Skip to content

PodCommons v1.1.0 — Full Show Archives & Security Hardening

Latest
Latest

Choose a tag to compare

View all tags
@wfryer wfryer released this 09 Sep 03:40
v1.1.0
12ce559

PodCommons v1.1.0

A major update focused on three things: closing security gaps from the v1.0.0 launch, redesigning how members discover episodes, and letting the commons reach any show's full back catalog on demand rather than only what's been imported.

Security Hardening

The v1.0.0 release shipped with several gaps typical of a fast-moving solo project. All are now closed:

  • Firestore rules rewritten. The committed rules file had reverted to Firebase's wide-open default, and production rules granted broader access than intended in several collections (moderationQueue, flags, podcastSuggestions). Rules are now role-based throughout, with admin, trusted, and member tiers properly scoped.
  • Admin scripts moved to the Firebase Admin SDK. Bulk tagging and pruning no longer require temporarily opening Firestore rules to run — they authenticate via a service account instead, closing a recurring window of exposure.
  • Admin token replaced with real authentication. The manual RSS poll trigger used to check a shared secret that was visible in the client bundle. It now verifies a Firebase Auth ID token server-side and confirms the caller's admin role in Firestore.
  • API key rotated after appearing in local session history.
  • Admin UI guards against self-lockout. The role-management buttons no longer let an admin accidentally demote or lock out their own account.

Discover Navigation Redesign

The old Discover tab plus abstract sliders is gone, replaced by a single row of mode pills that make the effect of each choice immediate and visible:

  • 🕐 Fresh — newest episodes, no algorithm. The default view.
  • 🎯 Recommended — ranked by the curator's taste profile and engagement signals, with a "Fine-tune" panel for adjusting the underlying weights.
  • 🔥 Buzzing — sorted purely by community likes, favorites, and comments.
  • 🧭 Wander — deliberately off the curator's usual path: familiar shows and high taste-scores are suppressed rather than boosted, surfacing genuinely different content.
  • ⭐ Picks — hand-featured episodes, most recently featured first.
  • 💬 Talking — episodes with active community comments.
  • 🎲 Lucky — jumps straight to one random episode.

Each mode pulls from a distinct pool of episodes rather than re-sorting the same list, so switching between them produces visibly different results instead of a shuffled version of the same fifteen episodes.

Any Show, Full Archive

This is the headline feature. Previously, a show page only existed for the five first-party podcasts, and PodCommons only ever ingested and stored an episode's five most recent items per feed.

  • Show pages now work for all 400+ podcasts in the commons, not just the curator's own shows.
  • Full archive browsing. Every show page offers a toggle between "In PodCommons" (the indexed episodes, with topics, taste scores, and community activity) and "Full archive" — the show's complete back catalog, fetched live from its RSS feed. Nothing in the archive view is stored; it's read fresh from the source every time, with light edge caching.
  • Import on demand. Find something in the archive worth favoriting, queuing, or discussing? One click imports that single episode — Gemini analyzes it the same way the regular poll does — and takes you straight to its full episode page. From there it behaves exactly like any other indexed episode.
  • Smart Add actually works now. The "Add a Podcast" panel in Admin — which resolves a show name, an Apple Podcasts/Spotify/Pocket Casts link, or a raw RSS URL to the correct feed — was built in an earlier session but was silently broken by a Cloud Functions permissions issue and had likely never worked end-to-end until this release fixed it.

Smaller Fixes

  • Admin feed titles now link directly to their show page.
  • Suggested podcast URLs in the Admin Suggestions queue are clickable.
  • Members' likes and favorites now actually increment the counters shown to everyone — a Firestore rules gap meant only the admin's own engagement was ever being counted. A one-time recount corrected historical totals.
  • Featured (Picks) episodes now sort by when they were featured, not just publish date.
  • Cloud Functions deploys no longer hang on source discovery — a long-standing local tooling issue is resolved by generating a functions manifest automatically before every deploy.

Known Issues / Roadmap

Tier 1 — Next Release

  • The /podcasts browsable grid — a visual, PocketCasts-style view of all shows sorted by most recently updated. The groundwork (latestEpisodeAt tracking, working show pages for every podcast) is now in place; the grid itself is next.
  • Admin "Add Feed" manual entry point outside of Smart Add.
  • Discussions tab: verify the comment-first, indented-episode layout from the original redesign is still working as intended.
  • Mobile UX audit pass.

Tier 2 — Future Release

  • Public RSS feed of member listening activity (opt-out, editable).
  • Algorithm Lab page: show the same episodes ranked three different ways side by side, with score breakdowns — a media literacy teaching tool as much as a feature.
  • Per-topic RSS output feeds.
  • "Suggested by @username" badges.
  • User-defined custom episode tags.

Tier 3 — Longer Term

  • Persistent Mastodon OAuth for one-tap sharing.
  • Cross-device resume playback.
  • Per-user personalized taste profiles (distinct from the curator's).
  • Mobile app.
  • Native Bluesky posting, email digest, embeddable episode widget.

Acknowledgments

Built across many vibe-coding sessions using Claude as an AI pair programmer. Updates and reflections on the development process are shared at [ai.wesfryer.com](https://ai.wesfryer.com).

#podcommons

Assets 2
Loading