From 6df7827bb9e7da55df61ce6c67a1c4478398c8e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C5=ABdolfs=20O=C5=A1i=C5=86=C5=A1?= <rudolfs@osins.org>
Date: Thu, 1 Oct 2026 10:23:45 +0200
Subject: [PATCH] Don't break the inbox on invalid stored pins

The pinned and hidden inbox repos were read with a bare JSON.parse, so
corrupted storage threw while the inbox loaded.
---
 src/components/InboxList.svelte | 35 ++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/src/components/InboxList.svelte b/src/components/InboxList.svelte
index 604730002..b80eba94a 100644
--- a/src/components/InboxList.svelte
+++ b/src/components/InboxList.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
   import type { NotificationsByRepo } from "@bindings/cob/inbox/NotificationsByRepo";
 
+  import { array, string } from "zod";
+
   import {
     type FilteredRepo,
     filterNotifications,
@@ -87,19 +89,24 @@
       : clearByRepo(rid);
   }
 
+  // Stored data can be anything, so an invalid list reads as empty instead of
+  // breaking the inbox.
+  function loadStoredRepos(key: string): string[] {
+    try {
+      const parsed = array(string()).safeParse(
+        JSON.parse(localStorage?.getItem(key) ?? "[]"),
+      );
+      return parsed.success ? parsed.data : [];
+    } catch {
+      return [];
+    }
+  }
+
   let pinnedRepos: string[] = $state(loadPinnedRepos());
   let hiddenRepos: string[] = $state(loadHiddenRepos());
 
   function loadPinnedRepos(): string[] {
-    const storedPinnedRepos = localStorage
-      ? localStorage.getItem("pinnedInboxRepos")
-      : null;
-
-    if (storedPinnedRepos === null) {
-      return [];
-    } else {
-      return JSON.parse(storedPinnedRepos);
-    }
+    return loadStoredRepos("pinnedInboxRepos");
   }
 
   function updatePinnedRepos(newRepos: string[]) {
@@ -117,15 +124,7 @@
   }
 
   function loadHiddenRepos(): string[] {
-    const storedHiddenRepos = localStorage
-      ? localStorage.getItem("hiddenInboxRepos")
-      : null;
-
-    if (storedHiddenRepos === null) {
-      return [];
-    } else {
-      return JSON.parse(storedHiddenRepos);
-    }
+    return loadStoredRepos("hiddenInboxRepos");
   }
 
   function updateHiddenRepos(newRepos: string[]) {