WhatchaWatching
WhatchaWatching is a Blazor Web App (.NET 10) to keep a list of the anime you want to watch, and to let chance pick the next one. Anime come from Jikan (MyAnimeList), with AniList as a fallback when Jikan does not answer.
Live site: https://whatcha-watching.alwaysdata.net
Features
- Anime, movies and TV series: one switch in the header (Anime / Movies / TV series) sets the type for the whole site: the search, the list, the random pick and the title pages (
?type=anime|movie|tv). The links and the search of the header keep the type.
- Search by title: anime from Jikan, then AniList if Jikan is down; movies and series from TMDB. When the providers are down, the titles already saved on the site are searched, with a notice.
- Title page (
/anime/{id}, /movie/{id}, /tv/{id}): poster, summary, genres, episodes and seasons, duration, status, score, and where to watch it (streaming platforms: Jikan and AniList for anime, TMDB and JustWatch for the others, for the country each user picks in the account page).
- Watchlist ("My List"): add and remove titles, filter by genre and episode duration, sort by date, title or duration. The list only holds what you still want to watch: no status, rating or notes.
- Random pick: "Surprise Me" picks from the whole list, "Find me something like..." narrows it down by genre and duration first. It avoids repeating the previous pick.
- Add an anime by hand (
/anime/new) when the providers do not have it. It is private to you, limited to 200 per user, and removing it from your list deletes it.
- Languages: English and French (footer switch, cookie, else the language of the browser); titles and synopses stay as the providers give them.
- Accounts (ASP.NET Core Identity, cookies): sign up, log in, log out, email confirmation, password reset by email, password change, account deletion, and a privacy page. Searching is open to everyone; the list, the picker and the account page need an account.
- Adult content is hidden by default. It can be turned on in My account (with a confirmation of being 18 or older); a switch next to the search and the random pick can then hide it again for the visit. Adult anime are flagged by the providers and carry an "18+" mark.
- A footer with the credits, the data sources and the version of the site with the commit it was built from (for example
v0.3.0 (d386362)).
Tech stack
- Blazor Web App (.NET 10, Interactive Server render mode; login, register and account pages are rendered by the server because they use the auth cookie)
- Entity Framework Core with MySQL (Pomelo provider)
- Jikan API and AniList API (GraphQL) for anime data, with retries, short timeouts and an automatic fallback; TMDB API for movies and TV series
- .NET Aspire for local orchestration
- xUnit for tests, run with a secret scan on every push and pull request by GitHub Actions
- Hosting and production database: AlwaysData
Architecture
The solution (WhatchaWatching.slnx) follows a layered Clean Architecture:
| Project | Role |
|---|
WhatchaWatching | User interface and Blazor components, accounts (Identity) |
WhatchaWatching.Application | Services (anime, watchlist, random picker, anime added by hand, user settings) and mappers |
WhatchaWatching.Infrastructure | Entities, EF Core configurations and migrations |
WhatchaWatching.Middleware | Anime providers: Jikan and AniList clients, the fallback between them |
WhatchaWatching.Common | DTOs, constants and enums |
WhatchaWatching.AppHost | .NET Aspire orchestrator |
WhatchaWatching.Tests | xUnit tests |
Dependencies: Web → Application → (Infrastructure, Middleware) → Common. The one exception is UserEntity, which the web project uses to set up Identity.
The data model is described in docs/DATA_MODEL.md.
Getting started
Prerequisites: the .NET 10 SDK, and either a MySQL (or MariaDB) database or a container runtime such as Docker Desktop (Aspire starts a MySQL container for you).
# Build
dotnet build
# Run the tests (they need no database and no network)
dotnet test
# Run everything via Aspire, with a MySQL container (dashboard at http://localhost:15209)
dotnet run --project WhatchaWatching.AppHost --launch-profile http
# Run the web app alone against a database you configured (http://localhost:5209)
dotnet run --project WhatchaWatching --launch-profile http
# Publish
dotnet publish WhatchaWatching -c Release
Aspire needs a container runtime. Without one, the mysql resource never starts and the site cannot reach its database: install Docker Desktop, or install MySQL yourself and run the web app alone.
Database
The schema is managed with EF Core migrations, which are not applied automatically. A new local database is empty until you apply them:
dotnet tool restore
dotnet ef database update --project WhatchaWatching.Infrastructure
This applies them to the database named by the connection string in your user secrets: check that it is not the production one before running it.
Configuration
Secrets must not be committed. Provide them through user secrets or environment variables.
| Key | Meaning |
|---|
ConnectionStrings:DefaultConnection | The MySQL connection string (injected by Aspire when it runs the database). |
Database:ServerVersion | Optional, for example 8.0.36-mysql. Skips the version detection that connects to the database; without it a database outage breaks every page that uses a service. |
Tmdb:AccessToken | The TMDB "API Read Access Token". Without it the site starts, but movies and TV series are reported as unavailable. |
Email:Host, Port, UserName, Password, From, FromName | The mailbox that sends the confirmation and password reset links (STARTTLS, port 587). Without it nothing is sent. |
dotnet user-secrets set "ConnectionStrings:DefaultConnection" "<value>" --project WhatchaWatching
In production, the same settings are environment variables of the site (ConnectionStrings__DefaultConnection, Database__ServerVersion, Tmdb__AccessToken, Email__Host...).
Continuous integration and secret scan
.github/workflows/ci.yml runs on every push to main and every pull request: build and tests in Release, a check for vulnerable packages, and a gitleaks scan of the history. It does not deploy.
Locally, git hooks in .githooks/ run the same secret scan before each commit and push. On a new clone, install gitleaks and run git config core.hooksPath .githooks (see docs/OPERATIONS.md).
Deployment
The site runs on AlwaysData. Two Claude Code skills in .claude/skills automate the steps; each one shows what it will do and asks for confirmation first:
/apply-migrations previews the SQL of the pending migrations and applies them to the production database./deploy-alwaysdata builds, tests, publishes, uploads over SFTP, restarts the site and checks it answers. It needs an SSH key registered at AlwaysData and the ALWAYSDATA_API_TOKEN environment variable; its non-secret settings are in .claude/skills/deploy-alwaysdata/config.json (not committed)./commit-push commits and pushes with a detailed message, and raises the version of the site (<Version> in WhatchaWatching/WhatchaWatching.csproj, shown in the footer) from what the commit changes: a new feature raises the minor number, a fix the patch number, docs and tests alone nothing.
When a release adds a migration, apply the migration first, then deploy: the previous code ignores a new column or table, but the new code needs it.
Data sources
Anime data comes from Jikan (an unofficial MyAnimeList API) and AniList; movie and TV series data from TMDB, with streaming availability by JustWatch. Streaming links point to the platforms' own pages; availability depends on the country.
