• backend/endpoints/collections.py
  • Modified add_collection, add_smart_collection, update_collection, and update_smart_collection to use File() and Form() for explicit parameter typing.
• backend/endpoints/configs.py
  • Refactored add_platform_binding, add_platform_version, and add_exclusion to accept Pydantic BaseModel payloads instead of raw JSON.
• backend/endpoints/rom.py
  • Updated update_rom to use a new RomUpdateForm Pydantic model and update_rom_user to use RomUserUpdatePayload, removing manual FormData parsing.
• backend/endpoints/saves.py
  • Changed add_save and update_save to use explicit File() parameters for uploaded files.
• backend/endpoints/screenshots.py
  • Modified add_screenshot to use an explicit File() parameter for the screenshot file.
• backend/endpoints/states.py
  • Updated add_state and update_state to use explicit File() parameters for state and screenshot files.
• backend/tests/endpoints/test_config.py
  • Added new test cases to verify the payload shapes for config-related endpoints.
• backend/tests/endpoints/test_rom.py
  • Added new tests for the update_rom_user endpoint, covering data envelope and last played flags.
• examples/config.example.yml
  • Updated comments for roms_folder and skip_hash_calculation in the example configuration.
• frontend/src/generated/index.ts
  • Regenerated OpenAPI types, including new Body_add_*, Body_update_*, ExclusionPayload, PlatformBindingPayload, and RomUserUpdatePayload types.
• frontend/src/generated/models/Body_add_collection_api_collections_post.ts
  • Modified generated type to include artwork, name, description, and url_cover.
• frontend/src/generated/models/Body_add_save_api_saves_post.ts
  • Added new generated type for add_save API request body.
• frontend/src/generated/models/Body_add_screenshot_api_screenshots_post.ts
  • Added new generated type for add_screenshot API request body.
• frontend/src/generated/models/Body_add_smart_collection_api_collections_smart_post.ts
  • Added new generated type for add_smart_collection API request body.
• frontend/src/generated/models/Body_add_state_api_states_post.ts
  • Added new generated type for add_state API request body.
• frontend/src/generated/models/Body_update_collection_api_collections__id__put.ts
  • Modified generated type to include artwork, rom_ids, name, description, and url_cover.
• frontend/src/generated/models/Body_update_rom_api_roms__id__put.ts
  • Modified generated type to include various metadata IDs, raw metadata fields, and file-related fields.
• frontend/src/generated/models/Body_update_save_api_saves__id__put.ts
  • Added new generated type for update_save API request body.
• frontend/src/generated/models/Body_update_smart_collection_api_collections_smart__id__put.ts
  • Added new generated type for update_smart_collection API request body.
• frontend/src/generated/models/Body_update_state_api_states__id__put.ts
  • Added new generated type for update_state API request body.
• frontend/src/generated/models/DetailedRomSchema.ts
  • Added ra_hash field to the schema.
• frontend/src/generated/models/ExclusionPayload.ts
  • Added new generated type for ExclusionPayload.
• frontend/src/generated/models/PlatformBindingPayload.ts
  • Added new generated type for PlatformBindingPayload.
• frontend/src/generated/models/RomFileSchema.ts
  • Added ra_hash field to the schema.
• frontend/src/generated/models/RomUserUpdatePayload.ts
  • Renamed Body_update_rom_user_api_roms__id__props_put.ts to RomUserUpdatePayload.ts and updated its structure.
• frontend/src/generated/models/SimpleRomSchema.ts
  • Added ra_hash field to the schema.
• frontend/src/components/common/Collection/Dialog/CreateCollection.vue
  • Adjusted API call to createCollection to remove { data } destructuring.
• frontend/src/components/common/Collection/Dialog/CreateSmartCollection.vue
  • Adjusted API call to createSmartCollection to remove { data } destructuring.
• frontend/src/components/common/Game/Dialog/EditRom.vue
  • Adjusted API call to uploadManuals to remove { data } destructuring.
• frontend/src/components/common/Game/Dialog/UploadRom.vue
  • Adjusted API call to uploadRoms to remove { data } destructuring.
• frontend/src/components/common/Platform/Dialog/UploadFirmware.vue
  • Adjusted API call to uploadFirmware to remove { data } destructuring.
• frontend/src/composables/useFavoriteToggle.ts
  • Adjusted API call to createCollection and updated filtering logic for rom_ids.
• frontend/src/console/views/Play.vue
  • Modified boot function to use buildFormInput for constructing FormData for state and screenshot uploads.
• frontend/src/services/api/collection.ts
  • Refactored API calls to use buildFormInput for FormData and updated return types to match generated types.
• frontend/src/services/api/config.ts
  • Updated API calls to use explicit PlatformBindingPayload and ExclusionPayload types for request bodies and adjusted return types.
• frontend/src/services/api/firmware.ts
  • Updated API calls to use AddFirmwareInput and adjusted return types.
• frontend/src/services/api/gamelist.ts
  • Adjusted exportGamelist return type.
• frontend/src/services/api/identity.ts
  • Updated API calls for password reset and logout to use explicit payload types and adjusted return types.
• frontend/src/services/api/platform.ts
  • Updated API calls for platform management to use explicit payload types and adjusted return types.
• frontend/src/services/api/rom.ts
  • Extensively refactored API calls for ROM management to use buildFormInput and explicit payload/return types.
• frontend/src/services/api/save.ts
  • Refactored API calls for save management to use buildFormInput and explicit payload/return types.
• frontend/src/services/api/screenshot.ts
  • Refactored API calls for screenshot management to use buildFormInput and explicit payload/return types.
• frontend/src/services/api/setup.ts
  • Updated SetupLibraryInfo to use PlatformSchema.
• frontend/src/services/api/sgdb.ts
  • Adjusted searchCover return type.
• frontend/src/services/api/state.ts
  • Refactored API calls for state management to use buildFormInput and explicit payload/return types.
• frontend/src/services/api/task.ts
  • Adjusted API call return types for task management.
• frontend/src/services/api/user.ts
  • Updated API calls for user management to use explicit payload types and adjusted return types.
• frontend/src/utils/formData.ts
  • Added a new utility function buildFormInput to simplify FormData creation.
• frontend/src/views/Patcher.vue
  • Adjusted API call to uploadPatchedRom to remove { data } destructuring.

• The pull request introduces significant changes across both backend and frontend, indicating a coordinated effort to improve API consistency and type safety.
• Backend endpoints were modified to leverage FastAPI's Form() and File() dependencies, and Pydantic models for request bodies.
• Frontend code was updated to reflect these backend API changes, including the regeneration of OpenAPI types and the introduction of a new formData utility.
• New tests were added for config and ROM endpoints to ensure the new payload structures are handled correctly.

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

1. backend/endpoints/collections.py, line 79-106 (link)

   Orphaned collection record on SSRF validation failure

   db_collection_handler.add_collection(...) is called and committed to the database on line 79 before the try/except block that wraps the cover URL validation. If validate_url_for_http_request raises a ValidationError (e.g. the user supplies a private-IP url_cover), the endpoint returns HTTP 400 — but the collection record already exists in the database with no cover.

   Before this PR the code was safe because get_cover would silently return None on a bad URL rather than raising. The new SSRF checks make the silent failure visible, but introduce this data-consistency gap.

   Move the db_collection_handler.add_collection call inside (or after) the try block, or validate url_cover before persisting, so that a failed validation never leaves an orphaned record:

   # Validate URL before persisting
   if url_cover:
       try:
           validate_url_for_http_request(url_cover, "Cover URL")
       except ValidationError as e:
           raise HTTPException(status_code=400, detail=str(e)) from e
   
   _added_collection = db_collection_handler.add_collection(Collection(**cleaned_data))
   # ... cover fetch (no longer raises ValidationError for scheme/IP issues)