66 Commits

Include renames

Author	SHA1	Message	Date
3 people	42602b7896	feat(policy): access groups + embedded OPA policy engine with decision audit log (#282) ... * docs(policy): add OPA policy engine design spec and implementation plan Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * build(deps): add OPA v1.18.2 SDK for the policy engine Pulls github.com/open-policy-agent/opa v1.18.2 (policy engine core for the upcoming internal/policy subsystem) and the transitive upgrades go mod tidy applied (otel 1.44, grpc 1.81.1, prometheus/common 0.67.5). Full build verified. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): add OPA engine core, vendor scope policy, and parity suite New internal/policy package (dead code — nothing wires into request paths yet): prepared-query Engine with 25ms eval timeout and fail-closed decode, typed PDP.ResolveViewerScope, go:embed vendor bundle, capabilities lockdown for future admin-authored Rego, and vendor scope.rego reproducing access.Resolver.Resolve (library intersection, disabled-library handling, quality/rating ceilings) with a narrowing-only silo_custom.scope.override extension hook. Parity proven by 1368 dual-execution subtests against the real access.Resolver, including the nil-vs-empty AllowedLibraryIDs battery and quality/rating variation; rank tables are test-pinned to internal/access. Rego unit tests run via opa/v1/tester inside go test. Bench: ~106µs/op per scope decision incl. input marshaling. Also restores the OPA requirement to go.mod (the earlier deps commit ran go mod tidy before any import existed, so tidy dropped it). Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed, corrected (quality.allowed raw-file-rank divergence), and verified here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): add policy document store, foundation schema, and compile-check policy_foundation migration: policy_documents (one enabled doc per domain via partial unique index — two enabled docs would define override twice and conflict at eval), immutable policy_document_versions, single-row policy_generation counter, and the partitioned policy_decisions log table (daily range partitions, no FK, denial partial index). PolicyStore: transactional version numbering (FOR UPDATE), activation that verifies compiled_ok and bumps the generation in the same tx, enable/disable with typed ErrDomainAlreadyEnabled, and a delete guard for documents with an active version. CompileCheck sandboxes admin Rego: locked capabilities (no http.send/net.*/opa.runtime), enforced silo_custom.<domain> package path, vendor+stub layering, 2s budget, structured row/col errors. Engine gains NewEngineWithCustom / NewEngineFromStore with WARN-and-skip for invalid custom rows. DB-backed tests verified against a migrated Postgres (concurrent version numbering, atomic generation bumps, activation guards). Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed and verified here (domain constants extracted). Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): add policy System lifecycle with hot reload and cross-node invalidation policy.System owns one long-lived Engine and reloads it in place when policy documents change: EventPolicyChanged on the existing ChannelAdmin bus (new cache event constant) plus a 60s generation-poll fallback for Redis-less deployments, with a generation-consistent snapshot read. Vendor compile failure is startup-fatal; store/custom failures degrade to vendor-only and the poll loop heals them; runtime reload failures keep the last known-good engine. NotifyChanged gives the future admin handlers synchronous local reload + cross-node publish. Wiring: constructed in integrated/api modes only, PolicySystem field on api.Dependencies (unused by routes yet), policy.eval_timeout_ms setting (hot-reloaded via configWatcher.OnChange; default 25ms). Verified by a full server boot smoke and DB-backed convergence tests (event + poll paths, degraded boot, last-known-good). Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed and verified here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): add async decision logging with sampling, retention, and query repo DecisionLogger batch-inserts each node's policy decisions straight to the partitioned policy_decisions table via a non-blocking buffered channel (drop-and-count on overflow — logging never adds latency to or fails a decision). Scope decisions sample 1-in-N (default 50, setting policy.decision_log_scope_sample_rate); denials and eval errors always log; input/result JSON samples only at policy.decision_log_verbosity= verbose. Cursor-paginated DecisionRepository backs the upcoming admin log viewer. Retention via partman (daily partitions) and a PolicyDecisionLogCleanupTask honoring policy.decision_log_retention_days (default 14). PDP emits entries per evaluation; the System owns the logger lifecycle and settings hot-reload. Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed and verified here (removed an unused, unsynchronized PDP setter). Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(api): add admin policy management API and capability endpoint /api/v1/policy/capability (authenticated feature detection) plus the acting-admin /api/v1/admin/policy surface: vendor Rego viewer, document CRUD with the one-enabled-per-domain conflict mapped to 409, immutable version creation (compile-checked; failed versions persist as audit history with structured row/col errors and can never activate), activate/rollback with synchronous reload + cross-node invalidation via System.NotifyChanged, stateless validate, throwaway-bundle simulate (never touches the live engine, never logs decisions), and cursor-paginated decision-log queries. Routes mount only when the policy system is wired, keeping proxy/transcode modes untouched. Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed and verified here (seeded the FK'd test user; replaced an unchecked fmt.Sscanf with strconv). Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): add /admin/policy workspace with Rego editor, simulate, and decision log New Policy admin page (System nav group): documents list with one-enabled-per-domain conflict handling, CodeMirror 6 Rego editor (hand-rolled StreamLanguage mode) with server compile issues rendered as inline lint diagnostics, explicit Save-version vs Activate flow with confirm, read-only vendor module viewer, simulate panel with seeded example inputs, version history with rollback, and a cursor-paginated decision-log browser. Capability-gated via /policy/capability. Adds the three decision-log settings to Log Retention. First code-editor dependency in web/ (@uiw/react-codemirror + @codemirror/*), decided in the design spec. Implementation drafted by Codex (GPT-5.5) via codex exec; verified here (lint, format:check, tsc --noEmit, vitest policy suites). Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): make OPA authoritative for viewer scope resolution policy.ViewerResolver implements the ViewerResolver interface backed by PDP.ResolveViewerScope and replaces access.Resolver at all five construction sites: router viewer middleware, notifications scopes, the reconciler, jellycompat's scope filter, and the ABS resolver (which now accepts a pre-built resolver, preserving its PIN-at-login semantics). PIN/profile-token verification and disabled-library loading are extracted into shared exported helpers used by both implementations, so the legacy resolver stays compiled as the parity reference with identical behavior. The adapter lives in internal/policy (which already depends on internal/access transitively) — direct typed PDP calls, no new import cycle. Sites without a policy system (proxy modes, bare test routers) keep the legacy resolver until the cleanup phase. Verified: full test suite green (jellycompat TestBeginWebOperation* and one playback GPU test are pre-existing failures, confirmed identical on main), 1368-case parity suite, dedicated ViewerResolver parity/PIN/ nil-vs-empty/fail-closed tests, and a full server boot smoke. Implementation drafted by Codex (GPT-5.5) via codex exec; a first-pass reflection-based adapter was rejected and reworked into the typed in-policy adapter; reviewed line-by-line and verified here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): make OPA authoritative for acting-admin and permission gates vendor/permission.rego reproduces the acting-admin rule (admin role + primary-profile-or-none), HasEffectivePermission semantics for marker_edit, and the metadata-curation rule including the subtle admin-past-refused-bypass case that requires the explicitly ASSIGNED permission. Policy-backed middleware in policy_gates.go keeps all Go-side lookups (declared-profile primary check, item->library resolution, the 404-on-unknown-item path) and preserves the legacy status/body taxonomy exactly — proven by dual-execution middleware tests that run every scenario through both implementations and assert byte-equal responses. Permission decisions always log (allowed flag populated); simulate and the capability endpoint gain the permission domain automatically via the domain registry. Router swaps behind single constructor choice points with the legacy gates retained for policy-less wiring. Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed and verified here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(policy): make OPA authoritative for download and playback admission decisions vendor/action.rego decides download eligibility (downloads enabled + user allowed), download-transcode eligibility (transcode enabled + user allowed + artifacts available), and playback admission (stream/transcode counts vs limits, zero = unlimited), with a tightening-only silo_custom.action override that can also clamp a quality ceiling (never widen — merged via quality.min). Go keeps everything stateful: config loading, preset-ladder enumeration, and live session counting. Downloads consult an optional ActionDecider (nil = legacy logic) mapped back to the existing sentinel errors and capability response. Playback gains a minimal AdmissionDecider hook at the exact point of the legacy limit comparison: counts snapshot under the session mutex, PDP evaluated OUTSIDE the lock, then revalidated under lock before insert (retry on count drift) — no admission ever decided on stale counts and no eval under the mutex. Deny reasons map to the legacy ErrTooManyStreams / ErrTooManyTranscodes sentinels, pinned by tests. Parity: combination tables driven against the real PresetsFor / ensureTranscodeAllowed / SessionLimits math; full suite green (known pre-existing jellycompat flakes only). Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed (locking design verified line-by-line) and verified here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(web): satisfy tsc -b strict return typing in the Rego stream tokenizer The production build (tsc -b) rejects assigning CodeMirror's string | void next() result to string | undefined; tsc --noEmit did not catch it. Restructured the string-literal loop. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): clearer error when a decision is undefined for partial input Vendor policies index required input fields directly, so a hand-written simulate payload missing fields yields an undefined decision. Surface that as 'decision X is undefined for this input (missing required input fields?)' instead of 'empty result' — found while exercising the simulate API against a live server. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(web): set changeOrigin automatically when the API proxy target is remote Remote dev backends sit behind vhost-routing proxies that reject a localhost Host header; local targets keep the existing pass-through behavior. Enables pointing the Vite dev server at a hosted backend via VITE_API_PROXY_TARGET in web/.env.local. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(web): redesign the policy workspace around the decision pipeline The first-pass UI was structurally generic: a five-column document table squeezed beside the editor, three equal-weight action buttons with hidden preconditions, raw version IDs, and jargon copy — nothing taught the model. The page now teaches it: - A pipeline strip states the mental model up front: Silo decides the baseline -> your overrides narrow it -> every decision is logged. Tabs renamed to Overrides / Baseline / Decision Log (ids stay stable for bookmarked URLs). - The document table becomes one card per domain (Library visibility / Admin & permissions / Downloads & playback) with plain-language descriptions, example rules, status pills (Live vN / Draft / Disabled), inline creation, and the enable kill-switch in place. - Selecting an override drills into a full-width editor with a visible lifecycle rail (Draft -> Validated -> Saved -> Live) and one contextual primary action per step; the unedited live source shows no actions until edited. Version comments appear only at the save step. - Simulate is reframed as 'Test before going live' with a human verdict chip (Allowed / Denied — reason / ceiling summary) above the raw JSON; internal generation counters no longer surface. - History uses 'Make live' with plain go-live copy; authors read 'User N'; the baseline tab explains that upgrades never touch overrides. Hand-written redesign (no Codex); verified via vitest, tsc, eslint, prettier, and a production build. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(web): present the policy baseline as readable rules, not raw Rego The Baseline tab dumped five Rego modules into read-only editors. It now leads with what the rules actually do: one card per domain with plain-language statements of the shipped behavior and a note on what an override may change, plus content-rating and playback-quality tier ladders parsed live from the lib module sources (so the tiers shown are the ones the server enforces, not a hardcoded copy). The Rego source stays one click away behind a per-module accordion and remains the stated source of truth; unrecognized modules fall back to source-only. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(policy): add access-groups design addendum Groups with permission toggles become the everyday admin surface; the Rego editor is demoted behind policy.editor_enabled (default off). Restriction-only composition: group grants are an upper bound, per-user settings tighten further — same rule as the existing account/profile merge, one layer up. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(access): add access groups — group defaults with restriction-only composition New access_groups table + users.access_group_id (one group per user, NULL = today's behavior). Group grants are an upper bound composed with the user's own settings by strictest-wins rules — library intersection, MinQuality, AND'd booleans, strictest positive stream/transcode limits, permission-mask intersection, and a requests toggle gating CreateRequest. The merge happens in Go (access.ApplyGroupPolicy / EffectivePolicyForUser) before policy inputs are built, so vendor Rego, the parity suites, and the decision log are untouched; every enforcement surface (viewer scope in both resolvers, permission gates, downloads, playback admission, requests) consumes the effective policy and fails closed on provider errors. Changing a group's quality ceiling bumps its members' access_policy_revision, mirroring the per-user rule. Additive admin API: /admin/access-groups CRUD with member counts; PUT /admin/users/{id} + user DTOs gain access_group_id. Also demotes the Rego editor: policy.editor_enabled (default off, hot-reloaded) drives the capability endpoint's editor_available and 403-gates editor endpoints while the engine and decision logging keep running. Design: docs/superpowers/specs/2026-07-02-access-groups-design.md. Implementation drafted by Codex (GPT-5.5) via codex exec; reviewed (composition core + fail-closed call-site audit) and verified here. DB-backed group-store tests pending local Postgres recovery. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): add Access Groups admin page and gate the policy editor New /admin/access-groups: a card grid summarizing each group (member count + key restrictions), drilling into an editor that reuses the same LibraryAccessSelector and quality presets as the user editor, with toggles for downloads/transcoded-downloads/requests, concurrent-stream and transcode limits, and a permissions mask (all-assignable by default, narrowable to specific permissions). Delete warns how many members fall back to the built-in defaults. Copy states the composition rule up front: a group grants the most a member can do; their own restrictions still apply on top. The user editor gains a Group picker and read-only row; the Policy nav entry is now hidden unless the capability reports the editor enabled. Plumbing (types, hooks, user-editor picker, nav gating) drafted by Codex (GPT-5.5); the Groups page hand-built. Verified: 25 tests across the touched suites, tsc, eslint, prettier, and a production build. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(access): seed a Default Group and auto-assign newly created users Adds access_groups.is_default with a partial unique index (one default at most — the profiles is_primary pattern) and seeds a permissive 'Default Group' whose ceiling is a no-op, so assignment never changes anyone's effective access until an admin edits it. The seed is guarded against pre-existing defaults and name collisions; the Down migration only removes the row if it is still untouched. Assignment happens at the single INSERT INTO users choke point (UserRepository.Create): when no explicit group is given, access_group_id is filled by a scalar subquery on the default flag — NULL when no default exists. Every creation path (setup, signup, invites, OAuth, admin create) is covered by construction. Setting a new default via the API atomically clears the previous one in the same transaction. Deleting or unsetting the default is legal: new users then start with no group, which is pre-feature behavior. Implementation drafted by Codex (GPT-5.5); migration guards and the choke-point subquery reviewed line-by-line here. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): surface the default access group Cards show a Default badge; the group editor gains a 'Default for new users' toggle (with copy noting existing users are never moved); the delete dialog warns when removing the default that new accounts will start with no group. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(access): ship the Default Group with house-rule ceilings Seed values per product decision: 5 concurrent streams, 5 transcodes, transcoded downloads off, and a permission mask of marker_edit only (metadata curation excluded). Plain downloads and requests stay on. The Down guard matches the new values so it still only removes an untouched seed row. Only newly created users are affected; existing users are never assigned. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(access): retire per-user defaults — the Default Group is the sole default policy Removes both legacy 'user defaults' mechanisms now that the seeded Default Group owns new-user policy: - users.max_streams / max_transcodes column defaults drop from 6/2 to 0 (= unrestricted at the user layer), so group ceilings apply to new signups/invites/OAuth users instead of fighting stale per-user numbers. Existing rows keep their stored values — nobody is silently uncapped on upgrade. - The dead defaults.max_playback_quality / defaults.max_profiles settings validation goes away with its only writer (the User Defaults dialog, removed on the web side). Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): replace the User Defaults dialog with group-governed creation The Users page's 'User Defaults' dialog (defaults.* server settings) duplicated what access groups now do properly, and its values were only ever form prefill — no backend path applied them. The button now links to Access Groups, and the create-user form seeds unrestricted user-layer values (0 streams/transcodes, any quality, downloads allowed) so the member's group governs; per-user fields remain for tightening individual users. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(access): migrate existing non-admin users into the Default Group Existing users join the seeded Default Group on upgrade so one policy source governs the whole instance. Their per-user limits still holding the retired 6/2 column defaults are normalized to 0 in the same statement so the group's ceilings actually apply; deliberately customized values are preserved. Admin accounts stay ungrouped — scope/action decisions are role-blind, so grouping an admin would cap the server owner on upgrade. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(access): keep admins out of the Default Group and treat group moves as policy changes New-user creation now mirrors the migration's admin exclusion: the default access group is only auto-assigned to non-admin roles, so a fresh server owner no longer inherits the starter group's transcode denial and stream caps. Changing a user's access group now bumps access_policy_revision (the group carries permissions, quality, and limits, exactly like the per-user fields that already bump it) and triggers admin session revocation when the group actually changes. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): enforce marker_edit through the PDP on marker write routes The Rego permission policy owned marker_edit but no Go caller ever consulted it: PUT/DELETE /markers went through a handler-local check that short-circuited admins and read only the user's own permissions, so group permission masks and custom policy overrides were ignored. Marker writes are now gated by router middleware like the other permission surfaces: a PDP-backed RequireMarkerEdit that evaluates the group-merged effective permissions (plus the legacy variant for proxy/test wiring without a policy system). The handler-local check and its user loader are gone. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(downloads): assert device/quality policy facts and honor the quality ceiling The download_transcode action check hard-coded an empty device ID and never asserted the requested quality, and no caller consumed ActionDecision.QualityCeiling — custom download policies keyed on those inputs were silently ineffective. Resolve now threads the request's device ID and requested quality into the action input, and a returned quality ceiling downscales the prepared transcode target (the ceiling applies to what is served, matching the serve-time rule in serveDownloadBytes). FileQuality and the content-rating pair stay intentionally empty for downloads — documented on downloadActionInput: those ceilings are enforced against the served artifact by the scope-derived access filter, and asserting the source's quality would wrongly deny capped transcodes. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(access): align the default-group seed assertions with the migration The DB test still asserted the earlier no-op seed (transcode allowed, unlimited streams/transcodes, null permissions); the shipped migration seeds transcode denied, 5/5 limits, and marker_edit-only permissions, so the test failed on any database with the migration applied. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): lock the Rego sandbox by builtin purity and bound compile work Exclude every nondeterministic builtin from the admin sandbox instead of denylisting names, so OPA upgrades cannot silently expose impure builtins while pure helpers like net.cidr_contains stay usable. Apply the same capabilities to the runtime engine, cap concurrent compile checks, and reject oversized sources before they reach the uncancelable compiler. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): require literal booleans in vendor override and input checks Bare object.get truthiness treated any non-false value as satisfied, so a malformed override 'allowed' value could fail to tighten a base grant and hand-crafted simulate input could flip flag predicates. Compare against literal true so anything else denies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): surface decision log cleanup failures to the task manager CleanupDecisionLogsOnce now returns the first error alongside the deleted count so a broken partition manager or DB outage marks the scheduled task failed instead of reporting 100% success while policy_decisions grows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): log admission decider errors before failing closed A policy-evaluation failure was silently mapped to the too-many-streams denial, making an engine outage indistinguishable from a real limit hit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(access): nil-guard the downloads user and restore the ABS legacy resolver effectiveDownloadUser dereferenced policy state before its nil-user check, and the ABS handler lost viewer-scoped filtering entirely when the policy system was unavailable because no legacy access.NewResolver fallback was wired like the other resolver paths. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(web): address admin policy review feedback - invalidate the version query by version_number, the key usePolicyVersion actually caches under - keep the goPrevious cursor-stack updater pure (Strict Mode double-invoke) - make version history rows keyboard-selectable like the document list - clamp download_transcode_allowed when downloads are disabled so groups cannot save a contradictory record Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): cap policy endpoint request bodies at 1 MiB The policy write endpoints (create document/version, set enabled, validate, simulate) decoded JSON bodies without a size limit, so an oversized payload buffered fully in memory before CompileCheck's 256 KiB source cap could reject it. Route all five through a shared decodePolicyRequest helper that wraps the body in http.MaxBytesReader and returns 413 with the repo's standard too_large error shape. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UtnZ2Uewzo959hpneLrtRN * fix(access): forbid deleting or demoting the default access group Deleting the default group (or unsetting its is_default flag) left the server with no default: new non-admin users were then created ungrouped with max_streams/max_transcodes of 0 — unlimited — because the legacy per-user column defaults were retired in favor of the group's ceilings. The store now rejects both operations with ErrDefaultGroupRequired (mapped to 409); promoting another group remains the supported way to move the default, and atomically clears the previous one. The admin UI disables the delete button and the default toggle on the default group and explains the promote-another-group flow. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UtnZ2Uewzo959hpneLrtRN * fix(web): keep unsaved policy drafts when a newer version activates elsewhere The editor state was keyed on the active version's id/sha, so a background refetch after another admin (or another tab) activated a version remounted the editor and silently discarded the dirty draft. PolicyEditorPanel now pins the seed it is editing against and only adopts an incoming seed when nothing can be lost: the editor is clean, the draft already equals the incoming source (the same-admin activate flow), or the selection moved to a different document. Otherwise the pinned editor stays mounted and an inline notice offers an explicit "Load live version" action. Part of #272 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UtnZ2Uewzo959hpneLrtRN * fix(policy): fail reloads on invalid custom sources and surface degraded/apply state A stored custom source that stops compiling used to be silently skipped on reload: the bundle widened to vendor-only for that domain while the generation reported fully applied. Reload is now strict — a bad enabled source fails the reload and the last known-good engine keeps serving. Boot keeps its vendor fallback for availability, but skips are recorded on the engine and exposed (with store-outage reasons) through System.DegradedState and additive degraded fields on GET /policy/capability. Activate/SetEnabled re-run CompileCheck instead of trusting the stored compiled_ok flag. Mutation endpoints also no longer conflate persistence with live apply: activation/enable responses carry additive applied/failed_step/ loaded_generation fields and return 202 when the store change persisted but the local reload failed. Addresses review findings C1, C2, and the degraded-signal gap (6.1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): type deny reasons across the contract and enforce profile_verified Deny handling used to branch on exact free-text reason strings in three Go consumers, and playback reported ANY unrecognized reason — including custom override free text and engine failures — as a stream-limit error. Decisions now carry a stable reason_code (custom overrides always get custom_denial); downloads, the metadata-curation gate, and playback admission switch on codes, with a new ErrPlaybackNotAllowed -> 403 playback_not_allowed mapping for non-limit denials. Rego tests pin every vendor code. The scope contract's tighten-only profile_verified output was also emitted but never consumed; a policy revocation now surfaces as ErrProfileUnverified (403 profile_unverified) instead of silently proceeding. Addresses review findings 6.2 and C4. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(catalog): close the dual-library disabled-scope bypass in direct item authorization EnsureAccessible, EnsureAccessibleIDs, and FilterAccessibleContentIDs gated library access with allow/deny predicates over a single joined media_item_libraries row, so an item linked to BOTH a passing library and a disabled one satisfied the disabled check via the passing row — a direct-ID bypass of disabled-library scope on the detail, media-file, playback, and download paths. All library access predicates now share one helper (libraryAccessConditions) emitting independent EXISTS / NOT EXISTS subqueries, the semantics GetByIDsWithAccess already used, including the orphan-item membership guard for disabled-only scopes. SQL-shape tests pin every builder and a DB-gated regression test covers the dual-library item end to end. Addresses review finding C3 (plus the same shape in buildFilterAccessibleContentIDsSQL, which the review did not flag). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(downloads): serialize quota check and row creation under a per-user advisory lock The concurrent-download quota was check-then-insert with nothing serializing the pair: parallel creates could all observe free quota before any row existed, bypassing the cap and stacking artifact encode jobs. All four check->insert spans (ephemeral original, artifact-backed, series batch, managed batch) now run inside Repository.WithUserQuotaLock — a pg_advisory_xact_lock keyed by user, so the serialization holds across nodes. The artifact path keeps the limiter-before-Ensure ordering (a rejected request must not leave an encode job behind) by holding the lock across Ensure. Managed-entry replacement stays quota-exempt and lock-free. A DB-gated barrier test races 8 creates against a cap of 1. Addresses review finding C5. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(downloads): assert served quality at create time for original and remux downloads Direct-original and remux downloads serve the source resolution unchanged, but create-time policy checks left file_quality empty — an over-ceiling source registered a row serveDownloadBytes could never satisfy. Resolve now runs a final download action check with FileQuality populated on those two paths (capped transcodes keep the ceiling-on-artifact behavior), a custom override ceiling below the served resolution denies, and quality_ceiling_exceeded maps to ErrQualityUnavailable. The ActionInput contract now documents exactly when file_quality and the rating facts are supplied so custom policy authors are not misled. Addresses review finding C6. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(policy): guard activation against slow overrides and make eval timeouts observable A custom scope override that exceeds the 25ms eval budget compiled fine, activated fine, and then converted to 500s on every authenticated request — server-wide lockout authored in the admin editor. Activation and enable now run GuardEvalCost: the candidate source is evaluated on a throwaway engine against a canned representative input under the live budget, and a source that cannot complete is rejected 422 with ErrPolicySlowEval before it goes live. Runtime timeouts keep failing closed but now carry a distinct ErrPolicyEvalTimeout sentinel, an Error log, and a per-engine counter exposed as eval_timeouts on GET /policy/capability so intermittent near-budget policies are attributable. Addresses review finding C7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * style: gofmt remediation files Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-05 17:38:19 -04:00
4 people	430224a1b9	perf: cut home-screen, Continue Watching, and Latest latency; cache shared home rails (#292) ... * perf(jellycompat,sections): bound resume scan, batch leaf detail progress, widen section concurrency Three low-risk fixes from the section-fetch performance investigation (docs/superpowers/plans/2026-07-03-section-fetch-performance.md): - jellycompat: bound loadProgressPage at resumeScanMaxRows=300 so a single request never pages through more than that many in-progress rows. The cap is unconditional: it also covers the sparse-visible-set case (a heavy watcher whose recent rows are mostly dismissed/superseded, or a Series/Season-only request that matches no leaf in-progress row), where the page never fills and the loop would otherwise scan the entire history — previously an O(history) scan reaching tens of seconds. In the common case the loop exits far earlier, so the cap only bounds the pathological worst case; 300 leaves ample headroom to fill a ~20-item Continue Watching page. Beyond the cap the reported total is a clamped lower bound. Covered by TestLoadProgressPage_BoundsScanForSparseVisibleSet. - jellycompat: batch the leaf-item (movie/episode) progress lookup in GetItemDetailsByIDs via ListProgressWithCompletedHistory instead of a per-item GetProgressWithCompletedHistory (~100 sequential queries for a 50-item detail page). Series keep the per-item episode-rollup path (they own no progress row). Output is unchanged; a batch-lookup failure is now logged rather than silently dropping played state for the whole page. - sections: raise fetchAllMaxConcurrency 4 -> 6 to cut FetchAll wave count for large home layouts, staying within the default 20-conn pool. Part of the home/continue-watching latency work. AI-use disclosure: implemented with AI (Claude) assistance. * perf(jellycompat): keep Latest browse on the cross-library fast path under isPlayed /Items/Latest with isPlayed=false is the highest-frequency compat browse (~10.8k calls/day). The played overlay can't be pushed into SQL, so browse over-fetches and filters locally. The cross-library recently_added fast path (BrowseRecentlyAddedAcrossLibraries: one ~1ms index walk per library) was gated on Offset==0, so a heavy watcher who had already seen the newest items needed a 2nd chunk and fell through to BrowsePage — a whole-catalog MIN(first_seen_at) + GROUP BY HashAggregate over ~147k movies measured at ~755ms per call (0.8-1.6s observed end-to-end). Fetch the entire over-fetch budget (maxScannedRows) in a single merged fast-path walk instead of paging into BrowsePage, so the loop fills from one call. The clamp caveat (MaxLimit=1000 leaves a fall-through only for requestedLimit>200, off the Latest hot path) is documented inline. Part of the home/browse latency work. AI-use disclosure: implemented with AI (Claude) assistance. * fix(jellycompat): scope resume scan cap to resume path and bound the fast-path loop Addresses PR #292 review feedback: - Codex (P2): the resumeScanMaxRows cap was applied unconditionally in the general loop, which also paginates the completed (watched-items) list. Gate it on resumeFiltered so the completed path keeps exact TotalRecordCount and deep StartIndex pagination. Covered by TestLoadProgressPage_CompletedScanNotCapped. - CodeRabbit (Critical): the earlier raw-offset fast-path loop — the default Continue Watching shape and the sections-fallback route — had the same unbounded-scan bug and was not covered by the cap (the existing test forces EnableTotalRecordCount=true, routing around it). Bound it with the same resumeScanMaxRows guard. Covered by TestLoadProgressPage_BoundsFastPathScanForSparseVisibleSet. - CodeRabbit (Minor): tag the doc's fenced example blocks as text to satisfy markdownlint MD040. AI-use disclosure: implemented with AI (Claude) assistance. * perf(sections): cache shared user-agnostic home rails per access scope Home-screen rails that are identical for everyone who can see the same libraries (recently added, recently released, genre, trending on server, most watched, new to library, critically acclaimed, award winners, format showcase, seasonal, mood, trending discover, admin-curated lists, and library collections) were rebuilt from Postgres once per request, per user. Only the overlay on top of each row (watched flags, play position, presigned poster URLs) is actually per-user. Insert a process-global resolved-list cache at the FetchOne choke point in internal/sections. Each cacheable row is built once per access scope, held with a 15m TTL, and refreshed in the background 3m before expiry; singleflight collapses cold-miss stampedes into a single build. The per-user overlay still runs fresh in buildSectionsResponse, so no profile state is ever shared. Random and per-user rows (continue watching, next up, recommendations, hidden gems, forgotten favorites, activity feed, user collections) bypass the cache. The access-scope key captures every access boundary the fetch path enforces -- section identity (type + id + config hash) + item limit + accessible and disabled libraries + max content rating + excluded media types + name prefix + allowed-content-id allowlist -- and nothing per-user, so entries are safely shared. Empty membership is never cached (avoids freezing a transiently empty rail); background refreshes are bounded by a timeout. Scale (analytical, derived from the cache behavior -- not a measured latency): for the user-agnostic rows, Postgres section-query volume collapses from O(rows x concurrent requests) to O(rows x distinct access scopes) per 15m refresh window, because most users share a handful of access scopes. Illustrative -- 40 cacheable rows on a home screen, 1000 concurrent users falling into ~5 distinct access scopes: - before: ~40 x 1000 = ~40,000 section queries per wave of home loads - after: ~40 x 5 = ~200 builds per 15m window (plus one background refresh per row per scope), i.e. a warm home load runs zero section queries for these rows. That is a ~99% reduction in shared section-query load at that concurrency; the win grows with concurrency and shrinks as access-scope diversity rises. Design/plan doc added under docs/superpowers/plans/. * perf(jellycompat): serve per-library Latest via the cached recently-added section A jellyfin-compat per-library /Items/Latest rail is the same user-agnostic list as the native "recently added" library rail -- both order by mil.first_seen_at DESC. It was rebuilt on every request through directContentService.BrowseItems, missing the resolved-list cache entirely. Route per-library Latest for movies and series libraries through the native section fetch instead, so it reuses the shared cache. HandleLatest resolves the library's type once, and for a movies/series library builds a synthetic SectionRecentlyAdded with the same type + config + limit + access scope the native rail uses and calls FetchOne; the per-user overlay (favorites, progress, episode targets, presign) is extracted into buildLatestItemDTOs and shared by both the native and BrowseItems paths, so no overlay logic is duplicated. Cached *models.MediaItem values are read-only -- LocalizeItemModels deep-copies before any presign mutation. To let the two surfaces share one entry, resolvedListCacheKey no longer includes the arbitrary section ID: every cacheable section type derives its membership from type + config + limit + scope, never from its own ID (audited all 14 cacheable types plus the library-collection path; the sole s.ID read lives in the non-cacheable user-collection branch). A native recently-added rail and the compat Latest for the same library + scope now collapse to ONE cache entry, built once and reused. Access-scope isolation is unchanged -- the removed ID never carried access information, and every access boundary (libraries, rating cap, excluded types, content allow-list, name prefix) still keys the entry. Guardrails: the native path is restricted to movies and series libraries; every other library type (ebook, music, manga, mixed) is ignored and keeps its exact BrowseItems behavior -- important because an unfiltered recently-added fetch would otherwise surface non-video items to Jellyfin clients that only expect video. Deeper pages, played-filter and backdrop-required requests, a client asking for a type other than the library's own, and any FetchOne error also fall back to BrowseItems. Chosen over an alternative that gave the synthetic section a deterministic ID (which kept two separate cache entries): both returned identical data with similar complexity, so the shared-entry design won. * fix(sections,jellycompat): post-review fixes for the shared-list cache and Latest path Consolidates fixes from the branch's adversarial review and PR #292 review comments into one commit: - Latest fast path: fall back to BrowseItems when a request carries a genre, name-prefix, or person filter (the synthetic recently-added section cannot express these, so serving it unfiltered would return a wrong, broader set). Eligibility is decided by latestFastPathEligible and covered by a test. - Clamp the /Items/Latest page size to compatBrowseMaxLimit before building the section, matching the BrowseItems fallback, so a large client Limit can't drive an oversized recently-added fetch or explode the shared cache key with unbounded ItemLimit values. - Evict expired entries from the process-global resolvedListCache: resolvedListSet sweeps expired keys at most once per minute, bounding the map to scopes seen within one TTL window. Covered by TestResolvedListCacheEvictsExpiredEntries. - Log a short digest of the cache key (resolvedListLogKey) instead of the raw key in the background-refresh panic/error paths, since the key embeds user-controlled access-scope fields such as NamePrefix. Skipped review comments (verified already fixed or stale against current code): the resume fast-path scan bound and watched-items cap (04d2e795) and the docs fence-language tags (already addressed). Build, vet, and go test -race pass for internal/sections and internal/jellycompat. * perf(plugins): cache plugin installations in-memory, invalidated on lifecycle change ## Problem Every poster/image on a warm home rail re-read plugin_installations from Postgres to answer "is this plugin enabled?" and to acquire the plugin client (Source A: metadata chain buildProviders enabled-check; Source B: ensureClient -> loadInstallation). Plugin-resolved image URLs are never URL-cached, so the plugin source and the DB read behind it fired again on every identical warm request; 100% of images in the target library are plugin-backed. ## Solution - Guarded in-memory installation cache (map[int]*Installation + RWMutex) in plugins.Service. loadInstallation reads through it; the requireEnabled gate stays after the cache read so ErrInstallationDisabled semantics are unchanged. invalidateInstallationCache clears it and is self-registered as a lifecycle hook, so Service.OnLifecycleChange wipes it on install/enable/disable/update/ uninstall. - A generation counter closes an invalidate-vs-repopulate race: captured before installations.GetByID and re-checked under the write lock, so a row fetched before a lifecycle mutation is never written into a freshly cleared cache (would otherwise resurrect a just-disabled plugin). - Route the metadata chain enabled-check through the same cache via a structural InstallationEnabledChecker interface (nil-safe: falls back to the pool query when no checker is injected), wired in cmd/silo/main.go. ## Post-review fix (auto-update reliability blocker) AutoUpdateService mutated installations (new InstallPath, old dir deleted) on the default auto update policy without firing OnLifecycleChange, leaving the cache stale and breaking plugins with "stored plugin manifest mismatch" until restart. It now takes an onChange callback wired to Service.OnLifecycleChange and fires it once per Check run that mutated a row. ## Verification go build/vet, go test ./internal/plugins/... ./internal/metadata/... (-race). Tests: cache hit/invalidation, racing-invalidation guard, IsInstallationEnabled, auto-update fires onChange. ## AI-use disclosure Implemented with AI assistance (Claude). * perf(jellycompat): batch per-item presign, and enrich series on the cached Latest path ## Problem List rails presigned each item's poster/backdrop/logo/still image individually (~160 singular resolver calls for a 40-item page where 4 batched calls suffice), and ItemsHandler carried a near-verbatim duplicate of the batch presigner. ## Solution (batching) Promote the batch presigner to a shared package-level presignCompatListItems (presign_list.go) with a generic collectImagePaths[T]; convert the per-item loops (cached home/Latest rail, favorites, batch loaders, userdata favorites) to one batched PresignImageURLsWithExpiry per image type per page; batch the season/episode collections; delete the three duplicate presign helpers. URL output is unchanged (verified byte-for-byte). ## Post-review fix (series Latest data-parity regression) The native cached Latest fast path built items via compatListItemsFromModels + buildLatestItemDTOs and never ran the series watch-state rollup, so a series library's Latest lost Played / UnplayedItemCount and page 1 disagreed with the BrowseItems fallback. enrichSeriesUserData is promoted to the ContentService interface and called on the native path (reused, not duplicated). ## Verification go build/vet, go test ./internal/jellycompat/... ./internal/catalog/... Tests: bounded presign invocation counts + per-item URL mapping; series rollup populated on the native Latest path. ## AI-use disclosure Implemented with AI assistance (Claude). * perf(sections): gate personalized rails out of the shared cache; widen refresh lead ## Problem 1. The shared home-rail cache whitelisted custom_filter/genre sections by TYPE alone, but those route through fetchFiltered -> ParseQueryDefinition and can carry personalized (per-profile) rules/sorts (watched, favorited, in_watchlist, in_progress, last_watched; sorts progress/date_viewed/plays). Their membership is per-profile yet the cache key excludes userID/profileID, so a personalized rail built for one profile was served to others in the same access scope for up to 15m -- a cross-profile watchlist/watch-state leak. 2. The background-refresh lead was tuned so steady traffic is served a warm entry from a longer soft window. ## Solution - Add QueryDefinition.IsPersonalized() (reusing the existing QueryFieldRequiresProfile/QuerySortRequiresProfile helpers). isCacheableSectionType now parses the section QueryDefinition and refuses to cache custom_filter/genre when personalized; non-personalized definitions stay cacheable. Seasonal/mood/trending build their definitions server-side and stay unconditionally cacheable. - resolvedListRefreshLead 3m -> 10m (soft threshold builtAt+5min instead of builtAt+12min). ## Verification go build/vet, go test ./internal/sections/... ./internal/catalog/... (-race). Test: personalized custom_filter/genre not cacheable; non-personalized are. ## AI-use disclosure Implemented with AI assistance (Claude). * fix(sections,metadata): post-review fixes for shared cache and plugin chain staleness Addresses three review findings on PR #292: - sections: canonicalize section config JSON before hashing so configs differing only in whitespace/field order share a cache entry (native + jellycompat rail sharing). Added TestHashSectionConfigCanonicalizes. - metadata: invalidate the resolved-chain cache on plugin lifecycle changes; the installation-enabled check already reads the invalidated plugin cache, but resolveChainCached could serve a stale provider chain for up to chainCacheTTL after a provider's availability changed. - jellycompat: move ctx to the first parameter of presignCompatListItems for consistency with the other presign helpers. Skipped the episode-image presign batching nitpick: the resolver already dedupes+singleflights, so it is a Minor perf-only item not worth the two-pass refactor risk in this pass. * fix(sections,jellycompat): harden shared rail cache and Latest fast path per review Addresses the eight findings from the deep review of this PR: - Detach the blocking cold-miss rebuild from the singleflight leader's request context (context.WithoutCancel + the shared 30s build timeout) so one client disconnect no longer fails every collapsed waiter and leaves the entry uncached. - Stop client-controlled values minting unbounded cache entries: the compat Latest fast path now always fetches a fixed 100-row budget and slices to the requested limit (one entry per scope+library instead of one per Limit value), and an unrecognized MaxOfficialRating string disqualifies the fast path instead of entering the global cache key. - Add release_date to the sections item projection/scan so movies served via the Latest fast path keep PremiereDate (Jellyfin default-set field) in parity with the BrowseItems fallback. - Fall back to per-item progress lookups when the batched leaf progress query fails, restoring one-item-at-a-time degradation instead of blanking played state for the whole page. - Derive cache eligibility from a single source of truth: fetchSection and isCacheableSectionType now share the userAgnosticSectionFetcher table, whose no-userID/profileID signature makes a fetcher drop out of the cacheable set at compile time if it ever gains per-profile inputs. - Decide Latest fast-path eligibility off the actual browse params the fallback would receive, so any filter later added to buildBrowseParams automatically disqualifies the cached path; share one compatDefaultBrowseLimit constant between both paths. - Extract AccessFilter.WriteAccessScopeCacheKey as the shared, security- critical serializer for all access-scoped caches (resolved-list, editorial candidates, audiobook groups); the editorial key now captures ExcludedMediaTypes, which its loaders already applied in SQL. - Strip leaked agent-transcript markup from the section-fetch plan doc. go build ./..., go vet, gofmt clean; go test -race on internal/sections, internal/catalog, internal/jellycompat passes (TestBeginWebOperation* failures are the known pre-existing flakes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-05 02:01:30 -04:00
4 people	a5fb16a5c5	feat(historyimport): import the Plex account watchlist alongside watch history (#285) ... * feat(historyimport): import the Plex account watchlist alongside watch history The Plex import migrated only watch history; the user's saved watchlist had to be rebuilt by hand (#245). - PlexClient gains FetchWatchlist: pages the account-level watchlist on the Plex discover API (discover.provider.plex.tv). It authenticates with the plex.tv ACCOUNT token — the PIN/OAuth session token, which resolvePlexAuth now threads through plexAuth.AccountToken (manual-token imports pass the user token, which doubles as the account token). - Watchlist entries become import Records flagged Watchlisted, carrying identity only (movie/show → KindMovie/KindSeries, guids parsed) and no watch state. They ride the existing matcher (series matching already exists), and matched entries are added to the importing profile's watchlist via the idempotent AddToWatchlistAt — re-imports do not duplicate. A watchlist fetch failure downgrades to a run warning so the history import still completes. - Run summaries gain a watchlist_added counter (new column + repo plumbing + client/admin UI cards). Fixes #245 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(historyimport): count only newly inserted watchlist rows in WatchlistAdded AddToWatchlistAt now reports whether a row was actually inserted (the insert is ON CONFLICT DO NOTHING / INSERT OR IGNORE), and the import summary increments WatchlistAdded only for genuine inserts, so re-importing the same Plex account no longer inflates the count. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>	2026-07-05 00:19:31 -04:00
4 people	c0f209a936	feat(catalog): Latest Episodes sort — order series by newest episode file (#283) ... * feat(catalog): Latest Episodes sort — order series by newest episode file Adds a latest_episode_added sort so users can see which shows received new episodes. Today's recently-added surfaces reflect when the SERIES was first added: linking a new episode file never bumps the series' media_item_libraries.first_seen_at (ON CONFLICT DO NOTHING), so a long-running show with a fresh episode sorts as stale (#202). - New denorm media_items.latest_episode_added_at (migration + backfill + partial series index), mirroring the last_air_date_at precedent. Source of truth is episode_libraries.first_seen_at; the three insert paths (UpdateEpisodeLink, BulkLinkEpisodesBySeries, scanner folder restore) bump the parent series atomically in the same statement, monotonically via GREATEST, and only for genuinely new links. - Sort registered in both frameworks: querySortDefs (sections + smart collections + /v1/catalog pick it up automatically via QuerySortFieldSet) and the browse buildOrderByPlan path. - Jellyfin compat: SortBy=DateLastContentAdded now maps to the new sort instead of silently collapsing to series creation date — Jellyfin clients already send this for the TV "Latest" shelf, so they get the correct behavior with no client changes. DatePlayed keeps its old created_at mapping instead of piggybacking. - Web sort picker gains "Latest Episode Added" (series scope). Additive-only per v1 API rules: new sort value, no field/status changes. Part of #202 Fixes #202 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(web): include latest_episode_added in the api QuerySort field union The picker-side QuerySortField gained the value but the api-layer QuerySort union did not, breaking the production tsc build. Part of #202 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scanner): recompute latest_episode_added_at when episode memberships are removed The denorm was only ever bumped upward (GREATEST) at insert time, but UpdateEpisodeLink also deletes the old episode's library membership on re-link, and reconciliation/path-prefix clears remove memberships too — leaving a stale timestamp that kept the series sorting as recently updated. All removal paths now run in a transaction and finish with a shared full MAX() recompute (catalog.RecomputeSeriesLatestEpisodeAdded) that also resets to NULL when no memberships remain, mirroring the last_air_date_at maintenance pattern. Sequential statements are load-bearing here: data-modifying CTEs are invisible to reads in the same statement, which also silently no-op'd the old path-prefix membership delete. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): keep DateLastContentAdded scoped to series-only requests mapSortBy runs for every /Items browse, so the latest_episode_added mapping leaked into movie and untyped requests where the column is always NULL, destroying the previous created_at ordering. The sort now falls back to created_at unless IncludeItemTypes is exactly Series. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>	2026-07-04 23:43:19 -04:00
3 people	604bbf1a0f	feat(playback): unified restart-resilient playback (native + jellycompat) (#174) ... * feat(playback): unified restart-resilient playback via shared TranscodeManager Make direct, remux, and native HLS transcode sessions survive a server restart through one shared flow instead of per-method paths. A missing in-memory session becomes a reconstruct trigger, not a 404: the server rebuilds the session from a tiny durable recipe card plus the position the client re-supplies on its next request. - internal/playback/transcode_manager.go: shared TranscodeManager owning the transcodes map, recipe-card lifecycle, reconstruct single-flight + concurrency cap, LoadOrReconstructSession front door, ReconstructSession / ReconstructTranscode, and orphan cleanup. ~90% is logic moved out of the native handler (no behavior change), not new surface. - internal/playback/recipecard.go + recipecard_postgres.go: RecipeCard with a PlayMethod discriminator (direct/remux/transcode; empty decodes as transcode for back-compat) behind a swappable, nil-safe RecipeStore interface backed by transcode_recipes. - internal/playback/session.go: RegisterReconstructed inserts a rebuilt Session under its existing id (no UUID mint, no limit double-count, race-yielding). - internal/playback/transcode.go: CloseProcess keeps the output dir so a reconstruct winner keeps serving; Close removes it. - internal/api/handlers: drain the transcode lifecycle into the manager; wire reconstruct into the stream/segment serve paths; re-bind ownership to the live caller (refuse userID==0/mismatch); card-aware orphan cleanup. - migrations: add transcode_recipes (expires_at TTL, filter-on-read, indexed). Ownership stays two-factor: an authenticated caller AND a session.UserID that matches; the card stores no secrets and identity is re-resolved per request. Tests: recipe-card round-trip/legacy-decode/disabled-noop, RegisterReconstructed insert/race/concurrency, close-vs-close-process dir semantics, the LoadOrReconstructSession status matrix, and the reconstruct concurrency cap. AI-use: implemented with AI assistance (design, implementation, adversarial review). * feat(jellycompat): reconstruct transcodes across restart via shared manager Bring Jellyfin (jellycompat) HLS playback onto the same restart-resilient flow as the native path. Previously jellycompat owned a separate PlaybackHandler with a private transcodes map and a duplicated transcode lifecycle that never grew the reconstruct half, so an in-flight Jellyfin transcode died on restart and the next segment request 404'd. - Embed the shared playback.TranscodeManager and delete the duplicate lifecycle, so jellycompat gets reconstruct, the concurrency cap, the node-affinity rule, and the card lifecycle for free. - internal/jellycompat/playback_sessions_postgres.go: DurableCompatPlaybackStore, a write-through cache over jellycompat_playback_sessions behind the new CompatPlaybackStore interface (nil pool degrades to cache-only). This persists the load-bearing PlaySessionId -> UpstreamSessionID mapping (plus media sources, route item id, seek) so it survives a restart instead of vanishing with the map. - Write a recipe card on compat transcode start keyed by the upstream session id, using the native StreamAppUserID so the ownership re-bind matches; reconstruct the upstream session and the transcode seeked to the requested seg_NNNNN. - migrations: add jellycompat_playback_sessions (expires_at TTL + compat_token index, full PlaybackSession in data JSONB). Auth is mapped to the native user id before reconstruct so the same two-factor ownership check and userID==0/mismatch refusal apply unchanged. Tests: DB-gated (SILO_TEST_DATABASE_URL) durable-store round-trip proving a session written by one instance reloads in a fresh one (the restart case), plus a nil-pool cache-only path; existing handler tests updated to the manager. AI-use: implemented with AI assistance (design, implementation, adversarial review). * docs(playback): consolidate unified playback reconstruction design Replace the three overlapping playback docs (the native Postgres restart-resilience spec, the jellycompat plan, and the unification spec) with a single self-contained design at docs/superpowers/specs/unified-playback-reconstruct.md. The doc leads with the unified design — the one-idea reconstruct model, a strong visual flow of a restart mid-playback, the shared TranscodeManager + recipe card, the two swappable durable stores, security, the concurrency cap and node-affinity constraint, preconditions, and verification. The design history and rationale (reconstruct-not-rehydrate, phased delivery, Redis-vs-Postgres, token-as- descriptor, failure analysis) move to an appendix. It references no other md file. AI-use: written with AI assistance. * fix(playback): address review on restart-resilient playback Four fixes from PR review of the unified reconstruction work: - Rewrite the recipe card on audio-track change. HandleChangeAudioTrack only updated the in-memory session/transcode, so after a restart reconstruct resumed with the stale AudioTrackIndex/TranscodeAudio (and stale play method) from the start-time card. Re-save the card (direct/remux/transcode) with the switched state, mirroring the start-card pattern. - Guard nil TranscodeManager in LoadOrReconstructSession and ReconstructSession. StreamHandler.TM is documented optional (tests/minimal setups); a missing session previously panicked in recipeEnabled instead of returning SessionMissing. ReconstructTranscode already guarded nil; make the two siblings consistent. - Reject direct/remux cards in doReconstructTranscode before spawning ffmpeg, so a non-transcode card id can never enter the HLS reconstruction path. - Log a non-success status from the remote transcode-node DELETE in CloseTranscodeSession; a 401/404/500 was previously silent. AI-use: implemented with AI assistance. * fix(playback): harden restart-resilient compat sessions * feat(playback): token-carried reconstruction across restarts Build on the shared TranscodeManager (introduced earlier in this branch) so a playback session survives an API-server or transcode-node restart without the client re-negotiating, and retire the Postgres transcode_recipes store in favor of a recipe carried inside the signed stream token. - RecipeCard encodes the byte-affecting encode parameters and rides inside the stream token; LoadOrReconstructSession rebuilds the in-memory Session (and, for integrated transcodes, the ffmpeg process) on a cold miss, single-flighted per session and paced by a spawn semaphore. Removes recipecard_postgres.go and the 20260617233705_add_transcode_recipes migration. - transcodenode reconstructs a lost ffmpeg node-side from the forwarded token. - TR-lease: proxy/streamauth enforce a revocation deny-marker on every served segment, with a 500ms Redis timeout, a bounded per-session "allowed" cache (3s TTL, expiry-first graceful eviction), and a degraded-fail-open counter. Review hardening folded in: - Manifest/segment handlers do the in-memory session lookup first and only verify the stream token on a reconstruct miss (token HMAC was per-segment). - Copy-mode reconstruct never applies the encoded-only seg*dur seek, at spawn time or via the recovery path: RestartSeekTarget reports "unresolved" for a copy session whose manifest cannot yet map the segment, so the client retries instead of seeking to a fabricated source time. - Crash teardown is a compare-and-delete (CloseTranscodeSessionIf returns whether it matched); the crash closure tears down the playback session only when it matched, so a session reconstructed under the same id is not killed. - Reconstruct enforces the same per-user stream/transcode caps as a fresh start (RegisterReconstructedWithLimits), closing a token-replay slot bypass. AI-use disclosure: implemented with AI assistance (Claude Code), including a two-round multi-agent adversarial review whose findings drove the hardening. * feat(jellycompat): node-side transcode reconstruct via shared recipe store Make Jellyfin-compat playback sessions survive a server or transcode-node restart by reusing the shared TranscodeManager reconstruct path and a durable recipe store, on top of the durable compat session store added earlier in this branch. - Node-side transcode reconstruct goes through the shared recipe store; the recipe is persisted to the control-plane store (Redis) when a dedicated transcode node is used so the node can rebuild ffmpeg after its own restart. - Adopt the shared manager's API (3-arg OnFFmpegCrash carrying the dead session, guarded CloseTranscodeSessionIf, RegisterReconstructedWithLimits). Review hardening folded in: - Recipe lifecycle: noderecipe.Store gains Delete, called on deliberate teardown (stop, method-switch discard, node stop/force-reload) so a stopped session cannot be resurrected by a buffered request after a node restart; crash paths intentionally keep the recipe so a resume can reconstruct. - Crash closure tears down the upstream session only when the guarded transcode close matched, so a reconstructed successor is never left orphaned. - Copy-mode segment recovery surfaces a retryable not-found instead of a wrong-position restart, matching the native and node paths. - Durable Update is now a SELECT ... FOR UPDATE transaction, removing the lost-update clobber that could silently drop a transcode recipe. - Empty-token route resolution no longer falls back to an unbounded full-table scan; DB expiry filters bind the injected clock; the redundant re-Get is gone. AI-use disclosure: implemented with AI assistance (Claude Code), including a two-round multi-agent adversarial review whose findings drove the hardening. * docs(playback): consolidate restart-resilient playback design Replace the superpowers spec with a single architecture record describing the token-carried recipe card, the shared TranscodeManager reconstruct path for direct/remux/transcode, the jellycompat durable session + node recipe store, and the revocation-lease model with its fail-open tradeoff. AI-use disclosure: written with AI assistance (Claude Code). * docs(playback): correct jellycompat node-recipe rationale in comments The noderecipe / transcode-node / jellycompat comments justified the Redis recipe store with "a Jellyfin client cannot round-trip a token". The real reason: the node-hop token is server-minted and could carry the recipe, but the recipe is mutated in place under a stable session id (a /Sessions/Playing/Progress audio switch restarts ffmpeg without re-minting the client's token) and a third-party Jellyfin client cannot be driven to refresh a stale token, so the node must reconstruct from a server-authoritative, node-reachable store. Aligns the comments with docs/architecture/restart-resilient-playback.md §10. Comment-only; no behavior change. * refactor(playback): remove deny-lease revocation, defer to future PR The deny-lease stream-revocation mechanism (the internal/streamauth package, its silo:streamauth:<sid> Redis markers, the proxy Allowed() enforcement, and the admin Stop/Terminate deny write) only ever enforced on the offload-proxy topology and was a silent no-op on the integrated single box and the dedicated transcode node. Rather than ship a partial revocation feature that looks complete but isn't, remove it wholesale and defer a uniform cross-topology revocation design to a dedicated follow-up. Removed: internal/streamauth (package + tests); the LeaseDenier field, StreamLeaseDenier interface, and denyStreamLease helper in playback.go; the admin deny write; the router/main wiring; and the proxy verifyToken Allowed() gate. The unified-reconstruct core (recipe-token, LoadOrReconstructSession) is orthogonal and untouched. Known limitation (now on every topology): admin Terminate and user Stop tear down the live in-memory session and ffmpeg producer, but a still-valid stream token can reconstruct the session until its 24h TTL expires. No node-side byte-withholding ships in this PR. docs/architecture/restart-resilient-playback.md is updated to mark the revocation/deny-lease sections as deferred and to drop the overstated "instant revocation on admin kill" claim. * fix(playback): allow zero-caller bearer on transcode reconstruct The authless HLS transcode delivery routes (master.m3u8 / segment) treat the session UUID as the bearer credential, so a real request carries requestUserID == 0. The live serve path already allows this, but ReconstructSession hard-rejected a zero caller, so a request that worked before a restart became SessionMissing -> 404 after the in-memory session was gone, breaking the restart resilience these routes advertise. Match the live-path contract in LoadOrReconstructSession: allow a zero caller (UUID-as-bearer) and refuse only a non-zero caller that mismatches the card owner. The reconstructed session is bound to card.UserID either way. Adds TestReconstructSession_Ownership covering both cases. * fix(jellycompat): re-persist recipe on local audio switch A Jellyfin client switching audio on an integrated/local compat transcode restarted live ffmpeg with the new track but did not re-persist PlaybackSession.Recipe. The remote branch already re-persists via startRemoteTranscode -> persistTranscodeRecipe. After a central restart, reconstruct rebuilt ffmpeg from the stale Recipe.AudioTrackIndex, so the integrated session resumed on the original audio track. Persist the updated recipe (best-effort) after a successful Restart in the local branch, mirroring the remote branch, so the durable Recipe.AudioTrackIndex tracks live ffmpeg. Adds a regression test. * fix(playback): strip stream token from proxied transcode-node URL proxyToTranscodeNode appended the client's raw query string to the internal transcode-node URL and logged that URL on transport failure. When a remote transcode runs without a separate proxy node, that query carries ?st=<signed JWT> — a 24h bearer reconstruction descriptor exposing the media path and recipe claims — placing the token into internal requests and error logs. Strip the "st" param before building targetURL, preserving any other query params. The token is neither forwarded to the node nor present in the logged URL. Header-forwarding of the token (so the node can reconstruct) is a separate follow-up (#6). * fix(playback): fail open on transient limit-provider error in reconstruct During the reconstruct wave right after a restart (Postgres under peak load), a transient limit-provider DB error was collapsed into a hard 404, permanently stopping playback for a user within their limits. limitsForUser wrapped any provider error, RegisterReconstructedWithLimits propagated it, and ReconstructSession mapped every error to SessionMissing -> 404 - indistinguishable from a genuine over-cap rejection. Distinguish the two: tag provider errors with a new ErrLimitProviderUnavailable sentinel and, during reconstruct, fail OPEN on a provider error (admit via RegisterReconstructed + log a degraded warning) rather than refuse - mirroring the reliability-first fail-open-on-dependency-error philosophy. A genuine ErrTooManyStreams / ErrTooManyTranscodes over-cap still refuses. Adds tests for both the fail-open and still-refused paths. * fix(playback): forward stream token to transcode node as header The dedicated transcode node's reconstruct path reads the stream token only from the X-Silo-Stream-Token header, but proxyToTranscodeNode forwarded only the node-API bearer token (and #5 now strips st from the URL). So when the central API proxied to the node and the node self-restarted, it could not reconstruct from the recipe-complete native token -> 404. Capture st before stripping it from the URL, verify it at the API boundary (streamtoken.Verify + SessionID match, mirroring the node's own check), and forward it as X-Silo-Stream-Token. Best-effort: a missing/invalid token never blocks the live proxy, and the token is still kept out of the forwarded URL and logs. * fix(playback): restart node ffmpeg on native remote audio switch A native audio-track switch on an offloaded/remote transcode was a no-op at the node yet returned 200 with a fresh URL: HandleChangeAudioTrack restarted ffmpeg only when the API owned a LOCAL TranscodeSession, so for an offloaded transcode the node kept serving the OLD audio (the node consults the token only on a session miss). The replacement URL was also minted from identity- only claims, so a later node restart 404'd. For the offloaded transcode case (detected via session.TranscodeNodeURL), POST a fresh /transcode/start to the node with the new AudioTrackIndex (handleStart tears down and restarts ffmpeg) and mint the replacement proxy URL from a full RecipeCard so reconstruct survives a node restart. The encode recipe is derived from the durable session target fields plus the file, mirroring HandleStartTranscode. A concrete SegmentDuration (playback.DefaultSegmentDuration) is embedded rather than 0: the node's token completeness gate treats SegmentDuration<=0 as incomplete and falls back to a recipe store the native path never populates, which would 404 on a node restart - the exact resilience this path provides. A failed node POST now surfaces 502 rather than a false 200. Remux and non-offloaded (local) transcode paths keep their prior identity-claim URLs unchanged. Known limitation: Session does not persist the original SegmentDuration or SubtitleTrackIndex/SubtitleBurnIn, so a remote audio switch resets subtitle selection to none and assumes the default segment length; a client that started with a non-default segment length will resegment on switch. Making that state durable on the session is a follow-up. * docs(playback): scrub stale deny-lease/revalidator comments The deny-lease revocation mechanism and its "central revalidator" were removed earlier in this branch, but four comments still described them as live (transcode_manager.go, noderecipe/store.go, streamtoken/token.go, proxy/server.go). Reword them to match the shipped behavior: ownership claims are re-resolved at reconstruct, the noderecipe store shares Redis only with the node-session tracker, and a sub-TTL hard cut depends on a node-side revocation mechanism that is deferred to a future PR. * fix(jellycompat): surface durable playback-session write failures DurableCompatPlaybackStore.Update applied the in-memory mutation and then swallowed every Postgres commit-failure path, returning nil. Callers that promise restart resilience (persistTranscodeRecipe's recipe write, the upstream-session binds in streams.go) were told the session was durably persisted when only the cache held it, so a transient DB hiccup could leave the next restart reloading a stale row (wrong audio track) or 404ing. updateDB now returns the genuine DB round-trip error (begin/query/unmarshal/ marshal/exec/commit); Update propagates it while still applying the in-memory mutation so live state stays correct. A nil pool and a genuinely absent/expired row remain best-effort (return nil) — only real infrastructure failures propagate, so existing rollback paths fire exactly when durability is lost. Part of #174 * fix(playback): re-inject stream token into proxied transcode manifests API-proxied remote transcode manifests dropped the reconstruct token from their segment URLs, so playback died after a node or API restart. When a remote transcode has no separate proxy node, the client loads its manifest via the API-local path; proxyToTranscodeNode strips the signed token ("st") from the forwarded URL (keeping it off node URLs and logs, forwarded only as the X-Silo-Stream-Token header), and the node builds relative segment URIs from that token-less query. The segment URLs the client received carried no token, and the proxy only re-attached the header when an incoming segment request already had "st" — which it never did — so a restart made those segments non-reconstructable and they 404'd. proxyToTranscodeNode now rewrites the manifest body at the boundary: every segment and #EXT-X-MAP init URI gets the client-facing, API-verified token re-appended (new playback.AppendManifestQueryParam helper), so the client's later segment fetches carry "st" again and reconstruct after a restart. The token still never reaches the node URL or its logs. Only 200 .m3u8 responses are rewritten (Content-Length corrected); segments stream through untouched. Part of #174 * fix(playback): preserve subtitle/cadence recipe across offloaded audio switch Switching audio on a remote (offloaded) transcode with burned-in subtitles silently dropped them, and reset a non-default segment cadence. The offloaded audio-switch restart rebuilt the node start request from Session state, but Session/SessionStreamState retained no subtitle or segment-duration state (only the live local ts.Opts() and the RecipeCard did), so the branch hard-coded SubtitleTrackIndex:-1, SubtitleBurnIn:false and SegmentDuration:Default — signing that altered recipe into the replacement stream token. An audio switch then changed bytes beyond audio selection, and any later reconstruct kept the wrong no-subtitle/wrong-cadence recipe. Persist the byte-affecting recipe on the session: SubtitleTrackIndex, SubtitleBurnIn and SegmentDuration are added to Session/SessionStreamState, populated at start (finalizeTranscodeStart) and on post-restart reconstruct (ReconstructSession from the card), carried forward on every audio-switch state update, and read back when rebuilding the offloaded node request and its recipe card. The restart now reproduces the exact live stream. Also resolves the M-4b non-default segment_duration reset. Part of #174 * fix(playback): serialize transcode spawn paths with a per-session lock Reconstruct was single-flighted only against other reconstructs, so a restart-driven segment reconstruct racing a quality/seek/audio fresh start could spawn two ffmpeg processes writing the same output directory at once — segment corruption, partial-write closes, orphaned processes, and skewed active-job accounting. The atomic register-after-spawn (GetOrRegister / the reconstruct compare-on-register) prevented a map leak but not the concurrent disk writers, because the losing path had already spawned. The dedicated transcode node had the same split between handleStart and spawnReconstruct. Add a refcounted per-session lifecycle lock to both TranscodeManager and the node Server, held across "check existing -> spawn -> register": - reconstruct (doReconstructTranscode / spawnReconstruct) re-checks under the lock and yields to any live session instead of spawning a duplicate; - the native and jellycompat fresh-start paths take the lock around their spawn+register (the native path also closes any session a reconstruct rebuilt in the meantime so its fresh ffmpeg is the sole writer); - the node handleStart holds it across teardown+spawn+register. The refcount drops the map entry once no path holds/waits, keeping it bounded. GetOrRegisterTranscodeSession is removed — the lock supersedes it and keeping a register-after-spawn primitive would invite reintroducing the race. Part of #174 * fix(playback): serialize restart re-spawn under the session lifecycle lock TranscodeSession.Restart() releases s.mu across cancel -> wait-for-done -> re-exec and spawns ffmpeg into opts.OutputDir without holding the per-session lifecycle lock. LockSessionLifecycle's contract (fresh start, restart, reconstruct) requires restart to hold it too, but all five callers invoked Restart unlocked: native audio-switch and segment-recovery, compat audio-switch and segment-recovery, and the transcode-node segment-recovery. A restart racing another restart (audio-switch vs segment-recovery) or a fresh-start/reconstruct could land two ffmpeg processes writing the same segment directory -- mixed timelines, init.mp4/segment mismatch, and an orphaned-but-still-writing ffmpeg -- the exact concurrent-writer corruption the lifecycle lock exists to prevent. Add RestartSessionLocked (TranscodeManager) and restartSessionLocked (node Server) that hold LockSessionLifecycle only across the cancel->respawn transition, re-check that the handle is still the live mapped session under the lock, and return ErrSessionSuperseded rather than re-spawning a stale handle. Route all five call sites through them. The lock is released before callers wait on segments so recovery latency is unchanged. Tests: gating (restart blocks until the lifecycle lock frees, then spawns), concurrent-restart serialization, and superseded re-check on both the manager (covers native + compat) and node lock owners. --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>	2026-07-02 14:23:14 -04:00
3 people	287ff3658f	fix(jellycompat): keep still-playing direct-play sessions in the activity view (#262) ... * test(jellycompat): implement ListProgressSince on userstore test fake PR #258 added ListProgressSince to the userstore.UserStore interface but missed the progressCountingStore stub, leaving the jellycompat test build broken on main. Stub it with the same panic("unused") the sibling methods use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): keep still-playing direct-play sessions in the activity view An Infuse Static=true direct play skips PlaybackInfo, so its playback reports carry a client-generated PlaySessionId. handlePlaybackReport only resolved reports by exact PlaySessionId, so every report silently no-op'd: the admin Activity View position froze, nothing refreshed the upstream session's activity, and stale cleanup reaped the session ~45s in while the client kept playing. Once reaped, ensureUpstreamPlayback early-returned the dangling session id forever, so the stream card never came back. Fix all three legs: - handlePlaybackReport falls back to the same token-scoped route lookup the stream path uses (ItemId, then MediaSourceId) when the PlaySessionId is unknown, and revives a reaped upstream session when a progress report proves the client is still playing. - HandleVideoStream marks an in-flight media transport around direct-play and remux serving, mirroring the native stream handler, so long-lived range transfers keep the session alive without progress reports. - ensureUpstreamPlayback verifies the upstream session still exists before reusing it, recreating it under the same play session when it was reaped. FindByRoute now compares RouteItemID with UUID normalization so report ids match regardless of client dash/case formatting. Closes #244 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): harden report fallback and upstream revive per adversarial review Address three review findings on the issue #244 fix: - Deterministic report binding: the stream path now records the client's own PlaySessionId (Static=true direct play never learns the server id) as an alias on the play session it binds, and playback reports resolve by that alias before falling back to the ambiguous item/source route scan. A Stopped report that only matched by bare route no longer tears the session down (it may not own it when the same item plays twice under one token); stale cleanup owns that path. - Same-method revive closes any transcode still keyed to the reaped upstream id before recreating the session, so a second ffmpeg cannot start alongside an orphaned one. - Attaching a new upstream session is now a compare-and-swap on the observed upstream id: the loser of a concurrent revive/range-request race stops its session and adopts the winner instead of leaving an orphan counted against the user's stream limits. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): guard alias ambiguity and method switches in upstream attach Second-round adversarial findings on the issue #244 fix: - A client PlaySessionId alias now only resolves when it identifies exactly one live session for the token, and the candidate must agree with the report's ItemId/MediaSourceId. A reused or stale client id degrades to the route scan (progress still lands on the right item) instead of binding an arbitrary session, and an ambiguous Stopped report tears nothing down. - A CAS loser only adopts the concurrent winner when it serves the same play method; a concurrent method switch surfaces 409 Conflict instead of continuing with mismatched transcode bookkeeping. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): key audio-selection updates by the resolved play session id Review follow-up (PR #262): after an alias or route fallback, req.PlaySessionID is the client's own generated id and not a playback store key, so the audio-track-change branch in handlePlaybackReport silently dropped selection updates for Static direct-play sessions. Use the resolved playSession.ID for the store mutation and logging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 11:37:32 -04:00
3 people	d1fd7c236f	fix(jellycompat): sync activity dashboard immediately on compat playback start/stop (#261) ... * fix(jellycompat): sync activity dashboard immediately on compat playback start/stop Compat (Infuse/Jellyfin) sessions were only reconciled into playback_sessions_sync on the periodic 15s reconciler tick, so stopped streams lingered in the admin activity dashboard and overlapped with newly started ones as ghost sessions. Native playback handlers already trigger an immediate SessionSyncer.SyncNow on start/stop; wire the same syncer into the jellycompat playback handler and flush after teardownPlaySession (Stopped report + ActiveEncodings teardown) and after a new upstream session starts. The stop-path sync detaches from request cancellation (context.WithoutCancel) because clients often drop the connection right after reporting a stop. Also adds the ListProgressSince method to the jellycompat test fake so the package's tests compile again after the downloads-v2 interface change. Part of #205 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(worker): serialize SyncNow and bound compat request-path session sync Adversarial review follow-ups: SyncNow snapshots could commit out of order when request-path syncs raced the periodic tick (an older snapshot committing last would resurrect stopped sessions or drop fresh ones), and the detached stop-path sync had no deadline, letting a stalled DB pin request goroutines. Serialize snapshot capture + reconcile under one lock and cap request-path syncs at 5s so failures degrade to the periodic tick. Part of #205 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(worker): coalesce immediate session syncs instead of queueing on a lock Review iteration 2: a stop-triggered sync queued on a bare mutex could expire its 5s deadline waiting behind a slow tick and fail before removing the stopped row. Coalesce instead: one owner reconciles at a time, callers that arrive mid-flight return immediately after flagging a follow-up pass, and the owner re-captures a fresh (post-change) snapshot afterwards. Request goroutines never block behind another sync, snapshots still commit in capture order, and an expired-context owner leaves the queued pass for the next tick instead of burning it. Part of #205 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 10:07:09 -04:00
3 people	eafa22a3c3	fix(jellycompat): improve audio track selection and display titles (#240) ... - preferredAudioStreamIndex: when default track is TrueHD/MLP and device profile doesn't explicitly list that codec, falls back to best compat track (EAC3 > AC3 > DTS > AAC…), same language preferred. Prevents Android TV clients receiving undecoded lossless passthrough streams. - audioTrackDisplayTitle: structured display title (e.g. "English - EAC3 5.1") replacing the raw firstNonEmpty fallback. Suppresses generic embedded labels (Stereo, Surround) that add no information. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-01 09:06:38 -04:00
CoffeeKnyteandGitHub	652b5d1e9f	perf(jellycompat): fast-paths for slow Jellyfin-compat queries (#247) ... * perf(jellycompat): fast-paths for slow Jellyfin-compat queries Rebuilds the jellycompat slow-query fast-paths cleanly on main, without the hub-sections virtual-library feature (which is intentionally absent on this branch). Each path is bounded so behavior stays predictable under load. Fast-paths: - Episode catalog: add the load-bearing `si.type = 'series'` hydration guard plus a matching entry-scan series-parent guard, so the page and count scans stay aligned with hydration (no under-filled pages, no inflated TotalRecordCount from podcast/audiobook episode rows). - /Shows/{id}/Episodes AdjacentTo: serve a bounded prev/self/next neighbor window with series-membership validation and a cross-series id guard, falling back to the full listing. - Resume: serve Continue Watching through the capped native continue-watching fetcher (next-up suppressed, in-progress only) instead of loadProgressPage's unbounded scan. Wires only the sections read-time fetcher (StoreProvider) into ItemsHandler; no hub-section/virtual-library exposure. - Played-history: push the type + library filter down into SQL. - recently_added: fan a no-parentId browse out across libraries with an app-side dedup merge, clamped to BrowseFilters.MaxLimit, and exclude compat-hidden (audiobook/podcast) libraries from the fan-out. - Detail fields: batch per-item GetItemDetail in the Latest/browse detail-field paths via GetItemDetailsByIDs, with per-item fallback. - Search: term-length and result-count guards for aux search. * perf(jellycompat): clamp Resume fast-path fetch to maxResumeItems A large client-supplied StartIndex on /UserItems/Resume inflated loadResumeViaSections' fetchLimit (pageSize + StartIndex) and fed it straight into ResolvedSection.ItemLimit, letting the continue-watching fetcher scan up to its continueProgressMaxScanned hard cap (1000 rows) instead of stopping near maxResumeItems. Clamp fetchLimit to maxResumeItems and short-circuit to an empty page when StartIndex is at or beyond the cap (no visible row can land there), keeping the capped fetcher's scan bounded and predictable under load. Addresses CodeRabbit review finding on PR #247.	2026-07-01 09:06:24 -04:00
CoffeeKnyteandGitHub	1dbcf2cd9a	fix(jellycompat): guard aux search paths and index-back person search (#252) ... * fix(jellycompat): guard aux search paths and index-back person search Short, recursive type-ahead terms (e.g. a single "a") against the PostgreSQL people index and the in-memory collection/box-set filter produced multi-second scans that pegged the server when a client fired one search per keystroke. Every jellycompat search path except the Meilisearch-backed /Items media search now rejects a provided SearchTerm shorter than 3 runes without touching any backend, and caps results at 20 regardless of the client-requested Limit: - /Persons (PostgreSQL people scan) - /Search/Hints (catalog search) - /Items BoxSet (in-memory collection filter) Shared policy + helpers live in search_guard.go (auxSearchMinTermLen=2, i.e. reject 1-2 runes / allow 3+, and auxSearchMaxResults=20) with unit coverage. The 3-rune floor is deliberate: 3 runes is the point where a pg_trgm trigram index becomes usable, so the gate lines up with the index and still lets legitimate short titles/names ("300", "Saw", 3-letter actors) and 3-char type-ahead hints through. PersonRepository.Search filters with `name ILIKE '%'||$1||'%'` rather than `LOWER(name) LIKE '%'||LOWER($1)||'%'`. The old expression filtered on LOWER(name), which the trigram GIN index idx_people_name_trgm (built on name) could not serve, so every search fell back to an ordered index scan on idx_people_name that walked the whole table for rare terms (~300-400ms on the 889k-row production people table). ILIKE on name lets pg_trgm serve rare 3+ char terms from the trigram index, while the planner still picks the ordered btree scan with early termination for common terms. ILIKE is case-insensitive, so behavior is preserved (including the pre-existing treatment of % and _ in the term as LIKE wildcards). Verified on production silo-postgres (889,302 people), parameterized query under both custom and generic plan cache modes: rare 3-char 'qzx': 304ms -> 1-8ms (trgm bitmap index) rare 4-char 'zzzz': 329ms -> 1-2ms (trgm bitmap index) common 3-char 'ann': 15ms -> 7-74ms (btree early-stop / trgm bitmap) New worst case across all terms is ~83ms (generic-plan common 3-char). * fix(jellycompat): stop gating meilisearch hints, clamp box-set search Two review follow-ups on the aux-search guards: - HandleSearchHints is served by the catalog (Meilisearch-backed) search provider, which already bounds and short-term-handles its own results. Gating it with auxSearchTermTooShort contradicted the guard's own "non-Meilisearch paths only" policy and hid valid 1-2 char titles ("Up", "It") from global type-ahead. Drop the too-short gate there; keep the empty-term check and the result clamp. - handleBoxSetsList gated short terms but passed query.limit straight to slicePage, which treats <=0 as no cap, so a box-set *search* was uncapped unlike Persons/Hints. Clamp the limit when a search term is present; empty-term browse keeps its client paging window.	2026-07-01 09:05:41 -04:00
QuickandGitHub	8afe783277	fix(jellycompat): honor StartItemId episode queues (#242) ... * fix(jellycompat): honor StartItemId episode queues * fix(jellycompat): compact episode queue models	2026-06-27 22:02:54 -04:00
QuickandGitHub	a0fbe2cdda	[codex] feat(jellycompat): use catalog search provider (#236) ... * feat(jellycompat): use catalog search provider * fix(jellycompat): route video search buckets to provider	2026-06-27 20:10:48 -04:00
3 people	02e62767a1	feat(watchsync): sync watchlists with Trakt/Simkl/MDBList (#227) ... * feat(watchsync): sync watchlists with Trakt/Simkl/MDBList Extend the watch-providers feature to sync a user's watchlist, generalizing the existing favorites pipeline rather than duplicating it. What changed - Generalize the favorites sync into one ListKind-parameterized pipeline (internal/watchsync/lists.go) driving both favorites and watchlist; the per-favorites service methods are replaced by kind-generic ones. The shadow table watch_provider_favorite_items becomes watch_provider_list_items with a list_kind discriminator. - Providers: Trakt gains watchlist sync (/sync/watchlist, distinct from favorites); Simkl gains plan-to-watch sync; MDBList is re-mapped from favorites to watchlist (its only list is a watchlist) — its capabilities now report import_favorites=false / import_watchlist=true, and the migration re-binds existing MDBList connections. - Auto-remove watched items from the watchlist: a standalone, default-on profile preference (user_profiles.remove_watched_from_watchlist) removes a movie when watched and a series once every episode is watched. Implemented as watchstate.CompletionObserver (internal/watchlist.Maintainer), wired into the manual mark-watched, playback-stop, and jellycompat mark-played paths. - Optional MDBList sort-order mirroring: an opt-in, capability-gated toggle mirrors MDBList's watchlist order into Silo via user_watchlist.sort_index; ListWatchlist orders by sort_index then added_at, so both /api/v1/watchlist and the catalog watchlist view inherit it. - Real-time + scheduled: local add/remove pushes to connected providers immediately (removals gated by the opt-in removals toggle); the hourly job is the inbound/import + retry/reconcile path. - Web: watch-provider settings gain watchlist import/export/removals and "mirror watchlist order" toggles plus watchlist sync stats. Why - The favorites and watchlist pipelines are ~90% identical; generalizing keeps one code path (per CLAUDE.md's anti-duplication guidance) instead of cloning. API/compat - All new fields on ConnectionStatus/Capabilities/ConnectionUpdate/SyncRun and the web types are additive (Silo v1 additive-only rule). No existing field is renamed, removed, or retyped. Risks / follow-up - MDBList capability flip is intentional and client-visible: silo-android / silo-apple may need to surface MDBList under the watchlist (not favorites) UI. - MDBList existing users: their MDBList list previously mirrored Silo favorites and now mirrors Silo watchlist; the first post-migration sync is a union (removals default off), so nothing is destructively purged. - Order mirroring reflects the order MDBList returns from /watchlist/items (couldn't confirm against their docs — Cloudflare-blocked); if it ever diverges from the UI sort, a sort param is the small follow-up. Tests: new maintainer (auto-remove) and watchlist-order unit tests; provider + service tests updated. go build, go test (affected pkgs), migrate-validate, verify-local-paths, web prettier/eslint/tsc all pass. AI-use disclosure: implemented with Claude Code (Claude Opus 4.8). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(watchsync): update list shadow table references * fix(watchsync): address review — retry/progress + error propagation Addresses CodeRabbit review on #227: - maintainer: propagate transient catalog lookup errors instead of silently treating every items.GetByID failure as "maybe an episode". - exportList: mark every queued item not confirmed sent (not_found, failed, or omitted) so the pending loop always advances; the next run's upsert clears the error and re-attempts, so transient failures still retry. - removePendingListItems + realtime removal: treat Sent and NotFound as reconciled; leave true failures pending (no last_error, which would strand them from the removal query) so the scheduled run retries, using in-memory dedupe to terminate the loop. - exportLocalListItems: send the normalized items (with computed ProviderItemKey), not the original event slice. - UpdateConnection: clear mirrored watchlist order before persisting the disable and propagate failures, so a failed clear can't report "disabled" while sort_index ordering is still active. - web: include favorite + watchlist removal counts in the exported "sent" total. - test: align serviceFakeRepo list-state with Postgres (clear last_error on successful transitions); add maintainer error-propagation test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 16:05:53 -04:00
3 people	a3aa93534d	fix(jellycompat): authenticate Android TV token-less direct play (#200) ... * fix(jellycompat): authenticate Android TV token-less direct play Stock Jellyfin Android TV ignores the api_key-bearing DirectStreamUrl returned from PlaybackInfo and builds its own direct-play URL with no auth header, no api_key/ApiKey query param, and no PlaySessionId. The media request arrives via the player's HTTP stack (okhttp) with auth_kind=none, so PlaybackSessionAuth 401s it — the client retries, falls back to a transcode that stalls, and surfaces "player error". Add a third fallback in PlaybackSessionAuth, scoped strictly to the direct-play video stream routes (/Videos/{id}/stream[.{container}]) via the chi route pattern so /Items/{id}/Download stays protected: anchor auth on the PlaybackSession negotiated during the preceding (already authenticated) PlaybackInfo, looked up by mediaSourceId when present (else the route item id), and resolve its CompatToken. Covered by tests: token-less direct play with a matching session succeeds, no matching session 401s, and Download is not loosened. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(jellycompat): require session item match + expand direct-play tests Address CodeRabbit review on PR #200: - Require the matched PlaybackSession's RouteItemID to equal the requested route item before authorizing, so a mediaSourceId cannot authorize a stream for a different item. - Seed the compat session in the 401 tests so they fail on route/session scoping rather than a missing session. - Table-drive the positive test across /Videos/{id}/stream and /Videos/{id}/stream.{container}, plus the route-item lookup branch when mediaSourceId is absent; add a cross-item denial test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 12:27:37 -04:00
3 people	185a90b048	fix(jellycompat): honor client subtitle selection in PlaybackInfo (#222) ... * fix(jellycompat): honor client subtitle selection in PlaybackInfo Jellyfin clients send the chosen subtitle as SubtitleStreamIndex on PlaybackInfo, but the compat layer only ever advertised the media's embedded default subtitle (or none). Picking a subtitle before playback had no effect and the video started without it — and an explicit "subtitles off" was ignored when the media had a default subtitle. Mirror the existing audio-selection plumbing for subtitles: - parse SubtitleStreamIndex from the PlaybackInfo body and query - persist it as SelectedSubtitleStreamIndex on the play-session source - advertise it via DefaultSubtitleStreamIndex and flip IsDefault onto the chosen stream (embedded, external, or Silo-downloaded) - honor a negative index as an explicit "subtitles off" The selection is validated against streamable tracks (bitmap subs that require burn-in are excluded, matching delivery) and the downloaded subtitle range, falling back to the media default when invalid. Out of scope (follow-ups): bitmap-subtitle burn-in transcode wiring and mid-playback subtitle changes on progress reports. Part of #217 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(jellycompat): handle downloaded-subtitle lookup failure in selection Don't let a transient ListDownloadedSubtitles error masquerade as "no downloaded subtitles", which silently downgraded a valid subtitle selection to the media default. The lookup error is now logged, and resolution honors a requested index it cannot validate (it may be a downloaded subtitle) instead of discarding the user's choice, while embedded/external selections continue to resolve normally. Addresses CodeRabbit review feedback on #222. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 12:26:27 -04:00
3 people	87159b0a38	feat(collections): add profile-scoped display filters (#191) ... * feat(collections): add profile-scoped display filters * refactor(collections): dedup display-filter helpers per review Address code-review feedback on the profile-scoped display filters without changing behavior: - Widen CompletedHistoryItemMap to accept ProgressCompletionStore and drop the duplicate completedHistoryItemMapForProgress copy. - Extract the duplicated MDBList candidate retry loop into a generic collectionutil.FetchMDBListWithFallback helper, used by both the user and library collection syncers, and cover it with unit tests. - Reuse validateOptionalLibraryIDs in HandleUpdateCollection instead of an inline positive-ID loop. - Import the shared COLLECTION_{WATCH,MEDIA}_FILTER_OPTIONS in the template config form rather than redefining them locally. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(collections): sanitize query_definition library_ids fallback readSourceConfigLibraryIDs validated source_config.library_ids (finite, positive, truncated, deduplicated) but returned the query_definition fallback raw, so legacy rows could surface zero/negative/duplicate IDs that the backend now rejects on save. Extract a shared sanitizer and apply it to both paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor(docs): This makes the agents annoying to work with * Improve playback session handling * Support collection source order in catalog filters * fix(collections): address display filter review feedback * refactor(catalog): remove duplicate collection query params * Hide episode media scope for collection overlays --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 11:03:38 -04:00
Quick	227986094b	Propagate playback client metadata through session sync	2026-06-23 14:26:14 -04:00
3 people	544a262924	fix(jellycompat): accept Jellyfin current ApiKey query param for stream auth (#186) ... Silo's ExtractToken only honored the legacy 'api_key' query parameter and the X-Emby-Token/X-Mediabrowser-Token headers. Real Jellyfin's AuthorizationContext treats 'ApiKey' (PascalCase) as the current, always-enabled query token and 'api_key' as legacy (gated behind EnableLegacyAuthorization). Native Jellyfin clients that build their own direct-play /Videos/{id}/stream URLs (incl. Jellyfin Android TV) send 'ApiKey', which Silo rejected — the request arrived with auth_kind=none and the route returned 401, surfacing as a client 'playbackerror'. Match both 'ApiKey' and 'api_key' case-insensitively in ExtractToken and in the authKind log classifier. Strictly additive: existing header and api_key paths are unchanged. Verified against the live server: /Videos/{id}/stream?...&ApiKey=<tok> returned 401 before and is accepted after; &api_key=<tok> and the X-Emby-Token header continue to return 206. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 16:20:04 -04:00
QuickandGitHub	cac435c4b9	Fix watch-state unwatch sync across user data and Jellyfin mappings (#179) ... * Refine playback session handling and API responses * fix(watchstate): harden completed-history visibility	2026-06-18 19:17:22 -04:00
CoffeeKnyteandGitHub	6e1f79e8a9	feat(jellycompat): expose library collections as an auto-shown Collections view (#175) ... * feat(jellycompat): expose library collections as a Collections library view Surface server library collections as a top-level Jellyfin "Collections" library (CollectionType "boxsets") so compat clients see them as the first library in /UserViews and can browse them by ParentId. The BoxSet machinery (list/detail/children) already existed; this adds the library wrapper. - catalog: add LibraryCollectionRepository.AnyVisibleInLibraries, an index-only EXISTS probe (no item join/aggregation) used to gate the view so an empty Collections tab never shows. Mirrors collectionVisible semantics (multi-library scope rows or the legacy single library_id fallback). - jellycompat: add the synthetic Collections CollectionFolder (fixed Jellyfin sentinel ID, stable across servers), prepend it to the user's views when a visible collection exists, and route ParentId/Items-by-ID for that sentinel to the existing BoxSet listing. ChildCount is left omitted (no per-call count, no unwatched badge). AI-use disclosure: implemented with assistance from Claude. * fix(jellycompat): display collection posters and a generated Collections tile Library collections surfaced as Jellyfin BoxSets showed blank cards: their poster_url is frequently a bundled frontend template path (/images/collection-templates/x.jpg), which the compat image route passed through unchanged and then rejected in parseRemoteImageURL (no scheme/host), returning BadGateway. Clients probed Images/Primary and got nothing. - images: serve app-relative artwork (bundled template posters) straight from the embedded frontend FS (new ImagesHandler.frontendFS), with content-type and cache headers. Wired through jellycompat.Dependencies.FrontendFS. - poster_gen: on-the-fly gradient poster generator (per-title hue, centered white caption with black outline, gobold/opentype), memoized in a bounded cache. Used for the synthetic Collections library tile and as a fallback for collections without usable artwork, so cards are never blank. - consolidate collection/view image routing in HandleItemImage, authorized by the signed tag or an authenticated, visibility-checked session. AI-use disclosure: implemented with assistance from Claude. * fix(jellycompat): declare 2:3 PrimaryImageAspectRatio on BoxSets and Collections tile Clients defaulted collection cards to a square and crop the 2:3 poster to fit. Set PrimaryImageAspectRatio (portrait 2/3) on the BoxSet DTO and the synthetic Collections library tile so the full poster is shown, matching Jellyfin. AI-use disclosure: implemented with assistance from Claude.	2026-06-18 10:20:48 -04:00
Quick	cf3e68e02a	fix(jellycompat): honor codec profile playback limits	2026-06-17 13:12:18 -04:00
d3v1l1989andGitHub	4502c7a850	fix(jellycompat): return seasons/episodes when browsing a series via /Items?ParentId= (#160) ... * fix(jellycompat): return seasons/episodes when browsing a series via /Items?ParentId= Clients that browse a show through the generic /Items?ParentId= endpoint with no IncludeItemTypes (e.g. the VoidTV Android-TV client's getSeasons/getEpisodes) got the top-level library views instead of the series' seasons or the season's episodes. HandleItems only honored an item/season ParentId when IncludeItemTypes=Season was present and otherwise fell through to the library-views fallback (or a global type browse), so ParentId was effectively ignored. Decode a season ParentId into its own parentSeasonID and route item parents: - season ParentId -> that season's episodes - series ParentId -> the series' seasons (or its episodes for IncludeItemTypes=Episode; an unsatisfiable type filter returns an empty page) Extract the shared writeSeriesEpisodesResponse used by /Shows/{id}/Episodes and the new browse paths. The generic /Items browse paths honor StartIndex/Limit (matching the /Items contract and the sibling seasons listing) while /Shows/{id}/Episodes keeps its existing whole-season response. Adds parent_browse_test.go covering series->seasons, season->episodes, the unsatisfiable-type-filter empty case, paging, and the parser's season/item ParentId distinction. * fix(jellycompat): empty result for non-episode type filter on a season ParentId handleSeasonEpisodeChildren ignored IncludeItemTypes and always returned the season's episodes. A season's only children are episodes, so a type filter that excludes Episode (e.g. IncludeItemTypes=Movie) now returns an empty page, mirroring the series-parent path's handling of unsatisfiable type filters. Addresses a CodeRabbit review comment.	2026-06-16 18:30:25 -04:00
d3v1l1989andGitHub	623348111c	fix(jellycompat): resolve smart-collection BoxSet children at read time (#161) ... Browsing into a smart (live-query) collection via /Items?ParentId={boxsetId} returned 0 children while the BoxSet's ChildCount showed a non-zero count: handleBoxSetChildren only read materialized library_collection_items via ListItems, which is empty for smart collections whose membership is a query evaluated at read time. Confirmed live — smart "Directed by ..." collections returned TotalRecordCount 0 while materialized collections returned their items. Branch handleBoxSetChildren on catalog.IsLiveQueryType: smart collections resolve their members through the query executor (mirroring the web API's loadLiveCollectionItems — Normalize/Validate/ApplySmartCollectionItemLimit, library-scope intersection, access-filtered Preview), then feed the resulting content IDs into the same hydration path as stored collections. A malformed or invalid query definition degrades to an empty page (never a 500). Hoist the duplicated intersectCollectionLibraryIDs helper into catalog.IntersectCollectionLibraryIDs so the web and compat resolvers share one implementation. Adds smart_boxset_test.go (smart children resolve in query order, library-scope intersection reaches the executor, malformed-query and no-executor degrade to empty).	2026-06-16 18:30:16 -04:00
d3v1l1989andGitHub	fe7eb70483	fix(jellycompat): reuse the play session for Static direct play instead of leaking one per request (#165) ... Clients that direct-play via /Videos/{id}/stream?Static=true never call PlaybackInfo, so they send their own client-generated PlaySessionId and repeat it on every range request. resolvePlaybackRoute looked that id up, missed (the server never minted it), and returned ErrSessionNotFound — so HandleVideoStream fell to createStaticPlaySession and started a *new* upstream session for every request. Each counts toward the per-user max_streams cap and only ages out after the 45s activity grace, so a single direct play's range requests pile up orphaned sessions and quickly trip the cap -> 429 TooManyStreams, locking the user out of their own playback. When the provided PlaySessionId is unknown (or owned by another caller), fall through to the existing CompatToken-scoped FindByRoute reuse instead of erroring, so all of a direct play's requests share one session. Reuse stays scoped to the caller's own token, so a guessed/foreign id cannot bind another user's session. Adds a test asserting StartSession runs once across repeated Static requests.	2026-06-16 17:51:42 -04:00
d3v1l1989andGitHub	c81de3459e	feat(jellycompat): add Filters2, LocalTrailers, UserImage, ClientLog and Sessions endpoints (#164) ... * feat(jellycompat): add Filters2, LocalTrailers, UserImage and ClientLog endpoints Four endpoints that real Jellyfin clients call were unregistered and fell through to chi's default 404 (or, for Filters2, were swallowed by /Items/{id}). All are additive and contract-faithful to the Jellyfin C# server: - GET /Items/Filters2 -> 200 QueryFilters v2 shape (Genres NameGuidPair[], Tags, Audio/SubtitleLanguages), empty arrays. Fladder's filter UI 404'd before. - GET /Items/{id}/LocalTrailers (+ /Users/{userId}/... alias) -> 200 bare BaseItemDto[] ([]); Silo indexes no local trailers. Infuse/Moonfin hit this on every item-detail load. - GET|HEAD /UserImage?userId= -> the same anonymous palette avatar as the legacy /Users/{id}/Images/Primary route; HandleUserImage now reads the id from the query param when the path segment is absent (modern Jellyfin route). - POST /ClientLog/Document -> 200 {FileName} after draining/discarding the body (Silo has no client-log store); 413 over 1 MiB, matching MaxDocumentSize. Stops recurring 404 noise and lets clients that depend on these (filter sheets, avatars, crash-log upload) work. Adds handler unit tests for each. * feat(jellycompat): add GET /Sessions returning a contract-shaped session list Wholphin and other jellyfin-sdk clients poll GET /Sessions (optionally ?deviceId=) every few seconds during playback; the route was unregistered, so each poll hit a chi 404 the SDK could not deserialize — a ~289-per-4h 404 storm in production. Register it under the same [Authorize] group Jellyfin uses and return a correctly-typed SessionInfoDto[] (currently empty, consistent with the existing compat stub handlers). This stops the storm and lets clients degrade cleanly; populating live session/now-playing state from the playback store is a follow-up. * refactor(jellycompat): match Jellyfin client-log size limit exactly Use 1,000,000 bytes (Jellyfin's ClientLogController.MaxDocumentSize, decimal) instead of 1<<20, and fix the comment that wrongly called it 1 MiB. Behavior is functionally identical (the body is discarded); this is contract-fidelity only. Review follow-up. * test(jellycompat): add router-level coverage for the new endpoints The per-handler tests call handlers directly and never exercise NewRouter, so route registration, chi static-vs-{id} ordering, and auth-group placement were untested — the one thing this change is actually about. Add a full NewRouter/ServeHTTP test asserting the session-auth-group routes (Filters2, LocalTrailers x2, Sessions, ClientLog/Document) return 401 unauthenticated (registered + behind auth, not 404 or accidentally anonymous), /UserImage serves its anonymous palette avatar, and an authenticated Filters2 reaches the v2 filters handler (not shadowed by /Items/{id}) with /Sessions returning [].	2026-06-16 17:51:00 -04:00
d3v1l1989andGitHub	3f3cf55002	fix(jellycompat): return 404 for HLS segments of a failed transcode (#163) ... HandleHLSSegment mapped every non-ErrSegmentNotFound error from the segment-retrieval/recovery path to a generic 500 "Failed to load segment". When a transcode process starts and then exits non-zero, WaitForSegment returns a wrapped playback.ErrTranscodeFailed, which fell through to that 500 — observed in production as repeated 500s on seg_00000.ts that drove an 8x client retry storm and crash-log uploads. The segment will never materialize once its transcode has died, so this is a not-found condition: Jellyfin's DynamicHls handler falls through to a PhysicalFileResult for the absent file, which ASP.NET serves as 404, never 500. Map ErrTranscodeFailed to 404 alongside ErrSegmentNotFound via a small extracted hlsSegmentErrorResponse helper, reserving 500 for genuinely unexpected errors. Adds a unit test pinning the mapping.	2026-06-16 11:14:14 -04:00
d3v1l1989andGitHub	190223e030	fix(jellycompat): serve item and user images anonymously to match Jellyfin (#158)	2026-06-15 18:18:10 -04:00
4 people	ea6d1d1f00	feat(jellycompat): support DELETE /Videos/ActiveEncodings transcode teardown (#159) ... * feat(jellycompat): support DELETE /Videos/ActiveEncodings transcode teardown * fix(jellycompat): guard ActiveEncodings teardown against not-yet-started sessions HandleDeleteActiveEncodings omitted the UpstreamSessionID == "" guard that the sibling Stopped-report path uses. A PlaybackSession is created by PlaybackInfo with an empty UpstreamSessionID; it is only populated once the first manifest request reaches ensureUpstreamPlayback. A DELETE /Videos/ActiveEncodings arriving in that window (with a matching token) passed the ownership guard and ran teardownPlaySession, which deletes the compat play session from the store. A subsequent HandleMasterManifest then 404s, and the teardown was not the "no-op-safe" operation its doc comment claims. Mirror the Stopped report path by treating an unknown, not-owned, OR not-yet-started PlaySessionId as a uniform idempotent 204 no-op. Add a regression test that fails if the guard is removed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 18:17:48 -04:00
Quick	ae65678ba4	fix(jellycompat): populate episode season parent metadata	2026-06-15 18:10:40 -04:00
d3v1l1989andGitHub	2e422b66df	fix(jellycompat): match the Static stream query parameter case-insensitively (#157)	2026-06-15 18:03:58 -04:00
4 people	13c5e0ba2f	feat(catalog): deterministic cross-server content_id (#155) ... * feat(catalog): deterministic cross-server content_id Replace per-server Sonyflake content_id with a structured natural key derived from provider IDs (movie:tmdb:…, series:tvdb:…, episode:…, local:… fallback), so two servers holding the same title share one anchor for artwork, watch history, progress, favorites and ratings. - internal/contentid: derivation core, SeriesIDFromContentID transform, frozen precedence, SchemeVersion=1, embedded-series-anchor invariant. - internal/metadata/service.go: deterministic id at every mint site. - internal/catalog/history_source.go: resolve show via string transform for anchored episode ids; skip the episodes_pkey probe. - migrations/sql/20260612130000: collision-safe value remap across the 65-column reference graph + COLLATE "C", FK/trigger handling, audit map, working down. Benchmarked against an exact-cardinality copy of cprod-postgres (1.93M episodes, 775k history rows): 2.57x faster history page, 1.7x throughput at 100 concurrent users, 2.7x cheaper per content_id probe. * feat(catalog): re-ID untagged items to deterministic content_id at first match Untagged libraries get a path-derived local: content_id at scan time and only learn their provider IDs later, when the match worker confirms a result. Previously that id was never folded back in, so untagged-then-matched items kept a per-server local: placeholder forever and never converged across servers (re-ID was deferred to a migration rerun). mergeAndPersist now promotes a local: skeleton to its deterministic provider-anchored id at the moment of first confirmed match, via a single new gate (canonicalizeLocalContentID): - target id already taken -> merge onto it (existing rebind machinery) - target id free -> rename in place The rename is a single SQL function (silo_rename_content_id); FK children follow via ON UPDATE CASCADE added to the content_id family, so a fresh skeleton moves a handful of rows rather than the full-table remap the bulk migration does. The guard is one IsLocal prefix check, so tagged content and all refreshes pay nothing, and the move is self-healing under retry. Verified: gofmt/vet/build clean; migrate-validate passes; migration applies on the real schema (up/down/up), FKs gain ON UPDATE CASCADE while keeping ON DELETE; functional test confirms series PK move + series_id cascade + provider-id sweep, and movie rename. Follow-ups (noted in docs): recomposeSeriesChildIDs for a series that accumulated episodes before matching; a lockstep test for the soft-ref list. * fix(catalog): harden content_id parsing and merge per review Address review feedback on the deterministic content_id work: - history_source.go: gate the anchored-episode display-id transform on the full five-part episode shape (split_part parts 2-5 non-empty), not just the 'episode:' prefix, so a malformed id can't transform to 'series:broken:' and vanish at the media_items join. Shared anchoredEpisodePredicate drives both the null-poisoned join key and the series-recovery expression. - contentid.go: unexport the provider-precedence slices so no package can mutate the frozen SchemeVersion ordering at runtime. - contentid.go: add parseAnchored to validate the exact per-kind arity and numeric season/episode suffixes; SeriesIDFromContentID and IsProviderAnchored now fail closed on truncated/malformed ids (e.g. "episode:tvdb:296762"). - canonicalize.go: distinguish catalog.ErrItemNotFound from transient lookup errors (a real error no longer masquerades as "target free"), and allow a matched local source to be consolidated onto the canonical row instead of orphaning a duplicate. * refactor(contentid): URL-safe "-" separator in content_id Use "-" instead of ":" to join content_id components (movie-tmdb-228064, episode-tvdb-296762-1-5, local-<hex>). "-" is an RFC 3986 unreserved character, so a content_id is URL-safe verbatim: encodeURIComponent is a no-op and the id is its own tidy path segment (/item/series-tvdb-296762) with no %3A escaping. The stored value equals the URL value, so there is no encode/decode boundary and an operator can grep the id straight out of a URL or log. Every component is [a-z0-9]+ (or "tt"+digits), so "-" is unambiguous. Pre-release format finalization: this branch is unmerged, so no deployed data carries ":" ids — the migration mints the "-" form fresh and no re-migration is needed. Still SchemeVersion 1. - contentid.go: single `sep` constant drives construction and parsing so the two can never drift; all constructors/parsers and doc examples updated. - history_source.go: split_part transform and the anchored-episode predicate use '-'; kept in lockstep with the package via a code comment. - 20260612130000_deterministic_content_id.sql: derivation and season/episode composition emit '-'; LIKE filters match 'series-%'. - docs/architecture/deterministic-content-id.md: format spec + rationale for the separator choice; this is the design doc the change is derived from. Client-side: the web frontend treats content_id as an opaque string (no splitting/regex), so no client changes are required; existing encodeURIComponent call sites simply stop emitting %3A. * docs(contentid): show why hash/bigint rejected in probe-cost table Add Cross-server deterministic / Zero-join show transform / Human-readable columns to the index-probe-cost comparison so the trade-off is legible at a glance: the 128-bit hash and bigint surrogate are faster but each give up a load-bearing property, and the structured key is the only all-checkmark row. * docs(contentid): order probe-cost table to end on the structured key * docs(contentid): label fenced blocks and drop stray EOF tags Per CodeRabbit review: add 'text' language to three fenced code blocks (MD040) and remove accidental </content></invoke> artifacts at EOF. * fix(catalog): remap array-valued content_id soft references in deterministic id migration The value-remap migration (20260612130000) enumerates the reference graph by FK plus a scalar name+type sweep (text/varchar/bpchar). That misses trending_discover_snapshots.content_ids: it is text[] (excluded by the type filter), named content_ids not content_id (excluded by the name list), and cannot carry an FK — so the bulk remap left those arrays holding stale Sonyflake ids that resolve to nothing until the snapshot regenerates. A counterexample to the migration's "self-protecting, cannot orphan" invariant. Remap the array element-wise in both directions (Up old->new, Down new->old), preserving order and leaving collision/unmatched elements untouched; a WHERE EXISTS guard skips empty/unaffected arrays so array_agg never collapses the NOT NULL column to NULL. Mirror the gap in silo_rename_content_id (20260614120000) with array_replace for the single-value runtime rename so the two stay in lockstep. Verified on PG18: mixed/collision/empty arrays remap correctly and round-trip clean; runtime array_replace preserves order. Surfaced reviewing #155. The jellycompat restart-decode regression and the atomicity-wording nit are posted as review comments, not addressed here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(jellycompat): pack content_id into compat UUID reversibly so item ids survive restarts Addresses the restart-decode regression raised in review of #155. With content_id now a structured string instead of a numeric Sonyflake, EncodeStringID sent every item/season id down the one-way SHA1 path, making decode depend on an in-memory reverse map. That map is cold after a process restart (the codec is a process-lifetime singleton), so a client presenting a previously-issued item UUID — resume-from-home, deep link, detail page, image, userdata — got "unknown compat id" until the item was re-listed. Make the encoding reversible instead of stateful: - internal/contentid: add Pack/Unpack, a bit-packed, fixed-budget (<=15 byte) binary form of a structured or local content_id. digitCount preserves provider-id leading zeros (e.g. imdb tt0944947); structured forms are self-delimiting; the local form fills the budget exactly. Provider ids that overflow uint64 return ok=false. - Shrink ForLocal to a 112-bit (sha256(path)[:14]) hash so a local id packs losslessly into the 15-byte UUID payload. 112 bits is far beyond any single server's local-item count. No other code assumed the old width. - internal/jellycompat: EncodeStringID packs item/season content_ids into the UUID (byte 0 = kind, bytes 1..15 = packed, non-zero tag distinguishes it from the numeric encoding); DecodeStringID unpacks first and re-packs to confirm, so an opaque id whose bytes merely parse is rejected and falls through to the map. Numeric ids and arbitrary names (genres, studios) are unchanged. Net: item/season ids decode by pure computation — stable across restarts and across instances — with no lookup table. Only the rare unpackable content_id and non-content names still use the in-memory map. TDD: round-trip property tests in contentid (all kinds, leading zeros, reject cases) and a cross-instance decode test in jellycompat that fails on the old hash+map path. Full contentid + jellycompat suites green; production code golangci-clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(migrate): make the migration run timeout configurable (SILO_MIGRATE_TIMEOUT) The boot-path migration runner hardcoded a 5-minute context timeout. The deterministic-content-id value-remap (20260612130000) does a full-table COLLATE rewrite + 65-column remap that needs ~20 min on a real dataset (615k items / 2M episodes), so it was cancelled at 5 min. Worse, Postgres keeps the orphaned backend running (holding AccessExclusive locks) until it notices the dead client at a statement boundary, while the goose session advisory lock releases on disconnect — so each 5-min boot retry piled a new attempt behind the previous one's locks. The migration never applied; the server boot-looped. Make the timeout configurable via SILO_MIGRATE_TIMEOUT (a Go duration like "60m"); 0 or negative disables the deadline for a one-off heavy migration. Default stays 5m. All three entry points (migrate-status, --migrate-only, boot) honor it. Required for the deterministic-content-id migration to apply on any real-sized database, not just dev — the 5m cap made the PR undeployable at scale. Follow-up (not here): on cancellation the runner should actively terminate its backend so a future timeout cannot orphan a lock-holding statement. TDD: MigrationTimeout parsing (default/override/zero/invalid) + MigrationContext deadline behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(contentid): require exact length for local ids in Unpack Tighten the tagLocal branch of Unpack from `len(body) < localHashLen` to an equality check. The local form fills the compat-UUID payload exactly (no padding), so a body of any other length is non-canonical; matching it exactly keeps Unpack a strict fail-closed inverse of Pack for the fixed-length branch, which decodes client-supplied UUIDs. Not applied to the structured branch (a review suggestion proposed the same change there): structured ids are self-delimiting and the compat layer pads them with trailing zeros to fill the 15-byte UUID payload, so ignoring trailing bytes is intentional and documented. Rejecting them would make every structured id fail to decode — the jellycompat cross-instance test guards against that. Not a live bug today (the only caller passes u[1:] from a 16-byte UUID, so body is always exactly localHashLen, and idcodec re-packs to verify), but it is the correct contract and zero-risk. Adds a regression test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 15:34:13 -04:00
3 people	5afe56cfc0	feat(jellycompat): add runtime-managed Jellyfin Web compatibility (#77) ... * feat(jellycompat): install web assets at runtime * fix(jellycompat): recover stale web operation locks * fix(jellycompat): harden web component management * feat(admin): refine compat settings and restart status * chore(dev): add hot-reload docker compose stack * fix(dev): include npm in hot-reload backend * feat(admin): refine Jellyfin compatibility settings * feat(settings): improve jellyfin proxy summary * feat(settings): improve jellyfin web controls * fix(settings): update jellyfin web removal status * fix(settings): enable jellyfin web after install * feat(jellycompat): auto-select web ui version * test(api): update rate limit handler setup * feat(jellycompat): refine web ui install onboarding * fix(jellycompat): address web ui install review issues * fix(onboarding): mirror jellyfin api runtime status * fix(admin): remove global restart banner * fix(settings): gate restart required tracking * fix(jellyfin): ignore live settings for restart status * fix(jellyfin): avoid restart for live compat settings * fix(subtitles): normalize AI language codes * fix(catalog): support partial title search tokens * feat(branding): add white-label customization * Add push relay engineering plan - Document relay API contracts, APNs/FCM behavior, auth, storage, and ops - Capture implementation plan, provider references, decisions, and README --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>	2026-06-15 09:34:08 -04:00
3 people	a17529fd6f	feat(config): live admin settings + truthful restart-required banner (#128) ... * feat(nodeconfig): harden config watcher for integrated-mode use - RequestReload(): non-blocking, coalescing reload nudge that runs on the poll goroutine, so concurrent requests can never swap a stale snapshot over a newer one (unlike ForceReload from request handlers) - Skip OnChange callbacks when the reloaded config is deep-equal to the previous one, so the 60s poll doesn't fire rebuild/log callbacks on no-op reloads - Add RedisURL to BootstrapOverrides; previously a reload clobbered an env-provided Redis URL in the live config - Split reload into fetchSettings/applySettings and add unit tests Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(config): hot-reload config watcher in integrated mode Start nodeconfig.Watcher in integrated/api mode (previously only proxy/ transcode worker modes hot-reloaded). Expose the live config to the API and jellycompat routers via func-typed LiveConfig/OnConfigChange fields with nil fallbacks to the startup snapshot, and wire the admin settings update hook to RequestReload so same-process changes apply immediately even without Redis. No consumer reads the live config yet — conversions land separately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(admin): truthful restart-required banner for settings saves The settings UI showed 'restart required' after every save regardless of the key. The backend now classifies each key via a central registry (internal/config/restart_keys.go) and PUT /admin/settings/{key} reports restart_required per key; useSettingsForm only raises the banner when a saved key actually needs a restart (and keeps it raised until restart). The registry is conservative: every currently startup-frozen key is marked restart-required; subsequent hot-reload conversions shrink it. Settings read live from the settings repo (branding, overlays, markers, download.*, ...) default to no-restart. DownloadSettings/OverlaySettings drop their hardcoded restartRequired={false} special-casing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(logging): hot-reload server.log_level and server.log_quiet Share one slog.LevelVar across the handler chain and make logfilter.Handler's quiet-prefix list an atomic pointer shared with WithAttrs/WithGroup clones (New previously returned the inner handler unwrapped when the quiet list was empty, leaving nothing to update). The integrated-mode config watcher now applies both settings live; their keys leave the restart-required registry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(auth): hot-reload access/refresh token expiries JWTService stores expiries as atomics with a SetExpiries hook; all three instances (main API, ABS compat, jellycompat) re-apply them on config reload. Applies to newly issued tokens; outstanding tokens keep their original expiry. The JWT secret stays fixed for the process lifetime. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(playback): read transcode config live at session start The playback and stream handlers pull ffmpeg path / hwaccel / transcode dir from the live config when starting a transcode or extracting subtitles, instead of values frozen at router construction. Each session snapshots the config once so its output dir and binary stay consistent. Also fixes a real bug: playback.hw_device was parsed into the config but never wired into the integrated-mode handler, so local transcodes always ran with an empty HWDevice while transcode nodes honored it. playback.transcode_dir leaves the restart-required registry (the handler is its only consumer); ffmpeg_path/hw_accel stay restart-required until scanner/chapterthumbs/audiobook consumers convert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(jellycompat): read compat identity settings live per request System/Auth handlers take a config provider instead of the startup snapshot, so jellyfin_compat.public_url, .server_name, and .emulated_server_version apply without restart. server_id stays restart-required (generate-once, baked into the resource mapper), as do the session-store TTLs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scanner,metadata,mdblist): hot-reload worker pools and API key scanner.workers, matcher.workers/batch_size, metadata.cache_images, and mdblist.api_key convert to atomic fields with setters wired to the config watcher. Worker counts apply on the next scan/match cycle (the loops read them per cycle); the MDBList key applies to the next request. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ai): hot-reload AI connection, models, toggles, and quotas The shared llm.Client holds its config behind an atomic pointer (UpdateConfig; each request snapshots once), and the subtitle/metadata AI services gain UpdateConfig plus setters on the translator (batching) and Whisper transcriber (ffmpeg path, chunk seconds). The router derives their configs from shared helpers used both at construction and in OnConfigChange callbacks, re-evaluating the chat-only-gateway transcribe guard on each reload and warning only when it newly fires. Everything on the AI Services page now applies without restart except ai.max_concurrent_jobs (fixed-capacity dispatch semaphore). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): wire transcode_enabled; remove dead playback/scanner knobs playback.transcode_enabled was parsed into the config but the resolver always received a hardcoded true — the admin toggle did nothing. It now reads the live config per playback start, so disabling transcodes applies without restart. Remove settings that were wired to nothing so 'save + restart' stops pretending: playback.allow_hevc_encoding (resolver field never assigned), playback.transcode_ahead_segments and playback.segment_duration (parsed, never consumed — segment duration is per-session from the client), scanner.file_removal_grace (DeleteMissing is never called). UI fields removed and the config struct fields pruned so they don't resurrect; YAML import still tolerates the legacy keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 19:25:07 -04:00
3 people	7958f0bbf0	feat(nodepool): node groups, per-node caps, and local transcode fallback control (#126) ... * feat(nodepool): node groups, per-node caps, and local transcode fallback control Group co-located transcode and proxy nodes so transcoded streams are served by a proxy on the same host/LAN instead of bouncing across the internal network (fixes #93): - New nodepool.Planner is the single selection entry point: it picks the transcode node and its group's proxy together (round-robin within the group), replacing the independent ProxyPool.Pick/TranscodePool.Acquire calls scattered across the native and jellycompat handlers, and absorbs the duplicated soft-affinity pick logic. - A group is only eligible while all of its enabled members are healthy; ungrouped nodes keep the historical behavior. - New per-node max_jobs cap (transcodes for transcode nodes, streams for proxies; NULL = unlimited), enforced via health-reported job counts plus short-lived reservations that expire once fresher health data arrives. Proxy health now reports real stream counts, including HLS sessions via idle-expiry tracking. - New playback.local_transcode_fallback setting (default on) lets admins refuse API-server transcoding when no eligible node exists. - Health checks now publish updated node copies under the pool lock instead of mutating shared structs in place, fixing a data race. - Admin UI: group + cap fields on the node form, group/cap columns, and the new fallback toggle in playback settings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(nodepool): proxy bandwidth measurement and egress caps Proxy nodes now measure their stream egress (rolling 60s average over everything under /stream) and report it via the health endpoint. A new per-proxy max_bandwidth_kbps cap lets the planner route new streams away from saturated proxies: - Admission combines the measured egress with the estimated bitrate of the new stream (transcode target bitrate, or source bitrate for direct play/remux) so a stream is only admitted where it fits. - Recently admitted streams are bridged as bandwidth reservations for the meter window, since the rolling average only converges on a new stream's rate gradually. - A group whose proxies lack bandwidth headroom is treated as full: its transcode nodes are skipped, same as the job cap. - Admin UI: per-proxy "Max Egress Bandwidth (Mbps)" field and a live egress column; manual health checks return the measured rate. Active streams are never interrupted - the cap only gates new admissions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * perf(playback): trim node-mode time-to-stream-start Distributed playback paid several avoidable costs before the first frame that integrated mode doesn't have. This trims the safe ones: - Web player preconnects to the stream origin (the proxy node) as soon as /playback/start returns, overlapping DNS/TCP/TLS handshakes with the transcode dispatch instead of paying them at the first manifest fetch. - The transcode node no longer blocks its 202 on monitoring work: the Redis session-track write moves off the request path, and a replaced session's segment directory is renamed aside and deleted in the background instead of synchronously (RemoveAll of a long session can take seconds on slow disks during quality switches). - The proxy's node-facing HTTP client gets a tuned transport: a larger idle-connection pool (Go's default of 2 per host causes connection churn and TLS re-handshakes when many viewers stream through one proxy->node pair) and a response-header timeout so a hung transcode node can no longer hang client requests indefinitely. - jellycompat's remote transcode dispatch gains the same 10s timeout the native path has had; an unreachable node previously hung the compat manifest request until the OS gave up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 17:18:18 -04:00
3 people	39ba284c9d	feat(ai): shared AI core — metadata translation, Whisper ASR, per-profile language, on-view translation (#127) ... * docs: design + plan for shared AI core, metadata translation, Whisper ASR Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(ai): shared LLM client, segment translator, and job runner packages internal/ai/llm: OpenAI-compatible chat client moved out of subtitles/ai, plus /v1/audio/transcriptions (verbose_json) for the ASR work; one shared retry/backoff loop for both. internal/ai/translate: the batched indexed-JSON translation protocol generalized to text segments. internal/ai/jobrunner: dispatch/heartbeat/reaper/cancel lifecycle extracted behind a minimal store interface, with a semaphore shareable across job services. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(subtitles): consume shared AI core LLMTranslator becomes a thin cue<->segment adapter over aitranslate; the service delegates dispatch/heartbeat/reaper/cancel to jobrunner; the local OpenAI client is gone in favor of internal/ai/llm. Behavior (prompts, wire protocol, job rows, recovery semantics) is unchanged. NewService now takes the dispatch semaphore so all AI job services can share one bound. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(config): shared ai.* settings, metadata translation job table, localization provenance columns ai.* connection keys (chat + optional separate ASR endpoint) load with a fallback to the legacy subtitle_ai.* rows — those are never renamed in SQL because encrypted values are GCM-bound to their setting key. New toggles: subtitle_ai.transcribe_enabled, metadata_ai.enabled. Migration adds metadata_translation_jobs, per-field provenance (provider|ai|manual) on the localization tables, and media_folders.auto_translate_metadata. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(catalog): localization field provenance with provider/ai/manual precedence Provider upserts keep manual values and never blank a field with an empty incoming value; new UpsertAITranslation/UpsertAIOverview methods write AI fields only over empty or ai-sourced values (force adds provider, never manual) — all enforced in single-statement SQL. Serving now merges only non-empty localized fields onto the base item, since localization rows are legitimately partial (AI rows carry no titles/artwork). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(metadata): AI translation service, refresh auto-fallback, and admin API internal/metadata/translation: job service over the shared AI core that expands an item to its season/episode overviews, skips already-localized fields (zero model calls on repeat runs), batches paragraphs through the generic translator, and persists per batch with provenance-aware upserts. MetadataService gains an AutoTranslator seam invoked after each refresh for libraries with auto_translate_metadata. Admin endpoints under the metadata curation guard: enqueue, list (poll), cancel; plus a status probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(subtitles): Whisper ASR transcribe and transcribe_translate jobs New WhisperTranscriber: one ffmpeg pass extracts the audio track to 10-min 16kHz mono WAV chunks (temp dir cleaned on every exit path), each chunk goes to the OpenAI-compatible /v1/audio/transcriptions endpoint (verbose_json, per-request timeout sized to 3x chunk duration), segment timestamps are offset and built into wrapped cues. Chunks process playhead-first and stream live to the requesting session. The transcript is stored as an ordinary downloaded subtitle (provider 'transcribed'); transcribe_translate chains the existing translator and stores the translated track as the job result. Enqueue accepts an optional kind; status reports transcribe_enabled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): AI services settings, metadata translate action, library auto-translate, generate-from-audio New AI Services admin page hosts the shared endpoint config (reads fall back to legacy subtitle_ai.* values, writes target ai.*) and the three feature toggles; the AI card moves out of Subtitles settings. The metadata editor gains a Translate-with-AI panel with job polling and force/re-translate. The library form gains the auto-translate toggle (threaded through the libraries API). The player translate modal gains a From-audio mode that lists audio tracks and submits transcribe / transcribe_translate jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * style: gofmt import grouping in router and translation tests Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(catalog): per-profile metadata language and viewer-triggered description translation user_profiles.preferred_metadata_language threads through the access scope into catalog serving: presentation language now resolves explicit param -> profile preference -> library metadata language (native API and jellycompat). ItemDetail gains pending_translation_language when the viewer's language is missing a localized overview. New metadata_ai.on_view setting (off|button| auto) gates POST /items/{id}/translate-description: any profile with item access may request its language, with in-flight dedup and a 15-minute failure cooldown so page views never hammer a broken endpoint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): on-view description translation with per-profile metadata language Profile playback settings gain a Metadata language picker (library default inherit). Detail pages: when the server reports pending_translation_language and metadata_ai.on_view is 'auto', the description translates on view with a pulse animation until the refetched detail comes back localized (45s timeout); in 'button' mode a small Translate chip triggers the same flow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(web): expose metadata_ai.on_view in AI Services settings The on-view translation mode had no UI control, so it could only ever be 'off' — viewers got neither the auto translation nor the fallback button. Adds the off/button/auto selector to the Features card, and the config loader now warns and falls back to 'off' on a bad row instead of refusing to start. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ai): clear configuration hint when the transcription endpoint is chat-only A blank Transcription base URL falls back to the chat endpoint; chat-only gateways reject the multipart upload with an opaque 400 that reads like a pipeline bug. 400/404/405 transcription failures now carry a hint to set a Whisper-compatible endpoint in AI Services. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(subtitles): wrap ASR cue text by rune count, not bytes Arabic/Cyrillic/Greek text is 2+ bytes per character in UTF-8, so byte-based wrapping broke lines at roughly half the intended visual width. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(web): steer transcription base URL hint away from chat-only gateways Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ai): block chat-only gateways for transcription, add endpoint presets llm.IsChatOnlyGateway (OpenRouter et al — no timestamped transcription API) is enforced in three layers: the settings API rejects ai.asr_base_url values pointing at one, the router disables ASR with a warning when the blank-URL fallback would land on one, and llm.Transcribe refuses outright. The AI Services page gains one-click transcription presets (Groq turbo/accurate, OpenAI, self-hosted speaches) plus the mirrored client-side check, and the settings API now also validates metadata_ai.on_view. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(subtitles): tighten ASR subtitle sync Three systematic timing-error sources addressed: cue offsets now use the segment muxer's exact per-chunk start times (segment_list CSV) instead of assuming index*chunk_seconds; the audio stream's start delay relative to the container timeline (common in TS remuxes) is probed via ffprobe and added to every cue; and the chunk length is now operator-tunable via subtitle_ai.asr_chunk_seconds (60-600s, default 600) since shorter chunks bound Whisper's within-chunk timestamp drift. Playhead-first ordering now pivots on real chunk starts, and a beyond-end playhead starts at the final chunk instead of restarting from zero. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ai): tolerate base URLs that already include the /v1 segment Providers like DeepInfra expose their OpenAI-compatible API under a base that contains the version segment (api.deepinfra.com/v1/openai); always appending /v1/... mangled those. endpointURL now appends bare paths when the base already carries /v1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): prefer self-hosted transcription in presets and hints Preset order becomes self-hosted (recommended) -> Groq turbo -> Groq large-v3 -> OpenAI, and the settings hint plus the job-error hint lead with the self-hosted option. The self-hosted preset now fills the turbo CT2 model to match the recommended speaches setup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(subtitles): request VAD and word timestamps for ASR cue accuracy Without vad_filter, faster-whisper servers report wall-to-wall segment times: cues linger on screen through silence (verified up to 91s) and paragraph-length segments become single 400+ char cues. Request vad_filter=true (skipped for hosted providers that reject non-OpenAI fields and run VAD server-side) plus timestamp_granularities word+segment, and rebuild cues from word timings: split at speech pauses, sentence ends, text capacity, and a 7s max duration; cap word-less segments instead of trusting their reported end; stretch sub-second cues to a readable minimum. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 14:58:54 -04:00
4 people	8b70357703	feat(ebooks): first-class ebook libraries, scanner, and reader (#124) ... * docs: define ebook architecture matching audiobooks * docs: plan ebook audiobook-parity implementation * feat: add ebook scanner parser foundation * fix: harden ebook scanner foundation * fix: handle ebook isbn labels * fix: guard ebook subtree scans * feat: scan ebook libraries in core * fix: preserve ebook scan people credits * fix: refresh ebook scan metadata safely * feat: persist ebook series membership * test: cover ebook series persistence decisions * fix: address ebook scanner PR review * docs: clarify ebook foundation PR scope * feat: add ebook metadata enricher * fix: harden ebook poster cache * feat: wire ebook metadata sync task * feat: expose ebook library metadata setup * feat: add ebook catalog scope support * feat: add ebook detail view * feat: label ebook file versions by format * feat: use file-size copy for downloads * feat: use file language in download dialog * test: cover ebook detail authors and downloads * fix: drop narrator credits from ebook scanner merges * fix: align ebook collection filters with book media * fix: drop asin provider ids from ebook enrichment * fix: force ebook people refresh for stale narrators * chore: omit ebook planning docs from branch * feat: add ebook detail related content * feat: add ebook reader file entrypoint * feat: render ebooks with foliate reader * feat: persist ebook reader progress * feat: add ebook reader controls * feat: extract ebook pdf metadata * feat: favor scanner isbn during ebook enrichment * feat: extract fbz ebook metadata * feat: count cbz ebook pages * feat: show ebook file page counts * feat: show ebook download summaries * feat: switch ebook reader files * feat: prefer epub for ebook read action * feat: surface ebook reader progress * feat: sync ebook reader progress cache * feat: hide ebook read action for unsupported files * feat: filter ebook reader file selector * fix: serve fbz ebook archives with reader mime type * fix: detect fbz ebooks from compound filename * fix: authorize fbz ebooks from compound filename * fix: scope ebook catalog facets * fix: reject narrator queries for ebooks * fix: build ebook recommendation text from authors * fix: include ebooks in embedding eligibility * fix: include ebooks in recommendation media mix * fix: include ebooks in recently added recommendations * feat: include ebook progress in recommendation signals * feat: include ebooks in continue watching sections * feat: include ebooks in catalog progress metrics * fix: read ebook isbn from epub metadata * fix: filter ebook asin provider aliases * fix: fall back from unsupported ebook reader files * fix: sort ebook catalogs by reader progress * fix: filter ebook catalogs by reader progress * fix: include ebooks in last watched catalog filters * feat: reflect ebook reader progress in item user state * feat: share ebook progress state across item surfaces * feat: report ebook scan progress * fix: include ebook activity in recommendations * fix: expose ebook reader progress on item detail * fix: support ebook subtree scans * fix: honor profile header for ebook item progress * fix: add ebook library default sections * fix: route ebook continue cards to reader * fix: hide watched toggle for ebooks * fix: route ebook watch tonight cards to reader * fix: route ebook hero actions to reader * fix: detect archive ebook reader formats by filename * feat: cache embedded ebook covers during scan * fix: encode ebook hero reader links * fix: persist non-epub ebook reader progress * fix: scope narrator catalog badges to audiobooks * fix: merge ebook reader progress during item repair * fix: label ebook progress filters as read * fix: show ebook related rails as book covers * fix: remove txt ebook reader support * fix: reject txt ebook reader files * fix: label ebook advanced filters as read * fix: label ebook personalized sorts as read * fix: remove plain text reader loader path * test: cover ebook unread catalog rules * fix: preserve ebook reader library context * fix: link ebook genres with library scope * fix: encode related rail item links * fix: encode catalog card item links * fix: encode hero and continue item links * fix: encode watch tonight item links * fix: encode recommendation and search item links * test: cover ebook scan format set * fix: label ebook search results clearly * fix: make global search prompt media neutral * fix: encode catalog read API ids * fix: encode item API ids * fix: include ebook reader vendor in docker build * fix: make ebook reader build clean * fix: clean ebook embedded descriptions * docs: plan ebook reader shell parity * feat: add ebook reader shell controls * fix: widen ebook scrolled reader flow * fix: remove scrolled reader content width cap * docs: plan ebook reader full parity * feat: persist ebook reader config * feat: add ebook annotations and bookmarks * feat: add ebook reader tools and aids * feat: add ebook advanced reader settings * fix: keep ebook reader panel in viewport * fix: use foliate sizing units for ebook scroll flow * fix: keep ebook settings controls readable * fix: simplify ebook reader settings controls * feat(ebooks): extract local covers during scan (#98) * feat(ebooks): extract local covers during scan * fix(ebooks): read nullable poster paths during cover scan * fix(catalog): coalesce nullable media artwork fields * fix(ebooks): group sibling formats by book identity * fix(ebooks): tolerate legacy ebook metadata encodings * fix(ebooks): decode PDF hex metadata strings * fix(ebooks): harden local cover extraction and format grouping Address review findings on the local cover scan: - Restrict generic sidecar covers (cover.jpg, folder.png, ...) to single-book directories, always accept images named after the book file, and apply exactly one cover per reconcile with sidecar taking precedence over the embedded cover. - Replace the read-then-write poster update with an atomic conditional UPDATE (ItemRepository.SetLocalPoster) so provider/admin artwork is never clobbered by concurrent writers, and refresh locally owned posters when the extracted cover bytes change (thumbhash compare). - Preserve UTF-8 PDF Info strings (including a UTF-8 BOM) instead of forcing everything through Windows-1252; the cp1252 fallback now only applies to non-UTF-8 bytes. - Select EPUB covers by manifest media-type with properties="cover-image" outranking the EPUB2 meta name="cover" id, so XHTML cover pages no longer shadow the real image. - Order CBZ pages naturally (2.jpg before 10.jpg, ch2/ before ch10/) when picking the cover page, via a single O(n) min-scan. - Bump the ebook content group key scheme to version 2 and reprocess rows written under older versions so pre-existing libraries gain sibling-format grouping instead of accumulating duplicates. - Group different formats only (a same-format sibling with colliding sparse metadata stays a separate item) and stop a joining sibling's embedded metadata from overwriting a provider-matched item. - Decode any IANA-labelled OPF/FB2 XML charset (windows-1251, koi8-r, shift_jis, ...) via x/net/html/charset, and wire the charset reader into FB2 parsing which previously had none. - Strip the full .fb2.zip double extension from filename-derived titles and group keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: rxwatcher <rxwatcher@users.noreply.github.com> Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat(ebooks): add reader profiles and ruler (#99) * feat(ebooks): extract local covers during scan * fix(ebooks): read nullable poster paths during cover scan * fix(catalog): coalesce nullable media artwork fields * fix(ebooks): group sibling formats by book identity * fix(ebooks): tolerate legacy ebook metadata encodings * fix(ebooks): decode PDF hex metadata strings * feat(ebooks): add reader profiles and ruler * fix(ebooks): address reader ruler and profile review findings - skip renderer setStyles/render when computed styles and attributes are unchanged, so ruler position updates no longer re-style the book view - drag the ruler via a local draft that commits on release, with the surface rect cached at pointer-down - migrate font values persisted before the generic stacks (Inter, Georgia, Merriweather, legacy serif) so the font select never renders blank, with a Custom fallback option for unknown values - make the ruler band click-through and move dragging to a dedicated keyboard-accessible slider handle so links and text selection keep working under the band - share font stacks between options and profiles via READER_FONT_STACKS - surface the active reading profile, move presets to the top of the settings panel, and drop the redundant profile button aria-labels Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ebooks): resolve prefer-const lint error in readest document lib `pnpm run lint` failed on the branch because `direction` is never reassigned in getDirection; split the destructure so only the reassigned `writingMode` stays mutable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: rxwatcher <rxwatcher@users.noreply.github.com> Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * Merge branch 'main' into work/ebooks-reader-base Brings the ebook integration branch up to date with main (audiobook library redesign, continue-watching rework and card affordances, quic-go bump, jellycompat fixes). Conflict resolutions favor main's generalized mechanisms and register ebooks with them: - media scope validation goes through IsValidMediaScope (now including "ebook" alongside main's "video" group scope), in Go and in the web filter/search types - continue-watching uses main's typed rails; reading-type sections pull resume points from ebook_reader_progress and the ebook library default section is wired to ContinueTypeConfig(ContinueTypeReading) - item_repo keeps main's derived select-list machinery (itemColumnExpr) and both poster accessors (GetPoster/SetLocalPoster for ebook covers, GetPosterPath for audiobook covers) - web cards/hero/watch-tonight adopt main's buildMediaPlayHref helpers, which now route ebooks to /reader/ebook and encode content ids; ebook affordances (BookOpen icon, Read verb, percent-read subtitle) carry over onto main's reworked components - LibraryForm ebook support ported into main's refactored useLibraryForm/libraryTypes modules Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(docker): copy foliate-js vendor into Dockerfile.dev frontend stage foliate-js is a file:vendor/foliate-js dependency, so pnpm install needs the vendor directory before the lockfile install layer. The production Dockerfile already copies it; the dev image was missed, breaking make dev-deploy with ENOENT on /app/web/vendor/foliate-js. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ebooks): render Continue Reading sections as upright poster cards All-ebook continue sections previously fell through to the horizontal 16:9 wide card; include ebooks in the poster-variant check so book covers render in their natural 2:3 framing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ui): stop related-rail highlight ring clipping on detail pages Move the current-item ring onto the cover artwork with a themed ring-offset color (matching the sidebar profile highlight) and give the scroll container top headroom so the ring is not cut off by overflow-x-auto. Applies to both ebook and audiobook detail rails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scanner): harden ebook scanning against data loss and bad metadata - Reconcile missing ebook files like video/audio, with real per-root walk failure tracking (failed/unmounted roots are excluded from deletion), symlinked-root support via the shared logical walker, and the empty-root cleanup allowance before any destructive reconciliation. - Create ebook items as 'pending' so enrichment can promote them to 'matched' (backfill migration included), and protect matched items from re-scan clobbering: title/year skipped, people/series fill-empty only. - PDF metadata: scan head + tail windows (non-linearized PDFs keep the Info dict at the end), require proper key delimiters, head values win. - Cap plain .fb2 reads like .fbz entries; drop .md as an ebook format. - gofmt internal/scanner/audiobook.go (pre-existing drift). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ebooks): make enrichment failures non-terminal with dedicated backoff state - Provider errors now record a failure (capped retries) instead of stamping last_refreshed, which permanently excluded items after transient outages. - Unconfigured metadata chains and the scan-window membership race skip the item without stamping or burning a retry. - Failure tracking moves to a new ebook_enrichment_state table, decoupling it from media_items.refresh_failures (shared with metadata refresh debt). - Preserve non-author people credits when persisting enrichment results. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(catalog): gate ebook progress on hidden history and centralize threshold - Apply user_history_hidden_items gating (video semantics) to the ebook watched/in-progress filters, progress sort plan, and Continue Reading. - Continue Reading pages past dismissed items via the shared collector and dedupes items across pages (also fixes the video path's latent exposure). - Centralize the 0.9 finished threshold as models.EbookFinishedProgressThreshold with a single SQL-interpolated mirror in catalog. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(recommendations): correct watcher counting and wire ebook taste signals - itemWatchersQuery dedupes to distinct (watcher, item) rows so one binge-watcher can no longer satisfy minWatchers; the eligibility floor now counts distinct accounts rather than profiles. - Hidden-history gating on GetEbookReaderProgressForUser (signal reader). - Ebook reading produces canonical implicit taste signals (weighted like the equivalent movie progress ratio); ebooks join taste-seed candidates. - Stale GetRecentlyAddedItems doc comment corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): harden ebook reader endpoints and serve a Content-Security-Policy - Serve a CSP on all SPA HTML responses: blob/srcdoc book iframes inherit it, so script-src 'self' 'wasm-unsafe-eval' blocks script execution from malicious book content (sandbox alone is defeated by the WebKit allow-scripts requirement). Threat model documented on the constant. - X-Content-Type-Options: nosniff on frontend, jellycompat, and ebook file responses; MIME resolution can no longer fall through to octet-stream for an admitted ebook file. - Annotation PATCH: presence-aware field semantics (absent keeps, present sets/clears), invariant re-validation on the merged row, and an atomic SELECT ... FOR UPDATE read-merge-write. - Request size caps (413) on progress/config/annotation writes; Content-Disposition via mime.FormatMediaType; hidden-history gating in the shared ebook progress lister; FK-cascade indexes for reader tables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(api): native read-state endpoints for ebooks - POST/DELETE /watched/{id} accepts ebook content IDs: mark read upserts progress 1.0 preserving the reader's file/location (or picks the preferred reader file for never-opened books); mark unread mirrors video unwatch semantics and deletes the progress row. - /history/remove accepts ebooks: hides via user_history_hidden_items without touching the reading position (hidden != unread; next reading activity resurfaces the book, mirroring video re-watch). - Access-filter checks match the video branch; shared logic lives in ebook_read_state.go. Sort metrics/user-state thresholds use the shared constant; profile-header fallback deduplicated. Clients: response is {type: "ebook", affected_count: 1, played: bool}; the existing watched SSE event fires. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(web): harden the ebook reader UI - Open-flow race: cancellation checked after every await with full stale-run teardown (no wrong-file progress saves, no leaked views/blob URLs); book.destroy() on cleanup. - Progress: monotonic stale-response guard; visibilitychange flush uses the refresh-capable client, pagehide uses keepalive; per-book cross-format progress documented as deliberate. - Settings: side effects out of the setState updater; local edits no longer clobbered by late server config; pending saves flushed on unmount/pagehide. - TTS: generation token so Stop actually stops (Chromium/Firefox synthetic events); Media Session uninstalled on unmount. - External book links: http(s) only, opened with noopener,noreferrer. - apiBlob 512 MiB guard with a user-facing error; fraction bookmarks navigable; search-result key collisions fixed; dead e-ink code removed; getLibrarySortRelevanceScope deduplicated; md format dropped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): mark read/unread affordances for ebooks - Item detail gets a Mark Read/Unread button; card menus drop the ebook gate and share type-aware labels/toasts (also dedupes audiobook wording). - Watched-state invalidation includes the reader progress query key so the Continue button and percent refresh after toggling. - Continue Reading dismiss copy for ebooks; dismissal path now URL-encodes item IDs (ebook content IDs can contain reserved characters). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: record the PR #124 review and hardening pass Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: rxwatcher <rxwatcher@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 08:18:35 -04:00
3 people	0bd4f8cb3b	fix(jellycompat): restore CanDownload with a real Download route for Infuse (#123) ... dd81a7ef set CanDownload=false to stop Wholphin's screensaver from 404ing on the nonexistent /Items/{id}/Download route — but the flag is load-bearing for Infuse, which refuses Direct Play (Static=true streaming) of items it believes it cannot download. With omitempty the field vanished from the JSON entirely and Infuse playback broke, while PlaybackInfo-negotiating clients were unaffected. Resolve the underlying inconsistency instead of trading one client for the other: implement GET/HEAD /Items/{id}/Download serving the original file (range support, Content-Disposition, optional mediaSourceId for multi-version items) under stream-group auth, and restore CanDownload=true now that the route exists. Fixes Infuse playback and keeps Wholphin's download callers working. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 21:09:47 -04:00
4 people	c5f21cb10d	fix(jellycompat): parse repeated Fields query params (#110) ... * fix(jellycompat): parse repeated Fields query params parseItemsQuery read the Fields parameter via q.Get("Fields"), which returns only the first value when a client sends Fields as repeated query params (Fields=A&Fields=B&...) instead of comma-separated in a single param (Fields=A,B,C). The jellyfin-sdk-kotlin (used by Wholphin) sends repeated params. When such a request listed a detail-only field like MediaSources after other fields — e.g. the episode-playlist request /Shows/{id}/Episodes?Fields=PrimaryImageAspectRatio&...&Fields=MediaSources&... silo saw only the first value (PrimaryImageAspectRatio), so needsDetailFields stayed false, the request took the list path, and the response came back without MediaSources. Clients then could not start playback of the returned episodes ("no media sources"). Join all repeated Fields values before splitting on commas so field order and delimiter style no longer matter. Comma-separated single-param clients (e.g. VidHub) are unaffected. * fix(jellycompat): stop advertising CanDownload and stub ThemeSongs Wholphin (jellyfin-sdk-kotlin) audit surfaced two reachable gaps: - mapping.go set CanDownload=true on every playable item while no /Items/{id}/Download route exists, sending clients that honor the flag (e.g. Wholphin's screensaver/slideshow) into 404s. Advertise false until a download route exists. - GET /Items/{id}/ThemeSongs 404'd, so enabling theme songs in Wholphin silently failed on every detail page. Stub it with an empty ThemeMediaResult. This cannot reuse the generic item stub: the SDK models OwnerId as non-nullable, so the response must include it even when empty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(architecture): add Wholphin endpoint coverage audit Cross-references every Jellyfin endpoint the Wholphin client can call against the routes jellycompat serves, with gating evidence for each missing-but-unreachable endpoint and prioritized recommendations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 20:42:46 -04:00
3 people	46540dfec3	fix(progress): track resume points independently of watched state (#117) ... * fix(progress): track resume points independently of watched state Re-watching a finished item never re-entered Continue Watching: completion latched completed = TRUE one-way, pinned position_seconds to the duration, and the resume query filtered on completed = FALSE — so a rewatch heartbeat could never surface the item again (and releasing the latch would have erased the watched state clients display). Adopt the Jellyfin invariant instead of guard heuristics: - Completion resets position_seconds to 0 (UpdateProgress, SetProgress, SetProgressAt, SetProgressIfNewer, MarkWatched, MarkProgressBatch), so position_seconds > 0 now means "live resume point". - completed stays a pure one-way watched latch; rewatch heartbeats re-enter Continue Watching through plain GREATEST/MAX while the watched flag and PlayCount survive (matching Plex and Jellyfin master). - ListProgress("in_progress") keys on position_seconds > 0 in both stores; the SQLite store also gains the min-resume floor the Postgres store had. - jellycompat reports Played=true with live PositionTicks during a rewatch (resumePositionTicks no longer zeroes played items) — the DTO shape real Jellyfin emits since jellyfin/jellyfin#15762. - Web mirrors the latch (playbackProgressCache), resumes rewatches at their stored position, and shows progress bars on rewatched episodes. - ABS audiobook surfaces keep today's behavior: finished books report 100% via the completed flag and Continue Listening still excludes them. - Migrations reset legacy completed rows (position pinned to duration) to 0: a Goose migration for Postgres and a user_version-gated one-time fix for the per-user SQLite DBs. Replaces the guard-based approach of #109, whose restart detection (50% fraction + 60s time gap) could never release the latch for immediate rewatches (blocked heartbeats refreshed updated_at, re-arming the gap) and un-watched items on position-0 heartbeats. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(progress): address review — migration gate, one-way latch, missed writers/readers Review fixes for the position-based watch-progress model: - The per-user SQLite data fix is now migrateToV11 in the existing versioned runMigrations chain (schemaVersion 11). The previous standalone PRAGMA gate compared against 1, but existing DBs already sit at user_version 10, so the reset never ran for them — and the gate would have rewound the version. Fresh DBs short-circuit to the current version as before. - `completed` is now one-way across every playback/sync writer: SetProgress (the RecordPlaybackStop path — stopping a rewatch below the watched threshold no longer clears the watched state), SetProgressAt, SetProgressIfNewer (both stores), and the history import upsert, which also stops pinning completed imports to position = duration. Mark-unwatched still releases the latch via ClearProgress/ClearProgressBatch. - MarkProgressBatch regains its freshness guard: a delayed batch mark carrying an old timestamp can no longer zero a newer rewatch resume point (the position-reset now rides the original updated_at check). - Catalog read paths align with the new in-progress definition (position_seconds > 0, completed-agnostic): smart-collection in_progress filter, progress sort ratio, episode progress CTE, and both next-up predicates. - jellycompat derives PlayedPercentage and PlaybackPositionTicks from the same clamped position; a played item at rest reports 100 (as the old model did) while a rewatch reports its live fraction. - ABS audiobook UpsertProgress stores position 0 on finish so finished books can't surface as phantom resume entries; re-listens still move position forward from 0 with the latch intact. - The web optimistic cache zeroes the resume point on completion, mirroring the server invariant until the refetch lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 19:44:40 -04:00
3 people	074d106402	feat(jellycompat): BoxSet collections, genre-by-name, and airtight ABS media exclusion (#115) ... * feat(jellycompat): exclude audiobook libraries, add BoxSets and genre-by-name - Audiobook libraries (type 'audiobooks'/'audiobook') no longer appear in Views/VirtualFolders, and all browse/search/genre/detail paths are clamped to movie/series/episode so audiobook items cannot leak or stream through the Jellyfin compat surface (they are served by the ABS-compat API). - Library collections are now exposed as Jellyfin BoxSets: IncludeItemTypes=BoxSet listing (optionally scoped via ParentId library), /Items/{id} BoxSet detail, ParentId children with curated position order preserved (explicit SortBy delegates to catalog ordering), poster/backdrop presigning, and visibility + library-access filtering. - /Items with only unexposable IncludeItemTypes (e.g. Playlist) returns an empty result instead of falling through to views/browse. - New GET /Genres/{name} endpoint resolving canonical genre casing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): centralize ABS media-type exclusion, fix BoxSet edge cases from review - Add catalog.AccessFilter.ExcludedMediaTypes, enforced by applyAccessFilter and threaded through Search/GetByIDsWithAccess/EnsureAccessible and BrowseFavorites. The compat layer stamps audiobook+podcast exclusions onto every resolved access filter (one wrap in withDefaults), closing the favorites, recommendations, and item-image leak paths that per-call-site guards missed. - Treat podcast libraries like audiobook libraries: hidden from Views, items excluded everywhere (they're served by the ABS-compat API). - HandleItems: BoxSet listing no longer hijacks user-state-filtered queries (IncludeItemTypes=BoxSet&Filters=IsFavorite returns empty again), IncludeItemTypes=CollectionFolder returns library views as before, and Ids=<boxsetId> re-hydrates the BoxSet DTO instead of falling through to the views response. - BoxSet artwork is now durable: stable signed tags seeded from the artwork key (no churn on presign rotation) plus a collections fallback in the images handler, so posters survive restarts and cache expiry. - BoxSet listing filters/sorts/pages the lightweight collection rows before building DTOs, so a Limit=24 page over 300 collections no longer presigns ~600 posters per request; collection children also page before hydrating user state. - Dedupe: shared loadVisibleCollection guard, shared collection-page writer, single scoped-types implementation, emptyQueryResult helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(jellycompat): address PR review comments - withCompatAccessExclusions merges compat exclusions with any the base resolver already supplies instead of conditionally skipping them. - Explicit type filters clamp to a closed allowlist (movie/series/episode/ season) rather than passing unknown types through to catalog queries. - Collection artwork on the session path applies the same visibility rules as the BoxSet item endpoints (hidden or inaccessible-library collections 404 instead of serving posters). - loadVisibleCollection propagates infrastructure errors instead of masking transient DB failures as 404/empty; only ErrLibraryCollectionNotFound maps to not-found. - ListFavorites filters ABS-surface favorites before applying the limit/offset window (over-fetching the raw rows) so pages don't shrink or shift, and presigns artwork only for the returned page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 19:16:28 -04:00
3 people	b246f271cb	fix(jellycompat): hide dismissed and superseded entries from Resume (#114) ... The jellycompat /UserItems/Resume endpoint served the raw in_progress list, so Jellyfin clients showed every half-watched episode a profile ever abandoned, including stale entries from earlier seasons of shows the viewer had long moved past. The first-party Continue Watching row already hid those via dismissal filtering and the superseded-episode check, but that logic was private to internal/sections. Extract the shared rules into internal/catalog (ContinueWatchingProgressFilter, HomeDismissalIndex) and apply them to the compat Resume path through a new UserDataService method, FilterResumeProgress. The sections fetcher now delegates to the same code, so both surfaces agree on what "still watching" means. Resume pagination keeps advancing by raw batch counts so filtering cannot terminate scans early, and the raw-offset fast path is limited to StartIndex=0 for Resume because filtered lists make raw offsets diverge from the visible list. The watched-items view ("completed" status) stays unfiltered, and the per-series collapse deliberately stays first-party only to preserve Jellyfin endpoint semantics. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 18:01:36 -04:00
4 people	ce9830cd02	fix(jellycompat): report fileless episodes as LocationType=Virtual (#111) ... * fix(jellycompat): report fileless episodes as LocationType=Virtual Provider-metadata-only episodes (unaired/missing entries pulled from TVDB/TMDB that have no underlying media file) were mapped with LocationType=FileSystem and an empty MediaSources list. Jellyfin's contract is that such items report LocationType=Virtual. Because they were not marked Virtual, clients that build playback queues from the episode list (Wholphin, Infuse, Findroid, ...) treated them as playable, queued them, and failed on advance with "no media sources". Wholphin specifically filters LocationType=Virtual out of its auto-advance playlist, so marking these Virtual lets next-episode / skip-outro jump cleanly to the next real episode, and the episode list greys them out as expected. itemFromDetailWithFields now stamps LocationType=Virtual on playable items (movie/episode) that have zero file versions. * fix(jellycompat): mark fileless episodes Virtual on list paths too The Virtual fix only covered itemFromDetailWithFields, which clients reach only when requesting detail-level Fields (MediaSources, MediaStreams, ...). itemFromList and episodeFromUpstream still stamped LocationType=FileSystem unconditionally, so the same fileless episode reported Virtual or FileSystem depending on the endpoint/Fields combination used. Centralize the decision in applyPlayableLocation (which also clears VideoType on virtual items, matching Jellyfin) and plumb a HasMediaFiles signal into the list paths: - episode targets query gains an EXISTS check against media_files - the pool-less fallback uses a new EpisodeRepository.HasFilesByIDs - the /Shows/{id}/Episodes non-detail path reuses the already-fetched episode targets, so no extra query is needed A nil signal preserves the historical FileSystem default for producers that do not check file presence (movies, series-level lists). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-09 16:59:55 -04:00
QuickandGitHub	7c64c06e3d	Redirect Jellyfin image routes to upstream URLs (#101) ... * Redirect Jellyfin image routes to upstream URLs * fix(jellycompat): proxy images for incompatible clients	2026-06-08 22:36:22 -04:00
QuickandGitHub	2fa30379ad	fix(jellycompat): include Wholphin display preference dimensions (#102)	2026-06-08 22:36:07 -04:00
3 people	cf4e080bf4	fix(jellycompat): Wholphin (jellyfin-sdk-kotlin) playback & genre compatibility (#100) ... * fix(jellycompat): match MediaSourceId across UUID formats (compact vs dashed) * fix(jellycompat): honor ImageTypes=Backdrop as a filter on /Items Wholphin genre cards request /Items?imageTypes=Backdrop&limit=1&sortBy=Random and assume every returned item has a backdrop. Silo ignored ImageTypes, so a random pick could lack a backdrop (BackdropImageTags: null), crashing Wholphin. Push the filter down to the catalog browse SQL (NULLIF(BTRIM(backdrop_path),'') IS NOT NULL) so random/limited selections only ever consider backdrop-having items; empty genres correctly return []. * fix(jellycompat): case-insensitive PlaySessionId + api_key in stream auth Wholphin's jellyfin-sdk-kotlin builds its own direct-play URL (/Videos/{id}/stream?static=true&playSessionId=...&mediaSourceId=...) with a lowercase 'playSessionId', no api_key, and no auth header (ExoPlayer's data source drops it). PlaybackSessionAuth read 'PlaySessionId'/'PlaySessionID' case-sensitively, so the fallback never matched -> 401 on every direct-play stream -> forced (often failing) transcode fallback. Resolve PlaySessionId via newCaseInsensitiveQuery, and likewise accept case-variant api_key in ExtractToken. * fix(jellycompat): support Wholphin season item queries --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>	2026-06-08 21:05:33 -04:00
3 people	9e29e7b330	feat(security): encrypt server-owned credentials at rest (#45) (#95) ... * feat(security): encrypt server-owned credentials at rest Introduce AES-256-GCM at-rest encryption (HKDF-derived from a required SECRET_KEY) for server-owned credentials, with row-bound AAD, a versioned enc:v1: envelope, and an idempotent startup backfill. - internal/secret: cipher + RowAAD/SettingsAAD + the startup backfill engine. - SECRET_KEY required at bootstrap; cipher threaded as an explicit dependency. - server_settings: EncryptedSettingsRepo decorator over the audited SensitiveSettingKeys (also drives admin redaction); the config watcher and watch-sync settings reads decrypt too. - Arr keys inline-encrypted; the ambiguous SecretResolver indirection removed from requests/autoscan. - Per-table columns encrypted: subtitles, watch-sync, webhook-sync (not webhook_secret), history-import, and the jellycompat session's bridged Silo access/refresh tokens. - Startup backfill (resolve-then-encrypt for arr refs) is best-effort and primary-node gated. Equality-looked-up secrets and plugin_runtime_configs.config_value are out of scope (need hashing / cross-repo design) — see docs/architecture/secret-encryption.md. Refs #45 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(compose): require SECRET_KEY in docker-compose The server now fatals without SECRET_KEY, so the integrated service (and the commented distributed proxy/transcode examples) pass it through with a fail-fast guard matching the existing MEDIA_ROOT pattern. Distributed worker nodes must use the SAME key as the primary to decrypt shared data. Generate with: openssl rand -base64 48. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(security): encrypt history import session credentials --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-08 15:25:48 -04:00
9 people	d3626fca00	feat(jellycompat): add /Users endpoint and unified sa_ admin-key auth (#91) ... * fix(api): allow HEAD on /api/v1/direct-download Firefox (and some download managers) issue a HEAD request before starting a download. The route only registered GET, so HEAD returned 405 Method Not Allowed and the browser aborted the download. Mirrors the pattern already used by /stream/{session_id}, which registers both GET and HEAD on the same handler. ServeDirect is built on http.ServeContent / ServeFile, which natively handle HEAD by writing headers without a body, so no handler changes are needed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: design jellyfin autoscan scan compatibility * refactor(scan): extract scan trigger resolver * refactor(api): share scan target resolution * feat(jellycompat): accept admin api keys for autoscan * feat(jellycompat): add autoscan media update route * docs: document jellyfin autoscan setup * fix(jellycompat): harden autoscan auth and batch scan enqueue - Reject nil API keys and bound last-used update with a 5s timeout - Stop leaking internal queue errors in autoscan responses - Batch scan enqueues via new CreateBatch and reuse folder list across path resolves * chore: add planning docs and requests updates - Add plans for date-named episodes and Jellyfin autoscan compat - Update requests handlers, service, and UI hooks - Remove Makefile.local.example * refactor(scantrigger): drop redundant Target.LibraryID field - Read library ID from Target.Folder.ID everywhere - Guard scan queue enqueue against nil Folder - Simplify admin API key auth error plumbing * fix(catalog): gate search overview-only matches behind title FTS - Always apply stats CTE + CROSS JOIN so single-word queries no longer flood results with description-only hits - Require overview_rank >= 0.15 for overview-only fallback rows - Switch title gate from contiguous LIKE to title_rank > 0 so reordered-token title matches aren't demoted * ci(docker): build image on push to main via self-hosted runner - Trigger Docker image builds on pushes to main instead of nightly cron - Run on self-hosted Linux runner - Drop the `nightly` tag * docs(specs): add design for TMDB-backed request section in search Adds the design for surfacing requestable TMDB results inside the main catalog search (Cmd+K dialog and full results page) as a clearly delimited "Request to Add" section that never blocks or displaces library results. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(specs): address Codex adversarial review for search request section Splits discovery eligibility from submission eligibility so blocked and quota-exhausted viewers still see the requestable section with disabled per-row CTAs, matching the documented behavior. Documents the required extensions to useRequestSearch — signal forwarding, viewer-identity-keyed cache, and invalidation on auth/profile/ settings/limit changes — so the planned 5-minute staleTime is safe and cancellation works as described. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(plans): add implementation plan for search request section Twelve TDD tasks covering: api() signal contract test, useCanRequest hook, viewer-keyed requestKeys.search, useRequestSearch extension (signal + viewer key + 5min staleTime + enabled override), invalidation cascade tests, RequestPosterCard optional onRequest, RequestToAddSection component (dialog + grid variants), GlobalSearch and Catalog wiring with empty-state suppression for the library-0/TMDB-pending edge case, final lint/test pass, and manual smoke. Notes a single deviation from the spec: submitDisabledReason is null in the initial implementation, with per-row request data driving disabled UI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(plans): address Codex adversarial review for search request section Fixes the high-severity finding that RequestToAddSection's internal useRequestSearch call was not gated on discoveryEnabled, allowing /api/v1/requests/search and TMDB lookups to fire for users without request access. The plan now (1) passes { enabled: discoveryEnabled } to the section's hook, (2) gates the parent mount in GlobalSearch and Catalog on canRequest.discoveryEnabled as defense in depth, and (3) adds tests asserting both the enabled forwarding and the no-mount behavior when discovery is disabled. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(api): pin AbortSignal forwarding contract on api() * feat(hooks): add useCanRequest gating hook for discovery eligibility * refactor(keys): add viewerKey to requestKeys.search * feat(requests): key useRequestSearch by viewer, forward signal, raise staleTime * test(requests): document viewer-keyed cache isolation and invalidation cascade * feat(request-card): make onRequest optional on discover variant * feat(search): add RequestToAddSection dialog variant * feat(search): add RequestToAddSection grid variant for Catalog page * feat(search): render RequestToAddSection in the Cmd+K dialog with empty-state suppression * feat(catalog): render RequestToAddSection grid with empty-state suppression * chore(web): format request search section * test(web): avoid unsupported Array.at in search request tests * commit message {"subject":"fix(search): prevent empty-state flash before TMDB fallback renders","body":"- Add isResolving to useCanRequest and gate empty states on it across GlobalSearch and Catalog\n- Debounce TMDB query in Catalog and hide ItemGrid when the request section may rescue an empty library\n- Track per-card submit state in RequestToAddSection grid so concurrent requests don't trample each other\n- Suppress anonymous TMDB request-search fetches to avoid cross-viewer cache leakage"} * fix(jellycompat): tolerate autoscan sidecar updates * fix(webhooksync): skip events for unmapped external users - Require explicit profile mapping instead of falling back to the default profile - Update settings UI copy to reflect that unmapped users are ignored * refactor(admin): show per-section loading and error states - Replace page-level loading gate with skeletons per section on dashboard and stats - Surface query errors inline instead of blocking the whole page - Disable "Scan All Libraries" when no libraries are configured * fix(search): address request search review feedback * feat(subtitles): restore upload management * feat(auth): add assignable user permissions * feat(auth): expose user permissions * feat(api): authorize item metadata curation * feat(api): route metadata curation by permission * feat(web): add permission helpers * feat(web): assign metadata curation permission * fix(web): keep device profile hooks unconditional * feat(web): show metadata tools to curators * fix(auth): address metadata curation review issues * fix(auth): tighten curator job response review fixes * docs: add metadata curation permission plan * test(auth): expand session revocation coverage * docs: add PageBack component design spec * fix(auth): gate media file paths on metadata curation permission - Allow curators (not just admins) to view media file paths and locations - Apply library access filter to file-level access checks * fix(metadata): break duplicate provider candidate ties - Score candidate metadata completeness and auto-match the richer duplicate when title/year/type tie - Enrich near-duplicate candidates via the provider chain before initial match selection - Seed both movie and series match queues for mixed-type libraries and wait for TV queue settle - Add taskmanager worker test coverage and a plan doc for the tie-breaker work * feat(ui): add shared PageBack component for consistent back navigation Replace the eight inconsistent back affordances across user-facing pages with a single absolute-positioned chevron pill, so the control lives in the same screen position regardless of title length or hero content. DetailBreadcrumb keeps its textual hierarchy path but no longer owns the back chevron; PageBack does. DetailHero gains a topNav slot consumed by Movie/Series/Season/Episode/Request detail pages. Non-hero pages drop their bespoke back buttons and add PageBack inside a relative wrapper. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(ui): add floating variant to PageBack for sticky nav - Add `floating` prop to pin PageBack to viewport on lg+ screens - Switch styling from glass-subtle to glass with shadow for better contrast - Use floating variant on SettingsLayout * fix(ui): make PageBack destinations deterministic * feat(episode-carousel): highlight currently viewed episode - Add "Now Viewing" badge with pulsing indicator on current episode - Replace border with primary-color ring for current episode card - Set aria-current="page" on links to the current episode * feat(jellycompat): sign image tags and accept them without session - HMAC-sign image tags using the configured JWT secret - Serve item/season/episode images via signed tag without requiring a session or cache hit * fix(jellycompat): harden signed image tags * fix(jellycompat): stabilize signed image tags across restarts {"subject":"fix(jellycompat): stabilize signed image tags across restarts","body":"- Sign library poster and episode parent series image tags from canonical paths/thumbhashes instead of presigned URLs so tags survive restarts\n- Accept signed canonical tags in the image handler without a session and fall back to legacy URL-derived cache tags\n- Always fetch series detail for episodes to build stable parent image tags"} * fix(metadata): accept exact cross-provider match ties * Optimize episode added_at sorting * fix(libraryingest): treat drainer shutdown cancel as clean stop TV/series full scans (libraries with new or updated items) were recorded as "cancelled" with an empty error message and never completed matching. When the file-walk finishes, the ingest executor waits out a settle window and then calls stopDrainers() to shut down the concurrent match goroutines. That cancels the drainer context while a ProcessBatchByFolderAndPathPrefix call may still be in flight. The drainer treated the resulting context.Canceled as a fatal error: it pushed the error to drainerErrCh and called cancel() on the whole scan context, so scanqueue.process() mapped it to cancelRun(). Large/slow libraries (many series, slow provider lookups) keep a batch in flight continuously, so stopDrainers() almost always landed mid-call and the scan was cancelled; small/fast libraries were usually idle at that instant and completed normally. Treat a cancelled drainer context as a deliberate shutdown: return cleanly without escalating. Genuine external cancellation still reaches the run via the main goroutine's scanCtx checks, so real cancels are not swallowed. Adds a regression test (settle window made injectable) that fails against the old handler with 'concurrent match scope ...: context canceled' and passes with the fix. * perf(catalog): add episode browse index fast path * fix(catalog): address episode catalog review feedback * Fix settle-window drainer cancellation in library ingest * fix(catalog): support relative date filters * fix(collections): cap smart collection results * fix(library): preserve episode browse url * fix(catalog): use season posters for episode cards * feat(sections): show episode context in cards * feat(calendar): show local episode airtimes * Enable DRI passthrough in docker compose Co-authored-by: Codex <noreply@openai.com> * feat(ui): paginate the Ambiguous Roots table Match the sibling tables on the Admin Libraries page (Troubleshooting/unmatched): use the existing usePagination hook + PaginationBar (10/page, auto-hidden when <=10 rows), render pag.rows, and reset to page 0 when the library selector or search filter changes. * feat(admin): enlarge match-candidate posters + hover-to-enlarge Unmatched-item match dialog rendered candidate posters at 44x64px, too small to identify a film. Bump to 64x96 (2:3) and add a portaled Tooltip hover preview (192x288) using the existing poster image, so operators can tell candidates apart. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(admin): search unmatched items across the whole table, not just the page The unmatched-items search filtered only the current page's rows client-side. Push the query server-side: HandleListUnmatchedItems takes an optional 'q' param and filters title/library/type/status with parameterized ILIKE across all rows, paginating the filtered set. Frontend hook takes a debounced search, resets to page 1 on change, keeps the section mounted while searching. Also fixes stale test mocks that returned the pre-pagination array shape instead of {items,total}. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * style(admin): prettier-format match dialog; reset unmatched page in onChange Run prettier over the Tooltip-wrapped poster JSX, and reset the unmatched-items page in the search input's onChange rather than a useEffect (avoids the react-hooks/set-state-in-effect warning / cascading renders). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(admin): wire QueryClientProvider + missing hook mocks so the suite runs The AdminLibraries test file failed all 6 tests with 'No QueryClient set' on this branch and at the parent commit -- pre-existing infrastructure gap. With that fixed, several hooks that the page imports (useCancelLibraryScans, useLibraryRoots, useUpsertLibraryRootOverride, useDeleteLibraryRootOverride, useActiveScans) and the UNMATCHED_PAGE_SIZE constant also needed mocking. One stale assertion on the renamed 'Root path' header is updated; the deeper troubleshooting test, which mocked useSkippedLibraryRoots but the section was refactored to useLibraryRoots(_, 'ambiguous'), is skipped with a TODO -- a real rewrite is needed and is out of scope for this MR. 5 of 6 tests now run and pass; the 6th is properly flagged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(admin): search all unmatched item library memberships * fix(naming): strip unsubstituted Sonarr tokens ({TvdbId}/{imdb-}) from titles These tokens survived the provider-tag regex ([\w]+ doesn't match braces), polluting parsed titles (e.g. 'A Girl & Her Guard Dog [tvdb-{TvdbId}]') so they could not score-match. Broaden the regex to drop {...} and empty tokens. * fix(naming): numeric-only titles are not bare provider IDs '86' / '22 7' were parsed as trailing tvdb ids, tripping the trusted-ID gate so the correct title match was rejected. Require a letter in the name before treating a trailing number as a bare id. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(naming): document bare-id trade-off; cover CJK title + movies numeric Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(matcher): auto-accept a year-corroborated single distinct show A search that resolves to one distinct show (one candidate, or the same title+year returned once per source as unmerged TVDB/TMDB rows) whose year matches the parsed year is now auto-accepted via the existing top-ranked candidate, even when the fuzzy title score is in the 55-69 band. The 55/70/15 thresholds are unchanged; this only adds a year-gated acceptance for effectively-unique results (recovers lone-correct-result items like 1201 (1993)). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(matcher): exercise the single-distinct-show guard properly + conflicting-ID case; doc notes Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(matcher): tolerate concurrent-merge ErrItemNotFound in series episode-link ensure A scan drainer and the background MatchWorker can process the same folder concurrently. When a provider-ID merge moves a series' episodes to the survivor and deletes the source, an in-flight ensureSeriesEpisodeLinks(sourceID) hits catalog.ErrItemNotFound and was failing the whole scan. The episodes are already reattached, so this is benign: log and continue (matching the lenient call sites) instead of failing. Genuine errors still abort. * diag(matcher): debug-log per-candidate match scores Adds a DEBUG-gated log in selectInitialMatchCandidate printing each scored candidate (title/year/type/sources/provider_ids/score) against the hint, so operators can see why an item did or didn't auto-match. Zero-cost when debug logging is off; no change to matching behavior. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(matcher): resolve cross-source ties by library provider priority Accept a year-corroborated single distinct show when the TOP tie-group (within 15 pts of best) is one show across providers, ignoring low-score noise below it, and pick the winner by the library's metadata-provider chain order (providerPriority, highest-first; falls back to top-scored). Recovers items like '100 Days Wild' that are returned identically by TVDB and TMDB. Thresholds (55/70/15) unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(matcher): accept cross-source-corroborated ties without a hint year When the top tie-group is one distinct show returned by 2+ distinct providers (candidatesAreSingleDistinctShow already verifies matching title+year), accept it even if the hint has no parsed year (year-less folders like '100 Deeds for Eddie McDowd'). Multi-source agreement substitutes for the year guard; lone single-source no-year results stay subject to the single-candidate >=70 gate. Thresholds unchanged. * diag(matcher): debug-log provider search query + per-provider result counts Adds DEBUG logs in the ModeInitialMatch search path: each provider's result count for the query, and the assembled raw/candidate totals. Lets us see when a provider search returns zero ('no metadata found') vs a scoring/tie issue. Zero behavior change. * fix(naming): parse bare bracketed IMDb IDs ([tt10011226]/{tt...}) Folders tagged with a bare IMDb id in brackets (Plex/Kodi style, e.g. '17 Blocks (2021) [tt10011226]') had the id silently dropped — folderIDPattern needs an 'imdb-' prefix and trailingImdbIDPattern needs an un-bracketed trailing tt-id. Recognize bracketed bare tt-ids so these items get the trusted-ID match path instead of falling to title+year scoring. * feat(metadata): match sole exact-title candidate despite year off by <=2 Folder years routinely differ from provider release years by a year or two (festival vs wide release, regional dates), zeroing the year bonus and leaving a lone exact-title candidate at 63-68 — just under the single-candidate >=70 gate (e.g. Dead Reckoning 1947 vs 1946, 17 Blocks 2021 vs 2019, Stasi FC). Add title corroboration to the existing lone-result rule: a sole distinct show whose normalized title exactly matches and whose year is within +/-2 is accepted. The 55 floor still rejects low-similarity titles (e.g. Hotel Transylvania Puppy! vs Puppy!). No 55/70/15 threshold change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore(lint): gofmt single-space alignment in root_inference.go var block When inferProviderTagRe was broadened to handle unsubstituted Sonarr token placeholders ({TvdbId}/{imdb-}), the regex grew long enough that gofmt prefers single-space rather than column-aligned spacing across the var block. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(metadata): tighten matcher and bare IMDb parsing * docs: add resilient library deletion design spec Batched, deadlock-retrying rewrite of delete_library to replace the single multi-minute transaction that deadlocks on large libraries. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs: add implementation plan for resilient library deletion Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(catalog): add deadlock-retry helper for batched deletes * test(catalog): clarify cancel-path expectation in retry test * feat(catalog): add deleteInBatches loop helper * refactor(catalog): make image-dir helpers querier-agnostic Add rowQuerier interface satisfied by both *pgxpool.Pool and pgx.Tx. Split collectImageDirs into collectRawImageDirs (raw collection) and a thin wrapper that filters via filterUnreferencedImageDirs. Both helpers now accept rowQuerier so a later task can call them from pool-level batch deletes without an open transaction. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(catalog): delete libraries in deadlock-retrying batches Replaces the single multi-minute delete transaction with phased, batched autocommit deletes (orphan items, media files, memberships, folder row), each retried on deadlock. Holds only short locks, survives concurrent writers, and is resumable on failure. * refactor(catalog): wrap orphan-batch iteration error * fix(catalog): clamp still/poster/logo backdrops to largest cached variant Episode stills used as backdrops only exist at w500/w300 in the cache, so requesting a w1280/w1920 backdrop width 404s. Add catalog.BackdropVariantPath + imageTypeFromCachedPath and route featured (w1920) and Continue Watching / Next Up (w1280) backdrops through it; still/poster/logo paths clamp to their type's largest cached variant while real backdrops keep the requested width. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * perf(startup): defer non-critical init off the HTTP listener path Collect catalog-size-dependent seeding (metadata match queues, legacy series-group cleanup) and the watch-provider scrobble sweep into a backgroundInit slice that runs sequentially in a background goroutine after the server is ready, instead of blocking startup before the listener accepts connections. Steps log failures and stop early on shutdown. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(migrations): make air_timezone column add idempotent Use ADD COLUMN IF NOT EXISTS so re-running 162 on a database that already has the column is a no-op. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * build: stamp git revision via Makefile ldflags `make build` did not inject buildinfo's `revisionOverride`/`dirtyOverride` ldflags (the Dockerfile already does), so binaries built via make report their version as "unavailable" in the admin Build panel whenever Go's VCS metadata isn't embedded. Mirror the Dockerfile by computing the git revision + dirty state and passing them through `-ldflags -X`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): accessibility & UX fixes from visual QA pass Accessibility (WCAG AA): - Lighten the Standard-theme `--muted-foreground` (#6e6e78 -> #9696a0, ~3.4:1 -> >=5.3:1) and darken the light-theme equivalent so secondary text meets 1.4.3 contrast app-wide; the opt-in High Contrast mode is no longer the only conformant path. - Give icon-only controls accessible names (4.1.2): the password show/hide toggle (also drop tabIndex={-1} so it's keyboard reachable), and the Edit/Delete/health/copy/refresh actions across the Users, Libraries, Nodes, API Keys, Catalog Maintenance and Job History admin tables. - Fix the Switch off-state (invisible track -> visible border + fill) and the PlaybackSettings SettingRow label association (the <label htmlFor> pointed at a wrapping <div>; the id now lands on the Switch/SelectTrigger). - Login: wrap the card in <main> and add an <h1>; Profiles: add an accessible PIN-protected label and a corner lock badge. - Player + catalog: role="status" on the initial loading overlay; scope the catalog count ("0 in library" for search) and announce it via aria-live; trim the verbose poster-link name to the title. UX / consistency: - Emphasize overdue scheduled tasks (warning colour + icon + word, not colour alone). - Per-source catalog subtitles instead of one shared string. - Add a Reconnect affordance when the admin log stream drops (it does not auto-retry). - Page titles for Watch Party + all admin sub-pages (incl. plugins); admin heading capitalisation normalised to Title Case. - Show "dev build" instead of "unavailable" when no build revision is stamped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(catalog): re-check orphan status when deleting library items Orphan detection moved outside the media_items delete in the batched library-delete rewrite, opening a TOCTOU race: a concurrent scan/import could attach one of the collected content IDs to another library between collectOrphanBatch and the delete, after which the unconditional `DELETE FROM media_items WHERE content_id = ANY($1)` would still remove the shared row and cascade away the newly-added membership — dropping the item from the other library. Re-check the orphan invariant inside the delete (NOT EXISTS a membership in another folder) and count rows actually deleted. Addresses PR #21 review (P1). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(metadata): persist a cleared air_timezone instead of skipping it Clearing a previously-set air timezone sent JSON null, which decodes to a nil *string that UpdateMetadata treats as "skip this column", so the old value remained. The dialog now sends "" (accepted by ValidateAirTimezone), and UpdateMetadata maps air_timezone through NULLIF so an empty value persists as SQL NULL (matching the nullable column) rather than "". Addresses PR #21 review (P2). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(startup): sweep open scrobbles before accepting playback The open-scrobble sweep was queued in the deferred background-init list, which runs concurrently with the HTTP listener; a resume immediately after restart could start new scrobbles before the previous process's open sessions were stopped, leaving overlapping/stale scrobbles on remote providers. Run the sweep synchronously before the listener starts, bounded by a 30s timeout so an unreachable provider can't hang startup (the heavier non-critical init stays deferred). Addresses PR #21 review (P2). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(catalog): scan air_timezone in paginated item queries scanItemsWithTotal was not updated for the new air_timezone column, yet the shared column lists it reads (itemColumns, qualifiedListItemColumns) include it. Search and BrowseFavorites build their SELECTs from those lists with COUNT(*) OVER (), so each row carried one more column than the scan had destinations and every call failed at scan time with a pgx mismatch. Add the missing &item.AirTimezone target between AirTime and ShowStatus. Found during PR #21 review (critical: Search/Favorites runtime regression). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * revert(startup): keep open-scrobble sweep deferred for fast startup Reverts 62563f5c. Running the sweep synchronously before the listener could add up to 30s to restart-before-playback when a watch provider is unreachable, which regresses the deliberate startup-deferral from a1a6c6cf. Prefer the fast-startup behavior and accept the small window where a resume immediately after restart may create a duplicate scrobble; the sweep returns to the deferred background-init list. (Panic-safety for that list is added in a follow-up commit.) Per PR #21 review decision. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(startup): recover from panics in deferred background init The deferred background-init steps run in a detached goroutine after the HTTP listener is already accepting connections. An unrecovered panic in any step (queue seeding, legacy cleanup, scrobble sweep) would crash the entire live server. Wrap each step in a recover that logs the panic with a stack and continues to the next step. Found during PR #21 review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): make usernames and emails case-insensitive Login identifiers were compared case-sensitively, so "John" and "john" were distinct accounts and a user could not log in unless they matched the exact casing used at registration. Convert users.username and users.email to the citext type (migration 165). citext compares case-insensitively while preserving the originally stored casing for display, so the existing unique constraints become case-insensitive and `WHERE username = $1` / `email = $1` lookups match regardless of case with no change to the query code itself. Also add auth.NormalizeUsername/NormalizeEmail (trim-only; case preserved), applied at the repository chokepoints (Create, Update, GetByUsername, GetByEmail) and before validation in the create paths, so surrounding whitespace no longer defeats matching or creates lookalike accounts. Verified non-destructively against the dev DB: mixed-case lookups resolve to the same row, case-variant inserts are rejected by the unique constraint, and the down migration cleanly reverts to text. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(sections): add trending_discover home section A library-agnostic home section that surfaces external global trending (TMDB or Trakt, admin-selectable) mixing movies + series, matched to titles in the viewer's enabled libraries. TMDB uses /trending/all/{window} (natively mixed); Trakt merges trending movies + shows. Fetched live with a 1h in-process cache, so no background job or stored collection — and no per-library duplication. Appears in the admin section gallery via its recipe presets (TMDB Trending Today/This Week, Trakt Trending); featured -> hero via the existing flag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add trending_discover persistent snapshot design Replace the in-process 1h trending cache with a background-refreshed, persisted snapshot for reliability under upstream failure and sync-run observability. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add trending_discover persistent snapshot implementation plan Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(sections): tidy trending_discover fetch and cache helpers Extract newTrendingEntry, reuse orderMediaItems, and collapse concurrent cache-miss loads with singleflight. Baseline for the persistent snapshot work. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(sections): add trending_discover_snapshots table * feat(sections): add trending snapshot model and repository * feat(sections): list enabled trending_discover section configs * feat(sections): add trending refresher with persisted snapshots * feat(tasks): add refresh_trending_discover task * refactor(sections): read trending_discover from persisted snapshot * feat: wire trending refresh task and snapshot reader * chore(sections): satisfy lint (wrap trakt errors, lift source/window constants) * fix(migrations): renumber trending_discover_snapshots 166 -> 167 The shared dev DB already recorded version 166 (166_trending_blend_collection_type from another branch), so the integer-version migration runner silently skipped our 166 and the table was never created — the trending section errored out empty. 167 is the next free version. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(sections): harden trending refresher per PR review - Interleave Trakt movies/shows by rank so the mixed row shows both types instead of burying all series past the display limit. - Treat any Trakt sub-fetch failure as fatal (errors.Join) so a partial result never overwrites the last-good snapshot with a media type missing. - Skip non-title entries (TMDB trending/all returns media_type "person") in both ID batching and ordering so they can't match an unrelated library title. - Guard the refresh task against a nil refresher. - Tests: person skip, Trakt interleave, Trakt partial-failure preserves last-good, snapshot read error propagation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(catalog): project air_timezone in episode catalog subquery episodeCatalogSelectBody is the derived "mi" relation that episode catalog hydration and preview read qualifiedListItemColumns("mi") from. The local episode airtimes feature (808f265f) added air_timezone to the shared column lists but not to this hand-written subquery, so the outer projection referenced mi.air_timezone, which the subquery never exposed. Postgres returns SQLSTATE 42703 (undefined_column), which is not one of the codes episodeCatalogEntriesUnavailable treats as "fast path unavailable" (it only catches 42P01/42883), so episode catalog requests failed with HTTP 500 instead of degrading. movie and series scopes query media_items directly, so the column is present there and only episode scope broke. Add si.air_timezone to the subquery, and add a regression test asserting that episodeCatalogSelectBody exposes every column qualifiedListItemColumns reads off mi, so future additions to the shared column lists cannot silently drift from the episode read model again. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(calendar): order events by viewer-local wall-clock time The local-airtime change re-sorted calendar events in Go using air_at, the absolute UTC instant, which is nil whenever air_timezone is unset. Since air_timezone is only inferred for a few networks/countries, most events fell through to the alphabetical title tiebreak while still displaying their raw air_time, so each day appeared scrambled. Sort each local day by the wall-clock time the viewer actually sees, mirroring the client: zoned events convert air_at into the viewer timezone, unzoned events use the raw air_time, and date-only entries (no air_time) sort last. The timezone reasoning lives in the new catalog.CalendarEventLocalTime helper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(calendar): add presets design spec and implementation plan Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): generalize personal filter to an id-set restriction Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): add per-profile followed/favorites/watchlist/watched resolvers Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): resolve presets to id-sets and overlay watched status Also drops the now-unused Filter/UserID/ProfileID fields from the blendUpcomingIntoDiscoverRows CalendarFilter literal in recommendations.go, which only wants an unrestricted windowed query. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): wire popular and trending sources into calendar handler Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): add watched field to CalendarEvent type Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): preset selector with responsive pills, persistence, empty-state nudge Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): dim and check-mark already-watched event cards Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(calendar): hide server-wide Popular preset in web UI for now Popular reflects server-wide watch counts, which are sparse on a low-traffic server. Hidden from the selector, URL allowlist, and empty-state nudge; backend filter and the CalendarFilter type are left intact so re-enabling is a one-line change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(calendar): simplify preset handler and reuse storage util - Extract hardcoded trending snapshot source/window to named constants. - Collapse the three identical personal-preset nil-checks into one case. - Persist the selected preset through the shared storage util (try/catch wrapped) instead of raw localStorage with manual SSR guards. - Derive KNOWN_FILTERS from PRESET_OPTIONS so the lists can't drift. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(jellycompat): add /Users endpoint and unified sa_ admin-key auth A user could not connect Tunarr to the Jellyfin-compat API. Tunarr's media-source health check probes both /Users/Me and /Users; for API-key connections (its recommended method) there is no "me", so it relies on GET /Users, which we did not implement. Adding it alone was insufficient: a Silo sa_ admin key only authorized two autoscan routes, so an API-key source would pass the ping but 401 on every browse/stream call. This adds GET /Users and unifies auth so an sa_ admin key authorizes the same browse/stream routes a session token does — matching Jellyfin, where an API key authorizes every endpoint: - GET /Users returns the caller's own user as a single-element list (current-profile-only; Silo is multi-account, so listing all users would leak across households). Behavior verified against real Jellyfin 10.11.8. - An sa_ admin key synthesizes a compat session bound to the account's primary profile, injected into request context so existing handlers work unchanged. Applied to the browse group (RequireSessionOrAPIKeySession) and the stream group (PlaybackSessionAuth); /Library/VirtualFolders keeps its admin-bool path. - The key + owning user are re-validated on every request (revocation is immediate); only the primary-profile lookup is cached. HLS follow-ups that carry only PlaySessionId resolve the negotiated session's sa_ CompatToken. Validated end-to-end on dev: connect -> list user -> libraries -> browse -> PlaybackInfo -> HLS stream, including PlaySessionId-only follow-ups. Security notes: an admin key acts as the primary (parent) profile, so it bypasses child-profile parental/PIN restrictions and can mutate the primary profile's watch state — acceptable for an admin-trust key. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Code <rxwatcher@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Silo Server Migration <noreply@silo-server.invalid> Co-authored-by: zZebrahz <zzebrahz@gmail.com> Co-authored-by: CoffeeKnyte <67730400+CoffeeKnyte@users.noreply.github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Silo Server Developer <warmasterx555@gmail.com>	2026-06-08 14:25:10 -04:00
d3v1l1989andGitHub	ecd85f9ca1	fix(jellycompat): enforce account-level library restrictions (#72) ... * fix(jellycompat): enforce account-level library restrictions The compat AccessFilterFn re-implemented a subset of the access policy and never loaded users.library_ids, so admin-assigned account library restrictions did not apply to the Jellyfin-compat API: restricted users could list, browse, search, and play items from every enabled library. Replace the hand-rolled closure with the shared access.Resolver via a new jellycompat.NewScopeAccessFilter adapter so account restrictions, profile restrictions, user-disabled libraries, and rating/quality ceilings apply exactly as on the native API. PIN verification is skipped because compat login already verifies profile PINs. Also: fail closed (empty allowlist) when scope resolution errors instead of returning an unrestricted filter; treat an empty allowlist as restricted-to-nothing in ListUserLibraries instead of unrestricted; and hide user-disabled libraries from the compat views list. * test(jellycompat): cover library list filtering via folder source stub Extract a folderListSource interface for the two FolderRepository methods directContentService uses (matching the existing browseSource/ itemAccessSource pattern) so ListUserLibraries is unit-testable, and add coverage for the restricted-allowlist path and the user-disabled library filtering in the views list.	2026-06-07 17:19:40 -04:00
d3v1l1989andGitHub	3353456d46	fix(jellycompat): aggregate series watch state from episode progress (#70) ... A series never has a user_watch_progress row of its own, so series items always rendered Played:false with no UnplayedItemCount — every show looked unwatched in compat clients' library views, and the IsPlayed browse filter treated all series as unplayed. Roll episode progress up to series rows in the browse/search/detail paths, mirroring applySeasonUserData and the native API's rollup semantics (WatchedCount/UnplayedCount/InProgressCount). Progress lookups are chunked at 500 ids (per-user stores may be SQLite-backed) and the rollup is capped at 250 series per page so max-limit browses of series-only libraries stay bounded.	2026-06-07 11:42:44 -04:00
d3v1l1989andGitHub	826f0d0b9a	fix(jellycompat): serve real MediaSources on Resume/NextUp pages (#69) ... Infuse and SenPlayer build Continue Watching rows from the listing's MediaSources and discard responses that carry only the detail-field stub, leaving the row empty. Keep the progress scan list-level (the per-entry GetItemDetail fanout removed in the error-report-2026-05-08 §6 fix stays removed), but re-map the returned page — bounded by the request limit, capped at 100 — through the detail path when the client requests detail-level Fields, matching HandleLatest's existing pattern. The stub remains as the fallback past the cap and is made honest: playability flags set, collections serialized empty instead of null.	2026-06-07 11:10:15 -04:00