howlongtobeat 0.2.3 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b94e6610de0b221a6a9913bcddc28648dc7fb7bbb79991e6e512dee9a7359cbc
-  data.tar.gz: 5daf1faf915be4b7f33ccb1542d801b079cf6386bcb1d8ae56dbb988a81bc4a9
+  metadata.gz: 33771117767e72dbc78a8b1559be38a30e27e680973a4301b67f9cde7b0ffe6e
+  data.tar.gz: 1b8540d8616c52e7b984fbff528c96afbf3b6e5d8e167b66d31171b7b80b31e4
 SHA512:
-  metadata.gz: b7e115db1b5c3ba6444d1fd5e2bf76082f830a6bb55c0c9a55da132b05dc33d364ded99036ef448872221aa99aaea84b2ac17e3d7ee37dfc97ee529f813898f6
-  data.tar.gz: dfaf4acae0ed822a1c59900a8c6a78131e4548aff26b0d59f2baaf91505fa533ff23f708d5627de6a84c7b04c2d27679bcfc3164ce31fab0e300e0f03b38f82b
+  metadata.gz: f717cf2bdc98707945faef90795d7e972b9f94f3c0f4b218fd3fae8ed7502f7f930d47d01d11ed1015220f1fbb72b6d7fc90fa532bd4354a1c2ea5f3dca19679
+  data.tar.gz: 928586677fb5c27e8582611f3611bd95b0fc0ac1b911fa50c6ddcab79d94f883067e1c50e73bcbcefd6ede5c0d42e481fb57b746905e68fc6c9483962c05c443

data/CHANGELOG.md

@@ -25,6 +25,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 - None
 
+## [0.2.5] - 2026-09-04
+
+### Fixed
+- HLTB moved the search endpoint from `/api/bleed` to the nested path `/api/search/site` (around 2026-08-26). Runtime discovery matched the new `fetch("/api/search/site", { method: "POST" })` call but truncated it to the first path segment (`/api/search`), whose `/init` returns 404. Every search and `search_from_id` returned `nil`. The full path is now kept verbatim (mirrors Python package fix for ScrappyCocco/HowLongToBeat-PythonAPI#59).
+- Refresh the hardcoded fallbacks (`SEARCH_URL`, the `fetch_search_token` default, and the candidate list) to put `/api/search/site` first.
+
+### Changed
+- Discovery now prefers the POST fetch that sends `x-auth-token` (the search call's signature). The HLTB bundle also contains an unrelated `fetch("/api/error", { method: "POST" })` chunk and chunk order is not stable, so stopping on the first POST fetch could pick the wrong endpoint. `SearchInfo#authenticated?` exposes the distinction; a plain POST fetch is still used as a last resort.
+
+## [0.2.4] - 2026-05-07
+
+### Fixed
+- HLTB renamed the search endpoint from `/api/finder` to `/api/bleed`. Runtime discovery already adapted, but the hardcoded fallbacks didn't — refresh `SEARCH_URL`, the default in `fetch_search_token`, and the candidate list to put `/api/bleed` first.
+
+### Changed
+- Drop the `_app-*.js` script-name filter in `send_website_request_getcode`. The modern HLTB build (Turbopack) ships chunks with opaque names like `0-~-0up.q3_p0.js`, so the filter never matched and forced every search through a redundant retry. Single-pass discovery now iterates all `<script src>` tags directly.
+- `send_website_request_getcode` only returns when a `search_url` is found; finding only an `api_key` no longer short-circuits the loop.
+
 ## [0.2.3] - 2026-04-15
 
 ### Fixed

data/README.md

@@ -1,6 +1,7 @@
 # HowLongToBeat Ruby API
 
 ![CI](https://github.com/dpashutskii/howlongtobeat/actions/workflows/ci.yml/badge.svg)
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy_Me_a_Coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/dpashutskii)
 
 A simple Ruby API to read data from howlongtobeat.com.
 

data/lib/howlongtobeat/html_requests.rb

@@ -8,7 +8,11 @@ module HowLongToBeat
     BASE_URL = 'https://howlongtobeat.com'
     REFERER_HEADER = BASE_URL
     GAME_URL = "#{BASE_URL}/game"
-    SEARCH_URL = "#{BASE_URL}/api/finder"
+    # HLTB renames this endpoint periodically
+    # (most recent: /api/find -> /api/finder -> /api/bleed -> /api/search/site).
+    # The runtime discovery in `send_website_request_getcode` is the source of truth;
+    # this constant is the fallback when discovery fails.
+    SEARCH_URL = "#{BASE_URL}/api/search/site"
 
     class SearchModifiers
       NONE = ""
@@ -21,12 +25,25 @@ module HowLongToBeat
     class SearchInfo
       attr_accessor :search_url, :api_key
 
+      # A POST fetch to /api/... whose request options mention x-auth-token.
+      # This is the signature of the search call and distinguishes it from
+      # other POST fetches in the bundle (e.g. /api/error).
+      AUTHENTICATED_FETCH_MARKER = /x-auth-token/i
+
       def initialize(script_content)
         @api_key = extract_api_from_script(script_content)
+        @authenticated = false
         @search_url = extract_search_url_script(script_content)
         @search_url = @search_url&.strip&.gsub(/^\/+|\/+$/, '')
       end
 
+      # True when the discovered search_url came from a fetch that sends
+      # x-auth-token. Callers use this to prefer the real search endpoint over
+      # any other POST fetch found in an earlier script.
+      def authenticated?
+        @authenticated
+      end
+
       private
 
       def extract_api_from_script(script_content)
@@ -48,12 +65,21 @@ module HowLongToBeat
 
       def extract_search_url_script(script_content)
         # Prefer the search endpoint used in POST fetch calls, which is more stable
-        # than hardcoding "/api/search" and works with variants like "/api/finder".
-        post_fetch_pattern = /fetch\s*\(\s*["']\/api\/([a-zA-Z0-9_\/-]+)[^"']*["']\s*,\s*{[^}]*method:\s*["']POST["'][^}]*}/mi
-        if (match = script_content.match(post_fetch_pattern))
-          path_suffix = match[1]
-          base_path = path_suffix.include?('/') ? path_suffix.split('/').first : path_suffix
-          return "/api/#{base_path}"
+        # than hardcoding "/api/search" and works with variants like "/api/finder",
+        # "/api/bleed" and nested paths like "/api/search/site" (current as of
+        # 2026-09). The full path is kept verbatim: truncating to the first
+        # segment turned "/api/search/site" into "/api/search", which 404s.
+        post_fetch_pattern = /fetch\s*\(\s*["']\/api\/([a-zA-Z0-9_\/-]+)[^"']*["']\s*,\s*({[^}]*method:\s*["']POST["'][^}]*})/mi
+        matches = script_content.to_enum(:scan, post_fetch_pattern).map { Regexp.last_match }
+        unless matches.empty?
+          # A single chunk can contain several POST fetches; the search one is
+          # the one that sends x-auth-token. Fall back to the first POST fetch
+          # so a header rename doesn't leave us with nothing.
+          match = matches.find { |m| m[2].match?(AUTHENTICATED_FETCH_MARKER) }
+          @authenticated = !match.nil?
+          match ||= matches.first
+          path_suffix = match[1].sub(%r{/+\z}, '')
+          return "/api/#{path_suffix}"
         end
 
         # Legacy fallback for previous script shape using .concat(...)
@@ -141,10 +167,7 @@ module HowLongToBeat
       end
 
       def send_web_request(game_name, search_modifiers = SearchModifiers::NONE, page = 1)
-        search_info = send_website_request_getcode(false)
-        if search_info.nil? || search_info.search_url.nil?
-          search_info = send_website_request_getcode(true)
-        end
+        search_info = send_website_request_getcode
 
         endpoint_candidates = build_endpoint_candidates(search_info&.search_url)
 
@@ -181,7 +204,7 @@ module HowLongToBeat
 
       def fetch_search_token(parsed_search_url = nil)
         base_endpoint = parsed_search_url.to_s.strip
-        base_endpoint = '/api/finder' if base_endpoint.empty?
+        base_endpoint = '/api/search/site' if base_endpoint.empty?
         base_endpoint = "/#{base_endpoint}" unless base_endpoint.start_with?('/')
         base_endpoint = base_endpoint.sub(%r{/+\z}, '')
         base_endpoint = base_endpoint.sub(%r{/init\z}, '')
@@ -216,7 +239,8 @@ module HowLongToBeat
         preferred = parsed_endpoint.to_s.strip
         candidates = []
         candidates << preferred unless preferred.empty?
-        candidates.concat(['/api/finder', '/api/search', '/api/s'])
+        # Known historical endpoints, newest first. HLTB rotates this name periodically.
+        candidates.concat(['/api/search/site', '/api/bleed', '/api/finder', '/api/search', '/api/s'])
 
         normalized = candidates.map do |endpoint|
           next nil if endpoint.nil? || endpoint.strip.empty?
@@ -228,7 +252,17 @@ module HowLongToBeat
         normalized.compact.uniq
       end
 
-      def send_website_request_getcode(parse_all_scripts)
+      # Walks every <script src> tag on the homepage looking for one that
+      # contains a `fetch("/api/<name>", { method: "POST" })` call. HLTB used to
+      # bundle the relevant code under `_app-*.js`, but the modern (Turbopack)
+      # build emits opaque chunk names like `0-~-0up.q3_p0.js`, so a name-based
+      # filter is no longer reliable — we iterate every script.
+      #
+      # The bundle also contains unrelated POST fetches (e.g. `/api/error`), and
+      # chunk order is not stable, so we stop on the first chunk whose POST fetch
+      # sends `x-auth-token` (the search call's signature) and only fall back to
+      # the first plain POST fetch if no chunk is authenticated.
+      def send_website_request_getcode
         headers = get_title_request_headers
         response = make_get_request(BASE_URL, headers)
         return nil unless response
@@ -236,18 +270,22 @@ module HowLongToBeat
         doc = Nokogiri::HTML(response)
         script_urls = doc.css('script[src]').map { |script| script['src'] }
 
-        scripts = parse_all_scripts ? script_urls : script_urls.select { |url| url.include?('_app-') }
-
-        scripts.each do |script_url|
+        fallback = nil
+        script_urls.each do |script_url|
           url = script_url.start_with?('http') ? script_url : "#{BASE_URL}#{script_url}"
           script_content = make_get_request(url, headers)
           next unless script_content
 
           search_info = SearchInfo.new(script_content)
-          return search_info if (search_info.search_url && !search_info.search_url.empty?) || (search_info.api_key && !search_info.api_key.empty?)
+          # Only consider a search_url match — an api_key without a search_url
+          # leaves us with no idea where to POST.
+          next unless search_info.search_url && !search_info.search_url.empty?
+
+          return search_info if search_info.authenticated?
+          fallback ||= search_info
         end
 
-        nil
+        fallback
       end
 
       def get_title_request_headers

data/lib/howlongtobeat/version.rb

@@ -1,3 +1,3 @@
 module HowLongToBeat
-  VERSION = "0.2.3"
+  VERSION = "0.2.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: howlongtobeat
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.5
 platform: ruby
 authors:
 - Dmitrii Pashutskii
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-15 00:00:00.000000000 Z
+date: 2026-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri