howlongtobeat 0.2.4 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e8314a8423ed470f6b0f5f80097b903ece915d2a6eabc356cdb34104dacb929
-  data.tar.gz: 7e6c9c045ee96345593fa961007988a96b78ffd4dd1f44b0f4529f79c14f2ecd
+  metadata.gz: 33771117767e72dbc78a8b1559be38a30e27e680973a4301b67f9cde7b0ffe6e
+  data.tar.gz: 1b8540d8616c52e7b984fbff528c96afbf3b6e5d8e167b66d31171b7b80b31e4
 SHA512:
-  metadata.gz: e6cb621ce224ad454077852c33e4295f8bab8394c81865703c397a93f6d83d710142cd426b43f14e9d94bca24e2f9e9aafb1ab800db66709864f7a7531d29b27
-  data.tar.gz: e59d86c29009a8e2759874ef021c0ff49285d797778454ef60cb639d8d8899412ce445d5cf6180c3d6cfc756b6590b60324abffda6f305f6ca5648b61c6eb630
+  metadata.gz: f717cf2bdc98707945faef90795d7e972b9f94f3c0f4b218fd3fae8ed7502f7f930d47d01d11ed1015220f1fbb72b6d7fc90fa532bd4354a1c2ea5f3dca19679
+  data.tar.gz: 928586677fb5c27e8582611f3611bd95b0fc0ac1b911fa50c6ddcab79d94f883067e1c50e73bcbcefd6ede5c0d42e481fb57b746905e68fc6c9483962c05c443

data/CHANGELOG.md

@@ -25,6 +25,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 - None
 
+## [0.2.5] - 2026-09-04
+
+### Fixed
+- HLTB moved the search endpoint from `/api/bleed` to the nested path `/api/search/site` (around 2026-08-26). Runtime discovery matched the new `fetch("/api/search/site", { method: "POST" })` call but truncated it to the first path segment (`/api/search`), whose `/init` returns 404. Every search and `search_from_id` returned `nil`. The full path is now kept verbatim (mirrors Python package fix for ScrappyCocco/HowLongToBeat-PythonAPI#59).
+- Refresh the hardcoded fallbacks (`SEARCH_URL`, the `fetch_search_token` default, and the candidate list) to put `/api/search/site` first.
+
+### Changed
+- Discovery now prefers the POST fetch that sends `x-auth-token` (the search call's signature). The HLTB bundle also contains an unrelated `fetch("/api/error", { method: "POST" })` chunk and chunk order is not stable, so stopping on the first POST fetch could pick the wrong endpoint. `SearchInfo#authenticated?` exposes the distinction; a plain POST fetch is still used as a last resort.
+
 ## [0.2.4] - 2026-05-07
 
 ### Fixed

data/README.md

@@ -1,6 +1,7 @@
 # HowLongToBeat Ruby API
 
 ![CI](https://github.com/dpashutskii/howlongtobeat/actions/workflows/ci.yml/badge.svg)
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy_Me_a_Coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/dpashutskii)
 
 A simple Ruby API to read data from howlongtobeat.com.
 

data/lib/howlongtobeat/html_requests.rb

@@ -8,10 +8,11 @@ module HowLongToBeat
     BASE_URL = 'https://howlongtobeat.com'
     REFERER_HEADER = BASE_URL
     GAME_URL = "#{BASE_URL}/game"
-    # HLTB renames this endpoint periodically (most recent: /api/find -> /api/finder -> /api/bleed).
+    # HLTB renames this endpoint periodically
+    # (most recent: /api/find -> /api/finder -> /api/bleed -> /api/search/site).
     # The runtime discovery in `send_website_request_getcode` is the source of truth;
     # this constant is the fallback when discovery fails.
-    SEARCH_URL = "#{BASE_URL}/api/bleed"
+    SEARCH_URL = "#{BASE_URL}/api/search/site"
 
     class SearchModifiers
       NONE = ""
@@ -24,12 +25,25 @@ module HowLongToBeat
     class SearchInfo
       attr_accessor :search_url, :api_key
 
+      # A POST fetch to /api/... whose request options mention x-auth-token.
+      # This is the signature of the search call and distinguishes it from
+      # other POST fetches in the bundle (e.g. /api/error).
+      AUTHENTICATED_FETCH_MARKER = /x-auth-token/i
+
       def initialize(script_content)
         @api_key = extract_api_from_script(script_content)
+        @authenticated = false
         @search_url = extract_search_url_script(script_content)
         @search_url = @search_url&.strip&.gsub(/^\/+|\/+$/, '')
       end
 
+      # True when the discovered search_url came from a fetch that sends
+      # x-auth-token. Callers use this to prefer the real search endpoint over
+      # any other POST fetch found in an earlier script.
+      def authenticated?
+        @authenticated
+      end
+
       private
 
       def extract_api_from_script(script_content)
@@ -51,13 +65,21 @@ module HowLongToBeat
 
       def extract_search_url_script(script_content)
         # Prefer the search endpoint used in POST fetch calls, which is more stable
-        # than hardcoding "/api/search" and works with variants like "/api/finder"
-        # and "/api/bleed" (current as of 2026-05).
-        post_fetch_pattern = /fetch\s*\(\s*["']\/api\/([a-zA-Z0-9_\/-]+)[^"']*["']\s*,\s*{[^}]*method:\s*["']POST["'][^}]*}/mi
-        if (match = script_content.match(post_fetch_pattern))
-          path_suffix = match[1]
-          base_path = path_suffix.include?('/') ? path_suffix.split('/').first : path_suffix
-          return "/api/#{base_path}"
+        # than hardcoding "/api/search" and works with variants like "/api/finder",
+        # "/api/bleed" and nested paths like "/api/search/site" (current as of
+        # 2026-09). The full path is kept verbatim: truncating to the first
+        # segment turned "/api/search/site" into "/api/search", which 404s.
+        post_fetch_pattern = /fetch\s*\(\s*["']\/api\/([a-zA-Z0-9_\/-]+)[^"']*["']\s*,\s*({[^}]*method:\s*["']POST["'][^}]*})/mi
+        matches = script_content.to_enum(:scan, post_fetch_pattern).map { Regexp.last_match }
+        unless matches.empty?
+          # A single chunk can contain several POST fetches; the search one is
+          # the one that sends x-auth-token. Fall back to the first POST fetch
+          # so a header rename doesn't leave us with nothing.
+          match = matches.find { |m| m[2].match?(AUTHENTICATED_FETCH_MARKER) }
+          @authenticated = !match.nil?
+          match ||= matches.first
+          path_suffix = match[1].sub(%r{/+\z}, '')
+          return "/api/#{path_suffix}"
         end
 
         # Legacy fallback for previous script shape using .concat(...)
@@ -182,7 +204,7 @@ module HowLongToBeat
 
       def fetch_search_token(parsed_search_url = nil)
         base_endpoint = parsed_search_url.to_s.strip
-        base_endpoint = '/api/bleed' if base_endpoint.empty?
+        base_endpoint = '/api/search/site' if base_endpoint.empty?
         base_endpoint = "/#{base_endpoint}" unless base_endpoint.start_with?('/')
         base_endpoint = base_endpoint.sub(%r{/+\z}, '')
         base_endpoint = base_endpoint.sub(%r{/init\z}, '')
@@ -218,7 +240,7 @@ module HowLongToBeat
         candidates = []
         candidates << preferred unless preferred.empty?
         # Known historical endpoints, newest first. HLTB rotates this name periodically.
-        candidates.concat(['/api/bleed', '/api/finder', '/api/search', '/api/s'])
+        candidates.concat(['/api/search/site', '/api/bleed', '/api/finder', '/api/search', '/api/s'])
 
         normalized = candidates.map do |endpoint|
           next nil if endpoint.nil? || endpoint.strip.empty?
@@ -234,8 +256,12 @@ module HowLongToBeat
       # contains a `fetch("/api/<name>", { method: "POST" })` call. HLTB used to
       # bundle the relevant code under `_app-*.js`, but the modern (Turbopack)
       # build emits opaque chunk names like `0-~-0up.q3_p0.js`, so a name-based
-      # filter is no longer reliable — we just iterate and stop on the first
-      # script that yields a `search_url`.
+      # filter is no longer reliable — we iterate every script.
+      #
+      # The bundle also contains unrelated POST fetches (e.g. `/api/error`), and
+      # chunk order is not stable, so we stop on the first chunk whose POST fetch
+      # sends `x-auth-token` (the search call's signature) and only fall back to
+      # the first plain POST fetch if no chunk is authenticated.
       def send_website_request_getcode
         headers = get_title_request_headers
         response = make_get_request(BASE_URL, headers)
@@ -244,19 +270,22 @@ module HowLongToBeat
         doc = Nokogiri::HTML(response)
         script_urls = doc.css('script[src]').map { |script| script['src'] }
 
+        fallback = nil
         script_urls.each do |script_url|
           url = script_url.start_with?('http') ? script_url : "#{BASE_URL}#{script_url}"
           script_content = make_get_request(url, headers)
           next unless script_content
 
           search_info = SearchInfo.new(script_content)
-          # Only return on a search_url match — an api_key without a search_url
-          # leaves us with no idea where to POST, and the loop should keep
-          # looking for a chunk that gives us the endpoint.
-          return search_info if search_info.search_url && !search_info.search_url.empty?
+          # Only consider a search_url match — an api_key without a search_url
+          # leaves us with no idea where to POST.
+          next unless search_info.search_url && !search_info.search_url.empty?
+
+          return search_info if search_info.authenticated?
+          fallback ||= search_info
         end
 
-        nil
+        fallback
       end
 
       def get_title_request_headers

data/lib/howlongtobeat/version.rb

@@ -1,3 +1,3 @@
 module HowLongToBeat
-  VERSION = "0.2.4"
+  VERSION = "0.2.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: howlongtobeat
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.2.5
 platform: ruby
 authors:
 - Dmitrii Pashutskii
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-07 00:00:00.000000000 Z
+date: 2026-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri