* docs: design spec for pluginizing requests fulfillment Pluginize the requests fulfillment backend behind an agnostic request_router.v1 capability (high seam: whole-request fulfiller). Host keeps lifecycle/quota/policy/quality-governance and a generic two-tier connection registry; plugins own routing+submission+status. First plugin extracts multi-instance Sonarr/Radarr; Seerr follows in a separate spec. Preserves autoscan reuse of arr connection rows. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for requests pluginization Three-phase plan: (1) request_router.v1 SDK capability, (2) new silo-plugin-requests-arr plugin extracting multi-instance Sonarr/Radarr, (3) host refactor routing fulfillment through the plugin while keeping quality governance, target records, and autoscan connection reuse host-side. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(db): generalize request_integrations into a two-tier connection registry Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): add generic connection fields to Integration + repo mapping * feat(pluginhost): typed RequestRouter capability client + resolver Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): plugin-backed RequestRouterProvider seam Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): route fulfillment through RequestRouterProvider; host keeps quality governance Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): base auto-approve gate on router connection model Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(api): wire plugin-backed request router at both service sites Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(requests): remove in-host Sonarr/Radarr fulfillment code * test(autoscan): lock request-integration reuse after connection generalization Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): plugin-driven request integration config form Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(api): echo router connection fields in integration response * fix(requests): retry dropped qualities, contain to one router installation, dedupe targets Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): harden plugin trust boundary (validate targets, contain bad connections, media-type routing) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): tighten auto-approve gate, restore default/4k validation, propagate config-encode error, drop itoa wrapper, test status/options translation Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(requests): resolve integrations/settings/secrets once per reconcile cycle Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): dedupe config helpers, preserve zero profile id, stabilize installation default, drop redundant options write Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: design spec for schema-driven plugin config form Extends AdminFormDescriptor into a full form-description language (dynamic options, multi-select, conditional visibility, sections, validation) + a plugin Validate RPC, rendered by one reusable SchemaForm engine. Retires the bespoke arr connection form and integrationOptionsFromRouter so any request_router backend renders its config UI from manifest data with zero host changes. Addresses code-review finding #9. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for schema-driven plugin config form Six phases: SDK AdminFormDescriptor extensions + Validate RPC; reusable SchemaForm renderer (refactor PluginConfigForm onto it); host Validate plumbing + generic options + legacy-column derivation + retire integrationOptionsFromRouter; requests admin page swap to SchemaForm with per-plugin grouping; arr manifest enrichment + Validate impl; verification. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): extend plugin admin-form TS types (sections, conditions, validation, multi-select) * feat(web): schema-form pure utils (show_when, validation, value coercion) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): SchemaForm renderer (controls, sections, show_when, dynamic options, errors) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(web): render PluginConfigForm via the shared SchemaForm engine Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): RequestRouter Validate client + provider seam Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): plugin Validate on save, generic options, derive legacy columns from plugin_config Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(api): generic options response + 400 field_errors on plugin validation failure * feat(web): generic request-integration options type + surface validation field_errors Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): render request connections via SchemaForm; per-plugin grouping; retire bespoke arr form Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): silent connection-options probe with inline failure status (no toast spam) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): serialize admin_form sections/show_when/dynamic_options/validation to the client Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): drop show_when-hidden fields from buildSchemaValues payload Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): pass requester user id as int64 (no truncation) * refactor(requests): drop legacy arr columns; plugin_config is sole source of truth Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): backfill api key in plugin validate; centralize validation 400; drop duplicate host cross-field check; guard admin-form serializer Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): refuse stored api key reuse when base_url changes (security hardening) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): SchemaForm regex-guard, default_value, type-driven coercion, validity callback Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): connection-options latest-wins + narrowed deps + clear stale errors; auto-select; type-driven persist; reuse types Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: design spec for silo-plugin-requests-seerr (request_router.v1 backend) * docs: implementation plan for silo-plugin-requests-seerr * docs(spec): FindExistingRequest uses /api/v1/request (carries request id) * docs(spec): seerr hardening — id-recovery, 404 terminal, media-status, sort pin, single missing-tmdb message * docs: design spec for shared plugin-platform SDK helpers (code-review #10) * docs: plan for plugin-platform SDK helpers (#10) + spec fix (inline broker wiring, no import cycle) * docs: design spec for typed 4K quality-tier signal (code-review #9) * docs: implementation plan for typed 4K quality-tier signal (#9) * feat(requests): stamp is4k per quality (host owns the 4K-tier fact) * fix(requests): store capability sub-id, not the type, in request_integrations request_integrations.capability_id carried the capability TYPE ("request_router.v1") instead of the capability sub-id ("arr"/"seerr"). The host resolves a router plugin via requireCapability("request_router.v1", id), which keys on (type, id), so storing the type resolved to no capability: every save/options/fulfill 500'd ("Request operation failed" / "no fulfillment backend configured") in ~1ms, before the arr/Seerr API was ever contacted. The path was internally split-brained (the fulfillment filter matched the type while the dispatcher needed the sub-id), so it never worked end-to-end; the unit tests hid it behind a fake provider that skips requireCapability. Align capability_id with the scan_source/metadata convention (sub-id): - validateInstance: require a non-empty sub-id; drop the default-to-type and the "!= request_router.v1" reject. - resolveRouterConnections / integrationConfigured / unbound-guidance: match on a non-empty capability, not type equality. - repository: persist capability_id verbatim (never default to the type). - web AdminRequests: send the selected plugin's capability.id in both the options probe and the save payload (was a hardcoded type constant). - migration 20260608131649: backfill capability_id from each bound installation's request_router.v1 capability and drop the column's misleading default. Unbound legacy rows are left for admin re-save. Tests: validateInstance now requires the sub-id, and the selected sub-id must reach the plugin Validate RPC (fakeRouterProvider records it). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): polish request connection cards (grouped toggles + option loading states) The schema-driven connection cards rendered each boolean as its own bordered, double-labeled box and showed dynamic SELECTs (root folder, quality profile, tags) as empty controls with a single "Loading options…" line while the host probed the service. - Toggles render as a cohesive settings list: consecutive switches collapse into one bordered, divided container; each row is toggle-first with the label + description hugging beside it (no stranded whitespace between a short label and its switch). Honors show_when, so conditional toggles still group correctly. - Dynamic SELECT/MULTI_SELECT fields show a per-field spinner + shimmer skeleton while options load, and only when there's nothing to show yet — a background re-probe never flashes over the operator's current value. - Sections get a softer surface and clearer titles; the card's enable switch is labeled Enabled/Disabled; the options-load failure is a proper inline alert with retry guidance. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): treat "Any"/no-cap playback ceiling as 4K-allowed allowedQualities decided whether to also request 2160p with `CompareQuality(ceiling, PlaybackQuality4K) >= 0`. But an "Any" max playback quality resolves to an empty ceiling ("no cap"), and in qualityRank "" is the LOWEST rank (0) — so CompareQuality("", "2160p") returns -1 and 4K was dropped. A requester with unlimited playback quality only got a 1080p request, never the 4K one. Use access.QualityAllowed(PlaybackQuality4K, ceiling), which already encodes "empty ceiling == no cap == allows everything". Now: - "" / "Any" -> 1080p + 2160p - "2160p" -> 1080p + 2160p - "1080p" -> 1080p only - resolver error still fails safe to the HD ceiling. Tests: add an "any/no-cap ceiling adds 2160p" case; the unknown-quality, status-coercion, dedup, and per-quality-idempotency submit tests now pin an explicit HD ceiling (they relied on the old empty-default == HD-only behavior and were not about 4K entitlement). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: design spec for collapsible Library + anime gate/nesting (request card UI, Spec A) Spec A of two for the request connection card UX: Library section becomes collapsible/collapsed (auto-expanding on validation errors) and the anime override fields move into a single gated section below Library instead of popping out as a detached sibling card. Single-default enforcement is Spec B. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for collapsible Library + anime gate/nesting (Spec A) Task-by-task TDD plan: SchemaForm auto-expand-on-error + nested-field affordance (silo-server), arr manifest regroup (collapsible Library, anime gate section), then build/deploy/reinstall + manual verify. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): auto-expand collapsible schema sections that have validation errors SchemaFormSection now accepts a forceOpen prop; when any field in the section has a mergedError (client validation or server error), the section expands automatically so required-field setup can never be hidden behind a collapsed accordion. The operator's manual toggle is preserved via a nullable userOpen state that only takes effect when forceOpen is false. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): indent show_when-revealed schema fields to read as nested Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: design spec for schema-driven single-default exclusivity enforcement (Spec B) At most one connection per service_kind may be the HD default (is_default) or 4K default (is_default_4k). Generic exclusivity: a new AdminFormField exclusive_group_field declares the rule, the plugin Validate enforces it against host-supplied siblings (config only, no creds), and the admin UI auto-clears conflicts as you toggle. Host stays plugin-agnostic. Forward-only; no migration. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for single-default exclusivity enforcement (Spec B) Five TDD tasks across 3 repos: SDK proto (siblings + exclusive_group_field) + buf regen; arr Validate cross-sibling + manifest; host gathers siblings (config-only) into Validate; frontend generic mutual-exclusion helper; then re-vendor/rebuild/redeploy + plugininstall. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(requests): pass sibling connections to plugin Validate for cross-connection rules Adds siblings []ResolvedRouterConnection to RequestRouterProvider.Validate so the plugin can enforce cross-connection invariants (e.g. one default per service_kind) without the host resolving sibling credentials. The new siblingConnections helper gathers other connections on the same installation, carrying only ID + PluginConfig. Vendor updated to the Task 1 SDK version that carries ValidateRequest.Siblings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(web): auto-clear mutually-exclusive defaults across request connection cards Adds generic applyExclusivity helper and wires it into updateCardConfig so turning on a field with exclusive_group_field proactively clears the same field on sibling cards sharing the same group value, matching server-side enforcement with a proactive UX. * docs: design spec for single-flighting plugin client launch (cold-start herd fix) Concurrent ensureClient calls for a cold installation each spawn a redundant plugin process (Host.Start releases its lock during launch). Wrap ensureClient in a per-installation singleflight.Group so concurrent first-use collapses to one launch. Host-only fix; surfaced while testing the request-router feature. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for single-flighting plugin client launch TDD: concurrency tests (herd collapses to one launch, warm-cache reuse, distinct installations stay parallel, failed launch propagates) + the singleflight wrapper around ensureClient; then rebuild/redeploy + verify. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): single-flight ensureClient to prevent cold-start launch herd Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(requests): harden capability containment + dedupe eligibility; UI/migration cleanups Addresses /code-review high findings on the previously-unreviewed commits: - resolveRouterConnections contains fulfillment to the first chosen (installation, capability) and locks only after a connection's key resolves, so a plugin exposing >1 request_router capability never mixes connections and a skipped bad-key connection never pins the capability (+ test). - extract eligibleRouterConnection, shared by resolveRouterConnections and integrationConfigured so the auto-approval gate and fulfillment filter can't drift. - SchemaForm: shared FieldDescription helper (field/switch/section); key switch groups by position so a show_when reveal doesn't remount the group (focus loss). - migration backfill uses a deterministic correlated subquery instead of a join cross-product when an installation exposes multiple request_router capabilities. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: design spec for opt-in Seerr per-user requester mapping Per-connection requester_mode (admin default | mapped). In mapped mode the host pushes the requester email/username into the Fulfill descriptor and the seerr plugin resolves/creates the matching Seerr user by email with operator-chosen default permissions, attributing the request (and gating Seerr-side approval via the auto-approve permission). Spans SDK (descriptor fields), host (extend UserIdentityLookup with email + a requester resolver), and the seerr plugin (Seerr user API + mapping). Fallback to admin on any failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: implementation plan for Seerr per-user requester mapping Five TDD tasks across 3 repos: SDK descriptor fields (requester_email/username); host resolves identity (UserIdentityLookup+email, RequesterIdentityResolver, populate descriptor at both Fulfill sites); seerr config+user API (find/create by email, exported PermissionBits); seerr Fulfill mapping + admin_form; then re-vendor/rebuild/redeploy + plugininstall (installation 6). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: make Seerr unmapped-requester behavior a toggle (admin fallback | fail request) Per user feedback: require_mapped_user switch (default off = admin fallback, on = fail the request). Updates spec + plan Tasks 3/4 (config field, Fulfill honoring the toggle via a mapFailed signal, a new test, and the manifest switch). * feat(requests): resolve requester email/username into the Fulfill descriptor Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: design spec for simplified Seerr mapped-user permissions Reduce the 5 permission toggles to two (request_4k_all + auto_approve); 1080p always granted; remove manage_requests; 4K eligibility per-user from the request's qualities (host-decided, same as arr) with a blanket override toggle. Seerr-plugin-only; permission-only override (host still gates 4K requests). * docs: implementation plan for simplified Seerr mapped-user permissions Two tasks (seerr-plugin-only): replace the 5 perm toggles with request_4k_all + auto_approve (1080p always; 4K from request qualities via userPermissions; remove PermManageRequests/PermissionBits; manifest + json_schema), then rebuild + reinstall (installation 6). No host/SDK change. * docs: design spec for host rebase onto main + #95 credential-model adoption Per-commit rebase of our 68 request-router commits onto the force-pushed origin/main (drops 188 patch-equivalent). At the credential-path conflicts, adopt #95's inline secret.Cipher model: keep our plugin columns + #95's encrypt/decrypt in repository.go; drop our SecretResolver and read in.APIKeyRef directly in service.go; wire NewRepository(pool, dataCipher). #39-area conflicts take ours (our pluginization supersedes it). Security review + SECRET_KEY deploy note. * docs: implementation plan for host rebase + #95 credential adoption Four tasks: (1) guided per-commit rebase onto origin/main, take-ours on credential files so it builds; (2) TDD integration commit adopting #95's secret.Cipher (encrypt/decrypt in repository.go, drop SecretResolver, read APIKeyRef directly, wire NewRepository(pool, cipher)); (3) security review; (4) pin published SDK v0.6.0, push fork, open host PR with SECRET_KEY deploy note. * chore(rebase): restore scan-source service methods + temp requests-repo arity Post-rebase conflict fixups: take-ours on internal/plugins/service.go dropped origin's ScanSourceClientByPluginID (independent upstream capability) — restored. mediarequests.NewRepository temporarily 1-arg to match our pre-#95 repo; Task 2 restores the cipher arg when adopting #95's at-rest credential model. * feat(requests): adopt at-rest credential cipher (#95) for plugin api keys; drop SecretResolver * build: pin published silo-plugin-sdk v0.6.0 (drop local replace) * test(requests): guard at-rest cipher round-trip + empty-key auto-approval (code-review) Max-effort code review of the #95 credential integration. Fixes the actionable findings: - TestEncryptAPIKeyRoundTripAndAAD: pins encryptAPIKey<->DecryptIfEncrypted inversion, the id-bound apiKeyAAD == secret.RowAAD(...) match (so #95's backfill rows decrypt), the blank-key "" sentinel, and row-bound AAD — the security- critical invariants had no automated guard (no DB harness for scanIntegration). - TestCreateRequestAutoApprovalEmptyKeyTreatedAsUnconfigured: pins that a keyless connection reads as unconfigured (request stays pending, never submitted), so integrationConfigured and resolveRouterConnections can't drift. - Fix stale fulfillContext comment (referenced a resolved-API-key cache removed with SecretResolver). Assessed-not-changed (documented): decrypt-error-fails-closed and failed-backfill behaviors are origin/main #95 design we adopt; nil-cipher is unreachable in prod and matches the codebase-wide no-guard pattern. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * build: drop stale machine-local SDK replace comment from go.mod The replace directive was already removed when v0.6.0 was pinned (3410df7); this leftover comment falsely claimed a local replace still existed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(web): prettier-format schema-form utils to 100-col width Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: drop internal superpowers specs/plans from PR These design specs and implementation plans are internal development artifacts; keep them out of the upstream PR diff. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(metadata): exclude providers from content levels they don't declare ResolveChain falls back to every enabled metadata provider when a library + content-level has no enabled chain entry. That fallback was media-type blind: a provider declaring default_priority only for an unrelated level (e.g. an audiobook provider declaring {"audiobook": N}) was kept in the list (merely sorted last) and invoked for video content levels. In production this made silo.audiobook-metadata hammer external audiobook APIs with anime/movie/series titles every scheduled enrichment pass (MatchWorker, 30s) for the season/episode levels that had no enabled chain entry. Disabling the chain entries did not help because the fallback never consults them; only disabling the installation removed it from the global set. Treat a non-empty default_priority map as the provider enumerating the content levels it supports: in resolveEnabledProvidersByPriority, exclude providers whose declared map omits the requested level instead of ranking them last. Providers that declare no default_priority make no claim and stay eligible everywhere (legacy behavior). Fixes #105 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(plugins): isolate singleflight launch from leader ctx cancellation The deduped ensureClient launch ran doEnsureClient under the leader caller's ctx, so if that caller's request was canceled/timed out mid-launch the shared plugin start was torn down and the error propagated to every waiter. Run the launch under context.WithoutCancel so a single caller cannot cancel work the other waiters depend on (values preserved for tracing/auth). (CodeRabbit) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): nil-guard request-router wiring RequestRouterClient dereferenced a.Svc unconditionally and AttachRequestRouter called SetRouterProvider even with nil deps, so a build without the plugin service would panic instead of degrading. Guard both: the adapter returns a controlled error and AttachRequestRouter no-ops, leaving fulfillment to fail with the existing "no backend configured" path. (CodeRabbit) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): correct value coercion + track capability sub-id in request form - schemaForm: Boolean("false") was true; parse string booleans explicitly. array:num now coerces decimals ("1.5"), array:int stays integer-only. - AdminRequests: track capability_id alongside installation_id (composite <Select> value) so a multi-capability installation resolves the exact backend; reset pluginConfig when the selected plugin changes so plugin A's keys never reach plugin B's options probe/save. (CodeRabbit) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(requests): address request-router review findings * fix(requests): handle router review edge cases * fix(web): resolve schema form build casing * fix(requests): skip unconfigured 4k fulfillment targets --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com>
518 lines
17 KiB
Go
518 lines
17 KiB
Go
package metadata
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"log/slog"
|
|
"sort"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
// ChainEntry represents a single entry in a library's provider chain.
|
|
type ChainEntry struct {
|
|
PluginInstallationID int
|
|
CapabilityID string
|
|
CapabilityType string // always "metadata_provider.v1" for now
|
|
ContentLevel string // "movie", "series", "season", "episode", or "" (legacy)
|
|
Priority int
|
|
Enabled bool
|
|
}
|
|
|
|
// ChainRepository provides operations for the library_provider_chains table.
|
|
type ChainRepository struct {
|
|
pool *pgxpool.Pool
|
|
}
|
|
|
|
// NewChainRepository creates a new ChainRepository.
|
|
func NewChainRepository(pool *pgxpool.Pool) *ChainRepository {
|
|
return &ChainRepository{pool: pool}
|
|
}
|
|
|
|
// Pool returns the underlying connection pool.
|
|
func (r *ChainRepository) Pool() *pgxpool.Pool {
|
|
return r.pool
|
|
}
|
|
|
|
// SetChain replaces the entire provider chain for a given media folder.
|
|
func (r *ChainRepository) SetChain(ctx context.Context, folderID int, entries []ChainEntry) error {
|
|
tx, err := r.pool.BeginTx(ctx, pgx.TxOptions{})
|
|
if err != nil {
|
|
return fmt.Errorf("beginning chain transaction: %w", err)
|
|
}
|
|
defer func() { _ = tx.Rollback(ctx) }()
|
|
|
|
_, err = tx.Exec(ctx, "DELETE FROM library_provider_chains WHERE media_folder_id = $1", folderID)
|
|
if err != nil {
|
|
return fmt.Errorf("deleting existing chain: %w", err)
|
|
}
|
|
|
|
for _, entry := range entries {
|
|
capType := entry.CapabilityType
|
|
if capType == "" {
|
|
capType = "metadata_provider.v1"
|
|
}
|
|
_, err = tx.Exec(ctx,
|
|
`INSERT INTO library_provider_chains (media_folder_id, plugin_installation_id, capability_id, capability_type, content_level, priority, enabled)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)`,
|
|
folderID, entry.PluginInstallationID, entry.CapabilityID, capType, entry.ContentLevel, entry.Priority, entry.Enabled,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("inserting chain entry (install=%d, cap=%s, level=%s, priority=%d): %w",
|
|
entry.PluginInstallationID, entry.CapabilityID, entry.ContentLevel, entry.Priority, err)
|
|
}
|
|
}
|
|
|
|
if err := tx.Commit(ctx); err != nil {
|
|
return fmt.Errorf("committing chain transaction: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GetChain returns entries for a specific content level. If no per-level entries
|
|
// exist, falls back to legacy flat entries (content_level = ”).
|
|
func (r *ChainRepository) GetChain(ctx context.Context, folderID int, contentLevel string) ([]ChainEntry, error) {
|
|
rows, err := r.pool.Query(ctx,
|
|
`SELECT plugin_installation_id, capability_id, capability_type, content_level, priority, enabled
|
|
FROM library_provider_chains
|
|
WHERE media_folder_id = $1 AND content_level = $2
|
|
ORDER BY priority ASC`,
|
|
folderID, contentLevel,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("querying chain: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var entries []ChainEntry
|
|
for rows.Next() {
|
|
var e ChainEntry
|
|
if err := rows.Scan(&e.PluginInstallationID, &e.CapabilityID, &e.CapabilityType, &e.ContentLevel, &e.Priority, &e.Enabled); err != nil {
|
|
return nil, fmt.Errorf("scanning chain entry: %w", err)
|
|
}
|
|
entries = append(entries, e)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("iterating chain rows: %w", err)
|
|
}
|
|
|
|
// Fall back to legacy flat chain if no per-level entries exist.
|
|
if len(entries) == 0 && contentLevel != "" {
|
|
return r.GetChain(ctx, folderID, "")
|
|
}
|
|
|
|
if entries == nil {
|
|
entries = []ChainEntry{}
|
|
}
|
|
return entries, nil
|
|
}
|
|
|
|
// GetAllChainEntries returns every chain entry for a folder, across all content levels.
|
|
func (r *ChainRepository) GetAllChainEntries(ctx context.Context, folderID int) ([]ChainEntry, error) {
|
|
rows, err := r.pool.Query(ctx,
|
|
`SELECT plugin_installation_id, capability_id, capability_type, content_level, priority, enabled
|
|
FROM library_provider_chains
|
|
WHERE media_folder_id = $1
|
|
ORDER BY content_level, priority ASC`,
|
|
folderID,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("querying all chain entries: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var entries []ChainEntry
|
|
for rows.Next() {
|
|
var e ChainEntry
|
|
if err := rows.Scan(&e.PluginInstallationID, &e.CapabilityID, &e.CapabilityType, &e.ContentLevel, &e.Priority, &e.Enabled); err != nil {
|
|
return nil, fmt.Errorf("scanning chain entry: %w", err)
|
|
}
|
|
entries = append(entries, e)
|
|
}
|
|
return entries, rows.Err()
|
|
}
|
|
|
|
// DeleteChain removes all provider chain entries for a given media folder.
|
|
func (r *ChainRepository) DeleteChain(ctx context.Context, folderID int) error {
|
|
_, err := r.pool.Exec(ctx, "DELETE FROM library_provider_chains WHERE media_folder_id = $1", folderID)
|
|
if err != nil {
|
|
return fmt.Errorf("deleting chain: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// AppendProviderToAllChains adds a provider to every existing library chain
|
|
// (per content level) that doesn't already include it. The defaultPriority
|
|
// callback returns the plugin's declared priority for a content level (0 means
|
|
// the plugin doesn't declare that level — the entry is still added but disabled).
|
|
func (r *ChainRepository) AppendProviderToAllChains(
|
|
ctx context.Context,
|
|
pluginInstallationID int,
|
|
capabilityID string,
|
|
defaultPriority func(contentLevel string) int,
|
|
) error {
|
|
// Find every distinct (folder, level) pair that has chain entries.
|
|
rows, err := r.pool.Query(ctx,
|
|
`SELECT DISTINCT media_folder_id, content_level
|
|
FROM library_provider_chains`)
|
|
if err != nil {
|
|
return fmt.Errorf("listing chain groups: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
type chainGroup struct {
|
|
folderID int
|
|
contentLevel string
|
|
}
|
|
var groups []chainGroup
|
|
for rows.Next() {
|
|
var g chainGroup
|
|
if err := rows.Scan(&g.folderID, &g.contentLevel); err != nil {
|
|
return fmt.Errorf("scanning chain group: %w", err)
|
|
}
|
|
groups = append(groups, g)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return fmt.Errorf("iterating chain groups: %w", err)
|
|
}
|
|
|
|
for _, g := range groups {
|
|
// Check if the provider is already in this chain.
|
|
var exists bool
|
|
err := r.pool.QueryRow(ctx,
|
|
`SELECT EXISTS(
|
|
SELECT 1 FROM library_provider_chains
|
|
WHERE media_folder_id = $1 AND content_level = $2
|
|
AND plugin_installation_id = $3 AND capability_id = $4
|
|
)`, g.folderID, g.contentLevel, pluginInstallationID, capabilityID,
|
|
).Scan(&exists)
|
|
if err != nil {
|
|
return fmt.Errorf("checking chain membership: %w", err)
|
|
}
|
|
if exists {
|
|
continue
|
|
}
|
|
|
|
// Determine priority position (append after the last entry).
|
|
var maxPriority int
|
|
err = r.pool.QueryRow(ctx,
|
|
`SELECT COALESCE(MAX(priority), -1)
|
|
FROM library_provider_chains
|
|
WHERE media_folder_id = $1 AND content_level = $2`,
|
|
g.folderID, g.contentLevel,
|
|
).Scan(&maxPriority)
|
|
if err != nil {
|
|
return fmt.Errorf("getting max priority: %w", err)
|
|
}
|
|
|
|
dp := defaultPriority(g.contentLevel)
|
|
enabled := dp > 0
|
|
|
|
_, err = r.pool.Exec(ctx,
|
|
`INSERT INTO library_provider_chains (media_folder_id, plugin_installation_id, capability_id, capability_type, content_level, priority, enabled)
|
|
VALUES ($1, $2, $3, 'metadata_provider.v1', $4, $5, $6)
|
|
ON CONFLICT DO NOTHING`,
|
|
g.folderID, pluginInstallationID, capabilityID, g.contentLevel, maxPriority+1, enabled,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("appending provider (install=%d, cap=%s) to folder %d level %q: %w",
|
|
pluginInstallationID, capabilityID, g.folderID, g.contentLevel, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ResolveChain builds the ordered list of Provider implementations for a given
|
|
// media folder and content level. If the folder has custom chain entries, those
|
|
// are used. Otherwise all enabled metadata provider capabilities are used,
|
|
// ordered by their plugin manifest default_priority for the given content level.
|
|
//
|
|
// Providers whose underlying plugin installation is disabled are silently skipped.
|
|
func ResolveChain(
|
|
ctx context.Context,
|
|
folderID int,
|
|
contentLevel string,
|
|
chainRepo *ChainRepository,
|
|
resolver pluginMetadataResolver,
|
|
) ([]Provider, error) {
|
|
chainEntries, err := chainRepo.GetChain(ctx, folderID, contentLevel)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("getting chain for folder %d: %w", folderID, err)
|
|
}
|
|
|
|
// Filter to only enabled entries.
|
|
var enabledEntries []ChainEntry
|
|
for _, e := range chainEntries {
|
|
if e.Enabled {
|
|
enabledEntries = append(enabledEntries, e)
|
|
}
|
|
}
|
|
chainEntries = enabledEntries
|
|
|
|
if len(chainEntries) > 0 {
|
|
return resolveChainEntries(ctx, chainEntries, resolver, chainRepo.pool), nil
|
|
}
|
|
|
|
providers, err := resolveEnabledProvidersByPriority(ctx, contentLevel, resolver, chainRepo.pool)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return providers, nil
|
|
}
|
|
|
|
// CapabilityInfo holds the fields needed to construct a provider from plugin tables.
|
|
type CapabilityInfo struct {
|
|
PluginInstallationID int
|
|
CapabilityID string
|
|
DisplayName string
|
|
}
|
|
|
|
// resolveEnabledProviders returns all enabled providers in installation ID order.
|
|
// Used by callers that don't have a content-level context (e.g. person refresh).
|
|
func resolveEnabledProviders(
|
|
ctx context.Context,
|
|
resolver pluginMetadataResolver,
|
|
pool *pgxpool.Pool,
|
|
) ([]Provider, error) {
|
|
caps, err := ListEnabledMetadataCapabilities(ctx, pool)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return buildProviders(ctx, caps, resolver, pool), nil
|
|
}
|
|
|
|
// resolveEnabledProvidersByPriority returns all enabled providers sorted by
|
|
// their plugin manifest default_priority for the given content level. Providers
|
|
// without a declared priority are placed last (sorted by installation ID as a tiebreaker).
|
|
func resolveEnabledProvidersByPriority(
|
|
ctx context.Context,
|
|
contentLevel string,
|
|
resolver pluginMetadataResolver,
|
|
pool *pgxpool.Pool,
|
|
) ([]Provider, error) {
|
|
caps, err := ListEnabledMetadataCapabilities(ctx, pool)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
type ranked struct {
|
|
cap CapabilityInfo
|
|
priority int
|
|
}
|
|
|
|
// Only providers that support contentLevel participate in the chain-less
|
|
// fallback. A provider declaring a non-empty default_priority map that omits
|
|
// this level is excluded outright (not merely ranked last), so a
|
|
// single-purpose provider is never invoked for content it does not handle.
|
|
items := make([]ranked, 0, len(caps))
|
|
for _, c := range caps {
|
|
metadataJSON := lookupCapabilityMetadata(ctx, pool, c.PluginInstallationID, c.CapabilityID)
|
|
if !providerSupportsLevel(metadataJSON, contentLevel) {
|
|
slog.Debug("skipping metadata provider: does not declare support for content level",
|
|
"installation_id", c.PluginInstallationID,
|
|
"capability_id", c.CapabilityID,
|
|
"content_level", contentLevel)
|
|
continue
|
|
}
|
|
items = append(items, ranked{cap: c, priority: extractDefaultPriority(metadataJSON, contentLevel)})
|
|
}
|
|
|
|
sort.SliceStable(items, func(i, j int) bool {
|
|
pi, pj := items[i].priority, items[j].priority
|
|
if (pi == 0) != (pj == 0) {
|
|
return pi != 0
|
|
}
|
|
if pi != pj {
|
|
return pi < pj
|
|
}
|
|
return items[i].cap.PluginInstallationID < items[j].cap.PluginInstallationID
|
|
})
|
|
|
|
sorted := make([]CapabilityInfo, len(items))
|
|
for i, item := range items {
|
|
sorted[i] = item.cap
|
|
}
|
|
return buildProviders(ctx, sorted, resolver, pool), nil
|
|
}
|
|
|
|
// providerSupportsLevel reports whether a metadata provider should participate
|
|
// in the chain-less global fallback for contentLevel. A provider that declares
|
|
// a non-empty default_priority map is treated as enumerating the content levels
|
|
// it supports: it is eligible only for levels present in that map with a
|
|
// positive priority. A provider that declares no default_priority makes no
|
|
// claim and stays eligible for every level (legacy behavior), ranked last.
|
|
//
|
|
// This is what keeps a single-purpose provider (e.g. an audiobook metadata
|
|
// provider declaring only {"audiobook": N}) from being pulled into video
|
|
// content levels when a library has no enabled chain entry for that level.
|
|
func providerSupportsLevel(metadataJSON []byte, contentLevel string) bool {
|
|
levels, declared := declaredPriorityLevels(metadataJSON)
|
|
if !declared {
|
|
return true
|
|
}
|
|
return levels[contentLevel] > 0
|
|
}
|
|
|
|
// lookupCapabilityMetadata returns the raw plugin_capabilities.metadata JSON for
|
|
// a provider's exact metadata_provider.v1 capability, or nil if absent.
|
|
func lookupCapabilityMetadata(ctx context.Context, pool *pgxpool.Pool, pluginInstallationID int, capabilityID string) []byte {
|
|
var metadataJSON []byte
|
|
err := pool.QueryRow(ctx,
|
|
`SELECT metadata FROM plugin_capabilities
|
|
WHERE plugin_installation_id = $1
|
|
AND capability_id = $2
|
|
AND capability_type = 'metadata_provider.v1'`,
|
|
pluginInstallationID,
|
|
capabilityID,
|
|
).Scan(&metadataJSON)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
return metadataJSON
|
|
}
|
|
|
|
// LookupDefaultPriority queries plugin_capabilities for a provider's declared
|
|
// default_priority at the given content level. Returns 0 if not found.
|
|
func LookupDefaultPriority(ctx context.Context, pool *pgxpool.Pool, pluginInstallationID int, capabilityID, contentLevel string) int {
|
|
return extractDefaultPriority(lookupCapabilityMetadata(ctx, pool, pluginInstallationID, capabilityID), contentLevel)
|
|
}
|
|
|
|
// extractDefaultPriority parses the default_priority for a content level from
|
|
// capability metadata JSON.
|
|
func extractDefaultPriority(metadataJSON []byte, contentLevel string) int {
|
|
levels, _ := declaredPriorityLevels(metadataJSON)
|
|
if v, ok := levels[contentLevel]; ok && v > 0 {
|
|
return int(v)
|
|
}
|
|
return 0
|
|
}
|
|
|
|
// declaredPriorityLevels parses a capability's default_priority map. The map may
|
|
// sit at the top level or inside a "metadata" envelope (plugin capability
|
|
// metadata wraps plugin-declared fields in a "metadata" sub-object). The second
|
|
// return value is true only when a non-empty map was found, i.e. the provider
|
|
// explicitly enumerates the content levels it supports.
|
|
func declaredPriorityLevels(metadataJSON []byte) (map[string]float64, bool) {
|
|
var meta map[string]json.RawMessage
|
|
if err := json.Unmarshal(metadataJSON, &meta); err != nil {
|
|
return nil, false
|
|
}
|
|
dpRaw, ok := meta["default_priority"]
|
|
if !ok {
|
|
if innerRaw, innerOK := meta["metadata"]; innerOK {
|
|
var inner map[string]json.RawMessage
|
|
if err := json.Unmarshal(innerRaw, &inner); err == nil {
|
|
dpRaw, ok = inner["default_priority"]
|
|
}
|
|
}
|
|
}
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
var dpMap map[string]float64
|
|
if err := json.Unmarshal(dpRaw, &dpMap); err != nil {
|
|
return nil, false
|
|
}
|
|
return dpMap, len(dpMap) > 0
|
|
}
|
|
|
|
// ListEnabledMetadataCapabilities returns all metadata_provider.v1 capabilities
|
|
// whose plugin installation is enabled.
|
|
func ListEnabledMetadataCapabilities(ctx context.Context, pool *pgxpool.Pool) ([]CapabilityInfo, error) {
|
|
rows, err := pool.Query(ctx,
|
|
`SELECT pc.plugin_installation_id, pc.capability_id,
|
|
COALESCE(pc.metadata->>'display_name', pc.capability_id)
|
|
FROM plugin_capabilities pc
|
|
JOIN plugin_installations pi ON pi.id = pc.plugin_installation_id
|
|
WHERE pc.capability_type = 'metadata_provider.v1'
|
|
AND pi.enabled = true
|
|
ORDER BY pc.plugin_installation_id`)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("listing enabled metadata capabilities: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var caps []CapabilityInfo
|
|
for rows.Next() {
|
|
var c CapabilityInfo
|
|
if err := rows.Scan(&c.PluginInstallationID, &c.CapabilityID, &c.DisplayName); err != nil {
|
|
return nil, fmt.Errorf("scanning capability: %w", err)
|
|
}
|
|
caps = append(caps, c)
|
|
}
|
|
return caps, rows.Err()
|
|
}
|
|
|
|
// resolveChainEntries builds Provider instances from explicit chain entries,
|
|
// skipping providers whose plugin installation is disabled.
|
|
func resolveChainEntries(
|
|
ctx context.Context,
|
|
entries []ChainEntry,
|
|
resolver pluginMetadataResolver,
|
|
pool *pgxpool.Pool,
|
|
) []Provider {
|
|
caps := make([]CapabilityInfo, 0, len(entries))
|
|
for _, e := range entries {
|
|
displayName := lookupCapabilityDisplayName(ctx, pool, e.PluginInstallationID, e.CapabilityID)
|
|
caps = append(caps, CapabilityInfo{
|
|
PluginInstallationID: e.PluginInstallationID,
|
|
CapabilityID: e.CapabilityID,
|
|
DisplayName: displayName,
|
|
})
|
|
}
|
|
return buildProviders(ctx, caps, resolver, pool)
|
|
}
|
|
|
|
// buildProviders constructs Provider instances from capability info, skipping
|
|
// providers whose plugin installation is disabled.
|
|
func buildProviders(
|
|
ctx context.Context,
|
|
caps []CapabilityInfo,
|
|
resolver pluginMetadataResolver,
|
|
pool *pgxpool.Pool,
|
|
) []Provider {
|
|
providers := make([]Provider, 0, len(caps))
|
|
for _, c := range caps {
|
|
var enabled bool
|
|
err := pool.QueryRow(ctx,
|
|
"SELECT enabled FROM plugin_installations WHERE id = $1",
|
|
c.PluginInstallationID,
|
|
).Scan(&enabled)
|
|
if err != nil || !enabled {
|
|
slog.Debug("skipping metadata provider: plugin installation disabled",
|
|
"installation_id", c.PluginInstallationID, "capability_id", c.CapabilityID)
|
|
continue
|
|
}
|
|
|
|
provider, err := NewPluginProviderFromCapability(c.PluginInstallationID, c.CapabilityID, c.DisplayName, resolver)
|
|
if err != nil {
|
|
slog.Warn("skipping metadata provider during chain resolution",
|
|
"installation_id", c.PluginInstallationID,
|
|
"capability_id", c.CapabilityID,
|
|
"error", err,
|
|
)
|
|
continue
|
|
}
|
|
providers = append(providers, provider)
|
|
}
|
|
return providers
|
|
}
|
|
|
|
// lookupCapabilityDisplayName retrieves the display name from plugin capability metadata.
|
|
func lookupCapabilityDisplayName(ctx context.Context, pool *pgxpool.Pool, installationID int, capabilityID string) string {
|
|
var displayName string
|
|
err := pool.QueryRow(ctx,
|
|
`SELECT COALESCE(metadata->>'display_name', $2)
|
|
FROM plugin_capabilities
|
|
WHERE plugin_installation_id = $1 AND capability_id = $2 AND capability_type = 'metadata_provider.v1'`,
|
|
installationID, capabilityID,
|
|
).Scan(&displayName)
|
|
if err != nil {
|
|
return capabilityID
|
|
}
|
|
return displayName
|
|
}
|