[ROMM-2899] PKGJ feed endpoints by gantoine · Pull Request #2986 · rommapp/romm

gantoine · 2026-02-04T02:26:24Z

Description
^{Explain the changes or enhancements you are proposing with this pull request.}

This PR adds support for PKGJ feeds across multiple playstation platforms (PSP, PSVita, and PSX).

Checklist
^{Please check all that apply.}

I've tested the changes locally
I've updated relevant comments
I've assigned reviewers for this PR
I've added unit tests that cover the changes

gemini-code-assist · 2026-02-04T02:26:39Z

Summary of Changes

Hello @gantoine, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request expands the API's feed generation capabilities by adding support for PKGJ feeds across multiple PlayStation platforms (PSP, PSVita, and PSX). It streamlines the process of creating these text-based feeds by introducing a reusable response helper and new data schemas, ensuring that users can access game and DLC information in a format compatible with PKGJ clients.

Highlights

New PKGJ Feed Endpoints: Introduced several new API endpoints to generate PKGJ-compatible feed files for PlayStation Portable (PSP), PlayStation Vita (PSVita), and PlayStation (PSX) games and DLCs.
Code Refactoring for Text Responses: A new helper function, _text_response, was created to centralize and standardize the generation of plain text file responses, improving code reusability and maintainability across various feed endpoints.
New Pydantic Schemas: Defined new Pydantic schemas (PkgjBaseItemSchema, PkgjPSPGamesItemSchema, PkgjPSPDlcsItemSchema, PkgjPSVGamesItemSchema, PkgjPSVDlcsItemSchema, PkgjPSXGamesItemSchema) to accurately model the data structure for the new PKGJ feed items.
Comprehensive Unit Tests: Added dedicated unit tests for each new PKGJ feed endpoint to ensure their correct functionality and adherence to the expected output format.

Changelog

backend/endpoints/feeds.py
- Imported new Pkgj feed item schemas for PSP, PSVita, and PSX.
- Created a _text_response helper function to encapsulate text file response generation.
- Refactored existing pkgi_ps3_feed, pkgi_psvita_feed, and pkgi_psp_feed functions to utilize the new _text_response helper.
- Added new API endpoints for /pkgj/psp/games, /pkgj/psp/dlc, /pkgj/psvita/games, /pkgj/psvita/dlc, and /pkgj/psx/games.
- Implemented a _format_pkgj_datetime helper for consistent date formatting in Pkgj feeds.
backend/endpoints/responses/feeds.py
- Imported the datetime module.
- Defined PkgjBaseItemSchema as a base for Pkgj feed items.
- Created specific Pydantic schemas: PkgjPSPGamesItemSchema, PkgjPSPDlcsItemSchema, PkgjPSVGamesItemSchema, PkgjPSVDlcsItemSchema, and PkgjPSXGamesItemSchema.
backend/tests/endpoints/feeds.py
- Added test_pkgj_psp_games_feed to verify the PSP games feed endpoint.
- Added test_pkgj_psp_dlc_feed to verify the PSP DLC feed endpoint.
- Added test_pkgj_psvita_games_feed to verify the PSVita games feed endpoint.
- Added test_pkgj_psvita_dlc_feed to verify the PSVita DLC feed endpoint.
- Added test_pkgj_psx_games_feed to verify the PSX games feed endpoint.

Activity

The pull request was opened by gantoine with the title '[ROMM-2899] PKGJ feed endpoints'.
The description mentions the purpose is to explain changes or enhancements, but currently contains only a checklist with unchecked items and a placeholder for screenshots.
No comments or reviews have been made on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces new PKGJ feed endpoints and refactors existing feed generation logic. However, a critical vulnerability exists across all new and refactored endpoints: they are susceptible to CSV/TSV injection due to unsanitized delimiters and newline characters in the generated responses. This could allow an attacker to hijack downloads by manipulating column data. Additionally, the new PKGJ endpoints for games and DLCs suffer from significant code duplication and a bug where content is not filtered by type, leading to incorrect feed content. The current tests are insufficient to catch these filtering issues.

backend/endpoints/feeds.py

backend/tests/endpoints/feeds.py

github-actions · 2026-02-04T02:31:50Z

Test Results

801 tests +1 800 ✅ +1 2m 2s ⏱️ -4s
1 suites ±0 1 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit acda4bb. ± Comparison against base commit 0b0756f.

♻️ This comment has been updated with latest results.

github-actions · 2026-02-04T02:31:51Z

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
13013	8515	65%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
backend/endpoints/feeds.py	18%	🟢
backend/endpoints/responses/feeds.py	94%	🟢
TOTAL	56%	🟢

updated for commit: acda4bb by action🐍

gantoine · 2026-02-10T13:42:18Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces new endpoints for PKGJ feeds (PSP, PSVita, PSX games and DLCs) and refactors existing feed generation logic, improving code reusability and readability with new helper functions and Pydantic schemas. However, a significant security vulnerability exists due to the manual construction of CSV and TSV responses without proper escaping or sanitization of user-influenced fields, which can lead to CSV/TSV injection. The use of request.url_for also makes the feeds susceptible to Host Header Injection. While comprehensive tests are included, a minor issue with inconsistent date formatting in PKGJ feed endpoints was identified. It is strongly recommended to use the standard csv module for feed generation to mitigate these security risks and ensure data integrity.

backend/endpoints/feeds.py

gantoine · 2026-02-10T14:45:23Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces new PKGJ feed endpoints and refactors existing text-based feeds to use the csv module for more robust line generation. While this is a good improvement, I've identified a few issues. There's a critical data integrity problem where SHA1 hashes are being used for fields expecting SHA256 hashes in the new PKGJ feeds. Additionally, there are performance inefficiencies in both the new and refactored feeds related to redundant function calls and object creation within loops. I've also pointed out significant code duplication in the new endpoints and suggested a refactoring approach to improve maintainability. Please review the detailed comments.

backend/endpoints/feeds.py

gantoine added 3 commits February 3, 2026 16:22

add new endpoints for pkgj

d0a71ae

bot created test file

4b4a346

refactor feeds file

959c9ac

gemini-code-assist bot reviewed Feb 4, 2026

View reviewed changes

gantoine added 3 commits February 4, 2026 09:52

Merge branch 'master' into romm-2899

7cc2097

tweaks to returned feed data

393375b

trunk check fix

527f144

gemini-code-assist bot reviewed Feb 10, 2026

View reviewed changes

gantoine added 2 commits February 10, 2026 08:56

use pkgj last_modified

7231414

use csv writer to build feed response

dc857d9

gemini-code-assist bot reviewed Feb 10, 2026

View reviewed changes

move get_rap_data out of loop

acda4bb

gantoine marked this pull request as ready for review February 10, 2026 15:42

gantoine merged commit c1a8a05 into master Feb 10, 2026
8 checks passed

gantoine deleted the romm-2899 branch February 10, 2026 15:43

Uh oh!

Conversation

gantoine commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Feb 4, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

☂️ Python Coverage

Overall Coverage

New Files

Modified Files

Uh oh!

gantoine commented Feb 10, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gantoine commented Feb 10, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gantoine commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading