screentinker/server
ScreenTinker fb58256b1c Fix YouTube autoplay block from stale localStorage gesture flag
userHasInteracted was initialized from localStorage('rd_audio_unlocked')
on every page load. Browser autoplay policy is per-document, so a flag
from a prior session does not actually grant autoplay rights — but the
player code used it to decide whether to start the YouTube embed muted
(autoplay-able) or unmuted (blocked). Result: kiosks with the flag set
loaded a YT embed with mute=0 that the browser refused to start.

- userHasInteracted now always starts as false. The cold-load tap
  overlay flips it to true on real gesture; the 5s auto-dismiss leaves
  it false and playback stays muted (still allowed).
- unlockAudio() now also calls activeYtPlayer.unMute() so the muted
  embed unmutes immediately when the user finally taps the overlay.
- Removed the now-unused localStorage writes of rd_audio_unlocked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 14:56:49 -05:00
..
db Add media folder organization to content library 2026-04-28 10:13:36 -05:00
middleware Fix UTF-8 encoding for special characters in filenames 2026-04-28 10:13:41 -05:00
player Fix YouTube autoplay block from stale localStorage gesture flag 2026-04-28 14:56:49 -05:00
routes Security: fix IDORs, XSS, rate limits, SSRF validation 2026-04-28 14:37:18 -05:00
services Add group-level scheduling, group playlist assignment, and persist audio unlock 2026-04-15 20:22:42 -05:00
ws Security: fix IDORs, XSS, rate limits, SSRF validation 2026-04-28 14:37:18 -05:00
config.js Add DISABLE_REGISTRATION env var to block public sign-ups 2026-04-22 19:35:32 -05:00
package-lock.json Security: fix IDORs, XSS, rate limits, SSRF validation 2026-04-28 14:37:18 -05:00
package.json Security: fix IDORs, XSS, rate limits, SSRF validation 2026-04-28 14:37:18 -05:00
server.js Fix screenshot fallback query and API 404 hang 2026-04-28 14:49:10 -05:00