endpoint to wss://api.xmoj-script.uk/ws/notifications with debug fallback unchanged. Change @connect metadata: keep legacy domains and add api.xmoj-script.uk for Tampermonkey permissioning. Update homepage and debug ghpages URLs to xmoj-script.uk. Bump userscript version header from 3.4.5 to 3.4.6 and align package.json version.	XMOJ.user.js package.json
Standardize image asset URLs to the new assets.xmoj-script.uk domain across userscript and messages UI.	Change Markdown image insertion URLs in multiple upload handlers from https://assets.xmoj-bbs.me/GetImage to https://assets.xmoj-script.uk/GetImage in the userscript. Update messages.html ASSET_BASE constant to https://assets.xmoj-script.uk/GetImage?ImageID=.	XMOJ.user.js messages.html
Align messages frontend API base, SSO UX text, and navigation badges with new backend behavior and status.	Update messages.html API_BASE constant from https://api.xmoj-bbs.me/ to https://api.xmoj-script.uk/. Relabel the SSO tab to indicate it is in development and disable the redirect by commenting out the location.href line. Remove the Alpha badge from the messages.html navigation link in index.html.	messages.html index.html
Update support and update-metadata endpoints to new locations.	Change @supportURL from custom support form to GitHub issues URL. Adjust Update.json (not fully shown) to reflect the 3.4.6 release and new endpoints if applicable.	XMOJ.user.js Update.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[cloudflare-workers-and-pages]

Deploying xmoj-script-dev-channel with    Cloudflare Pages

Latest commit:	e09ddc3
Status:	✅  Deploy successful!
Preview URL:	https://57a57d48.xmoj-script-dev-channel.pages.dev
Branch Preview URL:	https://copilot-switch-endpoint-to-a.xmoj-script-dev-channel.pages.dev

View logs

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Now that all runtime API calls target api.xmoj-script.uk, consider removing the legacy @connect entries (api.xmoj-bbs.tech / api.xmoj-bbs.me) from the userscript header to avoid requesting unnecessary Tampermonkey permissions.
• In messages.html, the SSO authorize function no longer navigates to OAUTH_AUTHORIZE_URL; if SSO is intentionally disabled, consider either removing or clearly feature-flagging that path (and associated UI tab) to avoid leaving a partially wired flow in the codebase.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Now that all runtime API calls target `api.xmoj-script.uk`, consider removing the legacy `@connect` entries (`api.xmoj-bbs.tech` / `api.xmoj-bbs.me`) from the userscript header to avoid requesting unnecessary Tampermonkey permissions.
- In `messages.html`, the SSO authorize function no longer navigates to `OAUTH_AUTHORIZE_URL`; if SSO is intentionally disabled, consider either removing or clearly feature-flagging that path (and associated UI tab) to avoid leaving a partially wired flow in the codebase.

## Individual Comments

### Comment 1
<location path="messages.html" line_range="994" />
<code_context>
         scope: OAUTH_SCOPE,
         state: state
     });
-    location.href = OAUTH_AUTHORIZE_URL + '?' + params.toString();
 }

</code_context>
<issue_to_address>
**suggestion:** The SSO initiate function now becomes a no-op, which may be confusing and could be simplified or guarded.

With the redirect removed, `startSsoAuthorize` now just creates `state` and `params` without any effect. If this is a deliberate dev-only stub, consider making that explicit by returning early with a clear stub behavior, or by not constructing `state`/`params` until the flow is re‑enabled. This will reduce confusion for future maintainers.

Suggested implementation:

```
    // SSO initiate flow is temporarily disabled.
    // This stub is intentional: remove or replace when re‑enabling SSO.
    return;
}

```

I assumed the existing implementation of `startSsoAuthorize` was computing `state` and `params` exactly as shown in the `SEARCH` block, and that those values are now unused since the redirect was removed. If the function signature or surrounding code differs, you should:
1. Ensure the `SEARCH` block matches the actual body of `startSsoAuthorize` that creates `state`/`params` so it can be fully replaced with the stub.
2. Optionally add a more explicit comment (e.g., `// TODO: Re‑enable SSO redirect when backend is ready`) if your codebase prefers TODO annotations for temporary stubs.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="messages.html">

<violation number="1" location="messages.html:77">
P2: The SSO login tab button uses `data-tab="sso-develop"`, but tab logic still expects `sso`, so clicking it won’t display the SSO panel.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[def-WA2025]

Test passed