priority_high
@@ -121,12 +121,12 @@
-
+
- {{ displayTitle }}
{{ displaySubtitle }}
{{ displayLineTwo || ' ' }}
@@ -788,11 +788,11 @@ export default { }, showEditModalFiles() { // More menu func - this.$emit('edit', this.libraryItem, 'files') + this.store.commit('showEditModalOnTab', { libraryItem: this.libraryItem, tab: 'files' }) }, showEditModalMatch() { // More menu func - this.$emit('edit', this.libraryItem, 'match') + this.store.commit('showEditModalOnTab', { libraryItem: this.libraryItem, tab: 'match' }) }, sendToDevice(deviceName) { // More menu func diff --git a/client/components/controls/LibraryFilterSelect.vue b/client/components/controls/LibraryFilterSelect.vue index 4834a1a25..62a9b8037 100644 --- a/client/components/controls/LibraryFilterSelect.vue +++ b/client/components/controls/LibraryFilterSelect.vue @@ -338,18 +338,6 @@ export default { const series = this.series.find((se) => se.id == decoded) if (series) filterValue = series.name } - } else if (parts[0] === 'progress') { - const item = this.progress.find((p) => p.id == decoded) - if (item) filterValue = item.name - } else if (parts[0] === 'tracks') { - const item = this.tracks.find((t) => t.id == decoded) - if (item) filterValue = item.name - } else if (parts[0] === 'ebooks') { - const item = this.ebooks.find((e) => e.id == decoded) - if (item) filterValue = item.name - } else if (parts[0] === 'missing') { - const item = this.missing.find((m) => m.id == decoded) - if (item) filterValue = item.name } else { filterValue = decoded } diff --git a/client/components/modals/BatchQuickMatchModel.vue b/client/components/modals/BatchQuickMatchModel.vue index f6bcd9728..8bea68faf 100644 --- a/client/components/modals/BatchQuickMatchModel.vue +++ b/client/components/modals/BatchQuickMatchModel.vue @@ -88,7 +88,7 @@ export default { }, providers() { if (this.isPodcast) return this.$store.state.scanners.podcastProviders - return this.$store.state.scanners.bookProviders + return this.$store.state.scanners.providers }, libraryProvider() { return this.$store.getters['libraries/getLibraryProvider'](this.currentLibraryId) || 'google' @@ -96,9 +96,6 @@ export default { }, methods: { init() { - // Fetch providers when modal is shown - this.$store.dispatch('scanners/fetchProviders') - // If we don't have a set provider (first open of dialog) or we've switched library, set // the selected provider to the current library default provider if (!this.options.provider || this.lastUsedLibrary != this.currentLibraryId) { @@ -130,7 +127,8 @@ export default { this.show = false }) } - } + }, + mounted() {} } diff --git a/client/components/modals/collections/AddCreateModal.vue b/client/components/modals/collections/AddCreateModal.vue index f0d43c14f..24e8695d6 100644 --- a/client/components/modals/collections/AddCreateModal.vue +++ b/client/components/modals/collections/AddCreateModal.vue @@ -227,7 +227,7 @@ export default { .catch((error) => { console.error('Failed to create collection', error) var errMsg = error.response ? error.response.data || '' : '' - this.$toast.error(errMsg) + this.$toast.error(this.$strings.ToastCollectionCreateFailed + ': ' + errMsg) this.processing = false }) } diff --git a/client/components/modals/item/tabs/Cover.vue b/client/components/modals/item/tabs/Cover.vue index be17f9636..b404a9abb 100644 --- a/client/components/modals/item/tabs/Cover.vue +++ b/client/components/modals/item/tabs/Cover.vue @@ -133,8 +133,8 @@ export default { } }, providers() { - if (this.isPodcast) return this.$store.state.scanners.podcastCoverProviders - return this.$store.state.scanners.bookCoverProviders + if (this.isPodcast) return this.$store.state.scanners.podcastProviders + return [{ text: 'Best', value: 'best' }, ...this.$store.state.scanners.providers, ...this.$store.state.scanners.coverOnlyProviders, { text: 'All', value: 'all' }] }, searchTitleLabel() { if (this.provider.startsWith('audible')) return this.$strings.LabelSearchTitleOrASIN @@ -438,8 +438,6 @@ export default { mounted() { // Setup socket listeners when component is mounted this.addSocketListeners() - // Fetch providers if not already loaded - this.$store.dispatch('scanners/fetchProviders') }, beforeDestroy() { // Cancel any ongoing search when component is destroyed diff --git a/client/components/modals/item/tabs/Match.vue b/client/components/modals/item/tabs/Match.vue index a1fc41091..3faa26b27 100644 --- a/client/components/modals/item/tabs/Match.vue +++ b/client/components/modals/item/tabs/Match.vue @@ -2,7 +2,7 @@- {{ $strings.LabelCurrently }} {{ mediaMetadata.publishedYear }} + {{ $strings.LabelCurrently }} {{ mediaMetadata.publishedYear }}
-
-
') - .replace(/<code>/gi, '
-# Organizing your media +# Organizing your audiobooks #### Directory structure and folder names are important to Audiobookshelf! -See [library docs](https://audiobookshelf.org/docs/category/libraries) for supported directory structures, folder naming conventions, and audio file metadata usage. +See [documentation](https://audiobookshelf.org/docs#book-directory-structure) for supported directory structure, folder naming conventions, and audio file metadata usage.
@@ -83,25 +87,276 @@ See [install docs](https://www.audiobookshelf.org/docs) #### Note: Using a subfolder is supported with no additional changes but the path must be `/audiobookshelf` (this is not changeable). See [discussion](https://github.com/advplyr/audiobookshelf/discussions/3535) -See [reverse proxy docs](https://audiobookshelf.org/docs/category/reverse-proxy) +### NGINX Proxy Manager -
+Toggle websockets support. -# Contributing +
-See [contributing docs](https://audiobookshelf.org/docs/contributing/general/)
+### NGINX Reverse Proxy
-### Localization
+Add this to the site config file on your nginx server after you have changed the relevant parts in the <> brackets, and inserted your certificate paths.
-Thank you to [Weblate](https://hosted.weblate.org/engage/audiobookshelf/) for hosting our localization infrastructure pro-bono. If you want to see Audiobookshelf in your language, please help us localize. Additional information on helping with the translations [here](https://www.audiobookshelf.org/faq#how-do-i-help-with-translations).
- 
+```bash
+server {
+ listen 443 ssl;
+ server_name ..;
-
+ access_log /var/log/nginx/audiobookshelf.access.log; + error_log /var/log/nginx/audiobookshelf.error.log; + + ssl_certificate /path/to/certificate; + ssl_certificate_key /path/to/key; + + location / { + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $http_host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_http_version 1.1; + + proxy_pass http://;
+ proxy_redirect http:// https://;
+
+ # Prevent 413 Request Entity Too Large error
+ # by increasing the maximum allowed size of the client request body
+ # For example, set it to 10 GiB
+ client_max_body_size 10240M;
+ }
+}
+```
+
+### Apache Reverse Proxy
+
+Add this to the site config file on your Apache server after you have changed the relevant parts in the <> brackets, and inserted your certificate paths.
+
+For this to work you must enable at least the following mods using `a2enmod`:
+
+- `ssl`
+- `proxy`
+- `proxy_http`
+- `proxy_balancer`
+- `proxy_wstunnel`
+- `rewrite`
+
+```bash
+
+
+ ServerName ..
+
+ ErrorLog ${APACHE_LOG_DIR}/error.log
+ CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+ ProxyPreserveHost On
+ ProxyPass / http://localhost:/
+ RewriteEngine on
+ RewriteCond %{HTTP:Upgrade} websocket [NC]
+ RewriteCond %{HTTP:Connection} upgrade [NC]
+ RewriteRule ^/?(.*) "ws://localhost:/$1" [P,L]
+
+ # unless you're doing something special this should be generated by a
+ # tool like certbot by let's encrypt
+ SSLCertificateFile /path/to/cert/file
+ SSLCertificateKeyFile /path/to/key/file
+
+
+```
+
+If using Apache >= 2.4.47 you can use the following, without having to use any of the `RewriteEngine`, `RewriteCond`, or `RewriteRule` directives. For example:
+
+```xml
+
+ ProxyPreserveHost on
+ ProxyPass http://localhost:/audiobookshelf upgrade=websocket
+ ProxyPassReverse http://localhost:/audiobookshelf
+
+```
+
+Some SSL certificates like those signed by Let's Encrypt require ACME validation. To allow Let's Encrypt to write and confirm the ACME challenge, edit your VirtualHost definition to prevent proxying traffic that queries `/.well-known` and instead serve that directly:
+
+```bash
+
+ # ...
+
+ # create the directory structure /.well-known/acme-challenges
+ # within DocumentRoot and give the HTTP user recursive write
+ # access to it.
+ DocumentRoot /path/to/local/directory
+
+ ProxyPreserveHost On
+ ProxyPass /.well-known !
+ ProxyPass / http://localhost:/
+
+ # ...
+
+```
+
+### SWAG Reverse Proxy
+
+[See LinuxServer.io config sample](https://github.com/linuxserver/reverse-proxy-confs/blob/master/audiobookshelf.subdomain.conf.sample)
+
+### Synology NAS Reverse Proxy Setup (DSM 7+/Quickconnect)
+
+1. **Open Control Panel**
+
+ - Navigate to `Login Portal > Advanced`.
+
+2. **General Tab**
+
+ - Click `Reverse Proxy` > `Create`.
+
+ | Setting | Value |
+ | ------------------ | -------------- |
+ | Reverse Proxy Name | audiobookshelf |
+
+3. **Source Configuration**
+
+ | Setting | Value |
+ | ---------------------- | ---------------------------------------- |
+ | Protocol | HTTPS |
+ | Hostname | `..synology.me` |
+ | Port | 443 |
+ | Access Control Profile | Leave as is |
+
+ - Example Hostname: `audiobookshelf.mydomain.synology.me`
+
+4. **Destination Configuration**
+
+ | Setting | Value |
+ | -------- | ----------- |
+ | Protocol | HTTP |
+ | Hostname | Your NAS IP |
+ | Port | 13378 |
+
+5. **Custom Header Tab**
+
+ - Go to `Create > Websocket`.
+ - Configure Headers (leave as is):
+
+ | Header Name | Value |
+ | ----------- | --------------------- |
+ | Upgrade | `$http_upgrade` |
+ | Connection | `$connection_upgrade` |
+
+6. **Advanced Settings Tab**
+ - Leave as is.
+
+### [Traefik Reverse Proxy](https://doc.traefik.io/traefik/)
+
+Middleware relating to CORS will cause the app to report Unknown Error when logging in. To prevent this don't apply any of the following headers to the router for this site:
+
+
+ +### Example Caddyfile - [Caddy Reverse Proxy](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy) + +``` +subdomain.domain.com { + encode gzip zstd + reverse_proxy:
+}
+```
+
+### HAProxy
+
+Below is a generic HAProxy config, using `audiobookshelf.YOUR_DOMAIN.COM`.
+
+To use `http2`, `ssl` is needed.
+
+```make
+global
+ # ... (your global settings go here)
+
+defaults
+ mode http
+ # ... (your default settings go here)
+
+frontend my_frontend
+ # Bind to port 443, enable SSL, and specify the certificate list file
+ bind :443 name :443 ssl crt-list /path/to/cert.crt_list alpn h2,http/1.1
+ mode http
+
+ # Define an ACL for subdomains starting with "audiobookshelf"
+ acl is_audiobookshelf hdr_beg(host) -i audiobookshelf
+
+ # Use the ACL to route traffic to audiobookshelf_backend if the condition is met,
+ # otherwise, use the default_backend
+ use_backend audiobookshelf_backend if is_audiobookshelf
+ default_backend default_backend
+
+backend audiobookshelf_backend
+ mode http
+ # ... (backend settings for audiobookshelf go here)
+
+ # Define the server for the audiobookshelf backend
+ server audiobookshelf_server 127.0.0.99:13378
+
+backend default_backend
+ mode http
+ # ... (default backend settings go here)
+
+ # Define the server for the default backend
+ server default_server 127.0.0.123:8081
+
+```
+
+### pfSense and HAProxy
+
+For pfSense the inputs are graphical, and `Health checking` is enabled.
+
+#### Frontend, Default backend, access control lists and actions
+
+##### Access Control lists
+
+| Name | Expression | CS | Not | Value |
+| :------------: | :---------------: | :-: | :-: | :-------------: |
+| audiobookshelf | Host starts with: | | | audiobookshelf. |
+
+##### Actions
+
+The `condition acl names` needs to match the name above `audiobookshelf`.
+
+| Action | Parameters | Condition acl names |
+| :-----------: | :------------: | :-----------------: |
+| `Use Backend` | audiobookshelf | audiobookshelf |
+
+#### Backend
+
+The `Name` needs to match the `Parameters` above `audiobookshelf`.
+
+| Name | audiobookshelf |
+| ---- | -------------- |
+
+##### Server list:
+
+| Name | Expression | CS | Not | Value |
+| :------------: | :---------------: | :-: | :-: | :-------------: |
+| audiobookshelf | Host starts with: | | | audiobookshelf. |
+
+##### Health checking:
+
+Health checking is enabled by default. `Http check method` of `OPTIONS` is not supported on Audiobookshelf. If Health check fails, data will not be forwared. Need to do one of following:
+
+- To disable: Change `Health check method` to `none`.
+- To make Health checking function: Change `Http check method` to `HEAD` or `GET`.
# Run from source
+# Contributing
+
This application is built using [NodeJs](https://nodejs.org/).
+### Localization
+
+Thank you to [Weblate](https://hosted.weblate.org/engage/audiobookshelf/) for hosting our localization infrastructure pro-bono. If you want to see Audiobookshelf in your language, please help us localize. Additional information on helping with the translations [here](https://www.audiobookshelf.org/faq#how-do-i-help-with-translations).
+
### Dev Container Setup
The easiest way to begin developing this project is to use a dev container. An introduction to dev containers in VSCode can be found [here](https://code.visualstudio.com/docs/devcontainers/containers).
@@ -192,3 +447,6 @@ If you are using VSCode, this project includes a couple of pre-defined targets t
- `Debug client (nuxt)`—Run the client with live reload.
- `Debug server and client (nuxt)`—Runs both the preceding two debug targets.
+# How to Support
+
+[See the incomplete "How to Support" page](https://www.audiobookshelf.org/support)
diff --git a/server/Server.js b/server/Server.js
index ef0888927..d6f748a1e 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -302,9 +302,7 @@ class Server {
this.server = http.createServer(app)
- // Skip file upload parsing for internal-api routes (Next.js proxies read multipart bodies).
router.use(
- /^(?!\/internal-api).*/,
fileUpload({
defCharset: 'utf8',
defParamCharset: 'utf8',
diff --git a/server/SocketAuthority.js b/server/SocketAuthority.js
index a54231d75..ad55f6605 100644
--- a/server/SocketAuthority.js
+++ b/server/SocketAuthority.js
@@ -3,7 +3,6 @@ const Logger = require('./Logger')
const Database = require('./Database')
const TokenManager = require('./auth/TokenManager')
const CoverSearchManager = require('./managers/CoverSearchManager')
-const { LogLevel } = require('./utils/constants')
/**
* @typedef SocketClient
@@ -86,14 +85,6 @@ class SocketAuthority {
}
}
- requireAdminSocket(socket, eventName) {
- const client = this.clients[socket.id]
- if (client?.user?.isAdminOrUp) return true
-
- Logger.warn(`[SocketAuthority] Unauthorized ${eventName} socket event from socket ${socket.id}`)
- return false
- }
-
/**
* Emits event with library item to all clients that can access the library item
* Note: Emits toOldJSONExpanded()
@@ -188,25 +179,14 @@ class SocketAuthority {
socket.on('auth', (token) => this.authenticateSocket(socket, token))
// Scanning
- socket.on('cancel_scan', (libraryId) => {
- if (!this.requireAdminSocket(socket, 'cancel_scan')) return
- this.cancelScan(libraryId)
- })
+ socket.on('cancel_scan', (libraryId) => this.cancelScan(libraryId))
// Cover search streaming
socket.on('search_covers', (payload) => this.handleCoverSearch(socket, payload))
socket.on('cancel_cover_search', (requestId) => this.handleCancelCoverSearch(socket, requestId))
// Logs
- socket.on('set_log_listener', (level) => {
- if (!this.requireAdminSocket(socket, 'set_log_listener')) return
-
- if (!Number.isInteger(level) || !Object.values(LogLevel).includes(level)) {
- Logger.warn(`[SocketAuthority] Invalid set_log_listener level from socket ${socket.id}`)
- return
- }
- Logger.addSocketListener(socket, level)
- })
+ socket.on('set_log_listener', (level) => Logger.addSocketListener(socket, level))
socket.on('remove_log_listener', () => Logger.removeSocketListener(socket.id))
// Sent automatically from socket.io clients
diff --git a/server/auth/TokenManager.js b/server/auth/TokenManager.js
index 5933209c7..d972b5345 100644
--- a/server/auth/TokenManager.js
+++ b/server/auth/TokenManager.js
@@ -1,5 +1,4 @@
const { Op } = require('sequelize')
-const uuid = require('uuid')
const Database = require('../Database')
const Logger = require('../Logger')
@@ -13,9 +12,9 @@ class TokenManager {
constructor() {
/** @type {number} Refresh token expiry in seconds */
- this.RefreshTokenExpiry = parseInt(process.env.REFRESH_TOKEN_EXPIRY) || 30 * 24 * 60 * 60 // 30 days
+ this.RefreshTokenExpiry = parseInt(process.env.REFRESH_TOKEN_EXPIRY) || 7 * 24 * 60 * 60 // 7 days
/** @type {number} Access token expiry in seconds */
- this.AccessTokenExpiry = parseInt(process.env.ACCESS_TOKEN_EXPIRY) || 1 * 60 * 60 // 1 hour
+ this.AccessTokenExpiry = parseInt(process.env.ACCESS_TOKEN_EXPIRY) || 12 * 60 * 60 // 12 hours
if (parseInt(process.env.REFRESH_TOKEN_EXPIRY) > 0) {
Logger.info(`[TokenManager] Refresh token expiry set from ENV variable to ${this.RefreshTokenExpiry} seconds`)
@@ -116,7 +115,6 @@ class TokenManager {
const payload = {
userId: user.id,
username: user.username,
- jti: uuid.v4(),
type: 'access'
}
const options = {
@@ -140,7 +138,6 @@ class TokenManager {
const payload = {
userId: user.id,
username: user.username,
- jti: uuid.v4(),
type: 'refresh'
}
const options = {
@@ -186,56 +183,20 @@ class TokenManager {
* @param {import('../models/User')} user
* @param {import('express').Request} req
* @param {import('express').Response} res
- * @param {boolean} gracePeriod - whether to use the grace period
* @returns {Promise<{ accessToken:string, refreshToken:string }>}
*/
- async rotateTokensForSession(session, user, req, res, gracePeriod = true) {
- const previousRefreshToken = session.refreshToken
+ async rotateTokensForSession(session, user, req, res) {
+ // Generate new tokens
const newAccessToken = this.generateTempAccessToken(user)
- let newRefreshToken = this.generateRefreshToken(user)
+ const newRefreshToken = this.generateRefreshToken(user)
+
+ // Calculate new expiration time
const newExpiresAt = new Date(Date.now() + this.RefreshTokenExpiry * 1000)
- let lastRefreshToken = null
- let lastRefreshTokenExpiresAt = null
- if (gracePeriod) {
- // Set grace period of old refresh token in case of race condition in token rotation.
- // This grace period may need to be longer if fetching the user data takes longer due to large progress objects
- lastRefreshToken = previousRefreshToken
- lastRefreshTokenExpiresAt = new Date(Date.now() + 60 * 1000) // 1 minute grace period
- }
-
- // Only update if this session row still has the refresh token we read
- const [numUpdated] = await Database.sessionModel.update(
- {
- refreshToken: newRefreshToken,
- expiresAt: newExpiresAt,
- lastRefreshToken,
- lastRefreshTokenExpiresAt
- },
- {
- where: {
- id: session.id,
- refreshToken: previousRefreshToken
- }
- }
- )
-
- if (numUpdated === 0) {
- Logger.debug(`[TokenManager] Race condition in rotateTokensForSession for user ${user.id}, getting new token`)
-
- const updatedSession = await Database.sessionModel.findOne({ where: { id: session.id } })
-
- newRefreshToken = updatedSession.refreshToken
- session.refreshToken = updatedSession.refreshToken
- session.expiresAt = updatedSession.expiresAt
- session.lastRefreshToken = updatedSession.lastRefreshToken
- session.lastRefreshTokenExpiresAt = updatedSession.lastRefreshTokenExpiresAt
- } else {
- session.refreshToken = newRefreshToken
- session.expiresAt = newExpiresAt
- session.lastRefreshToken = lastRefreshToken
- session.lastRefreshTokenExpiresAt = lastRefreshTokenExpiresAt
- }
+ // Update the session with the new refresh token and expiration
+ session.refreshToken = newRefreshToken
+ session.expiresAt = newExpiresAt
+ await session.save()
// Set new refresh token cookie
this.setRefreshTokenCookie(req, res, newRefreshToken)
@@ -273,13 +234,6 @@ class TokenManager {
}
const user = await Database.userModel.getUserById(apiKey.userId)
-
- if (!user?.isActive) {
- // deny login
- done(null, null)
- return
- }
-
done(null, user)
} else {
// JWT based authentication
@@ -333,40 +287,23 @@ class TokenManager {
}
}
- let session = await Database.sessionModel.findOne({
- where: {
- [Op.or]: [{ refreshToken: refreshToken }, { lastRefreshToken: refreshToken }]
- }
+ const session = await Database.sessionModel.findOne({
+ where: { refreshToken: refreshToken }
})
if (!session) {
- Logger.error(`[TokenManager] Failed to refresh token. Session not found`)
+ Logger.error(`[TokenManager] Failed to refresh token. Session not found for refresh token: ${refreshToken}`)
return {
error: 'Invalid refresh token'
}
}
- let isGracePeriod = false
- if (session.refreshToken !== refreshToken) {
- // Token matched lastRefreshToken
- if (session.lastRefreshTokenExpiresAt && session.lastRefreshTokenExpiresAt > new Date()) {
- isGracePeriod = true
- Logger.debug(`[TokenManager] Grace period hit for user ${session.userId}`)
- } else {
- Logger.debug(`[TokenManager] Grace period expired for user ${session.userId}`)
- return {
- error: 'Invalid refresh token'
- }
- }
- } else {
- // Token matched current refreshToken
- // Check if session is expired in database
- if (session.expiresAt < new Date()) {
- Logger.info(`[TokenManager] Session expired in database, cleaning up`)
- await session.destroy()
- return {
- error: 'Refresh token expired'
- }
+ // Check if session is expired in database
+ if (session.expiresAt < new Date()) {
+ Logger.info(`[TokenManager] Session expired in database, cleaning up`)
+ await session.destroy()
+ return {
+ error: 'Refresh token expired'
}
}
@@ -378,20 +315,6 @@ class TokenManager {
}
}
- if (isGracePeriod) {
- // Return the already rotated refresh token store in the database,
- // and generate a new access token without changing the refresh token
- // again
- const accessToken = this.generateTempAccessToken(user)
- this.setRefreshTokenCookie(req, res, session.refreshToken)
-
- return {
- accessToken,
- refreshToken: session.refreshToken,
- user
- }
- }
-
const newTokens = await this.rotateTokensForSession(session, user, req, res)
return {
accessToken: newTokens.accessToken,
@@ -445,7 +368,7 @@ class TokenManager {
// So rotate token for current session
const currentSession = await Database.sessionModel.findOne({ where: { refreshToken: currentRefreshToken } })
if (currentSession) {
- const newTokens = await this.rotateTokensForSession(currentSession, user, req, res, false)
+ const newTokens = await this.rotateTokensForSession(currentSession, user, req, res)
// Invalidate all sessions for the user except the current one
await Database.sessionModel.destroy({
@@ -459,7 +382,7 @@ class TokenManager {
return newTokens.accessToken
} else {
- Logger.error(`[TokenManager] No session found to rotate tokens`)
+ Logger.error(`[TokenManager] No session found to rotate tokens for refresh token ${currentRefreshToken}`)
}
}
@@ -483,7 +406,7 @@ class TokenManager {
try {
const numDeleted = await Database.sessionModel.destroy({ where: { refreshToken: refreshToken } })
- Logger.info(`[TokenManager] Refresh token invalidated, ${numDeleted} sessions deleted`)
+ Logger.info(`[TokenManager] Refresh token ${refreshToken} invalidated, ${numDeleted} sessions deleted`)
return true
} catch (error) {
Logger.error(`[TokenManager] Error invalidating refresh token: ${error.message}`)
diff --git a/server/controllers/AuthorController.js b/server/controllers/AuthorController.js
index 8c2e80aec..50eeda31a 100644
--- a/server/controllers/AuthorController.js
+++ b/server/controllers/AuthorController.js
@@ -10,7 +10,7 @@ const CacheManager = require('../managers/CacheManager')
const CoverManager = require('../managers/CoverManager')
const AuthorFinder = require('../finders/AuthorFinder')
-const { reqSupportsWebp, isValidASIN, clampPositiveInt } = require('../utils/index')
+const { reqSupportsWebp, isValidASIN } = require('../utils/index')
const naturalSort = createNewSortInstance({
comparer: new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' }).compare
@@ -113,7 +113,7 @@ class AuthorController {
payload.lastFirst = Database.authorModel.getLastFirst(payload.name)
}
- // Check if author name matches another author in the same library and merge the authors
+ // Check if author name matches another author and merge the authors
let existingAuthor = null
if (authorNameUpdate) {
existingAuthor = await Database.authorModel.findOne({
@@ -121,8 +121,7 @@ class AuthorController {
id: {
[sequelize.Op.not]: req.author.id
},
- name: payload.name,
- libraryId: req.author.libraryId
+ name: payload.name
}
})
}
@@ -149,7 +148,7 @@ class AuthorController {
})
if (libraryItems.length) {
await Database.bookAuthorModel.removeByIds(req.author.id) // Remove all old BookAuthor
- await Database.bookAuthorModel.bulkCreate(bookAuthorsToCreate, { ignoreDuplicates: true }) // Create all new unique BookAuthor
+ await Database.bookAuthorModel.bulkCreate(bookAuthorsToCreate) // Create all new BookAuthor
for (const libraryItem of libraryItems) {
await libraryItem.saveMetadataFile()
}
@@ -412,8 +411,8 @@ class AuthorController {
const options = {
format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
- height: clampPositiveInt(height ? parseInt(height) : null, 4096),
- width: clampPositiveInt(width ? parseInt(width) : null, 4096)
+ height: height ? parseInt(height) : null,
+ width: width ? parseInt(width) : null
}
return CacheManager.handleAuthorCache(res, authorId, options)
}
diff --git a/server/controllers/CollectionController.js b/server/controllers/CollectionController.js
index bb00ea346..475adfe0f 100644
--- a/server/controllers/CollectionController.js
+++ b/server/controllers/CollectionController.js
@@ -3,7 +3,6 @@ const Sequelize = require('sequelize')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
-const htmlSanitizer = require('../utils/htmlSanitizer')
const RssFeedManager = require('../managers/RssFeedManager')
@@ -32,19 +31,13 @@ class CollectionController {
async create(req, res) {
const reqBody = req.body || {}
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
-
// Validation
- if (!nameCleaned || !reqBody.libraryId) {
+ if (!reqBody.name || !reqBody.libraryId) {
return res.status(400).send('Invalid collection data')
}
if (reqBody.description && typeof reqBody.description !== 'string') {
return res.status(400).send('Invalid collection description')
}
- if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
- Logger.warn(`[CollectionController] User "${req.user.username}" attempted to create collection in inaccessible library ${reqBody.libraryId}`)
- return res.sendStatus(403)
- }
const libraryItemIds = (reqBody.books || []).filter((b) => !!b && typeof b == 'string')
if (!libraryItemIds.length) {
return res.status(400).send('Invalid collection data. No books')
@@ -72,7 +65,7 @@ class CollectionController {
newCollection = await Database.collectionModel.create(
{
libraryId: reqBody.libraryId,
- name: nameCleaned,
+ name: reqBody.name,
description: reqBody.description || null
},
{ transaction }
@@ -113,9 +106,8 @@ class CollectionController {
*/
async findAll(req, res) {
const collectionsExpanded = await Database.collectionModel.getOldCollectionsJsonExpanded(req.user)
- const accessibleCollections = collectionsExpanded.filter((c) => req.user.checkCanAccessLibrary(c.libraryId))
res.json({
- collections: accessibleCollections
+ collections: collectionsExpanded
})
}
@@ -153,12 +145,9 @@ class CollectionController {
collectionUpdatePayload.description = req.body.description
wasUpdated = true
}
- if (req.body.name !== undefined && typeof req.body.name === 'string') {
- const nameCleaned = htmlSanitizer.stripAllTags(req.body.name)
- if (nameCleaned !== req.collection.name) {
- collectionUpdatePayload.name = nameCleaned
- wasUpdated = true
- }
+ if (req.body.name !== undefined && req.body.name !== req.collection.name) {
+ collectionUpdatePayload.name = req.body.name
+ wasUpdated = true
}
if (wasUpdated) {
@@ -436,10 +425,6 @@ class CollectionController {
if (!collection) {
return res.status(404).send('Collection not found')
}
- if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
- Logger.warn(`[CollectionController] User "${req.user.username}" attempted to access collection ${collection.id} in inaccessible library ${collection.libraryId}`)
- return res.status(404).send('Collection not found')
- }
req.collection = collection
}
diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js
index 41e082fd4..4b0a94b39 100644
--- a/server/controllers/FileSystemController.js
+++ b/server/controllers/FileSystemController.js
@@ -117,7 +117,7 @@ class FileSystemController {
filepath = fileUtils.filePathToPOSIX(filepath)
// Ensure filepath is inside library folder (prevents directory traversal)
- if (!fileUtils.isSameOrSubPath(libraryFolder.path, filepath)) {
+ if (!filepath.startsWith(libraryFolder.path)) {
Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)
return res.sendStatus(400)
}
diff --git a/server/controllers/LibraryController.js b/server/controllers/LibraryController.js
index 73b3d5c60..e63441f0b 100644
--- a/server/controllers/LibraryController.js
+++ b/server/controllers/LibraryController.js
@@ -221,11 +221,13 @@ class LibraryController {
const includeArray = (req.query.include || '').split(',')
if (includeArray.includes('filterdata')) {
const filterdata = await libraryFilters.getFilterData(req.library.mediaType, req.library.id)
+ const customMetadataProviders = await Database.customMetadataProviderModel.getForClientByMediaType(req.library.mediaType)
return res.json({
filterdata,
issues: filterdata.numIssues,
numUserPlaylists: await Database.playlistModel.getNumPlaylistsForUserAndLibrary(req.user.id, req.library.id),
+ customMetadataProviders,
library: req.library.toOldJSON()
})
}
@@ -462,7 +464,7 @@ class LibraryController {
}
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" from folder "${folder.path}"`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
if (authorIds.length) {
@@ -563,7 +565,7 @@ class LibraryController {
mediaItemIds.push(libraryItem.mediaId)
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" from library "${req.library.name}"`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
// Set PlaybackSessions libraryId to null
@@ -714,7 +716,7 @@ class LibraryController {
}
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" with issue`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
if (authorIds.length) {
@@ -1435,15 +1437,10 @@ class LibraryController {
const libraryItems = await Database.libraryItemModel.findAll({
attributes: ['id', 'libraryId', 'path', 'isFile'],
where: {
- id: itemIds,
- libraryId: req.library.id
+ id: itemIds
}
})
- if (libraryItems.length < itemIds.length) {
- Logger.warn(`[LibraryController] User "${req.user.username}" requested ${itemIds.length} items but only ${libraryItems.length} are in library "${req.library.id}"`)
- }
-
Logger.info(`[LibraryController] User "${req.user.username}" requested download for items "${itemIds}"`)
const filename = `LibraryItems-${Date.now()}.zip`
diff --git a/server/controllers/LibraryItemController.js b/server/controllers/LibraryItemController.js
index 07b4ee67f..5247dbb06 100644
--- a/server/controllers/LibraryItemController.js
+++ b/server/controllers/LibraryItemController.js
@@ -1,14 +1,13 @@
const { Request, Response, NextFunction } = require('express')
const Path = require('path')
const fs = require('../libs/fsExtra')
-const cron = require('../libs/nodeCron')
const uaParserJs = require('../libs/uaParser')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
const zipHelpers = require('../utils/zipHelpers')
-const { reqSupportsWebp, clampPositiveInt } = require('../utils/index')
+const { reqSupportsWebp } = require('../utils/index')
const { ScanResult, AudioMimeType } = require('../utils/constants')
const { getAudioMimeTypeFromExtname, encodeUriPath } = require('../utils/fileUtils')
const LibraryItemScanner = require('../scanner/LibraryItemScanner')
@@ -37,24 +36,6 @@ const ShareManager = require('../managers/ShareManager')
* @typedef {RequestWithUser & RequestEntityObject & RequestLibraryFileObject} LibraryItemControllerRequestWithFile
*/
-/**
- * Enforce per-item access for batch item routes
- *
- * @param {RequestWithUser} req
- * @param {Response} res
- * @param {import('../models/LibraryItem')[]} libraryItems
- * @returns {boolean} true if the user may access every item; false if 403 was sent
- */
-function ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems) {
- for (const libraryItem of libraryItems) {
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- res.sendStatus(403)
- return false
- }
- }
- return true
-}
-
class LibraryItemController {
constructor() {}
@@ -130,7 +111,7 @@ class LibraryItemController {
}
}
- await this.handleDeleteLibraryItem(req.libraryItem.id, mediaItemIds, req.libraryItem.libraryId)
+ await this.handleDeleteLibraryItem(req.libraryItem.id, mediaItemIds)
if (hardDelete) {
Logger.info(`[LibraryItemController] Deleting library item from file system at "${libraryItemPath}"`)
await fs.remove(libraryItemPath).catch((error) => {
@@ -221,11 +202,6 @@ class LibraryItemController {
} else if (mediaPayload.autoDownloadSchedule !== undefined && req.libraryItem.media.autoDownloadSchedule !== mediaPayload.autoDownloadSchedule) {
isPodcastAutoDownloadUpdated = true
}
-
- if (mediaPayload.autoDownloadSchedule && !cron.validate(mediaPayload.autoDownloadSchedule)) {
- Logger.error(`[LibraryItemController] Invalid auto download schedule cron expression "${mediaPayload.autoDownloadSchedule}" for library item "${req.libraryItem.media.title}"`)
- return res.status(400).send('Invalid auto download schedule cron expression')
- }
}
let hasUpdates = (await req.libraryItem.media.updateFromRequest(mediaPayload)) || mediaPayload.url
@@ -422,8 +398,8 @@ class LibraryItemController {
const options = {
format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
- height: clampPositiveInt(height ? parseInt(height) : null, 4096),
- width: clampPositiveInt(width ? parseInt(width) : null, 4096)
+ height: height ? parseInt(height) : null,
+ width: width ? parseInt(width) : null
}
return CacheManager.handleCoverCache(res, libraryItemId, options)
}
@@ -571,13 +547,7 @@ class LibraryItemController {
return res.sendStatus(404)
}
- // Ensure user has permission to delete these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, itemsToDelete)) {
- return
- }
-
const libraryId = itemsToDelete[0].libraryId
-
for (const libraryItem of itemsToDelete) {
const libraryItemPath = libraryItem.path
Logger.info(`[LibraryItemController] (${hardDelete ? 'Hard' : 'Soft'}) deleting Library Item "${libraryItem.media.title}" with id "${libraryItem.id}"`)
@@ -595,7 +565,7 @@ class LibraryItemController {
authorIds.push(...libraryItem.media.authors.map((au) => au.id))
}
}
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, libraryItem.libraryId)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
if (hardDelete) {
Logger.info(`[LibraryItemController] Deleting library item from file system at "${libraryItemPath}"`)
await fs.remove(libraryItemPath).catch((error) => {
@@ -611,7 +581,6 @@ class LibraryItemController {
}
await Database.resetLibraryIssuesFilterData(libraryId)
-
res.sendStatus(200)
}
@@ -624,11 +593,6 @@ class LibraryItemController {
* @param {Response} res
*/
async batchUpdate(req, res) {
- if (!req.user.canUpdate) {
- Logger.warn(`[LibraryItemController] User "${req.user.username}" attempted to batch update without permission`)
- return res.sendStatus(403)
- }
-
const updatePayloads = req.body
if (!Array.isArray(updatePayloads) || !updatePayloads.length) {
Logger.error(`[LibraryItemController] Batch update failed. Invalid payload`)
@@ -651,11 +615,6 @@ class LibraryItemController {
return res.sendStatus(404)
}
- // Ensure user has permission to update these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems)) {
- return
- }
-
let itemsUpdated = 0
const seriesIdsRemoved = []
@@ -665,11 +624,6 @@ class LibraryItemController {
const mediaPayload = updatePayload.mediaPayload
const libraryItem = libraryItems.find((li) => li.id === updatePayload.id)
- if (libraryItem.isPodcast && mediaPayload.autoDownloadSchedule && !cron.validate(mediaPayload.autoDownloadSchedule)) {
- Logger.warn(`[LibraryItemController] Invalid auto download schedule cron expression "${mediaPayload.autoDownloadSchedule}" for library item "${libraryItem.media.title}" - skipping update`)
- continue
- }
-
let hasUpdates = await libraryItem.media.updateFromRequest(mediaPayload)
if (libraryItem.isBook && Array.isArray(mediaPayload.metadata?.series)) {
@@ -741,10 +695,6 @@ class LibraryItemController {
const libraryItems = await Database.libraryItemModel.findAllExpandedWhere({
id: libraryItemIds
})
- // Ensure user has permission to access these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems)) {
- return
- }
res.json({
libraryItems: libraryItems.map((li) => li.toOldJSONExpanded())
})
diff --git a/server/controllers/MeController.js b/server/controllers/MeController.js
index c5968f521..51773a5ad 100644
--- a/server/controllers/MeController.js
+++ b/server/controllers/MeController.js
@@ -63,7 +63,7 @@ class MeController {
* @param {Response} res
*/
async getItemListeningSessions(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.libraryItemId)
+ const libraryItem = await Database.libraryItemModel.findByPk(req.params.libraryItemId)
const episode = await Database.podcastEpisodeModel.findByPk(req.params.episodeId)
if (!libraryItem || (libraryItem.isPodcast && !episode)) {
@@ -71,12 +71,6 @@ class MeController {
return res.sendStatus(404)
}
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to access listening sessions for library item "${req.params.libraryItemId}" without access`)
- return res.sendStatus(403)
- }
-
const mediaItemId = episode?.id || libraryItem.mediaId
let listeningSessions = await this.getUserItemListeningSessionsHelper(req.user.id, mediaItemId)
@@ -131,13 +125,6 @@ class MeController {
* @param {Response} res
*/
async removeMediaProgress(req, res) {
- // Verify the media progress belongs to the current user
- const mediaProgress = req.user.mediaProgresses.find((mp) => mp.id === req.params.id)
- if (!mediaProgress) {
- Logger.error(`[MeController] Media progress not found or does not belong to user "${req.user.username}"`)
- return res.sendStatus(404)
- }
-
await Database.mediaProgressModel.removeById(req.params.id)
req.user.mediaProgresses = req.user.mediaProgresses.filter((mp) => mp.id !== req.params.id)
@@ -205,16 +192,7 @@ class MeController {
* @param {Response} res
*/
async createBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to create bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const { time, title } = req.body
if (isNullOrNaN(time)) {
@@ -238,16 +216,7 @@ class MeController {
* @param {Response} res
*/
async updateBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to update bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const { time, title } = req.body
if (isNullOrNaN(time)) {
@@ -276,16 +245,7 @@ class MeController {
* @param {Response} res
*/
async removeBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to remove bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const time = Number(req.params.time)
if (isNaN(time)) {
diff --git a/server/controllers/MiscController.js b/server/controllers/MiscController.js
index 591f8ccf2..c779bdd63 100644
--- a/server/controllers/MiscController.js
+++ b/server/controllers/MiscController.js
@@ -8,7 +8,7 @@ const Database = require('../Database')
const Watcher = require('../Watcher')
const libraryItemFilters = require('../utils/queries/libraryItemFilters')
-const cron = require('../libs/nodeCron')
+const patternValidation = require('../libs/nodeCron/pattern-validation')
const { isObject, getTitleIgnorePrefix } = require('../utils/index')
const { sanitizeFilename } = require('../utils/fileUtils')
@@ -142,9 +142,6 @@ class MiscController {
Logger.warn('Cannot disable iframe when ALLOW_IFRAME is enabled in environment')
return res.status(400).send('Cannot disable iframe when ALLOW_IFRAME is enabled in environment')
}
- if (settingsUpdate.allowedOrigins && !Array.isArray(settingsUpdate.allowedOrigins)) {
- return res.status(400).send('allowedOrigins must be an array')
- }
const madeUpdates = Database.serverSettings.update(settingsUpdate)
if (madeUpdates) {
@@ -605,11 +602,13 @@ class MiscController {
return res.sendStatus(400)
}
- if (!cron.validate(expression)) {
- Logger.warn(`[MiscController] Invalid cron expression ${expression}`)
- return res.status(400).send('Invalid cron expression')
+ try {
+ patternValidation(expression)
+ res.sendStatus(200)
+ } catch (error) {
+ Logger.warn(`[MiscController] Invalid cron expression ${expression}`, error.message)
+ res.status(400).send(error.message)
}
- res.sendStatus(200)
}
/**
diff --git a/server/controllers/PlaylistController.js b/server/controllers/PlaylistController.js
index 6ad7cff9e..972c352a4 100644
--- a/server/controllers/PlaylistController.js
+++ b/server/controllers/PlaylistController.js
@@ -2,7 +2,6 @@ const { Request, Response, NextFunction } = require('express')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
-const htmlSanitizer = require('../utils/htmlSanitizer')
/**
* @typedef RequestUserObject
@@ -30,17 +29,12 @@ class PlaylistController {
const reqBody = req.body || {}
// Validation
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
- if (!nameCleaned || !reqBody.libraryId) {
+ if (!reqBody.name || !reqBody.libraryId) {
return res.status(400).send('Invalid playlist data')
}
if (reqBody.description && typeof reqBody.description !== 'string') {
return res.status(400).send('Invalid playlist description')
}
- if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist in inaccessible library ${reqBody.libraryId}`)
- return res.sendStatus(403)
- }
const items = reqBody.items || []
const isPodcast = items.some((i) => i.episodeId)
const libraryItemIds = new Set()
@@ -90,7 +84,7 @@ class PlaylistController {
{
libraryId: reqBody.libraryId,
userId: req.user.id,
- name: nameCleaned,
+ name: reqBody.name,
description: reqBody.description || null
},
{ transaction }
@@ -137,9 +131,8 @@ class PlaylistController {
*/
async findAllForUser(req, res) {
const playlistsForUser = await Database.playlistModel.getOldPlaylistsForUserAndLibrary(req.user.id)
- const accessiblePlaylists = playlistsForUser.filter((p) => req.user.checkCanAccessLibrary(p.libraryId))
res.json({
- playlists: accessiblePlaylists
+ playlists: playlistsForUser
})
}
@@ -181,11 +174,7 @@ class PlaylistController {
}
const playlistUpdatePayload = {}
-
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
- if (nameCleaned) {
- playlistUpdatePayload.name = nameCleaned
- }
+ if (reqBody.name) playlistUpdatePayload.name = reqBody.name
if (reqBody.description) playlistUpdatePayload.description = reqBody.description
// Update name and description
@@ -513,10 +502,6 @@ class PlaylistController {
if (!collection) {
return res.status(404).send('Collection not found')
}
- if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist from collection ${collection.id} in inaccessible library ${collection.libraryId}`)
- return res.status(404).send('Collection not found')
- }
// Expand collection to get library items
const collectionExpanded = await collection.getOldJsonExpanded(req.user)
if (!collectionExpanded) {
@@ -582,10 +567,6 @@ class PlaylistController {
Logger.warn(`[PlaylistController] Playlist ${req.params.id} requested by user ${req.user.id} that is not the owner`)
return res.sendStatus(403)
}
- if (!req.user.checkCanAccessLibrary(playlist.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to access playlist ${playlist.id} in inaccessible library ${playlist.libraryId}`)
- return res.status(404).send('Playlist not found')
- }
req.playlist = playlist
}
diff --git a/server/controllers/PodcastController.js b/server/controllers/PodcastController.js
index 5eaa2a64a..1ebe1d110 100644
--- a/server/controllers/PodcastController.js
+++ b/server/controllers/PodcastController.js
@@ -5,10 +5,9 @@ const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
const fs = require('../libs/fsExtra')
-const cron = require('../libs/nodeCron')
const { getPodcastFeed, findMatchingEpisodes } = require('../utils/podcastUtils')
-const { getFileTimestampsWithIno, filePathToPOSIX, isSameOrSubPath } = require('../utils/fileUtils')
+const { getFileTimestampsWithIno, filePathToPOSIX } = require('../utils/fileUtils')
const { validateUrl } = require('../utils/index')
const htmlSanitizer = require('../utils/htmlSanitizer')
@@ -47,11 +46,6 @@ class PodcastController {
return res.status(400).send('Invalid request body. "media" and "media.metadata" are required')
}
- if (payload.media.autoDownloadSchedule && !cron.validate(payload.media.autoDownloadSchedule)) {
- Logger.error(`[PodcastController] Invalid auto download schedule cron expression "${payload.media.autoDownloadSchedule}"`)
- return res.status(400).send('Invalid auto download schedule cron expression')
- }
-
const library = await Database.libraryModel.findByIdWithFolders(payload.libraryId)
if (!library) {
Logger.error(`[PodcastController] Create: Library not found "${payload.libraryId}"`)
@@ -64,18 +58,8 @@ class PodcastController {
return res.status(404).send('Folder not found')
}
- if (typeof payload.path !== 'string' || !payload.path.trim()) {
- return res.status(400).send('Invalid request body. "path" must be a non-empty string')
- }
-
- const libraryFolderPath = filePathToPOSIX(folder.path)
const podcastPath = filePathToPOSIX(payload.path)
- if (!isSameOrSubPath(libraryFolderPath, podcastPath)) {
- Logger.error(`[PodcastController] Create: Podcast path is outside library folder "${libraryFolderPath}": "${podcastPath}"`)
- return res.status(400).send('Podcast path must be inside the selected library folder')
- }
-
// Check if a library item with this podcast folder exists already
const existingLibraryItem =
(await Database.libraryItemModel.count({
@@ -99,7 +83,7 @@ class PodcastController {
const libraryItemFolderStats = await getFileTimestampsWithIno(podcastPath)
- let relPath = podcastPath.replace(libraryFolderPath, '')
+ let relPath = payload.path.replace(folder.fullPath, '')
if (relPath.startsWith('/')) relPath = relPath.slice(1)
let newLibraryItem = null
@@ -428,26 +412,9 @@ class PodcastController {
Logger.debug(`[PodcastController] Sanitized description from "${req.body[key]}" to "${sanitizedDescription}"`)
req.body[key] = sanitizedDescription
}
- } else if (key === 'subtitle' && req.body[key]) {
- const sanitizedSubtitle = htmlSanitizer.sanitize(req.body[key])
- if (sanitizedSubtitle !== req.body[key]) {
- Logger.debug(`[PodcastController] Sanitized subtitle from "${req.body[key]}" to "${sanitizedSubtitle}"`)
- req.body[key] = sanitizedSubtitle
- }
}
updatePayload[key] = req.body[key]
- } else if (key === 'enclosure') {
- const enclosure = req.body.enclosure
- if (enclosure === null) {
- updatePayload.enclosureURL = null
- updatePayload.enclosureSize = null
- updatePayload.enclosureType = null
- } else if (typeof enclosure === 'object' && typeof enclosure.url === 'string') {
- updatePayload.enclosureURL = enclosure.url
- updatePayload.enclosureType = typeof enclosure.type === 'string' ? enclosure.type : null
- updatePayload.enclosureSize = enclosure.length !== undefined && enclosure.length !== null ? enclosure.length : null
- }
} else if (key === 'chapters' && Array.isArray(req.body[key]) && req.body[key].every((ch) => typeof ch === 'object' && ch.title && ch.start)) {
updatePayload[key] = req.body[key]
} else if (key === 'publishedAt' && typeof req.body[key] === 'number') {
diff --git a/server/controllers/SearchController.js b/server/controllers/SearchController.js
index ecd9a41c0..bb3382f71 100644
--- a/server/controllers/SearchController.js
+++ b/server/controllers/SearchController.js
@@ -4,29 +4,7 @@ const BookFinder = require('../finders/BookFinder')
const PodcastFinder = require('../finders/PodcastFinder')
const AuthorFinder = require('../finders/AuthorFinder')
const Database = require('../Database')
-const { isValidASIN, getQueryParamAsString, ValidationError, NotFoundError } = require('../utils')
-
-// Provider name mappings for display purposes
-const providerMap = {
- all: 'All',
- best: 'Best',
- google: 'Google Books',
- itunes: 'iTunes',
- openlibrary: 'Open Library',
- fantlab: 'FantLab.ru',
- audiobookcovers: 'AudiobookCovers.com',
- audible: 'Audible.com',
- 'audible.ca': 'Audible.ca',
- 'audible.uk': 'Audible.co.uk',
- 'audible.au': 'Audible.com.au',
- 'audible.fr': 'Audible.fr',
- 'audible.de': 'Audible.de',
- 'audible.jp': 'Audible.co.jp',
- 'audible.it': 'Audible.it',
- 'audible.in': 'Audible.in',
- 'audible.es': 'Audible.es',
- audnexus: 'Audnexus'
-}
+const { isValidASIN } = require('../utils')
/**
* @typedef RequestUserObject
@@ -38,44 +16,6 @@ const providerMap = {
class SearchController {
constructor() {}
- /**
- * Fetches a library item by ID
- * @param {string} id - Library item ID
- * @param {string} methodName - Name of the calling method for logging
- * @returns {Promise}
- */
- static async fetchLibraryItem(id) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(id)
- if (!libraryItem) {
- throw new NotFoundError(`library item "${id}" not found`)
- }
- return libraryItem
- }
-
- /**
- * Maps custom metadata providers to standardized format
- * @param {Array} providers - Array of custom provider objects
- * @returns {Array<{value: string, text: string}>}
- */
- static mapCustomProviders(providers) {
- return providers.map((provider) => ({
- value: provider.getSlug(),
- text: provider.name
- }))
- }
-
- /**
- * Static helper method to format provider for client (for use in array methods)
- * @param {string} providerValue - Provider identifier
- * @returns {{value: string, text: string}}
- */
- static formatProvider(providerValue) {
- return {
- value: providerValue,
- text: providerMap[providerValue] || providerValue
- }
- }
-
/**
* GET: /api/search/books
*
@@ -83,25 +23,19 @@ class SearchController {
* @param {Response} res
*/
async findBooks(req, res) {
- try {
- const query = req.query
- const provider = getQueryParamAsString(query, 'provider', 'google')
- const title = getQueryParamAsString(query, 'title', '')
- const author = getQueryParamAsString(query, 'author', '')
- const id = getQueryParamAsString(query, 'id', undefined)
+ const id = req.query.id
+ const libraryItem = await Database.libraryItemModel.getExpandedById(id)
+ const provider = req.query.provider || 'google'
+ const title = req.query.title || ''
+ const author = req.query.author || ''
- // Fetch library item
- const libraryItem = id ? await SearchController.fetchLibraryItem(id) : null
-
- const results = await BookFinder.search(libraryItem, provider, title, author)
- res.json(results)
- } catch (error) {
- Logger.error(`[SearchController] findBooks: ${error.message}`)
- if (error instanceof ValidationError || error instanceof NotFoundError) {
- return res.status(error.status).json({ error: error.message })
- }
- return res.status(500).json({ error: 'Internal server error' })
+ if (typeof provider !== 'string' || typeof title !== 'string' || typeof author !== 'string') {
+ Logger.error(`[SearchController] findBooks: Invalid request query params`)
+ return res.status(400).send('Invalid request query params')
}
+
+ const results = await BookFinder.search(libraryItem, provider, title, author)
+ res.json(results)
}
/**
@@ -111,24 +45,20 @@ class SearchController {
* @param {Response} res
*/
async findCovers(req, res) {
- try {
- const query = req.query
- const podcast = query.podcast === '1' || query.podcast === 1
- const title = getQueryParamAsString(query, 'title', '', true)
- const author = getQueryParamAsString(query, 'author', '')
- const provider = getQueryParamAsString(query, 'provider', 'google')
+ const query = req.query
+ const podcast = query.podcast == 1
- let results = null
- if (podcast) results = await PodcastFinder.findCovers(title)
- else results = await BookFinder.findCovers(provider, title, author)
- res.json({ results })
- } catch (error) {
- Logger.error(`[SearchController] findCovers: ${error.message}`)
- if (error instanceof ValidationError) {
- return res.status(error.status).json({ error: error.message })
- }
- return res.status(500).json({ error: 'Internal server error' })
+ if (!query.title || typeof query.title !== 'string') {
+ Logger.error(`[SearchController] findCovers: Invalid title sent in query`)
+ return res.sendStatus(400)
}
+
+ let results = null
+ if (podcast) results = await PodcastFinder.findCovers(query.title)
+ else results = await BookFinder.findCovers(query.provider || 'google', query.title, query.author || '')
+ res.json({
+ results
+ })
}
/**
@@ -139,42 +69,34 @@ class SearchController {
* @param {Response} res
*/
async findPodcasts(req, res) {
- try {
- const query = req.query
- const term = getQueryParamAsString(query, 'term', '', true)
- const country = getQueryParamAsString(query, 'country', 'us')
-
- const results = await PodcastFinder.search(term, { country })
- res.json(results)
- } catch (error) {
- Logger.error(`[SearchController] findPodcasts: ${error.message}`)
- if (error instanceof ValidationError) {
- return res.status(error.status).json({ error: error.message })
- }
- return res.status(500).json({ error: 'Internal server error' })
+ const term = req.query.term
+ const country = req.query.country || 'us'
+ if (!term) {
+ Logger.error('[SearchController] Invalid request query param "term" is required')
+ return res.status(400).send('Invalid request query param "term" is required')
}
+
+ const results = await PodcastFinder.search(term, {
+ country
+ })
+ res.json(results)
}
/**
* GET: /api/search/authors
- * Note: This endpoint is not currently used in the web client.
*
* @param {RequestWithUser} req
* @param {Response} res
*/
async findAuthor(req, res) {
- try {
- const query = getQueryParamAsString(req.query, 'q', '', true)
-
- const author = await AuthorFinder.findAuthorByName(query)
- res.json(author)
- } catch (error) {
- Logger.error(`[SearchController] findAuthor: ${error.message}`)
- if (error instanceof ValidationError) {
- return res.status(error.status).json({ error: error.message })
- }
- return res.status(500).json({ error: 'Internal server error' })
+ const query = req.query.q
+ if (!query || typeof query !== 'string') {
+ Logger.error(`[SearchController] findAuthor: Invalid query param`)
+ return res.status(400).send('Invalid query param')
}
+
+ const author = await AuthorFinder.findAuthorByName(query)
+ res.json(author)
}
/**
@@ -184,55 +106,16 @@ class SearchController {
* @param {Response} res
*/
async findChapters(req, res) {
- try {
- const query = req.query
- const asin = getQueryParamAsString(query, 'asin', '', true)
- const region = getQueryParamAsString(query, 'region', 'us').toLowerCase()
-
- if (!isValidASIN(asin.toUpperCase())) throw new ValidationError('asin', 'is invalid')
-
- const chapterData = await BookFinder.findChapters(asin, region)
- if (!chapterData) {
- return res.json({ error: 'Chapters not found', stringKey: 'MessageChaptersNotFound' })
- }
- res.json(chapterData)
- } catch (error) {
- Logger.error(`[SearchController] findChapters: ${error.message}`)
- if (error instanceof ValidationError) {
- if (error.paramName === 'asin') {
- return res.json({ error: 'Invalid ASIN', stringKey: 'MessageInvalidAsin' })
- }
- if (error.paramName === 'region') {
- return res.json({ error: 'Invalid region', stringKey: 'MessageInvalidRegion' })
- }
- }
- return res.status(500).json({ error: 'Internal server error' })
+ const asin = req.query.asin
+ if (!isValidASIN(asin.toUpperCase())) {
+ return res.json({ error: 'Invalid ASIN', stringKey: 'MessageInvalidAsin' })
}
- }
-
- /**
- * GET: /api/search/providers
- * Get all available metadata providers
- *
- * @param {RequestWithUser} req
- * @param {Response} res
- */
- async getAllProviders(req, res) {
- const customProviders = await Database.customMetadataProviderModel.findAll()
-
- const customBookProviders = customProviders.filter((p) => p.mediaType === 'book')
- const customPodcastProviders = customProviders.filter((p) => p.mediaType === 'podcast')
-
- const bookProviders = BookFinder.providers.filter((p) => p !== 'audiobookcovers')
-
- // Build minimized payload with custom providers merged in
- const providers = {
- books: [...bookProviders.map((p) => SearchController.formatProvider(p)), ...SearchController.mapCustomProviders(customBookProviders)],
- booksCovers: [SearchController.formatProvider('best'), ...BookFinder.providers.map((p) => SearchController.formatProvider(p)), ...SearchController.mapCustomProviders(customBookProviders), SearchController.formatProvider('all')],
- podcasts: [SearchController.formatProvider('itunes'), ...SearchController.mapCustomProviders(customPodcastProviders)]
+ const region = (req.query.region || 'us').toLowerCase()
+ const chapterData = await BookFinder.findChapters(asin, region)
+ if (!chapterData) {
+ return res.json({ error: 'Chapters not found', stringKey: 'MessageChaptersNotFound' })
}
-
- res.json({ providers })
+ res.json(chapterData)
}
}
module.exports = new SearchController()
diff --git a/server/controllers/SessionController.js b/server/controllers/SessionController.js
index 7cc8d35e2..872f635de 100644
--- a/server/controllers/SessionController.js
+++ b/server/controllers/SessionController.js
@@ -339,9 +339,9 @@ class SessionController {
var playbackSession = this.playbackSessionManager.getSession(req.params.id)
if (!playbackSession) return res.sendStatus(404)
- if (playbackSession.userId !== req.user.id && !req.user.isAdminOrUp) {
- Logger.error(`[SessionController] Non-admin user "${req.user.username}" attempting to access session belonging to another user "${req.params.id}"`)
- return res.sendStatus(403)
+ if (playbackSession.userId !== req.user.id) {
+ Logger.error(`[SessionController] User "${req.user.username}" attempting to access session belonging to another user "${req.params.id}"`)
+ return res.sendStatus(404)
}
req.playbackSession = playbackSession
diff --git a/server/controllers/ShareController.js b/server/controllers/ShareController.js
index 73da84a8a..3e7ea1deb 100644
--- a/server/controllers/ShareController.js
+++ b/server/controllers/ShareController.js
@@ -53,10 +53,6 @@ class ShareController {
if (playbackSession) {
if (mediaItemShare.id === playbackSession.mediaItemShareId) {
Logger.debug(`[ShareController] Found share playback session ${req.cookies.share_session_id}`)
- // If ?t was provided, override the cached currentTime
- if (startTime > 0 && startTime < playbackSession.duration) {
- playbackSession.currentTime = startTime
- }
mediaItemShare.playbackSession = playbackSession.toJSONForClient()
return res.json(mediaItemShare)
} else {
diff --git a/server/finders/BookFinder.js b/server/finders/BookFinder.js
index 90fed951f..a6a6b07e6 100644
--- a/server/finders/BookFinder.js
+++ b/server/finders/BookFinder.js
@@ -227,7 +227,7 @@ class BookFinder {
title = this.#removeAuthorFromTitle(title)
const titleTransformers = [
- [/(: |[,;_]| by ).*/g, ''], // Remove subtitle
+ [/([,:;_]| by ).*/g, ''], // Remove subtitle
[/(^| )\d+k(bps)?( |$)/, ' '], // Remove bitrate
[/ (2nd|3rd|\d+th)\s+ed(\.|ition)?/g, ''], // Remove edition
[/(^| |\.)(m4b|m4a|mp3)( |$)/g, ''], // Remove file-type
@@ -385,11 +385,6 @@ class BookFinder {
if (!title) return books
- // Truncate excessively long inputs to prevent ReDoS attacks
- const MAX_INPUT_LENGTH = 500
- title = title.substring(0, MAX_INPUT_LENGTH)
- author = author?.substring(0, MAX_INPUT_LENGTH) || author
-
const isTitleAsin = isValidASIN(title.toUpperCase())
let actualTitleQuery = title
@@ -407,8 +402,7 @@ class BookFinder {
let authorCandidates = new BookFinder.AuthorCandidates(cleanAuthor, this.audnexus)
// Remove underscores and parentheses with their contents, and replace with a separator
- // Use negated character classes to prevent ReDoS vulnerability (input length validated at entry point)
- const cleanTitle = title.replace(/\[[^\]]*\]|\([^)]*\)|{[^}]*}|_/g, ' - ')
+ const cleanTitle = title.replace(/\[.*?\]|\(.*?\)|{.*?}|_/g, ' - ')
// Split title into hypen-separated parts
const titleParts = cleanTitle.split(/ - | -|- /)
for (const titlePart of titleParts) authorCandidates.add(titlePart)
@@ -428,7 +422,7 @@ class BookFinder {
}
}
- if (books.length && libraryItem) {
+ if (books.length) {
const isAudibleProvider = provider.startsWith('audible')
const libraryItemDurationMinutes = libraryItem?.media?.duration ? libraryItem.media.duration / 60 : null
@@ -646,11 +640,11 @@ class BookFinder {
module.exports = new BookFinder()
function hasSubtitle(title) {
- return title.includes(': ') || title.includes(' - ')
+ return title.includes(':') || title.includes(' - ')
}
function stripSubtitle(title) {
- if (title.includes(': ')) {
- return title.split(': ')[0].trim()
+ if (title.includes(':')) {
+ return title.split(':')[0].trim()
} else if (title.includes(' - ')) {
return title.split(' - ')[0].trim()
}
@@ -674,9 +668,7 @@ function cleanTitleForCompares(title, keepSubtitle = false) {
let stripped = keepSubtitle ? title : stripSubtitle(title)
// Remove text in paranthesis (i.e. "Ender's Game (Ender's Saga)" becomes "Ender's Game")
- // Use negated character class to prevent ReDoS vulnerability (input length validated at entry point)
- let cleaned = stripped.replace(/\([^)]*\)/g, '') // Remove parenthetical content
- cleaned = cleaned.replace(/\s+/g, ' ').trim() // Clean up any resulting multiple spaces
+ let cleaned = stripped.replace(/ *\([^)]*\) */g, '')
// Remove single quotes (i.e. "Ender's Game" becomes "Enders Game")
cleaned = cleaned.replace(/'/g, '')
diff --git a/server/finders/PodcastFinder.js b/server/finders/PodcastFinder.js
index 40d6a5a00..abaf02ac6 100644
--- a/server/finders/PodcastFinder.js
+++ b/server/finders/PodcastFinder.js
@@ -7,9 +7,9 @@ class PodcastFinder {
}
/**
- *
- * @param {string} term
- * @param {{country:string}} options
+ *
+ * @param {string} term
+ * @param {{country:string}} options
* @returns {Promise}
*/
async search(term, options = {}) {
@@ -20,16 +20,12 @@ class PodcastFinder {
return results
}
- /**
- * @param {string} term
- * @returns {Promise}
- */
async findCovers(term) {
if (!term) return null
Logger.debug(`[iTunes] Searching for podcast covers with term "${term}"`)
- const results = await this.iTunesApi.searchPodcasts(term)
+ var results = await this.iTunesApi.searchPodcasts(term)
if (!results) return []
- return results.map((r) => r.cover).filter((r) => r)
+ return results.map(r => r.cover).filter(r => r)
}
}
-module.exports = new PodcastFinder()
+module.exports = new PodcastFinder()
\ No newline at end of file
diff --git a/server/managers/ApiCacheManager.js b/server/managers/ApiCacheManager.js
index e34e4c055..2d8eece85 100644
--- a/server/managers/ApiCacheManager.js
+++ b/server/managers/ApiCacheManager.js
@@ -5,9 +5,6 @@ const Database = require('../Database')
class ApiCacheManager {
defaultCacheOptions = { max: 1000, maxSize: 10 * 1000 * 1000, sizeCalculation: (item) => item.body.length + JSON.stringify(item.headers).length }
defaultTtlOptions = { ttl: 30 * 60 * 1000 }
- highChurnModels = new Set(['session', 'mediaProgress', 'playbackSession', 'device'])
- modelsInvalidatingPersonalized = new Set(['mediaProgress'])
- modelsInvalidatingMe = new Set(['session', 'mediaProgress', 'playbackSession', 'device'])
constructor(cache = new LRUCache(this.defaultCacheOptions), ttlOptions = this.defaultTtlOptions) {
this.cache = cache
@@ -19,47 +16,8 @@ class ApiCacheManager {
hooks.forEach((hook) => database.sequelize.addHook(hook, (model) => this.clear(model, hook)))
}
- getModelName(model) {
- if (typeof model?.name === 'string') return model.name
- if (typeof model?.model?.name === 'string') return model.model.name
- if (typeof model?.constructor?.name === 'string' && model.constructor.name !== 'Object') return model.constructor.name
- return 'unknown'
- }
-
- clearByUrlPattern(urlPattern) {
- let removed = 0
- for (const key of this.cache.keys()) {
- try {
- const parsed = JSON.parse(key)
- if (typeof parsed?.url === 'string' && urlPattern.test(parsed.url)) {
- if (this.cache.delete(key)) removed++
- }
- } catch {
- if (this.cache.delete(key)) removed++
- }
- }
- return removed
- }
-
- clearUserProgressSlices(modelName, hook) {
- let removedPersonalized = 0
- let removedRecentEpisodes = 0
- if (this.modelsInvalidatingPersonalized.has(modelName)) {
- removedPersonalized = this.clearByUrlPattern(/^\/libraries\/[^/]+\/personalized/)
- removedRecentEpisodes = this.clearByUrlPattern(/^\/libraries\/[^/]+\/recent-episodes/)
- }
- const removedMe = this.modelsInvalidatingMe.has(modelName) ? this.clearByUrlPattern(/^\/me(\/|\?|$)/) : 0
- Logger.debug(`[ApiCacheManager] ${modelName}.${hook}: cleared user-progress cache slices (personalized=${removedPersonalized}, recentEpisodes=${removedRecentEpisodes}, me=${removedMe})`)
- }
-
clear(model, hook) {
- const modelName = this.getModelName(model)
- if (this.highChurnModels.has(modelName)) {
- this.clearUserProgressSlices(modelName, hook)
- return
- }
-
- Logger.debug(`[ApiCacheManager] ${modelName}.${hook}: Clearing cache`)
+ Logger.debug(`[ApiCacheManager] ${model.constructor.name}.${hook}: Clearing cache`)
this.cache.clear()
}
diff --git a/server/managers/BackupManager.js b/server/managers/BackupManager.js
index a7b531e62..102521b71 100644
--- a/server/managers/BackupManager.js
+++ b/server/managers/BackupManager.js
@@ -48,14 +48,9 @@ class BackupManager {
}
async init() {
- try {
- const backupsDirExists = await fs.pathExists(this.backupPath)
- if (!backupsDirExists) {
- await fs.ensureDir(this.backupPath)
- }
- } catch (error) {
- Logger.error(`[BackupManager] Failed to ensure backup directory at "${this.backupPath}": ${error.message}`)
- throw new Error(`[BackupManager] Failed to ensure backup directory at "${this.backupPath}"`, { cause: error })
+ const backupsDirExists = await fs.pathExists(this.backupPath)
+ if (!backupsDirExists) {
+ await fs.ensureDir(this.backupPath)
}
await this.loadBackups()
@@ -126,31 +121,13 @@ class BackupManager {
} catch (error) {
// Not a valid zip file
Logger.error('[BackupManager] Failed to read backup file - backup might not be a valid .zip file', tempPath, error)
- await zip.close().catch(() => {})
- await fs.remove(tempPath).catch((err) => Logger.error(`[BackupManager] Failed to remove rejected backup file "${tempPath}"`, err))
return res.status(400).send('Failed to read backup file - backup might not be a valid .zip file')
}
- if (!entries['absdatabase.sqlite']) {
+ if (!Object.keys(entries).includes('absdatabase.sqlite')) {
Logger.error(`[BackupManager] Invalid backup with no absdatabase.sqlite file - might be a backup created on an old Audiobookshelf server.`)
- await zip.close().catch(() => {})
- await fs.remove(tempPath).catch((err) => Logger.error(`[BackupManager] Failed to remove rejected backup file "${tempPath}"`, err))
return res.status(500).send('Invalid backup with no absdatabase.sqlite file - might be a backup created on an old Audiobookshelf server.')
}
- const detailsEntry = entries['details']
- if (!detailsEntry) {
- Logger.error('[BackupManager] Invalid backup - missing details entry')
- await zip.close().catch(() => {})
- await fs.remove(tempPath).catch((err) => Logger.error(`[BackupManager] Failed to remove rejected backup file "${tempPath}"`, err))
- return res.status(400).send('Invalid backup file - missing details entry')
- }
- if (detailsEntry.size > 1024 * 1024) {
- Logger.error(`[BackupManager] Backup details entry too large: ${detailsEntry.size} bytes`)
- await zip.close().catch(() => {})
- await fs.remove(tempPath).catch((err) => Logger.error(`[BackupManager] Failed to remove rejected backup file "${tempPath}"`, err))
- return res.status(400).send('Invalid backup file - details entry too large')
- }
-
const data = await zip.entryData('details')
const details = data.toString('utf8').split('\n')
@@ -158,13 +135,9 @@ class BackupManager {
if (!backup.serverVersion) {
Logger.error(`[BackupManager] Invalid backup with no server version - might be a backup created before version 2.0.0`)
- await zip.close().catch(() => {})
- await fs.remove(tempPath).catch((err) => Logger.error(`[BackupManager] Failed to remove rejected backup file "${tempPath}"`, err))
return res.status(500).send('Invalid backup. Might be a backup created before version 2.0.0.')
}
- await zip.close().catch(() => {})
-
backup.fileSize = await getFileSize(backup.fullPath)
const existingBackupIndex = this.backups.findIndex((b) => b.id === backup.id)
@@ -279,24 +252,9 @@ class BackupManager {
let data = null
try {
zip = new StreamZip.async({ file: fullFilePath })
- const entries = await zip.entries()
-
- const detailsEntry = entries['details']
- if (!detailsEntry) {
- Logger.error(`[BackupManager] Backup "${fullFilePath}" missing details entry - skipping`)
- await zip.close().catch(() => {})
- continue
- }
- if (detailsEntry.size > 1024 * 1024) {
- Logger.error(`[BackupManager] Backup "${fullFilePath}" details entry too large (${detailsEntry.size} bytes) - skipping`)
- await zip.close().catch(() => {})
- continue
- }
-
data = await zip.entryData('details')
} catch (error) {
Logger.error(`[BackupManager] Failed to unzip backup "${fullFilePath}"`, error)
- if (zip) await zip.close().catch(() => {})
continue
}
diff --git a/server/managers/CacheManager.js b/server/managers/CacheManager.js
index 38c0415e9..b44b65de3 100644
--- a/server/managers/CacheManager.js
+++ b/server/managers/CacheManager.js
@@ -24,15 +24,10 @@ class CacheManager {
this.ImageCachePath = Path.join(this.CachePath, 'images')
this.ItemCachePath = Path.join(this.CachePath, 'items')
- try {
- await fs.ensureDir(this.CachePath)
- await fs.ensureDir(this.CoverCachePath)
- await fs.ensureDir(this.ImageCachePath)
- await fs.ensureDir(this.ItemCachePath)
- } catch (error) {
- Logger.error(`[CacheManager] Failed to create cache directories at "${this.CachePath}": ${error.message}`)
- throw new Error(`[CacheManager] Failed to create cache directories at "${this.CachePath}"`, { cause: error })
- }
+ await fs.ensureDir(this.CachePath)
+ await fs.ensureDir(this.CoverCachePath)
+ await fs.ensureDir(this.ImageCachePath)
+ await fs.ensureDir(this.ItemCachePath)
}
async handleCoverCache(res, libraryItemId, options = {}) {
diff --git a/server/managers/CoverSearchManager.js b/server/managers/CoverSearchManager.js
index 193176766..ddcaa23db 100644
--- a/server/managers/CoverSearchManager.js
+++ b/server/managers/CoverSearchManager.js
@@ -224,9 +224,6 @@ class CoverSearchManager {
if (!Array.isArray(results)) return covers
results.forEach((result) => {
- if (typeof result === 'string') {
- covers.push(result)
- }
if (result.covers && Array.isArray(result.covers)) {
covers.push(...result.covers)
}
diff --git a/server/managers/CronManager.js b/server/managers/CronManager.js
index 7138d26a8..d3e652129 100644
--- a/server/managers/CronManager.js
+++ b/server/managers/CronManager.js
@@ -153,11 +153,6 @@ class CronManager {
startPodcastCron(expression, libraryItemIds) {
try {
- if (!cron.validate(expression)) {
- Logger.error(`[CronManager] Invalid auto download schedule cron expression "${expression}" - not starting podcast episode check cron`)
- return
- }
-
Logger.debug(`[CronManager] Scheduling podcast episode check cron "${expression}" for ${libraryItemIds.length} item(s)`)
const task = cron.schedule(expression, () => {
if (this.podcastCronExpressionsExecuting.includes(expression)) {
@@ -172,7 +167,7 @@ class CronManager {
task
})
} catch (error) {
- Logger.error(`[PodcastManager] Failed to schedule podcast cron ${expression}`, error)
+ Logger.error(`[PodcastManager] Failed to schedule podcast cron ${this.serverSettings.podcastEpisodeSchedule}`, error)
}
}
diff --git a/server/managers/LogManager.js b/server/managers/LogManager.js
index 07bb7d401..731dfe70a 100644
--- a/server/managers/LogManager.js
+++ b/server/managers/LogManager.js
@@ -37,13 +37,8 @@ class LogManager {
}
async ensureLogDirs() {
- try {
- await fs.ensureDir(this.DailyLogPath)
- await fs.ensureDir(this.ScanLogPath)
- } catch (error) {
- console.error(`[LogManager] Failed to create log directories at "${this.DailyLogPath}": ${error.message}`)
- throw new Error(`[LogManager] Failed to create log directories at "${this.DailyLogPath}"`, { cause: error })
- }
+ await fs.ensureDir(this.DailyLogPath)
+ await fs.ensureDir(this.ScanLogPath)
}
/**
@@ -107,20 +102,20 @@ class LogManager {
}
/**
- *
- * @param {string} filename
+ *
+ * @param {string} filename
*/
async removeLogFile(filename) {
const fullPath = Path.join(this.DailyLogPath, filename)
const exists = await fs.pathExists(fullPath)
if (!exists) {
Logger.error(TAG, 'Invalid log dne ' + fullPath)
- this.dailyLogFiles = this.dailyLogFiles.filter((dlf) => dlf !== filename)
+ this.dailyLogFiles = this.dailyLogFiles.filter(dlf => dlf !== filename)
} else {
try {
await fs.unlink(fullPath)
Logger.info(TAG, 'Removed daily log: ' + filename)
- this.dailyLogFiles = this.dailyLogFiles.filter((dlf) => dlf !== filename)
+ this.dailyLogFiles = this.dailyLogFiles.filter(dlf => dlf !== filename)
} catch (error) {
Logger.error(TAG, 'Failed to unlink log file ' + fullPath)
}
@@ -128,8 +123,8 @@ class LogManager {
}
/**
- *
- * @param {LogObject} logObj
+ *
+ * @param {LogObject} logObj
*/
async logToFile(logObj) {
// Fatal crashes get logged to a separate file
@@ -157,8 +152,8 @@ class LogManager {
}
/**
- *
- * @param {LogObject} logObj
+ *
+ * @param {LogObject} logObj
*/
async logCrashToFile(logObj) {
const line = JSON.stringify(logObj) + '\n'
@@ -166,18 +161,18 @@ class LogManager {
const logsDir = Path.join(global.MetadataPath, 'logs')
await fs.ensureDir(logsDir)
const crashLogPath = Path.join(logsDir, 'crash_logs.txt')
- return fs.writeFile(crashLogPath, line, { flag: 'a+' }).catch((error) => {
+ return fs.writeFile(crashLogPath, line, { flag: "a+" }).catch((error) => {
console.log('[LogManager] Appended crash log', error)
})
}
/**
* Most recent 5000 daily logs
- *
+ *
* @returns {string}
*/
getMostRecentCurrentDailyLogs() {
return this.currentDailyLog?.logs.slice(-5000) || ''
}
}
-module.exports = LogManager
+module.exports = LogManager
\ No newline at end of file
diff --git a/server/managers/MigrationManager.js b/server/managers/MigrationManager.js
index e302038ff..8635def10 100644
--- a/server/managers/MigrationManager.js
+++ b/server/managers/MigrationManager.js
@@ -38,12 +38,7 @@ class MigrationManager {
if (!(await fs.pathExists(this.configPath))) throw new Error(`Config path does not exist: ${this.configPath}`)
this.migrationsDir = path.join(this.configPath, 'migrations')
- try {
- await fs.ensureDir(this.migrationsDir)
- } catch (error) {
- Logger.error(`[MigrationManager] Failed to create migrations directory at "${this.migrationsDir}": ${error.message}`)
- throw new Error(`[MigrationManager] Failed to create migrations directory at "${this.migrationsDir}"`, { cause: error })
- }
+ await fs.ensureDir(this.migrationsDir)
this.serverVersion = this.extractVersionFromTag(serverVersion)
if (!this.serverVersion) throw new Error(`Invalid server version: ${serverVersion}. Expected a version tag like v1.2.3.`)
diff --git a/server/managers/PlaybackSessionManager.js b/server/managers/PlaybackSessionManager.js
index 1e95727f1..fb12fedaa 100644
--- a/server/managers/PlaybackSessionManager.js
+++ b/server/managers/PlaybackSessionManager.js
@@ -459,12 +459,7 @@ class PlaybackSessionManager {
* Remove all stream folders in `/metadata/streams`
*/
async removeOrphanStreams() {
- try {
- await fs.ensureDir(this.StreamsPath)
- } catch (error) {
- Logger.error(`[PlaybackSessionManager] Failed to create streams directory at "${this.StreamsPath}": ${error.message}`)
- throw new Error(`[PlaybackSessionManager] Failed to create streams directory at "${this.StreamsPath}"`, { cause: error })
- }
+ await fs.ensureDir(this.StreamsPath)
try {
const streamsInPath = await fs.readdir(this.StreamsPath)
for (const streamId of streamsInPath) {
diff --git a/server/managers/RssFeedManager.js b/server/managers/RssFeedManager.js
index a066a0d32..c4681bdc2 100644
--- a/server/managers/RssFeedManager.js
+++ b/server/managers/RssFeedManager.js
@@ -2,7 +2,6 @@ const { Request, Response } = require('express')
const Path = require('path')
const Logger = require('../Logger')
-const { getAudioMimeTypeFromExtname } = require('../utils/fileUtils')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
@@ -217,11 +216,6 @@ class RssFeedManager {
res.sendStatus(404)
return
}
- // Express does not set the correct mimetype for m4b files so use our defined mimetypes if available
- const audioMimeType = getAudioMimeTypeFromExtname(Path.extname(episodePath))
- if (audioMimeType) {
- res.setHeader('Content-Type', audioMimeType)
- }
res.sendFile(episodePath)
}
diff --git a/server/migrations/v2.33.0-add-discover-query-indexes.js b/server/migrations/v2.33.0-add-discover-query-indexes.js
deleted file mode 100644
index ebd92bbaa..000000000
--- a/server/migrations/v2.33.0-add-discover-query-indexes.js
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * @typedef MigrationContext
- * @property {import('sequelize').QueryInterface} queryInterface
- * @property {import('../Logger')} logger
- *
- * @typedef MigrationOptions
- * @property {MigrationContext} context
- */
-
-const migrationVersion = '2.33.0'
-const migrationName = `${migrationVersion}-add-discover-query-indexes`
-const loggerPrefix = `[${migrationVersion} migration]`
-
-const indexes = [
- {
- table: 'mediaProgresses',
- name: 'media_progresses_user_item_finished_time',
- fields: ['userId', 'mediaItemId', 'isFinished', 'currentTime']
- },
- {
- table: 'bookSeries',
- name: 'book_series_series_book',
- fields: ['seriesId', 'bookId']
- }
-]
-
-async function up({ context: { queryInterface, logger } }) {
- logger.info(`${loggerPrefix} UPGRADE BEGIN: ${migrationName}`)
-
- for (const index of indexes) {
- await addIndexIfMissing(queryInterface, logger, index)
- }
-
- logger.info(`${loggerPrefix} UPGRADE END: ${migrationName}`)
-}
-
-async function down({ context: { queryInterface, logger } }) {
- logger.info(`${loggerPrefix} DOWNGRADE BEGIN: ${migrationName}`)
-
- for (const index of indexes) {
- await removeIndexIfExists(queryInterface, logger, index)
- }
-
- logger.info(`${loggerPrefix} DOWNGRADE END: ${migrationName}`)
-}
-
-async function addIndexIfMissing(queryInterface, logger, index) {
- const existing = await queryInterface.showIndex(index.table)
- if (existing.some((i) => i.name === index.name)) {
- logger.info(`${loggerPrefix} index ${index.name} already exists on ${index.table}`)
- return
- }
-
- logger.info(`${loggerPrefix} adding index ${index.name} on ${index.table}(${index.fields.join(', ')})`)
- await queryInterface.addIndex(index.table, {
- name: index.name,
- fields: index.fields
- })
- logger.info(`${loggerPrefix} added index ${index.name}`)
-}
-
-async function removeIndexIfExists(queryInterface, logger, index) {
- const existing = await queryInterface.showIndex(index.table)
- if (!existing.some((i) => i.name === index.name)) {
- logger.info(`${loggerPrefix} index ${index.name} does not exist on ${index.table}`)
- return
- }
-
- logger.info(`${loggerPrefix} removing index ${index.name}`)
- await queryInterface.removeIndex(index.table, index.name)
- logger.info(`${loggerPrefix} removed index ${index.name}`)
-}
-
-module.exports = { up, down }
diff --git a/server/migrations/v2.35.0-add-last-refresh-token.js b/server/migrations/v2.35.0-add-last-refresh-token.js
deleted file mode 100644
index 0ad190e9a..000000000
--- a/server/migrations/v2.35.0-add-last-refresh-token.js
+++ /dev/null
@@ -1,84 +0,0 @@
-/**
- * @typedef MigrationContext
- * @property {import('sequelize').QueryInterface} queryInterface - a Sequelize QueryInterface object.
- * @property {import('../Logger')} logger - a Logger object.
- *
- * @typedef MigrationOptions
- * @property {MigrationContext} context - an object containing the migration context.
- */
-
-const migrationVersion = '2.35.0'
-const migrationName = `${migrationVersion}-add-last-refresh-token`
-const loggerPrefix = `[${migrationVersion} migration]`
-
-/**
- * This migration script adds lastRefreshToken and lastRefreshTokenExpiresAt columns to the sessions table.
- *
- * @param {MigrationOptions} options - an object containing the migration context.
- * @returns {Promise} - A promise that resolves when the migration is complete.
- */
-async function up({ context: { queryInterface, logger } }) {
- logger.info(`${loggerPrefix} UPGRADE BEGIN: ${migrationName}`)
-
- if (await queryInterface.tableExists('sessions')) {
- const tableDescription = await queryInterface.describeTable('sessions')
-
- if (!tableDescription.lastRefreshToken) {
- logger.info(`${loggerPrefix} Adding lastRefreshToken column to sessions table`)
- await queryInterface.addColumn('sessions', 'lastRefreshToken', {
- type: queryInterface.sequelize.Sequelize.DataTypes.STRING,
- allowNull: true
- })
- } else {
- logger.info(`${loggerPrefix} lastRefreshToken column already exists in sessions table`)
- }
-
- if (!tableDescription.lastRefreshTokenExpiresAt) {
- logger.info(`${loggerPrefix} Adding lastRefreshTokenExpiresAt column to sessions table`)
- await queryInterface.addColumn('sessions', 'lastRefreshTokenExpiresAt', {
- type: queryInterface.sequelize.Sequelize.DataTypes.DATE,
- allowNull: true
- })
- } else {
- logger.info(`${loggerPrefix} lastRefreshTokenExpiresAt column already exists in sessions table`)
- }
- } else {
- logger.info(`${loggerPrefix} sessions table does not exist`)
- }
-
- logger.info(`${loggerPrefix} UPGRADE END: ${migrationName}`)
-}
-
-/**
- * This migration script removes the lastRefreshToken and lastRefreshTokenExpiresAt columns from the sessions table.
- *
- * @param {MigrationOptions} options - an object containing the migration context.
- * @returns {Promise} - A promise that resolves when the migration is complete.
- */
-async function down({ context: { queryInterface, logger } }) {
- logger.info(`${loggerPrefix} DOWNGRADE BEGIN: ${migrationName}`)
-
- if (await queryInterface.tableExists('sessions')) {
- const tableDescription = await queryInterface.describeTable('sessions')
-
- if (tableDescription.lastRefreshToken) {
- logger.info(`${loggerPrefix} Removing lastRefreshToken column from sessions table`)
- await queryInterface.removeColumn('sessions', 'lastRefreshToken')
- } else {
- logger.info(`${loggerPrefix} lastRefreshToken column does not exist in sessions table`)
- }
-
- if (tableDescription.lastRefreshTokenExpiresAt) {
- logger.info(`${loggerPrefix} Removing lastRefreshTokenExpiresAt column from sessions table`)
- await queryInterface.removeColumn('sessions', 'lastRefreshTokenExpiresAt')
- } else {
- logger.info(`${loggerPrefix} lastRefreshTokenExpiresAt column does not exist in sessions table`)
- }
- } else {
- logger.info(`${loggerPrefix} sessions table does not exist`)
- }
-
- logger.info(`${loggerPrefix} DOWNGRADE END: ${migrationName}`)
-}
-
-module.exports = { up, down }
diff --git a/server/models/Author.js b/server/models/Author.js
index 65561e211..287b66976 100644
--- a/server/models/Author.js
+++ b/server/models/Author.js
@@ -111,17 +111,16 @@ class Author extends Model {
*
* @param {string} name
* @param {string} libraryId
- * @returns {Promise<{ author: Author, created: boolean }>}
+ * @returns {Promise}
*/
static async findOrCreateByNameAndLibrary(name, libraryId) {
const author = await this.getByNameAndLibrary(name, libraryId)
- if (author) return { author, created: false }
- const newAuthor = await this.create({
+ if (author) return author
+ return this.create({
name,
lastFirst: this.getLastFirst(name),
libraryId
})
- return { author: newAuthor, created: true }
}
/**
diff --git a/server/models/Book.js b/server/models/Book.js
index 7e1a2e30c..96371f3a2 100644
--- a/server/models/Book.js
+++ b/server/models/Book.js
@@ -4,7 +4,6 @@ const { getTitlePrefixAtEnd, getTitleIgnorePrefix } = require('../utils')
const parseNameString = require('../utils/parsers/parseNameString')
const htmlSanitizer = require('../utils/htmlSanitizer')
const libraryItemsBookFilters = require('../utils/queries/libraryItemsBookFilters')
-const SocketAuthority = require('../SocketAuthority')
/**
* @typedef EBookFileObject
@@ -471,23 +470,13 @@ class Book extends Model {
for (const author of authorsRemoved) {
await bookAuthorModel.removeByIds(author.id, this.id)
- const numBooks = await bookAuthorModel.getCountForAuthor(author.id)
- if (numBooks > 0) {
- SocketAuthority.emitter('author_updated', author.toOldJSONExpanded(numBooks))
- }
Logger.debug(`[Book] "${this.title}" Removed author "${author.name}"`)
this.authors = this.authors.filter((au) => au.id !== author.id)
}
const authorsAdded = []
for (const authorName of newAuthorNames) {
- const { author, created } = await authorModel.findOrCreateByNameAndLibrary(authorName, libraryId)
+ const author = await authorModel.findOrCreateByNameAndLibrary(authorName, libraryId)
await bookAuthorModel.create({ bookId: this.id, authorId: author.id })
- if (created) {
- SocketAuthority.emitter('author_added', author.toOldJSON())
- } else {
- const numBooks = await bookAuthorModel.getCountForAuthor(author.id)
- SocketAuthority.emitter('author_updated', author.toOldJSONExpanded(numBooks))
- }
Logger.debug(`[Book] "${this.title}" Added author "${author.name}"`)
this.authors.push(author)
authorsAdded.push(author)
@@ -647,11 +636,6 @@ class Book extends Model {
}
}
- /**
- * Minified book JSON for list/shelf endpoints.
- * `toOldJSONExpanded()` must be a strict superset: every key here must exist in expanded
- * with the same value semantics. Only additive changes to expanded; never remove or rename keys.
- */
toOldJSONMinified() {
if (!this.authors) {
throw new Error(`[Book] Cannot convert to old JSON because authors are not loaded`)
@@ -674,12 +658,6 @@ class Book extends Model {
}
}
- /**
- * Expanded book JSON for item detail and socket events.
- * Must be a strict superset of `toOldJSONMinified()` — built by spreading minified, then adding expanded-only fields.
- *
- * @param {string} libraryItemId
- */
toOldJSONExpanded(libraryItemId) {
if (!libraryItemId) {
throw new Error(`[Book] Cannot convert to old JSON because libraryItemId is not provided`)
@@ -692,12 +670,16 @@ class Book extends Model {
}
return {
- ...this.toOldJSONMinified(),
- libraryItemId,
+ id: this.id,
+ libraryItemId: libraryItemId,
metadata: this.oldMetadataToJSONExpanded(),
+ coverPath: this.coverPath,
+ tags: [...(this.tags || [])],
audioFiles: structuredClone(this.audioFiles),
chapters: structuredClone(this.chapters),
ebookFile: structuredClone(this.ebookFile),
+ duration: this.duration,
+ size: this.size,
tracks: this.getTracklist(libraryItemId)
}
}
diff --git a/server/models/BookAuthor.js b/server/models/BookAuthor.js
index f2cbf60f0..d7d65728e 100644
--- a/server/models/BookAuthor.js
+++ b/server/models/BookAuthor.js
@@ -1,4 +1,4 @@
-const { DataTypes, Model, fn, col } = require('sequelize')
+const { DataTypes, Model } = require('sequelize')
class BookAuthor extends Model {
constructor(values, options) {
@@ -37,32 +37,6 @@ class BookAuthor extends Model {
})
}
- /**
- * Get number of books for each author
- *
- * @param {string[]} authorIds
- * @returns {Promise>}
- */
- static async getCountsForAuthors(authorIds) {
- if (!authorIds.length) return {}
-
- const rows = await this.findAll({
- attributes: ['authorId', [fn('COUNT', col('id')), 'count']],
- where: {
- authorId: authorIds
- },
- group: ['authorId'],
- raw: true
- })
-
- /** @type {Record} */
- const counts = {}
- for (const row of rows) {
- counts[row.authorId] = Number(row.count)
- }
- return counts
- }
-
/**
* Initialize model
* @param {import('../Database').sequelize} sequelize
diff --git a/server/models/BookSeries.js b/server/models/BookSeries.js
index e71f28a8e..31eccb9fa 100644
--- a/server/models/BookSeries.js
+++ b/server/models/BookSeries.js
@@ -48,10 +48,6 @@ class BookSeries extends Model {
{
name: 'bookSeries_seriesId',
fields: ['seriesId']
- },
- {
- name: 'book_series_series_book',
- fields: ['seriesId', 'bookId']
}
]
}
diff --git a/server/models/LibraryItem.js b/server/models/LibraryItem.js
index c03667efc..16a521615 100644
--- a/server/models/LibraryItem.js
+++ b/server/models/LibraryItem.js
@@ -340,15 +340,6 @@ class LibraryItem extends Model {
const shelves = []
- const timed = async (loader) => {
- const start = Date.now()
- const payload = await loader()
- return {
- payload,
- elapsedSeconds: ((Date.now() - start) / 1000).toFixed(2)
- }
- }
-
// "Continue Listening" shelf
const itemsInProgressPayload = await libraryFilters.getMediaItemsInProgress(library, user, include, limit, false)
if (itemsInProgressPayload.items.length) {
@@ -380,18 +371,11 @@ class LibraryItem extends Model {
}
Logger.debug(`Loaded ${itemsInProgressPayload.items.length} of ${itemsInProgressPayload.count} items for "Continue Listening/Reading" in ${((Date.now() - fullStart) / 1000).toFixed(2)}s`)
+ let start = Date.now()
if (library.isBook) {
- const [continueSeriesResult, mostRecentResult, seriesMostRecentResult, discoverResult, mediaFinishedResult, newestAuthorsResult] = await Promise.all([
- timed(() => libraryFilters.getLibraryItemsContinueSeries(library, user, include, limit)),
- timed(() => libraryFilters.getLibraryItemsMostRecentlyAdded(library, user, include, limit)),
- timed(() => libraryFilters.getSeriesMostRecentlyAdded(library, user, include, 5)),
- timed(() => libraryFilters.getLibraryItemsToDiscover(library, user, include, limit)),
- timed(() => libraryFilters.getMediaFinished(library, user, include, limit)),
- timed(() => libraryFilters.getNewestAuthors(library, user, limit))
- ])
-
- const continueSeriesPayload = continueSeriesResult.payload
+ start = Date.now()
// "Continue Series" shelf
+ const continueSeriesPayload = await libraryFilters.getLibraryItemsContinueSeries(library, user, include, limit)
if (continueSeriesPayload.libraryItems.length) {
shelves.push({
id: 'continue-series',
@@ -402,103 +386,10 @@ class LibraryItem extends Model {
total: continueSeriesPayload.count
})
}
- Logger.debug(`Loaded ${continueSeriesPayload.libraryItems.length} of ${continueSeriesPayload.count} items for "Continue Series" in ${continueSeriesResult.elapsedSeconds}s`)
-
- const mostRecentPayload = mostRecentResult.payload
- // "Recently Added" shelf
- if (mostRecentPayload.libraryItems.length) {
- shelves.push({
- id: 'recently-added',
- label: 'Recently Added',
- labelStringKey: 'LabelRecentlyAdded',
- type: library.mediaType,
- entities: mostRecentPayload.libraryItems,
- total: mostRecentPayload.count
- })
- }
- Logger.debug(`Loaded ${mostRecentPayload.libraryItems.length} of ${mostRecentPayload.count} items for "Recently Added" in ${mostRecentResult.elapsedSeconds}s`)
-
- const seriesMostRecentPayload = seriesMostRecentResult.payload
- // "Recent Series" shelf
- if (seriesMostRecentPayload.series.length) {
- shelves.push({
- id: 'recent-series',
- label: 'Recent Series',
- labelStringKey: 'LabelRecentSeries',
- type: 'series',
- entities: seriesMostRecentPayload.series,
- total: seriesMostRecentPayload.count
- })
- }
- Logger.debug(`Loaded ${seriesMostRecentPayload.series.length} of ${seriesMostRecentPayload.count} series for "Recent Series" in ${seriesMostRecentResult.elapsedSeconds}s`)
-
- const discoverLibraryItemsPayload = discoverResult.payload
- // "Discover" shelf
- if (discoverLibraryItemsPayload.libraryItems.length) {
- shelves.push({
- id: 'discover',
- label: 'Discover',
- labelStringKey: 'LabelDiscover',
- type: library.mediaType,
- entities: discoverLibraryItemsPayload.libraryItems,
- total: discoverLibraryItemsPayload.count
- })
- }
- Logger.debug(`Loaded ${discoverLibraryItemsPayload.libraryItems.length} of ${discoverLibraryItemsPayload.count} items for "Discover" in ${discoverResult.elapsedSeconds}s`)
-
- const mediaFinishedPayload = mediaFinishedResult.payload
- // "Listen Again" shelf
- if (mediaFinishedPayload.items.length) {
- const ebookOnlyItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.ebookFormat && !li.media.numTracks)
- const audioItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.numTracks || li.mediaType === 'podcast')
-
- if (audioItemsInProgress.length) {
- shelves.push({
- id: 'listen-again',
- label: 'Listen Again',
- labelStringKey: 'LabelListenAgain',
- type: library.isPodcast ? 'episode' : 'book',
- entities: audioItemsInProgress,
- total: mediaFinishedPayload.count
- })
- }
-
- if (ebookOnlyItemsInProgress.length) {
- // "Read Again" shelf
- shelves.push({
- id: 'read-again',
- label: 'Read Again',
- labelStringKey: 'LabelReadAgain',
- type: 'book',
- entities: ebookOnlyItemsInProgress,
- total: mediaFinishedPayload.count
- })
- }
- }
- Logger.debug(`Loaded ${mediaFinishedPayload.items.length} of ${mediaFinishedPayload.count} items for "Listen/Read Again" in ${mediaFinishedResult.elapsedSeconds}s`)
-
- const newestAuthorsPayload = newestAuthorsResult.payload
- // "Newest Authors" shelf
- if (newestAuthorsPayload.authors.length) {
- shelves.push({
- id: 'newest-authors',
- label: 'Newest Authors',
- labelStringKey: 'LabelNewestAuthors',
- type: 'authors',
- entities: newestAuthorsPayload.authors,
- total: newestAuthorsPayload.count
- })
- }
- Logger.debug(`Loaded ${newestAuthorsPayload.authors.length} of ${newestAuthorsPayload.count} authors for "Newest Authors" in ${newestAuthorsResult.elapsedSeconds}s`)
+ Logger.debug(`Loaded ${continueSeriesPayload.libraryItems.length} of ${continueSeriesPayload.count} items for "Continue Series" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
} else if (library.isPodcast) {
- const [newestEpisodesResult, mostRecentResult, mediaFinishedResult] = await Promise.all([
- timed(() => libraryFilters.getNewestPodcastEpisodes(library, user, limit)),
- timed(() => libraryFilters.getLibraryItemsMostRecentlyAdded(library, user, include, limit)),
- timed(() => libraryFilters.getMediaFinished(library, user, include, limit))
- ])
-
- const newestEpisodesPayload = newestEpisodesResult.payload
// "Newest Episodes" shelf
+ const newestEpisodesPayload = await libraryFilters.getNewestPodcastEpisodes(library, user, limit)
if (newestEpisodesPayload.libraryItems.length) {
shelves.push({
id: 'newest-episodes',
@@ -509,52 +400,103 @@ class LibraryItem extends Model {
total: newestEpisodesPayload.count
})
}
- Logger.debug(`Loaded ${newestEpisodesPayload.libraryItems.length} of ${newestEpisodesPayload.count} episodes for "Newest Episodes" in ${newestEpisodesResult.elapsedSeconds}s`)
+ Logger.debug(`Loaded ${newestEpisodesPayload.libraryItems.length} of ${newestEpisodesPayload.count} episodes for "Newest Episodes" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
+ }
- const mostRecentPayload = mostRecentResult.payload
- // "Recently Added" shelf
- if (mostRecentPayload.libraryItems.length) {
+ start = Date.now()
+ // "Recently Added" shelf
+ const mostRecentPayload = await libraryFilters.getLibraryItemsMostRecentlyAdded(library, user, include, limit)
+ if (mostRecentPayload.libraryItems.length) {
+ shelves.push({
+ id: 'recently-added',
+ label: 'Recently Added',
+ labelStringKey: 'LabelRecentlyAdded',
+ type: library.mediaType,
+ entities: mostRecentPayload.libraryItems,
+ total: mostRecentPayload.count
+ })
+ }
+ Logger.debug(`Loaded ${mostRecentPayload.libraryItems.length} of ${mostRecentPayload.count} items for "Recently Added" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
+
+ if (library.isBook) {
+ start = Date.now()
+ // "Recent Series" shelf
+ const seriesMostRecentPayload = await libraryFilters.getSeriesMostRecentlyAdded(library, user, include, 5)
+ if (seriesMostRecentPayload.series.length) {
shelves.push({
- id: 'recently-added',
- label: 'Recently Added',
- labelStringKey: 'LabelRecentlyAdded',
- type: library.mediaType,
- entities: mostRecentPayload.libraryItems,
- total: mostRecentPayload.count
+ id: 'recent-series',
+ label: 'Recent Series',
+ labelStringKey: 'LabelRecentSeries',
+ type: 'series',
+ entities: seriesMostRecentPayload.series,
+ total: seriesMostRecentPayload.count
})
}
- Logger.debug(`Loaded ${mostRecentPayload.libraryItems.length} of ${mostRecentPayload.count} items for "Recently Added" in ${mostRecentResult.elapsedSeconds}s`)
+ Logger.debug(`Loaded ${seriesMostRecentPayload.series.length} of ${seriesMostRecentPayload.count} series for "Recent Series" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
- const mediaFinishedPayload = mediaFinishedResult.payload
- // "Listen Again" shelf
- if (mediaFinishedPayload.items.length) {
- const ebookOnlyItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.ebookFormat && !li.media.numTracks)
- const audioItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.numTracks || li.mediaType === 'podcast')
-
- if (audioItemsInProgress.length) {
- shelves.push({
- id: 'listen-again',
- label: 'Listen Again',
- labelStringKey: 'LabelListenAgain',
- type: 'episode',
- entities: audioItemsInProgress,
- total: mediaFinishedPayload.count
- })
- }
-
- if (ebookOnlyItemsInProgress.length) {
- // "Read Again" shelf
- shelves.push({
- id: 'read-again',
- label: 'Read Again',
- labelStringKey: 'LabelReadAgain',
- type: 'book',
- entities: ebookOnlyItemsInProgress,
- total: mediaFinishedPayload.count
- })
- }
+ start = Date.now()
+ // "Discover" shelf
+ const discoverLibraryItemsPayload = await libraryFilters.getLibraryItemsToDiscover(library, user, include, limit)
+ if (discoverLibraryItemsPayload.libraryItems.length) {
+ shelves.push({
+ id: 'discover',
+ label: 'Discover',
+ labelStringKey: 'LabelDiscover',
+ type: library.mediaType,
+ entities: discoverLibraryItemsPayload.libraryItems,
+ total: discoverLibraryItemsPayload.count
+ })
}
- Logger.debug(`Loaded ${mediaFinishedPayload.items.length} of ${mediaFinishedPayload.count} items for "Listen/Read Again" in ${mediaFinishedResult.elapsedSeconds}s`)
+ Logger.debug(`Loaded ${discoverLibraryItemsPayload.libraryItems.length} of ${discoverLibraryItemsPayload.count} items for "Discover" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
+ }
+
+ start = Date.now()
+ // "Listen Again" shelf
+ const mediaFinishedPayload = await libraryFilters.getMediaFinished(library, user, include, limit)
+ if (mediaFinishedPayload.items.length) {
+ const ebookOnlyItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.ebookFormat && !li.media.numTracks)
+ const audioItemsInProgress = mediaFinishedPayload.items.filter((li) => li.media.numTracks || li.mediaType === 'podcast')
+
+ if (audioItemsInProgress.length) {
+ shelves.push({
+ id: 'listen-again',
+ label: 'Listen Again',
+ labelStringKey: 'LabelListenAgain',
+ type: library.isPodcast ? 'episode' : 'book',
+ entities: audioItemsInProgress,
+ total: mediaFinishedPayload.count
+ })
+ }
+
+ // "Read Again" shelf
+ if (ebookOnlyItemsInProgress.length) {
+ shelves.push({
+ id: 'read-again',
+ label: 'Read Again',
+ labelStringKey: 'LabelReadAgain',
+ type: 'book',
+ entities: ebookOnlyItemsInProgress,
+ total: mediaFinishedPayload.count
+ })
+ }
+ }
+ Logger.debug(`Loaded ${mediaFinishedPayload.items.length} of ${mediaFinishedPayload.count} items for "Listen/Read Again" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
+
+ if (library.isBook) {
+ start = Date.now()
+ // "Newest Authors" shelf
+ const newestAuthorsPayload = await libraryFilters.getNewestAuthors(library, user, limit)
+ if (newestAuthorsPayload.authors.length) {
+ shelves.push({
+ id: 'newest-authors',
+ label: 'Newest Authors',
+ labelStringKey: 'LabelNewestAuthors',
+ type: 'authors',
+ entities: newestAuthorsPayload.authors,
+ total: newestAuthorsPayload.count
+ })
+ }
+ Logger.debug(`Loaded ${newestAuthorsPayload.authors.length} of ${newestAuthorsPayload.count} authors for "Newest Authors" in ${((Date.now() - start) / 1000).toFixed(2)}s`)
}
Logger.debug(`Loaded ${shelves.length} personalized shelves in ${((Date.now() - fullStart) / 1000).toFixed(2)}s`)
@@ -1004,11 +946,6 @@ class LibraryItem extends Model {
}
}
- /**
- * Minified library item JSON for list/shelf endpoints.
- * `toOldJSONExpanded()` must be a strict superset: every key here must exist in expanded
- * with the same value semantics. Only additive changes to expanded; never remove or rename keys.
- */
toOldJSONMinified() {
if (!this.media) {
throw new Error(`[LibraryItem] Cannot convert to old JSON without media for library item "${this.id}"`)
@@ -1037,18 +974,30 @@ class LibraryItem extends Model {
}
}
- /**
- * Expanded library item JSON for item detail and socket events.
- * Must be a strict superset of `toOldJSONMinified()` — built by spreading minified, then adding expanded-only fields.
- */
toOldJSONExpanded() {
return {
- ...this.toOldJSONMinified(),
+ id: this.id,
+ ino: this.ino,
+ oldLibraryItemId: this.extraData?.oldLibraryItemId || null,
+ libraryId: this.libraryId,
+ folderId: this.libraryFolderId,
+ path: this.path,
+ relPath: this.relPath,
+ isFile: this.isFile,
+ mtimeMs: this.mtime?.valueOf(),
+ ctimeMs: this.ctime?.valueOf(),
+ birthtimeMs: this.birthtime?.valueOf(),
+ addedAt: this.createdAt.valueOf(),
+ updatedAt: this.updatedAt.valueOf(),
lastScan: this.lastScan?.valueOf(),
scanVersion: this.lastScanVersion,
+ isMissing: !!this.isMissing,
+ isInvalid: !!this.isInvalid,
+ mediaType: this.mediaType,
media: this.media.toOldJSONExpanded(this.id),
// LibraryFile JSON includes a fileType property that may not be saved in libraryFiles column in the database
- libraryFiles: this.getLibraryFilesJson()
+ libraryFiles: this.getLibraryFilesJson(),
+ size: this.size
}
}
}
diff --git a/server/models/MediaProgress.js b/server/models/MediaProgress.js
index 9c0269a9e..0ebe2f598 100644
--- a/server/models/MediaProgress.js
+++ b/server/models/MediaProgress.js
@@ -80,10 +80,6 @@ class MediaProgress extends Model {
indexes: [
{
fields: ['updatedAt']
- },
- {
- name: 'media_progresses_user_item_finished_time',
- fields: ['userId', 'mediaItemId', 'isFinished', 'currentTime']
}
]
}
diff --git a/server/models/Podcast.js b/server/models/Podcast.js
index 9c222e48a..a96e1dd02 100644
--- a/server/models/Podcast.js
+++ b/server/models/Podcast.js
@@ -78,7 +78,6 @@ class Podcast extends Model {
*/
static async createFromRequest(payload, transaction) {
const title = typeof payload.metadata.title === 'string' ? payload.metadata.title : null
- // cron expression validated in controller
const autoDownloadSchedule = typeof payload.autoDownloadSchedule === 'string' ? payload.autoDownloadSchedule : null
const genres = Array.isArray(payload.metadata.genres) && payload.metadata.genres.every((g) => typeof g === 'string' && g.length) ? payload.metadata.genres : []
const tags = Array.isArray(payload.tags) && payload.tags.every((t) => typeof t === 'string' && t.length) ? payload.tags : []
@@ -90,9 +89,6 @@ class Podcast extends Model {
}
})
- const rawDescription = typeof payload.metadata.description === 'string' ? payload.metadata.description : null
- const description = rawDescription ? htmlSanitizer.sanitize(rawDescription) : null
-
return this.create(
{
title,
@@ -101,7 +97,7 @@ class Podcast extends Model {
releaseDate: typeof payload.metadata.releaseDate === 'string' ? payload.metadata.releaseDate : null,
feedURL: typeof payload.metadata.feedUrl === 'string' ? payload.metadata.feedUrl : null,
imageURL: typeof payload.metadata.imageUrl === 'string' ? payload.metadata.imageUrl : null,
- description,
+ description: typeof payload.metadata.description === 'string' ? payload.metadata.description : null,
itunesPageURL: typeof payload.metadata.itunesPageUrl === 'string' ? payload.metadata.itunesPageUrl : null,
itunesId: typeof payload.metadata.itunesId === 'string' ? payload.metadata.itunesId : null,
itunesArtistId: typeof payload.metadata.itunesArtistId === 'string' ? payload.metadata.itunesArtistId : null,
@@ -274,7 +270,6 @@ class Podcast extends Model {
hasUpdates = true
}
if (typeof payload.autoDownloadSchedule === 'string' && payload.autoDownloadSchedule !== this.autoDownloadSchedule) {
- // cron expression validated in controller
this.autoDownloadSchedule = payload.autoDownloadSchedule
hasUpdates = true
}
@@ -451,11 +446,6 @@ class Podcast extends Model {
}
}
- /**
- * Minified podcast JSON for list/shelf endpoints.
- * `toOldJSONExpanded()` must be a strict superset: every key here must exist in expanded
- * with the same value semantics. Only additive changes to expanded; never remove or rename keys.
- */
toOldJSONMinified() {
return {
id: this.id,
@@ -473,12 +463,6 @@ class Podcast extends Model {
}
}
- /**
- * Expanded podcast JSON for item detail and socket events.
- * Must be a strict superset of `toOldJSONMinified()` — built by spreading minified, then adding expanded-only fields.
- *
- * @param {string} libraryItemId
- */
toOldJSONExpanded(libraryItemId) {
if (!libraryItemId) {
throw new Error(`[Podcast] Cannot convert to old JSON because libraryItemId is not provided`)
@@ -488,9 +472,18 @@ class Podcast extends Model {
}
return {
- ...this.toOldJSONMinified(),
- libraryItemId,
- episodes: this.podcastEpisodes.map((e) => e.toOldJSONExpanded(libraryItemId))
+ id: this.id,
+ libraryItemId: libraryItemId,
+ metadata: this.oldMetadataToJSONExpanded(),
+ coverPath: this.coverPath,
+ tags: [...(this.tags || [])],
+ episodes: this.podcastEpisodes.map((e) => e.toOldJSONExpanded(libraryItemId)),
+ autoDownloadEpisodes: this.autoDownloadEpisodes,
+ autoDownloadSchedule: this.autoDownloadSchedule,
+ lastEpisodeCheck: this.lastEpisodeCheck?.valueOf() || null,
+ maxEpisodesToKeep: this.maxEpisodesToKeep,
+ maxNewEpisodesToDownload: this.maxNewEpisodesToDownload,
+ size: this.size
}
}
}
diff --git a/server/models/Session.js b/server/models/Session.js
index 3b85bd46a..fe9dd5425 100644
--- a/server/models/Session.js
+++ b/server/models/Session.js
@@ -18,10 +18,6 @@ class Session extends Model {
this.userId
/** @type {Date} */
this.expiresAt
- /** @type {string} */
- this.lastRefreshToken
- /** @type {Date} */
- this.lastRefreshTokenExpiresAt
// Expanded properties
@@ -70,14 +66,6 @@ class Session extends Model {
expiresAt: {
type: DataTypes.DATE,
allowNull: false
- },
- lastRefreshToken: {
- type: DataTypes.STRING,
- allowNull: true
- },
- lastRefreshTokenExpiresAt: {
- type: DataTypes.DATE,
- allowNull: true
}
},
{
diff --git a/server/models/User.js b/server/models/User.js
index f380f8e4f..36b2eca98 100644
--- a/server/models/User.js
+++ b/server/models/User.js
@@ -352,7 +352,11 @@ class User extends Model {
if (cachedUser) return cachedUser
const user = await this.findOne({
- where: sequelize.where(sequelize.fn('lower', sequelize.col('username')), username.toLowerCase()),
+ where: {
+ username: {
+ [sequelize.Op.like]: username
+ }
+ },
include: this.sequelize.models.mediaProgress
})
@@ -373,7 +377,11 @@ class User extends Model {
if (cachedUser) return cachedUser
const user = await this.findOne({
- where: sequelize.where(sequelize.fn('lower', sequelize.col('email')), email.toLowerCase()),
+ where: {
+ email: {
+ [sequelize.Op.like]: email
+ }
+ },
include: this.sequelize.models.mediaProgress
})
@@ -774,14 +782,7 @@ class User extends Model {
error: 'Library item not found',
statusCode: 404
}
- } else if (libraryItem.mediaType !== 'book') {
- Logger.error(`[User] createUpdateMediaProgress: library item ${progressPayload.libraryItemId} is not a book`)
- return {
- error: 'Library item is not a book',
- statusCode: 400
- }
}
-
mediaItemId = libraryItem.media.id
mediaProgress = libraryItem.media.mediaProgresses?.[0]
}
diff --git a/server/objects/DeviceInfo.js b/server/objects/DeviceInfo.js
index 68237f0fb..ceff6c32e 100644
--- a/server/objects/DeviceInfo.js
+++ b/server/objects/DeviceInfo.js
@@ -1,10 +1,6 @@
-const uuidv4 = require('uuid').v4
-const { stripAllTags } = require('../utils/htmlSanitizer')
+const uuidv4 = require("uuid").v4
class DeviceInfo {
- /** @type {string[]} Fields to sanitize when loading from stored data */
- static stringFields = ['deviceId', 'clientVersion', 'manufacturer', 'model', 'sdkVersion', 'clientName', 'deviceName']
-
constructor(deviceInfo = null) {
this.id = null
this.userId = null
@@ -35,7 +31,7 @@ class DeviceInfo {
construct(deviceInfo) {
for (const key in deviceInfo) {
if (deviceInfo[key] !== undefined && this[key] !== undefined) {
- this[key] = DeviceInfo.stringFields.includes(key) ? stripAllTags(deviceInfo[key]) : deviceInfo[key]
+ this[key] = deviceInfo[key]
}
}
}
@@ -67,8 +63,7 @@ class DeviceInfo {
}
get deviceDescription() {
- if (this.model) {
- // Set from mobile apps
+ if (this.model) { // Set from mobile apps
if (this.sdkVersion) return `${this.model} SDK ${this.sdkVersion} / v${this.clientVersion}`
return `${this.model} / v${this.clientVersion}`
}
@@ -77,7 +72,18 @@ class DeviceInfo {
// When client doesn't send a device id
getTempDeviceId() {
- const keys = [this.userId, this.browserName, this.browserVersion, this.osName, this.osVersion, this.clientVersion, this.manufacturer, this.model, this.sdkVersion, this.ipAddress].map((k) => k || '')
+ const keys = [
+ this.userId,
+ this.browserName,
+ this.browserVersion,
+ this.osName,
+ this.osVersion,
+ this.clientVersion,
+ this.manufacturer,
+ this.model,
+ this.sdkVersion,
+ this.ipAddress
+ ].map(k => k || '')
return 'temp-' + Buffer.from(keys.join('-'), 'utf-8').toString('base64')
}
@@ -93,17 +99,12 @@ class DeviceInfo {
this.osVersion = ua?.os.version || null
this.deviceType = ua?.device.type || null
- this.clientVersion = stripAllTags(clientDeviceInfo?.clientVersion) || serverVersion
- this.manufacturer = stripAllTags(clientDeviceInfo?.manufacturer) || null
- this.model = stripAllTags(clientDeviceInfo?.model) || null
+ this.clientVersion = clientDeviceInfo?.clientVersion || serverVersion
+ this.manufacturer = clientDeviceInfo?.manufacturer || null
+ this.model = clientDeviceInfo?.model || null
+ this.sdkVersion = clientDeviceInfo?.sdkVersion || null
- if (typeof clientDeviceInfo?.sdkVersion === 'number') {
- this.sdkVersion = clientDeviceInfo.sdkVersion.toString()
- } else {
- this.sdkVersion = stripAllTags(clientDeviceInfo?.sdkVersion) || null
- }
-
- this.clientName = stripAllTags(clientDeviceInfo?.clientName) || null
+ this.clientName = clientDeviceInfo?.clientName || null
if (this.sdkVersion) {
if (!this.clientName) this.clientName = 'Abs Android'
this.deviceName = `${this.manufacturer || 'Unknown'} ${this.model || ''}`
@@ -148,4 +149,4 @@ class DeviceInfo {
return hasUpdates
}
}
-module.exports = DeviceInfo
+module.exports = DeviceInfo
\ No newline at end of file
diff --git a/server/objects/PlaybackSession.js b/server/objects/PlaybackSession.js
index ace0256e8..ba031b665 100644
--- a/server/objects/PlaybackSession.js
+++ b/server/objects/PlaybackSession.js
@@ -110,8 +110,7 @@ class PlaybackSession {
startedAt: this.startedAt,
updatedAt: this.updatedAt,
audioTracks: this.audioTracks.map((at) => at.toJSON?.() || { ...at }),
- libraryItem: libraryItem?.toOldJSONExpanded() || null,
- coverAspectRatio: this.coverAspectRatio !== null ? this.coverAspectRatio : undefined // Used for share sessions
+ libraryItem: libraryItem?.toOldJSONExpanded() || null
}
}
diff --git a/server/objects/Stream.js b/server/objects/Stream.js
index 70361463f..d9bdd583c 100644
--- a/server/objects/Stream.js
+++ b/server/objects/Stream.js
@@ -73,7 +73,7 @@ class Stream extends EventEmitter {
return [AudioMimeType.FLAC, AudioMimeType.OPUS, AudioMimeType.WMA, AudioMimeType.AIFF, AudioMimeType.WEBM, AudioMimeType.WEBMA, AudioMimeType.AWB, AudioMimeType.CAF]
}
get codecsToForceAAC() {
- return ['alac', 'ac3', 'eac3', 'opus']
+ return ['alac']
}
get userToken() {
return this.user.token
@@ -273,16 +273,7 @@ class Stream extends EventEmitter {
audioCodec = 'aac'
}
- const codecOptions = [`-loglevel ${logLevel}`, '-map 0:a']
-
- if (['ac3', 'eac3'].includes(this.tracksCodec) && this.tracks.length > 0 && this.tracks[0].bitRate && this.tracks[0].channels) {
- // In case for ac3/eac3 it needs to be passed the bitrate and channels to avoid ffmpeg errors
- codecOptions.push(`-c:a ${audioCodec}`, `-b:a ${this.tracks[0].bitRate}`, `-ac ${this.tracks[0].channels}`)
- } else {
- codecOptions.push(`-c:a ${audioCodec}`)
- }
-
- this.ffmpeg.addOption(codecOptions)
+ this.ffmpeg.addOption([`-loglevel ${logLevel}`, '-map 0:a', `-c:a ${audioCodec}`])
const hlsOptions = ['-f hls', '-copyts', '-avoid_negative_ts make_non_negative', '-max_delay 5000000', '-max_muxing_queue_size 2048', `-hls_time 6`, `-hls_segment_type ${this.hlsSegmentType}`, `-start_number ${this.segmentStartNumber}`, '-hls_playlist_type vod', '-hls_list_size 0', '-hls_allow_cache 0']
this.ffmpeg.addOption(hlsOptions)
if (this.hlsSegmentType === 'fmp4') {
diff --git a/server/objects/settings/ServerSettings.js b/server/objects/settings/ServerSettings.js
index f0bb4b201..a03e17c75 100644
--- a/server/objects/settings/ServerSettings.js
+++ b/server/objects/settings/ServerSettings.js
@@ -3,7 +3,6 @@ const packageJson = require('../../../package.json')
const { BookshelfView } = require('../../utils/constants')
const Logger = require('../../Logger')
const User = require('../../models/User')
-const { sanitize } = require('../../utils/htmlSanitizer')
class ServerSettings {
constructor(settings) {
@@ -127,7 +126,7 @@ class ServerSettings {
this.version = settings.version || null
this.buildNumber = settings.buildNumber || 0 // Added v2.4.5
- this.authLoginCustomMessage = sanitize(settings.authLoginCustomMessage) || null // Added v2.8.0
+ this.authLoginCustomMessage = settings.authLoginCustomMessage || null // Added v2.8.0
this.authActiveAuthMethods = settings.authActiveAuthMethods || ['local']
this.authOpenIDIssuerURL = settings.authOpenIDIssuerURL || null
@@ -260,18 +259,6 @@ class ServerSettings {
}
}
- /**
- * Host timezone used by cron schedulers (not persisted in settings)
- * @returns {string} IANA timezone name, e.g. "America/New_York"
- */
- static getHostTimeZone() {
- try {
- return Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC'
- } catch {
- return 'UTC'
- }
- }
-
toJSONForBrowser() {
const json = this.toJSON()
delete json.tokenSecret
@@ -280,7 +267,6 @@ class ServerSettings {
delete json.authOpenIDMobileRedirectURIs
delete json.authOpenIDGroupClaim
delete json.authOpenIDAdvancedPermsClaim
- json.timeZone = ServerSettings.getHostTimeZone()
return json
}
@@ -323,7 +309,7 @@ class ServerSettings {
get authFormData() {
const clientFormData = {
- authLoginCustomMessage: sanitize(this.authLoginCustomMessage)
+ authLoginCustomMessage: this.authLoginCustomMessage
}
if (this.authActiveAuthMethods.includes('openid')) {
clientFormData.authOpenIDButtonText = this.authOpenIDButtonText
@@ -341,9 +327,6 @@ class ServerSettings {
update(payload) {
let hasUpdates = false
for (const key in payload) {
- if (key === 'authLoginCustomMessage') {
- payload[key] = sanitize(payload[key])
- }
if (key === 'sortingPrefixes') {
// Sorting prefixes are updated with the /api/sorting-prefixes endpoint
continue
diff --git a/server/providers/Audible.js b/server/providers/Audible.js
index 133d3c0d8..2c12ffc1a 100644
--- a/server/providers/Audible.js
+++ b/server/providers/Audible.js
@@ -57,13 +57,8 @@ class Audible {
})
}
- let genresCleaned = []
- let tagsCleaned = []
-
- if (genres && Array.isArray(genres)) {
- genresCleaned = [...new Set(genres.filter((g) => g.type == 'genre').map((g) => g.name))]
- tagsCleaned = [...new Set(genres.filter((g) => g.type == 'tag').map((g) => g.name))]
- }
+ const genresFiltered = genres ? genres.filter((g) => g.type == 'genre').map((g) => g.name) : []
+ const tagsFiltered = genres ? genres.filter((g) => g.type == 'tag').map((g) => g.name) : []
return {
title,
@@ -76,8 +71,8 @@ class Audible {
cover: image,
asin,
isbn,
- genres: genresCleaned.length ? genresCleaned : null,
- tags: tagsCleaned.length ? tagsCleaned : null,
+ genres: genresFiltered.length ? genresFiltered : null,
+ tags: tagsFiltered.length ? tagsFiltered.join(', ') : null,
series: series.length ? series : null,
language: language ? language.charAt(0).toUpperCase() + language.slice(1) : null,
duration: runtimeLengthMin && !isNaN(runtimeLengthMin) ? Number(runtimeLengthMin) : 0,
diff --git a/server/providers/CustomProviderAdapter.js b/server/providers/CustomProviderAdapter.js
index 5c8cad75a..c079a1280 100644
--- a/server/providers/CustomProviderAdapter.js
+++ b/server/providers/CustomProviderAdapter.js
@@ -89,27 +89,6 @@ class CustomProviderAdapter {
})
.filter((s) => s !== undefined)
}
- /**
- * Validates and dedupes tags/genres array
- * Can be comma separated string or array of strings
- * @param {string|string[]} tagsGenres
- * @returns {string[]}
- */
- const validateTagsGenresArray = (tagsGenres) => {
- if (!tagsGenres || (typeof tagsGenres !== 'string' && !Array.isArray(tagsGenres))) return undefined
-
- // If string, split by comma and trim each item
- if (typeof tagsGenres === 'string') tagsGenres = tagsGenres.split(',')
- // If array, ensure all items are strings
- else if (!tagsGenres.every((t) => typeof t === 'string')) return undefined
-
- // Trim and filter out empty strings
- tagsGenres = tagsGenres.map((t) => t.trim()).filter(Boolean)
- if (!tagsGenres.length) return undefined
-
- // Dedup
- return [...new Set(tagsGenres)]
- }
// re-map keys to throw out
return matches.map((match) => {
@@ -126,8 +105,8 @@ class CustomProviderAdapter {
cover: toStringOrUndefined(cover),
isbn: toStringOrUndefined(isbn),
asin: toStringOrUndefined(asin),
- genres: validateTagsGenresArray(genres),
- tags: validateTagsGenresArray(tags),
+ genres: Array.isArray(genres) && genres.every((g) => typeof g === 'string') ? genres : undefined,
+ tags: toStringOrUndefined(tags),
series: validateSeriesArray(series),
language: toStringOrUndefined(language),
duration: !isNaN(duration) && duration !== null ? Number(duration) : undefined
diff --git a/server/routers/ApiRouter.js b/server/routers/ApiRouter.js
index e89b364f3..6446ecc80 100644
--- a/server/routers/ApiRouter.js
+++ b/server/routers/ApiRouter.js
@@ -283,7 +283,6 @@ class ApiRouter {
this.router.get('/search/podcast', SearchController.findPodcasts.bind(this))
this.router.get('/search/authors', SearchController.findAuthor.bind(this))
this.router.get('/search/chapters', SearchController.findChapters.bind(this))
- this.router.get('/search/providers', SearchController.getAllProviders.bind(this))
//
// Cache Routes (Admin and up)
@@ -363,9 +362,8 @@ class ApiRouter {
* Remove library item and associated entities
* @param {string} libraryItemId
* @param {string[]} mediaItemIds array of bookId or podcastEpisodeId
- * @param {string} libraryId
*/
- async handleDeleteLibraryItem(libraryItemId, mediaItemIds, libraryId) {
+ async handleDeleteLibraryItem(libraryItemId, mediaItemIds) {
const numProgressRemoved = await Database.mediaProgressModel.destroy({
where: {
mediaItemId: mediaItemIds
@@ -396,8 +394,7 @@ class ApiRouter {
await Database.libraryItemModel.removeById(libraryItemId)
SocketAuthority.emitter('item_removed', {
- id: libraryItemId,
- libraryId
+ id: libraryItemId
})
}
diff --git a/server/scanner/AbsMetadataFileScanner.js b/server/scanner/AbsMetadataFileScanner.js
index 0ea34b1bb..e554dfb44 100644
--- a/server/scanner/AbsMetadataFileScanner.js
+++ b/server/scanner/AbsMetadataFileScanner.js
@@ -5,15 +5,15 @@ const { LogLevel } = require('../utils/constants')
const abmetadataGenerator = require('../utils/generators/abmetadataGenerator')
class AbsMetadataFileScanner {
- constructor() {}
+ constructor() { }
/**
* Check for metadata.json file and set book metadata
- *
- * @param {import('./LibraryScan')} libraryScan
- * @param {import('./LibraryItemScanData')} libraryItemData
- * @param {Object} bookMetadata
- * @param {string} [existingLibraryItemId]
+ *
+ * @param {import('./LibraryScan')} libraryScan
+ * @param {import('./LibraryItemScanData')} libraryItemData
+ * @param {Object} bookMetadata
+ * @param {string} [existingLibraryItemId]
*/
async scanBookMetadataFile(libraryScan, libraryItemData, bookMetadata, existingLibraryItemId = null) {
const metadataLibraryFile = libraryItemData.metadataJsonLibraryFile
@@ -32,8 +32,7 @@ class AbsMetadataFileScanner {
if (metadataText) {
libraryScan.addLog(LogLevel.INFO, `Found metadata file "${metadataFilePath}"`)
- const abMetadata = abmetadataGenerator.parseJson(metadataText, 'book') || {}
-
+ const abMetadata = abmetadataGenerator.parseJson(metadataText) || {}
for (const key in abMetadata) {
// TODO: When to override with null or empty arrays?
if (abMetadata[key] === undefined || abMetadata[key] === null) continue
@@ -49,11 +48,11 @@ class AbsMetadataFileScanner {
/**
* Check for metadata.json file and set podcast metadata
- *
- * @param {import('./LibraryScan')} libraryScan
- * @param {import('./LibraryItemScanData')} libraryItemData
- * @param {Object} podcastMetadata
- * @param {string} [existingLibraryItemId]
+ *
+ * @param {import('./LibraryScan')} libraryScan
+ * @param {import('./LibraryItemScanData')} libraryItemData
+ * @param {Object} podcastMetadata
+ * @param {string} [existingLibraryItemId]
*/
async scanPodcastMetadataFile(libraryScan, libraryItemData, podcastMetadata, existingLibraryItemId = null) {
const metadataLibraryFile = libraryItemData.metadataJsonLibraryFile
@@ -72,7 +71,7 @@ class AbsMetadataFileScanner {
if (metadataText) {
libraryScan.addLog(LogLevel.INFO, `Found metadata file "${metadataFilePath}"`)
- const abMetadata = abmetadataGenerator.parseJson(metadataText, 'podcast') || {}
+ const abMetadata = abmetadataGenerator.parseJson(metadataText) || {}
for (const key in abMetadata) {
if (abMetadata[key] === undefined || abMetadata[key] === null) continue
if (key === 'tags' && !abMetadata.tags?.length) continue
@@ -82,4 +81,4 @@ class AbsMetadataFileScanner {
}
}
}
-module.exports = new AbsMetadataFileScanner()
+module.exports = new AbsMetadataFileScanner()
\ No newline at end of file
diff --git a/server/scanner/BookScanner.js b/server/scanner/BookScanner.js
index 2b106cdc8..a1e7ff507 100644
--- a/server/scanner/BookScanner.js
+++ b/server/scanner/BookScanner.js
@@ -7,7 +7,6 @@ const parseNameString = require('../utils/parsers/parseNameString')
const parseEbookMetadata = require('../utils/parsers/parseEbookMetadata')
const globals = require('../utils/globals')
const { readTextFile, filePathToPOSIX, getFileTimestampsWithIno } = require('../utils/fileUtils')
-const htmlSanitizer = require('../utils/htmlSanitizer')
const AudioFileScanner = require('./AudioFileScanner')
const Database = require('../Database')
@@ -228,7 +227,6 @@ class BookScanner {
bookId: media.id,
authorId: existingAuthorId
})
- libraryScan.authorsNumBooksChangedIds.add(existingAuthorId)
libraryScan.addLog(LogLevel.DEBUG, `Updating book "${bookMetadata.title}" added author "${authorName}"`)
authorsUpdated = true
} else {
@@ -239,7 +237,6 @@ class BookScanner {
})
await media.addAuthor(newAuthor)
Database.addAuthorToFilterData(libraryItemData.libraryId, newAuthor.name, newAuthor.id)
- SocketAuthority.emitter('author_added', newAuthor.toOldJSON())
libraryScan.addLog(LogLevel.DEBUG, `Updating book "${bookMetadata.title}" added new author "${authorName}"`)
authorsUpdated = true
}
@@ -249,7 +246,6 @@ class BookScanner {
for (const author of media.authors) {
if (!bookMetadata.authors.includes(author.name)) {
await author.bookAuthor.destroy()
- libraryScan.authorsNumBooksChangedIds.add(author.id)
libraryScan.addLog(LogLevel.DEBUG, `Updating book "${bookMetadata.title}" removed author "${author.name}"`)
authorsUpdated = true
bookAuthorsRemoved.push(author.id)
@@ -481,7 +477,6 @@ class BookScanner {
}
const createdAtTimestamp = new Date().getTime()
- const newAuthorNames = new Set()
if (bookMetadata.authors.length) {
for (const authorName of bookMetadata.authors) {
const matchingAuthorId = await Database.getAuthorIdByName(libraryItemData.libraryId, authorName)
@@ -489,8 +484,6 @@ class BookScanner {
bookObject.bookAuthors.push({
authorId: matchingAuthorId
})
- // Existing author — only numBooks changes; batch emit at scan end
- libraryScan.authorsNumBooksChangedIds.add(matchingAuthorId)
} else {
// New author
bookObject.bookAuthors.push({
@@ -502,7 +495,6 @@ class BookScanner {
lastFirst: Database.authorModel.getLastFirst(authorName)
}
})
- newAuthorNames.add(authorName)
}
}
}
@@ -600,9 +592,6 @@ class BookScanner {
for (const ba of libraryItem.book.bookAuthors) {
if (ba.author) {
Database.addAuthorToFilterData(libraryItemData.libraryId, ba.author.name, ba.author.id)
- if (newAuthorNames.has(ba.author.name)) {
- SocketAuthority.emitter('author_added', ba.author.toOldJSON())
- }
}
}
}
@@ -699,10 +688,6 @@ class BookScanner {
bookMetadata.titleIgnorePrefix = getTitleIgnorePrefix(bookMetadata.title)
- if (typeof bookMetadata.description === 'string' && bookMetadata.description) {
- bookMetadata.description = htmlSanitizer.sanitize(bookMetadata.description)
- }
-
return bookMetadata
}
@@ -835,9 +820,6 @@ class BookScanner {
const metadataFilePath = Path.join(metadataPath, `metadata.${global.ServerSettings.metadataFileFormat}`)
- /**
- * Keys must match abmetadataGenerator.js
- */
const jsonObject = {
tags: libraryItem.media.tags || [],
chapters: libraryItem.media.chapters?.map((c) => ({ ...c })) || [],
@@ -901,34 +883,6 @@ class BookScanner {
})
}
- /**
- * Emit authors_num_books_updated for authors whose book count changed during a scan (linked or unlinked).
- * Authors with no book links are omitted — orphans are handled by author_removed.
- * @param {string} libraryId
- * @param {import('./LibraryScan')|import('./ScanLogger')} scanLogger
- * @returns {Promise}
- */
- async emitAuthorsNumBooksUpdated(libraryId, scanLogger) {
- if (!scanLogger.authorsNumBooksChangedIds?.size) return
-
- const authorIds = [...scanLogger.authorsNumBooksChangedIds]
- scanLogger.authorsNumBooksChangedIds.clear()
-
- const countsByAuthorId = await Database.bookAuthorModel.getCountsForAuthors(authorIds)
-
- const authors = Object.entries(countsByAuthorId).map(([id, numBooks]) => ({
- id,
- numBooks
- }))
-
- if (!authors.length) return
-
- SocketAuthority.emitter('authors_num_books_updated', {
- libraryId,
- authors
- })
- }
-
/**
* Check authors that were removed from a book and remove them if they no longer have any books
* keep authors without books that have a asin, description or imagePath
diff --git a/server/scanner/LibraryItemScanner.js b/server/scanner/LibraryItemScanner.js
index de95c9a09..501df4274 100644
--- a/server/scanner/LibraryItemScanner.js
+++ b/server/scanner/LibraryItemScanner.js
@@ -66,7 +66,7 @@ class LibraryItemScanner {
if (libraryItemDataUpdated || wasUpdated) {
SocketAuthority.libraryItemEmitter('item_updated', expandedLibraryItem)
- await this.finalizeAuthorsAndSeriesFromScan(library.id, scanLogger)
+ await this.checkAuthorsAndSeriesRemovedFromBooks(library.id, scanLogger)
return ScanResult.UPDATED
}
@@ -76,13 +76,12 @@ class LibraryItemScanner {
}
/**
- * Emit author book count updates, then remove empty authors/series left after the scan
+ * Remove empty authors and series
* @param {string} libraryId
* @param {ScanLogger} scanLogger
* @returns {Promise}
*/
- async finalizeAuthorsAndSeriesFromScan(libraryId, scanLogger) {
- await BookScanner.emitAuthorsNumBooksUpdated(libraryId, scanLogger)
+ async checkAuthorsAndSeriesRemovedFromBooks(libraryId, scanLogger) {
if (scanLogger.authorsRemovedFromBooks.length) {
await BookScanner.checkAuthorsRemovedFromBooks(libraryId, scanLogger)
}
@@ -216,10 +215,7 @@ class LibraryItemScanner {
scanLogger.verbose = true
scanLogger.setData('libraryItem', libraryItemScanData.relPath)
- const newLibraryItem = await this.scanNewLibraryItem(libraryItemScanData, library.settings, scanLogger)
- // Watcher path does not go through full-library scan cleanup — emit author book count updates here
- await BookScanner.emitAuthorsNumBooksUpdated(library.id, scanLogger)
- return newLibraryItem
+ return this.scanNewLibraryItem(libraryItemScanData, library.settings, scanLogger)
}
}
module.exports = new LibraryItemScanner()
diff --git a/server/scanner/LibraryScan.js b/server/scanner/LibraryScan.js
index 0366addba..e77f30ba6 100644
--- a/server/scanner/LibraryScan.js
+++ b/server/scanner/LibraryScan.js
@@ -24,8 +24,6 @@ class LibraryScan {
/** @type {string[]} */
this.authorsRemovedFromBooks = []
- /** @type {Set} */
- this.authorsNumBooksChangedIds = new Set()
/** @type {string[]} */
this.seriesRemovedFromBooks = []
diff --git a/server/scanner/LibraryScanner.js b/server/scanner/LibraryScanner.js
index 73cb51553..640c82d76 100644
--- a/server/scanner/LibraryScanner.js
+++ b/server/scanner/LibraryScanner.js
@@ -234,7 +234,8 @@ class LibraryScanner {
SocketAuthority.libraryItemsEmitter('items_updated', libraryItemsUpdated)
}
- if (this.shouldCancelScan(libraryScan)) return true
+ // Authors and series that were removed from books should be removed if they are now empty
+ await LibraryItemScanner.checkAuthorsAndSeriesRemovedFromBooks(libraryScan.libraryId, libraryScan)
// Update missing library items
if (libraryItemIdsMissing.length) {
@@ -280,9 +281,6 @@ class LibraryScanner {
}
}
- // Author book count updates and empty authors/series cleanup after all items are processed
- await LibraryItemScanner.finalizeAuthorsAndSeriesFromScan(libraryScan.libraryId, libraryScan)
-
libraryScan.addLog(LogLevel.INFO, `Scan completed. ${libraryScan.resultStats}`)
return false
}
diff --git a/server/scanner/PodcastScanner.js b/server/scanner/PodcastScanner.js
index f3241d536..c9569c3ad 100644
--- a/server/scanner/PodcastScanner.js
+++ b/server/scanner/PodcastScanner.js
@@ -11,7 +11,6 @@ const LibraryFile = require('../objects/files/LibraryFile')
const fsExtra = require('../libs/fsExtra')
const PodcastEpisode = require('../models/PodcastEpisode')
const AbsMetadataFileScanner = require('./AbsMetadataFileScanner')
-const htmlSanitizer = require('../utils/htmlSanitizer')
/**
* Metadata for podcasts pulled from files
@@ -399,10 +398,6 @@ class PodcastScanner {
podcastMetadata.titleIgnorePrefix = getTitleIgnorePrefix(podcastMetadata.title)
- if (typeof podcastMetadata.description === 'string' && podcastMetadata.description) {
- podcastMetadata.description = htmlSanitizer.sanitize(podcastMetadata.description)
- }
-
return podcastMetadata
}
@@ -425,9 +420,6 @@ class PodcastScanner {
const metadataFilePath = Path.join(metadataPath, `metadata.${global.ServerSettings.metadataFileFormat}`)
- /**
- * Keys must match abmetadataGenerator.js
- */
const jsonObject = {
tags: libraryItem.media.tags || [],
title: libraryItem.media.title,
diff --git a/server/scanner/ScanLogger.js b/server/scanner/ScanLogger.js
index 2748f1f3b..7aed21f13 100644
--- a/server/scanner/ScanLogger.js
+++ b/server/scanner/ScanLogger.js
@@ -14,8 +14,6 @@ class ScanLogger {
/** @type {string[]} */
this.authorsRemovedFromBooks = []
- /** @type {Set} */
- this.authorsNumBooksChangedIds = new Set()
/** @type {string[]} */
this.seriesRemovedFromBooks = []
diff --git a/server/scanner/Scanner.js b/server/scanner/Scanner.js
index af4405987..206068cc4 100644
--- a/server/scanner/Scanner.js
+++ b/server/scanner/Scanner.js
@@ -259,17 +259,18 @@ class Scanner {
SocketAuthority.emitter('author_added', author.toOldJSON())
// Update filter data
Database.addAuthorToFilterData(libraryItem.libraryId, author.name, author.id)
+
+ await Database.bookAuthorModel
+ .create({
+ authorId: author.id,
+ bookId: libraryItem.media.id
+ })
+ .then(() => {
+ Logger.info(`[Scanner] quickMatchBookBuildUpdatePayload: Added author "${author.name}" to "${libraryItem.media.title}"`)
+ libraryItem.media.authors.push(author)
+ hasAuthorUpdates = true
+ })
}
- await Database.bookAuthorModel
- .create({
- authorId: author.id,
- bookId: libraryItem.media.id
- })
- .then(() => {
- Logger.info(`[Scanner] quickMatchBookBuildUpdatePayload: Added author "${author.name}" to "${libraryItem.media.title}"`)
- libraryItem.media.authors.push(author)
- hasAuthorUpdates = true
- })
}
const authorsRemoved = libraryItem.media.authors.filter((a) => !matchData.author.find((ma) => ma.toLowerCase() === a.name.toLowerCase()))
if (authorsRemoved.length) {
diff --git a/server/utils/constants.js b/server/utils/constants.js
index 925035e17..cc5217f41 100644
--- a/server/utils/constants.js
+++ b/server/utils/constants.js
@@ -48,8 +48,6 @@ module.exports.AudioMimeType = {
AIF: 'audio/x-aiff',
WEBM: 'audio/webm',
WEBMA: 'audio/webm',
- // TODO: Switch to `audio/matroska`? marked as deprecated in IANA registry
- // ref: https://datatracker.ietf.org/doc/html/rfc9559
MKA: 'audio/x-matroska',
AWB: 'audio/amr-wb',
CAF: 'audio/x-caf',
diff --git a/server/utils/ffmpegHelpers.js b/server/utils/ffmpegHelpers.js
index 7ad2a3aee..80832cc77 100644
--- a/server/utils/ffmpegHelpers.js
+++ b/server/utils/ffmpegHelpers.js
@@ -1,5 +1,4 @@
const axios = require('axios')
-const ssrfFilter = require('ssrf-req-filter')
const Ffmpeg = require('../libs/fluentFfmpeg')
const ffmpgegUtils = require('../libs/fluentFfmpeg/utils')
const fs = require('../libs/fsExtra')
@@ -98,8 +97,6 @@ async function resizeImage(filePath, outputPath, width, height) {
module.exports.resizeImage = resizeImage
/**
- * Download podcast episode
- * Uses SSRF filter to prevent internal URLs
*
* @param {import('../objects/PodcastEpisodeDownload')} podcastEpisodeDownload
* @returns {Promise<{success: boolean, isRequestError?: boolean}>}
@@ -124,9 +121,7 @@ module.exports.downloadPodcastEpisode = (podcastEpisodeDownload) => {
Accept: '*/*',
'User-Agent': userAgent
},
- timeout: global.PodcastDownloadTimeout,
- httpAgent: global.DisableSsrfRequestFilter?.(podcastEpisodeDownload.url) ? null : ssrfFilter(podcastEpisodeDownload.url),
- httpsAgent: global.DisableSsrfRequestFilter?.(podcastEpisodeDownload.url) ? null : ssrfFilter(podcastEpisodeDownload.url)
+ timeout: global.PodcastDownloadTimeout
})
Logger.debug(`[ffmpegHelpers] Successfully connected with User-Agent: ${userAgent}`)
diff --git a/server/utils/generators/abmetadataGenerator.js b/server/utils/generators/abmetadataGenerator.js
index d0d278752..01f853288 100644
--- a/server/utils/generators/abmetadataGenerator.js
+++ b/server/utils/generators/abmetadataGenerator.js
@@ -1,51 +1,7 @@
const Logger = require('../../Logger')
const parseSeriesString = require('../parsers/parseSeriesString')
-const mediaTypeKeys = {
- book: {
- tags: 'stringArray',
- title: 'string',
- subtitle: 'string',
- authors: 'stringArray',
- narrators: 'stringArray',
- series: 'stringArray',
- genres: 'stringArray',
- publishedYear: 'string',
- publishedDate: 'string',
- publisher: 'string',
- description: 'string',
- isbn: 'string',
- asin: 'string',
- language: 'string',
- explicit: 'boolean',
- abridged: 'boolean'
- },
- podcast: {
- tags: 'stringArray',
- title: 'string',
- author: 'string',
- description: 'string',
- releaseDate: 'string',
- genres: 'stringArray',
- feedURL: 'string',
- imageURL: 'string',
- itunesPageURL: 'string',
- itunesId: 'string',
- itunesArtistId: 'string',
- asin: 'string',
- language: 'string',
- explicit: 'boolean',
- podcastType: 'string'
- }
-}
-
-/**
- *
- * @param {string} text
- * @param {"book" | "podcast"} mediaType
- * @returns {Object}
- */
-function parseJsonMetadataText(text, mediaType) {
+function parseJsonMetadataText(text) {
try {
const abmetadataData = JSON.parse(text)
@@ -63,41 +19,28 @@ function parseJsonMetadataText(text, mediaType) {
}
delete abmetadataData.metadata
- const expectedKeys = mediaTypeKeys[mediaType]
- if (!expectedKeys) {
- Logger.error(`[abmetadataGenerator] Invalid media type "${mediaType}"`)
- return null
+ if (abmetadataData.series?.length) {
+ abmetadataData.series = [...new Set(abmetadataData.series.map((t) => t?.trim()).filter((t) => t))]
+ abmetadataData.series = abmetadataData.series.map((series) => parseSeriesString.parse(series))
}
-
- const validated = {}
- for (const key in expectedKeys) {
- const expectedType = expectedKeys[key]
- if (!(key in abmetadataData)) continue
-
- const validatedValue = validateMetadataValue(key, abmetadataData[key], expectedType)
- if (validatedValue !== undefined) {
- validated[key] = validatedValue
- }
+ // clean tags & remove dupes
+ if (abmetadataData.tags?.length) {
+ abmetadataData.tags = [...new Set(abmetadataData.tags.map((t) => t?.trim()).filter((t) => t))]
}
-
- if (validated.series?.length) {
- validated.series = validated.series.map((series) => parseSeriesString.parse(series)).filter(Boolean)
+ if (abmetadataData.chapters?.length) {
+ abmetadataData.chapters = cleanChaptersArray(abmetadataData.chapters, abmetadataData.title)
}
-
- if (mediaType === 'book' && 'chapters' in abmetadataData) {
- if (abmetadataData.chapters === null) {
- validated.chapters = []
- } else if (Array.isArray(abmetadataData.chapters)) {
- const cleanedChapters = cleanChaptersArray(abmetadataData.chapters, validated.title ?? abmetadataData.title)
- if (cleanedChapters) {
- validated.chapters = cleanedChapters
- }
- } else {
- Logger.warn(`[abmetadataGenerator] Invalid metadata key "chapters" expected array, got ${typeof abmetadataData.chapters}`)
- }
+ // clean remove dupes
+ if (abmetadataData.authors?.length) {
+ abmetadataData.authors = [...new Set(abmetadataData.authors.map((t) => t?.trim()).filter((t) => t))]
}
-
- return validated
+ if (abmetadataData.narrators?.length) {
+ abmetadataData.narrators = [...new Set(abmetadataData.narrators.map((t) => t?.trim()).filter((t) => t))]
+ }
+ if (abmetadataData.genres?.length) {
+ abmetadataData.genres = [...new Set(abmetadataData.genres.map((t) => t?.trim()).filter((t) => t))]
+ }
+ return abmetadataData
} catch (error) {
Logger.error(`[abmetadataGenerator] Invalid metadata.json JSON`, error)
return null
@@ -105,54 +48,6 @@ function parseJsonMetadataText(text, mediaType) {
}
module.exports.parseJson = parseJsonMetadataText
-/**
- * @param {string} key
- * @param {*} value
- * @param {string} expectedType
- * @returns {*|undefined} undefined excludes the key
- */
-function validateMetadataValue(key, value, expectedType) {
- if (expectedType === 'string') {
- if (value === null) return null
- if (typeof value === 'number') return String(value)
- if (typeof value === 'string') return value
- Logger.warn(`[abmetadataGenerator] Invalid metadata key "${key}" expected string, got ${typeof value}`)
- return undefined
- }
-
- if (expectedType === 'boolean') {
- if (value === null) return null
- if (typeof value === 'boolean') return value
- if (typeof value === 'string') {
- const lower = value.toLowerCase()
- if (lower === 'true') return true
- if (lower === 'false') return false
- }
- Logger.warn(`[abmetadataGenerator] Invalid metadata key "${key}" expected boolean, got ${typeof value}`)
- return undefined
- }
-
- // Filter empty strings and deduplicate
- if (expectedType === 'stringArray') {
- if (value === null) return []
- if (!Array.isArray(value)) {
- Logger.warn(`[abmetadataGenerator] Invalid metadata key "${key}" expected string array, got ${typeof value}`)
- return undefined
- }
-
- const cleanedArray = value.filter((t) => typeof t === 'string')
- return [...new Set(cleanedArray.map((t) => t.trim()).filter((t) => t))]
- }
-
- Logger.warn(`[abmetadataGenerator] Unknown expected type "${expectedType}" for key "${key}"`)
- return undefined
-}
-
-/**
- * @param {Object[]} chaptersArray
- * @param {string} mediaTitle
- * @returns {Object[]}
- */
function cleanChaptersArray(chaptersArray, mediaTitle) {
const chapters = []
let index = 0
diff --git a/server/utils/htmlSanitizer.js b/server/utils/htmlSanitizer.js
index be839b7c2..4ed30e727 100644
--- a/server/utils/htmlSanitizer.js
+++ b/server/utils/htmlSanitizer.js
@@ -5,10 +5,11 @@ const { entities } = require('./htmlEntities')
*
* @param {string} html
* @returns {string}
+ * @throws {Error} if input is not a string
*/
function sanitize(html) {
if (typeof html !== 'string') {
- return ''
+ throw new Error('sanitizeHtml: input must be a string')
}
const sanitizerOptions = {
@@ -26,8 +27,6 @@ function sanitize(html) {
module.exports.sanitize = sanitize
function stripAllTags(html, shouldDecodeEntities = true) {
- if (typeof html !== 'string') return ''
-
const sanitizerOptions = {
allowedTags: [],
disallowedTagsMode: 'discard'
diff --git a/server/utils/index.js b/server/utils/index.js
index 49a7c8e67..369620276 100644
--- a/server/utils/index.js
+++ b/server/utils/index.js
@@ -54,16 +54,6 @@ module.exports.isNullOrNaN = (num) => {
return num === null || isNaN(num)
}
-/**
- * @param {number|null|undefined} value
- * @param {number} max
- * @returns {number|null}
- */
-module.exports.clampPositiveInt = (value, max) => {
- if (value == null || !Number.isFinite(value) || value <= 0) return null
- return Math.min(Math.floor(value), max)
-}
-
const xmlToJSON = (xml) => {
return new Promise((resolve, reject) => {
parseString(xml, (err, results) => {
@@ -287,57 +277,3 @@ module.exports.timestampToSeconds = (timestamp) => {
}
return null
}
-
-class ValidationError extends Error {
- constructor(paramName, message, status = 400) {
- super(`Query parameter "${paramName}" ${message}`)
- this.name = 'ValidationError'
- this.paramName = paramName
- this.status = status
- }
-}
-module.exports.ValidationError = ValidationError
-
-class NotFoundError extends Error {
- constructor(message, status = 404) {
- super(message)
- this.name = 'NotFoundError'
- this.status = status
- }
-}
-module.exports.NotFoundError = NotFoundError
-
-/**
- * Safely extracts a query parameter as a string, rejecting arrays to prevent type confusion
- * Express query parameters can be arrays if the same parameter appears multiple times
- * @example ?author=Smith => "Smith"
- * @example ?author=Smith&author=Jones => throws error
- *
- * @param {Object} query - Query object
- * @param {string} paramName - Parameter name
- * @param {string} defaultValue - Default value if undefined/null
- * @param {boolean} required - Whether the parameter is required
- * @param {number} maxLength - Optional maximum length (defaults to 10000 to prevent ReDoS attacks)
- * @returns {string} String value
- * @throws {ValidationError} If value is an array
- * @throws {ValidationError} If value is too long
- * @throws {ValidationError} If value is required but not provided
- */
-module.exports.getQueryParamAsString = (query, paramName, defaultValue = '', required = false, maxLength = 1000) => {
- const value = query[paramName]
- if (value === undefined || value === null) {
- if (required) {
- throw new ValidationError(paramName, 'is required')
- }
- return defaultValue
- }
- // Explicitly reject arrays to prevent type confusion
- if (Array.isArray(value)) {
- throw new ValidationError(paramName, 'is an array')
- }
- // Reject excessively long strings to prevent ReDoS attacks
- if (typeof value === 'string' && value.length > maxLength) {
- throw new ValidationError(paramName, 'is too long')
- }
- return String(value)
-}
diff --git a/server/utils/notifications.js b/server/utils/notifications.js
index 497d7a1a1..700d3c389 100644
--- a/server/utils/notifications.js
+++ b/server/utils/notifications.js
@@ -100,7 +100,7 @@ module.exports.notificationData = {
variables: ['version'],
defaults: {
title: 'Test Notification on Abs {{version}}',
- body: 'Test notification body for abs {{version}}.'
+ body: 'Test notificataion body for abs {{version}}.'
},
testData: {
version: 'v' + version
diff --git a/server/utils/parsers/parseNfoMetadata.js b/server/utils/parsers/parseNfoMetadata.js
index 4276443d0..6682a0078 100644
--- a/server/utils/parsers/parseNfoMetadata.js
+++ b/server/utils/parsers/parseNfoMetadata.js
@@ -22,7 +22,7 @@ function parseNfoMetadata(nfoText) {
switch (key) {
case 'title':
{
- const titleMatch = value.match(/^(.*?): (.*)$/)
+ const titleMatch = value.match(/^(.*?):(.*)$/)
if (titleMatch) {
metadata.title = titleMatch[1].trim()
metadata.subtitle = titleMatch[2].trim()
diff --git a/server/utils/podcastUtils.js b/server/utils/podcastUtils.js
index 1cb0c4cb4..b62e024f0 100644
--- a/server/utils/podcastUtils.js
+++ b/server/utils/podcastUtils.js
@@ -171,7 +171,7 @@ function extractEpisodeData(item) {
// Full description with html
if (item['content:encoded']) {
- const rawDescription = (extractFirstArrayItemString(item, 'content:encoded') || '').trim()
+ const rawDescription = (extractFirstArrayItem(item, 'content:encoded') || '').trim()
episode.description = htmlSanitizer.sanitize(rawDescription)
}
@@ -217,10 +217,6 @@ function extractEpisodeData(item) {
episode[cleanKey] = extractFirstArrayItemString(item, key)
})
- if (episode.subtitle) {
- episode.subtitle = htmlSanitizer.sanitize(episode.subtitle.trim())
- }
-
// Extract psc:chapters if duration is set
episode.durationSeconds = episode.duration ? timestampToSeconds(episode.duration) : null
diff --git a/server/utils/queries/libraryItemsBookFilters.js b/server/utils/queries/libraryItemsBookFilters.js
index fbe0c4f0d..494a9564f 100644
--- a/server/utils/queries/libraryItemsBookFilters.js
+++ b/server/utils/queries/libraryItemsBookFilters.js
@@ -236,7 +236,7 @@ module.exports = {
} else if (group === 'publishedDecades') {
const startYear = parseInt(value)
const endYear = parseInt(value, 10) + 9
- mediaWhere = Sequelize.where(Sequelize.literal('CAST(publishedYear AS INTEGER)'), {
+ mediaWhere = Sequelize.where(Sequelize.literal('CAST(`book`.`publishedYear` AS INTEGER)'), {
[Sequelize.Op.between]: [startYear, endYear]
})
}
@@ -888,79 +888,28 @@ module.exports = {
})
}
- const discoverWhere = [
- {
- '$mediaProgresses.isFinished$': {
- [Sequelize.Op.or]: [null, 0]
- },
- '$mediaProgresses.currentTime$': {
- [Sequelize.Op.or]: [null, 0]
- },
- [Sequelize.Op.or]: [
- Sequelize.where(Sequelize.literal(`(SELECT COUNT(*) FROM bookSeries bs where bs.bookId = book.id)`), 0),
- {
- id: {
- [Sequelize.Op.in]: booksFromSeriesToInclude
+ // Step 2: Get books not started and not in a series OR is the first book of a series not started (ordered randomly)
+ const { rows: books, count } = await Database.bookModel.findAndCountAll({
+ where: [
+ {
+ '$mediaProgresses.isFinished$': {
+ [Sequelize.Op.or]: [null, 0]
+ },
+ '$mediaProgresses.currentTime$': {
+ [Sequelize.Op.or]: [null, 0]
+ },
+ [Sequelize.Op.or]: [
+ Sequelize.where(Sequelize.literal(`(SELECT COUNT(*) FROM bookSeries bs where bs.bookId = book.id)`), 0),
+ {
+ id: {
+ [Sequelize.Op.in]: booksFromSeriesToInclude
+ }
}
- }
- ]
- },
- ...userPermissionBookWhere.bookWhere
- ]
-
- const baseDiscoverInclude = [
- {
- model: Database.libraryItemModel,
- where: {
- libraryId
- }
- },
- {
- model: Database.mediaProgressModel,
- where: {
- userId: user.id
+ ]
},
- required: false
- }
- ]
-
- // Step 2a: Count with lightweight includes only
- const count = await Database.bookModel.count({
- where: discoverWhere,
+ ...userPermissionBookWhere.bookWhere
+ ],
replacements: userPermissionBookWhere.replacements,
- include: baseDiscoverInclude,
- distinct: true,
- col: 'id',
- subQuery: false
- })
-
- // Step 2b: Select random IDs with lightweight includes only
- const randomSelection = await Database.bookModel.findAll({
- attributes: ['id'],
- where: discoverWhere,
- replacements: userPermissionBookWhere.replacements,
- include: baseDiscoverInclude,
- subQuery: false,
- distinct: true,
- limit,
- order: Database.sequelize.random()
- })
-
- const selectedIds = randomSelection.map((b) => b.id).filter(Boolean)
- if (!selectedIds.length) {
- return {
- libraryItems: [],
- count
- }
- }
-
- // Step 2c: Hydrate selected IDs with full metadata for API response
- const books = await Database.bookModel.findAll({
- where: {
- id: {
- [Sequelize.Op.in]: selectedIds
- }
- },
include: [
{
model: Database.libraryItemModel,
@@ -969,6 +918,13 @@ module.exports = {
},
include: libraryItemIncludes
},
+ {
+ model: Database.mediaProgressModel,
+ where: {
+ userId: user.id
+ },
+ required: false
+ },
{
model: Database.bookAuthorModel,
attributes: ['authorId'],
@@ -986,14 +942,14 @@ module.exports = {
separate: true
}
],
- subQuery: false
+ subQuery: false,
+ distinct: true,
+ limit,
+ order: Database.sequelize.random()
})
- const booksById = new Map(books.map((b) => [b.id, b]))
- const orderedBooks = selectedIds.map((id) => booksById.get(id)).filter(Boolean)
-
// Step 3: Map books to library items
- const libraryItems = orderedBooks.map((bookExpanded) => {
+ const libraryItems = books.map((bookExpanded) => {
const libraryItem = bookExpanded.libraryItem
const book = bookExpanded
delete book.libraryItem
diff --git a/test/server/controllers/LibraryItemController.test.js b/test/server/controllers/LibraryItemController.test.js
index 1d57219d3..5a0422392 100644
--- a/test/server/controllers/LibraryItemController.test.js
+++ b/test/server/controllers/LibraryItemController.test.js
@@ -123,9 +123,7 @@ describe('LibraryItemController', () => {
const fakeReq = {
query: {},
user: {
- username: 'test',
- canDelete: true,
- checkCanAccessLibraryItem: () => true
+ canDelete: true
},
body: {
libraryItemIds: [libraryItem1Id]
@@ -201,102 +199,4 @@ describe('LibraryItemController', () => {
expect(series2Exists).to.be.true
})
})
-
- describe('batch item access control', () => {
- let lib1Id
- let itemLib1Id
- let itemLib2Id
-
- beforeEach(async () => {
- const lib1 = await Database.libraryModel.create({ name: 'Lib 1', mediaType: 'book' })
- const folder1 = await Database.libraryFolderModel.create({ path: '/l1', libraryId: lib1.id })
- const book1 = await Database.bookModel.create({ title: 'B1', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
- const li1 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book1.id,
- mediaType: 'book',
- libraryId: lib1.id,
- libraryFolderId: folder1.id
- })
- lib1Id = lib1.id
- itemLib1Id = li1.id
-
- const lib2 = await Database.libraryModel.create({ name: 'Lib 2', mediaType: 'book' })
- const folder2 = await Database.libraryFolderModel.create({ path: '/l2', libraryId: lib2.id })
- const book2 = await Database.bookModel.create({ title: 'B2', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
- const li2 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book2.id,
- mediaType: 'book',
- libraryId: lib2.id,
- libraryFolderId: folder2.id
- })
- itemLib2Id = li2.id
- })
-
- const userLimitedToLib1 = () => ({
- username: 'limited',
- canDelete: true,
- canUpdate: true,
- checkCanAccessLibraryItem(li) {
- return li.libraryId === lib1Id
- }
- })
-
- it('batchGet returns 403 for a library item the user cannot access', async () => {
- const fakeRes = { sendStatus: sinon.spy(), json: sinon.spy() }
- const fakeReq = {
- body: { libraryItemIds: [itemLib2Id] },
- user: userLimitedToLib1()
- }
- await LibraryItemController.batchGet.bind(apiRouter)(fakeReq, fakeRes)
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- })
-
- it('batchGet returns items when the user can access them', async () => {
- const fakeRes = { sendStatus: sinon.spy(), json: sinon.spy() }
- const fakeReq = {
- body: { libraryItemIds: [itemLib1Id] },
- user: userLimitedToLib1()
- }
- await LibraryItemController.batchGet.bind(apiRouter)(fakeReq, fakeRes)
- expect(fakeRes.json.calledOnce).to.be.true
- const payload = fakeRes.json.firstCall.args[0]
- expect(payload.libraryItems).to.have.length(1)
- expect(payload.libraryItems[0].id).to.equal(itemLib1Id)
- })
-
- it('batchUpdate returns 403 for a library item the user cannot access', async () => {
- const fakeRes = { sendStatus: sinon.spy(), json: sinon.spy() }
- const fakeReq = {
- user: userLimitedToLib1(),
- body: [{ id: itemLib2Id, mediaPayload: {} }]
- }
- await LibraryItemController.batchUpdate.bind(apiRouter)(fakeReq, fakeRes)
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- })
-
- it('batchUpdate returns 403 when the user lacks canUpdate', async () => {
- const u = userLimitedToLib1()
- u.canUpdate = false
- const fakeRes = { sendStatus: sinon.spy(), json: sinon.spy() }
- const fakeReq = {
- user: u,
- body: [{ id: itemLib1Id, mediaPayload: {} }]
- }
- await LibraryItemController.batchUpdate.bind(apiRouter)(fakeReq, fakeRes)
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- })
-
- it('batchDelete returns 403 for a library item the user cannot access', async () => {
- const fakeRes = { sendStatus: sinon.spy() }
- const fakeReq = {
- query: {},
- user: userLimitedToLib1(),
- body: { libraryItemIds: [itemLib2Id] }
- }
- await LibraryItemController.batchDelete.bind(apiRouter)(fakeReq, fakeRes)
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- })
- })
})
diff --git a/test/server/controllers/MeController.test.js b/test/server/controllers/MeController.test.js
deleted file mode 100644
index 3cc5496d9..000000000
--- a/test/server/controllers/MeController.test.js
+++ /dev/null
@@ -1,636 +0,0 @@
-const { expect } = require('chai')
-const { Sequelize } = require('sequelize')
-const sinon = require('sinon')
-
-const Database = require('../../../server/Database')
-const ApiRouter = require('../../../server/routers/ApiRouter')
-const MeController = require('../../../server/controllers/MeController')
-const Auth = require('../../../server/Auth')
-const Logger = require('../../../server/Logger')
-const SocketAuthority = require('../../../server/SocketAuthority')
-
-describe('MeController - IDOR Security Tests', () => {
- /** @type {ApiRouter} */
- let apiRouter
-
- beforeEach(async () => {
- global.ServerSettings = {}
- Database.sequelize = new Sequelize({ dialect: 'sqlite', storage: ':memory:', logging: false })
- Database.sequelize.uppercaseFirst = (str) => (str ? `${str[0].toUpperCase()}${str.substr(1)}` : '')
- await Database.buildModels()
-
- // Create mock server object with required dependencies
- const mockServer = {
- auth: new Auth(),
- playbackSessionManager: { sessions: [] },
- abMergeManager: {},
- backupManager: {},
- podcastManager: {},
- audioMetadataManager: {},
- cronManager: {},
- emailManager: {},
- apiCacheManager: { middleware: (req, res, next) => next() }
- }
-
- apiRouter = new ApiRouter(mockServer)
-
- sinon.stub(Logger, 'info')
- sinon.stub(Logger, 'error')
- sinon.stub(SocketAuthority, 'clientEmitter')
- })
-
- afterEach(async () => {
- sinon.restore()
-
- // Clear all tables
- await Database.sequelize.sync({ force: true })
- })
-
- describe('removeMediaProgress - IDOR Protection', () => {
- let user1, user2
- let mediaProgress1, mediaProgress2
-
- beforeEach(async () => {
- // Create two users
- user1 = await Database.userModel.create({
- username: 'user1',
- pash: 'hashed_password_1',
- type: 'user',
- isActive: true
- })
-
- user2 = await Database.userModel.create({
- username: 'user2',
- pash: 'hashed_password_2',
- type: 'user',
- isActive: true
- })
-
- // Create library and book
- const library = await Database.libraryModel.create({ name: 'Test Library', mediaType: 'book' })
- const libraryFolder = await Database.libraryFolderModel.create({ path: '/test', libraryId: library.id })
- const book = await Database.bookModel.create({ title: 'Test Book', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
- const libraryItem = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book.id,
- mediaType: 'book',
- libraryId: library.id,
- libraryFolderId: libraryFolder.id
- })
-
- // Create media progress for each user
- mediaProgress1 = await Database.mediaProgressModel.create({
- userId: user1.id,
- mediaItemId: book.id,
- mediaItemType: 'book',
- duration: 1000,
- currentTime: 500,
- isFinished: false
- })
-
- mediaProgress2 = await Database.mediaProgressModel.create({
- userId: user2.id,
- mediaItemId: book.id,
- mediaItemType: 'book',
- duration: 1000,
- currentTime: 300,
- isFinished: false
- })
-
- // Load media progresses into users
- user1.mediaProgresses = await user1.getMediaProgresses()
- user2.mediaProgresses = await user2.getMediaProgresses()
- })
-
- it('should allow user to delete their own media progress', async () => {
- const fakeReq = {
- user: user1,
- params: { id: mediaProgress1.id }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- await MeController.removeMediaProgress(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(200)).to.be.true
-
- // Verify media progress was deleted
- const deletedProgress = await Database.mediaProgressModel.findByPk(mediaProgress1.id)
- expect(deletedProgress).to.be.null
- })
-
- it('should prevent user from deleting another users media progress (IDOR)', async () => {
- const fakeReq = {
- user: user1,
- params: { id: mediaProgress2.id } // Trying to delete user2's progress
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- await MeController.removeMediaProgress(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(404)).to.be.true
-
- // Verify media progress was NOT deleted
- const existingProgress = await Database.mediaProgressModel.findByPk(mediaProgress2.id)
- expect(existingProgress).to.not.be.null
- expect(existingProgress.userId).to.equal(user2.id)
- })
-
- it('should return 404 for non-existent media progress', async () => {
- const fakeReq = {
- user: user1,
- params: { id: 'non-existent-id' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- await MeController.removeMediaProgress(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(404)).to.be.true
- })
- })
-
- describe('Bookmark Operations - Authorization Checks', () => {
- let user1, user2
- let library1, library2
- let libraryItem1, libraryItem2
-
- beforeEach(async () => {
- // Create two users with different library access
- user1 = await Database.userModel.create({
- username: 'user1',
- pash: 'hashed_password_1',
- type: 'user',
- isActive: true,
- librariesAccessible: null // Access to all libraries
- })
-
- user2 = await Database.userModel.create({
- username: 'user2',
- pash: 'hashed_password_2',
- type: 'user',
- isActive: true,
- librariesAccessible: [] // Will be set to specific library
- })
-
- // Create two libraries
- library1 = await Database.libraryModel.create({ name: 'Library 1', mediaType: 'book' })
- library2 = await Database.libraryModel.create({ name: 'Library 2', mediaType: 'book' })
-
- // User2 only has access to library1
- user2.librariesAccessible = [library1.id]
- await user2.save()
-
- const libraryFolder1 = await Database.libraryFolderModel.create({ path: '/test1', libraryId: library1.id })
- const libraryFolder2 = await Database.libraryFolderModel.create({ path: '/test2', libraryId: library2.id })
-
- const book1 = await Database.bookModel.create({ title: 'Book 1', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
- const book2 = await Database.bookModel.create({ title: 'Book 2', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
-
- libraryItem1 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book1.id,
- mediaType: 'book',
- libraryId: library1.id,
- libraryFolderId: libraryFolder1.id
- })
-
- libraryItem2 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book2.id,
- mediaType: 'book',
- libraryId: library2.id,
- libraryFolderId: libraryFolder2.id
- })
-
- // Initialize bookmarks
- user1.bookmarks = []
- user2.bookmarks = []
- })
-
- describe('createBookmark', () => {
- it('should allow user to create bookmark for accessible library item', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- const bookmark = { libraryItemId: libraryItem1.id, time: 100, title: 'Test Bookmark', createdAt: Date.now() }
-
- const fakeReq = {
- user: {
- ...user2.toJSON(),
- id: user2.id,
- username: user2.username,
- checkCanAccessLibraryItem: () => true,
- createBookmark: sinon.stub().resolves(bookmark),
- toOldJSONForBrowser: () => ({ id: user2.id, username: user2.username })
- },
- params: { id: libraryItem1.id },
- body: { time: 100, title: 'Test Bookmark' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.createBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.json.calledOnce).to.be.true
- expect(fakeRes.json.calledWith(bookmark)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should prevent user from creating bookmark for inaccessible library item (IDOR)', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem2.id)
-
- const fakeReq = {
- user: user2, // user2 doesn't have access to library2
- params: { id: libraryItem2.id },
- body: { time: 100, title: 'Test Bookmark' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- // Mock getExpandedById
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.createBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- expect(fakeRes.json.called).to.be.false
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should return 404 for non-existent library item', async () => {
- const fakeReq = {
- user: user1,
- params: { id: 'non-existent-id' },
- body: { time: 100, title: 'Test Bookmark' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- // Mock getExpandedById to return null
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(null)
-
- await MeController.createBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(404)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should validate bookmark time parameter', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- const fakeReq = {
- user: {
- ...user1.toJSON(),
- id: user1.id,
- username: user1.username,
- checkCanAccessLibraryItem: () => true
- },
- params: { id: libraryItem1.id },
- body: { time: null, title: 'Test Bookmark' } // null time is invalid
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.createBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.status.calledWith(400)).to.be.true
- expect(fakeRes.send.calledWith('Invalid time')).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
- })
-
- describe('updateBookmark', () => {
- beforeEach(async () => {
- // Add existing bookmark to user1
- user1.bookmarks = [{ libraryItemId: libraryItem1.id, time: 100, title: 'Original Title' }]
- await user1.save()
- })
-
- it('should allow user to update bookmark for accessible library item', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- const bookmark = { libraryItemId: libraryItem1.id, time: 100, title: 'Updated Title' }
-
- const fakeReq = {
- user: {
- ...user1.toJSON(),
- id: user1.id,
- username: user1.username,
- checkCanAccessLibraryItem: () => true,
- updateBookmark: sinon.stub().resolves(bookmark),
- toOldJSONForBrowser: () => ({ id: user1.id, username: user1.username })
- },
- params: { id: libraryItem1.id },
- body: { time: 100, title: 'Updated Title' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.updateBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.json.calledOnce).to.be.true
- expect(fakeRes.json.calledWith(bookmark)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should prevent user from updating bookmark for inaccessible library item (IDOR)', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem2.id)
-
- const fakeReq = {
- user: user2, // user2 doesn't have access to library2
- params: { id: libraryItem2.id },
- body: { time: 100, title: 'Updated Title' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.updateBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
- })
-
- describe('removeBookmark', () => {
- beforeEach(async () => {
- // Add existing bookmark to user1
- user1.bookmarks = [{ libraryItemId: libraryItem1.id, time: 100, title: 'Test Bookmark' }]
- await user1.save()
- })
-
- it('should allow user to remove bookmark for accessible library item', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- const fakeReq = {
- user: {
- ...user1.toJSON(),
- id: user1.id,
- username: user1.username,
- checkCanAccessLibraryItem: () => true,
- findBookmark: sinon.stub().returns({ libraryItemId: libraryItem1.id, time: 100, title: 'Test Bookmark' }),
- removeBookmark: sinon.stub().resolves(true),
- toOldJSONForBrowser: () => ({ id: user1.id, username: user1.username })
- },
- params: { id: libraryItem1.id, time: '100' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.removeBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(200)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should prevent user from removing bookmark for inaccessible library item (IDOR)', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem2.id)
-
- const fakeReq = {
- user: user2, // user2 doesn't have access to library2
- params: { id: libraryItem2.id, time: '100' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.removeBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
-
- it('should validate time parameter is a number', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- const fakeReq = {
- user: {
- ...user1.toJSON(),
- id: user1.id,
- username: user1.username,
- checkCanAccessLibraryItem: () => true
- },
- params: { id: libraryItem1.id, time: 'not-a-number' }
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
-
- await MeController.removeBookmark(fakeReq, fakeRes)
-
- expect(fakeRes.status.calledWith(400)).to.be.true
- expect(fakeRes.send.calledWith('Invalid time')).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
- })
- })
-
- describe('getItemListeningSessions - Authorization Check', () => {
- let user1, user2
- let library1, library2
- let libraryItem1, libraryItem2
-
- beforeEach(async () => {
- // Create two users with different library access
- user1 = await Database.userModel.create({
- username: 'user1',
- pash: 'hashed_password_1',
- type: 'user',
- isActive: true,
- librariesAccessible: null // Access to all libraries
- })
-
- user2 = await Database.userModel.create({
- username: 'user2',
- pash: 'hashed_password_2',
- type: 'user',
- isActive: true,
- librariesAccessible: [] // Will be set to specific library
- })
-
- // Create two libraries
- library1 = await Database.libraryModel.create({ name: 'Library 1', mediaType: 'book' })
- library2 = await Database.libraryModel.create({ name: 'Library 2', mediaType: 'book' })
-
- // User2 only has access to library1
- user2.librariesAccessible = [library1.id]
- await user2.save()
-
- const libraryFolder1 = await Database.libraryFolderModel.create({ path: '/test1', libraryId: library1.id })
- const libraryFolder2 = await Database.libraryFolderModel.create({ path: '/test2', libraryId: library2.id })
-
- const book1 = await Database.bookModel.create({ title: 'Book 1', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
- const book2 = await Database.bookModel.create({ title: 'Book 2', audioFiles: [], tags: [], narrators: [], genres: [], chapters: [] })
-
- libraryItem1 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book1.id,
- mediaType: 'book',
- libraryId: library1.id,
- libraryFolderId: libraryFolder1.id
- })
-
- libraryItem2 = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: book2.id,
- mediaType: 'book',
- libraryId: library2.id,
- libraryFolderId: libraryFolder2.id
- })
- })
-
- it('should allow user to view listening sessions for accessible library item', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem1.id)
-
- // Create mock context with getUserItemListeningSessionsHelper
- const mockContext = {
- getUserItemListeningSessionsHelper: sinon.stub().resolves([{ id: 'session1', timeListening: 300, startedAt: Date.now() }])
- }
-
- const fakeReq = {
- user: {
- ...user1.toJSON(),
- id: user1.id,
- username: user1.username,
- checkCanAccessLibraryItem: () => true
- },
- params: { libraryItemId: libraryItem1.id },
- query: {}
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
- sinon.stub(Database.podcastEpisodeModel, 'findByPk').resolves(null)
-
- await MeController.getItemListeningSessions.bind(mockContext)(fakeReq, fakeRes)
-
- expect(fakeRes.json.calledOnce).to.be.true
- expect(fakeRes.sendStatus.called).to.be.false
-
- // Verify the payload structure
- const payload = fakeRes.json.firstCall.args[0]
- expect(payload).to.have.property('total')
- expect(payload).to.have.property('sessions')
-
- Database.libraryItemModel.getExpandedById.restore()
- Database.podcastEpisodeModel.findByPk.restore()
- })
-
- it('should prevent user from viewing listening sessions for inaccessible library item (IDOR)', async () => {
- const expandedItem = await Database.libraryItemModel.getExpandedById(libraryItem2.id)
-
- const fakeReq = {
- user: user2, // user2 doesn't have access to library2
- params: { libraryItemId: libraryItem2.id },
- query: {}
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(expandedItem)
- sinon.stub(Database.podcastEpisodeModel, 'findByPk').resolves(null)
-
- await MeController.getItemListeningSessions.bind(apiRouter)(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(403)).to.be.true
- expect(fakeRes.json.called).to.be.false
-
- Database.libraryItemModel.getExpandedById.restore()
- Database.podcastEpisodeModel.findByPk.restore()
- })
-
- it('should return 404 for non-existent library item', async () => {
- const fakeReq = {
- user: user1,
- params: { libraryItemId: 'non-existent-id' },
- query: {}
- }
- const fakeRes = {
- sendStatus: sinon.spy(),
- status: sinon.stub().returnsThis(),
- send: sinon.spy(),
- json: sinon.spy()
- }
-
- sinon.stub(Database.libraryItemModel, 'getExpandedById').resolves(null)
-
- await MeController.getItemListeningSessions.bind(apiRouter)(fakeReq, fakeRes)
-
- expect(fakeRes.sendStatus.calledWith(404)).to.be.true
-
- Database.libraryItemModel.getExpandedById.restore()
- })
- })
-})
diff --git a/test/server/finders/BookFinder.test.js b/test/server/finders/BookFinder.test.js
index cb697b81a..6578ca82a 100644
--- a/test/server/finders/BookFinder.test.js
+++ b/test/server/finders/BookFinder.test.js
@@ -35,10 +35,7 @@ describe('TitleCandidates', () => {
['adds candidate, removing author', `anna karenina by ${cleanAuthor}`, ['anna karenina']],
['does not add empty candidate after removing author', cleanAuthor, []],
['adds candidate, removing subtitle', 'anna karenina: subtitle', ['anna karenina']],
- ['adds candidate, not stripping subtitle for bare colon in title', '10:04', ['10:04']],
- ['adds candidate, not stripping subtitle for colon between words without space', 'making the mission:impossible movies', ['making the mission:impossible movies']],
['adds candidate + variant, removing "by ..."', 'anna karenina by arnold schwarzenegger', ['anna karenina', 'anna karenina by arnold schwarzenegger']],
- ['adds candidate + variant, removing "by ..." when title has bare colon', '10:04 by ben lerner', ['10:04', '10:04 by ben lerner']],
['adds candidate + variant, removing bitrate', 'anna karenina 64kbps', ['anna karenina', 'anna karenina 64kbps']],
['adds candidate + variant, removing edition 1', 'anna karenina 2nd edition', ['anna karenina', 'anna karenina 2nd edition']],
['adds candidate + variant, removing edition 2', 'anna karenina 4th ed.', ['anna karenina', 'anna karenina 4th ed.']],
diff --git a/test/server/managers/ApiCacheManager.test.js b/test/server/managers/ApiCacheManager.test.js
index 2e9ad5b77..19bbeecf6 100644
--- a/test/server/managers/ApiCacheManager.test.js
+++ b/test/server/managers/ApiCacheManager.test.js
@@ -1,7 +1,6 @@
// Import dependencies and modules for testing
const { expect } = require('chai')
const sinon = require('sinon')
-const { LRUCache } = require('lru-cache')
const ApiCacheManager = require('../../../server/managers/ApiCacheManager')
describe('ApiCacheManager', () => {
@@ -95,17 +94,4 @@ describe('ApiCacheManager', () => {
expect(res.originalSend.calledWith(body)).to.be.true
})
})
-
- describe('clear on mediaProgress', () => {
- it('should remove recent-episodes cache entries', () => {
- const key = JSON.stringify({ user: 'u', url: '/libraries/abc-123/recent-episodes?limit=50&page=0' })
- const cache = new LRUCache({ max: 10 })
- cache.set(key, { body: '[]', headers: {}, statusCode: 200 })
- const manager = new ApiCacheManager(cache)
-
- manager.clear({ name: 'mediaProgress' }, 'afterUpdate')
-
- expect(cache.get(key)).to.be.undefined
- })
- })
})
diff --git a/test/server/models/oldJsonSerialization.test.js b/test/server/models/oldJsonSerialization.test.js
deleted file mode 100644
index 98bab6afa..000000000
--- a/test/server/models/oldJsonSerialization.test.js
+++ /dev/null
@@ -1,158 +0,0 @@
-const { expect } = require('chai')
-const { Sequelize } = require('sequelize')
-
-const Database = require('../../../server/Database')
-
-/**
- * Assert that `expanded` contains every key from `minified` with matching values.
- * Used to enforce the contract: toOldJSONExpanded() is a strict superset of toOldJSONMinified().
- *
- * @param {object} minified
- * @param {object} expanded
- * @param {string} [path]
- */
-function assertExpandedSuperset(minified, expanded, path = '') {
- for (const key of Object.keys(minified)) {
- const keyPath = path ? `${path}.${key}` : key
- expect(expanded, `missing key ${keyPath}`).to.have.property(key)
-
- const minifiedValue = minified[key]
- const expandedValue = expanded[key]
-
- if (minifiedValue !== null && typeof minifiedValue === 'object' && !Array.isArray(minifiedValue)) {
- assertExpandedSuperset(minifiedValue, expandedValue, keyPath)
- } else if (Array.isArray(minifiedValue)) {
- expect(expandedValue, `expected array at ${keyPath}`).to.be.an('array')
- expect(expandedValue).to.deep.equal(minifiedValue)
- } else {
- expect(expandedValue, `value mismatch at ${keyPath}`).to.equal(minifiedValue)
- }
- }
-}
-
-describe('old JSON serialization', () => {
- let bookLibraryItemId
- let podcastLibraryItemId
-
- beforeEach(async () => {
- global.ServerSettings = {}
- Database.sequelize = new Sequelize({ dialect: 'sqlite', storage: ':memory:', logging: false })
- Database.sequelize.uppercaseFirst = (str) => (str ? `${str[0].toUpperCase()}${str.substr(1)}` : '')
- await Database.buildModels()
-
- const bookLibrary = await Database.libraryModel.create({ name: 'Book Library', mediaType: 'book' })
- const bookLibraryFolder = await Database.libraryFolderModel.create({ path: '/books', libraryId: bookLibrary.id })
-
- const book = await Database.bookModel.create({
- title: 'Test Book',
- audioFiles: [{ index: 1, ino: '1', metadata: { filename: 'track.mp3', ext: '.mp3', path: '/track.mp3', relPath: 'track.mp3', size: 1000 } }],
- tags: ['fiction'],
- narrators: ['Narrator One'],
- genres: ['Fantasy'],
- chapters: [{ id: 0, start: 0, end: 100, title: 'Chapter 1' }],
- ebookFile: { ino: '2', metadata: { filename: 'book.epub', ext: '.epub', path: '/book.epub', relPath: 'book.epub', size: 500 }, ebookFormat: 'epub' }
- })
- const bookLibraryItem = await Database.libraryItemModel.create({
- libraryFiles: [{ ino: '1', metadata: { filename: 'track.mp3', ext: '.mp3', path: '/track.mp3', relPath: 'track.mp3' } }],
- mediaId: book.id,
- mediaType: 'book',
- libraryId: bookLibrary.id,
- libraryFolderId: bookLibraryFolder.id
- })
- bookLibraryItemId = bookLibraryItem.id
-
- const author = await Database.authorModel.create({ name: 'Test Author', libraryId: bookLibrary.id })
- await Database.bookAuthorModel.create({ bookId: book.id, authorId: author.id })
-
- const series = await Database.seriesModel.create({ name: 'Test Series', libraryId: bookLibrary.id })
- await Database.bookSeriesModel.create({ bookId: book.id, seriesId: series.id, sequence: '2' })
-
- const podcastLibrary = await Database.libraryModel.create({ name: 'Podcast Library', mediaType: 'podcast' })
- const podcastLibraryFolder = await Database.libraryFolderModel.create({ path: '/podcasts', libraryId: podcastLibrary.id })
-
- const podcast = await Database.podcastModel.create({
- title: 'Test Podcast',
- tags: ['news'],
- genres: ['Technology'],
- autoDownloadEpisodes: false
- })
- const podcastLibraryItem = await Database.libraryItemModel.create({
- libraryFiles: [],
- mediaId: podcast.id,
- mediaType: 'podcast',
- libraryId: podcastLibrary.id,
- libraryFolderId: podcastLibraryFolder.id
- })
- podcastLibraryItemId = podcastLibraryItem.id
-
- await Database.podcastEpisodeModel.create({
- podcastId: podcast.id,
- title: 'Episode 1',
- index: 1,
- audioFile: { ino: '3', metadata: { filename: 'ep1.mp3', ext: '.mp3', path: '/ep1.mp3', relPath: 'ep1.mp3' } }
- })
- })
-
- afterEach(async () => {
- await Database.sequelize.sync({ force: true })
- })
-
- describe('Book', () => {
- it('toOldJSONExpanded is a strict superset of toOldJSONMinified', async () => {
- const libraryItem = await Database.libraryItemModel.getExpandedById(bookLibraryItemId)
- const minified = libraryItem.media.toOldJSONMinified()
- const expanded = libraryItem.media.toOldJSONExpanded(libraryItem.id)
-
- assertExpandedSuperset(minified, expanded)
-
- expect(expanded).to.have.property('libraryItemId', libraryItem.id)
- expect(expanded).to.have.property('audioFiles')
- expect(expanded).to.have.property('chapters')
- expect(expanded).to.have.property('tracks')
- expect(expanded.numTracks).to.equal(expanded.tracks.length)
- expect(expanded.numAudioFiles).to.equal(expanded.audioFiles.length)
- expect(expanded.numChapters).to.equal(expanded.chapters.length)
- expect(expanded.ebookFormat).to.equal('epub')
- })
- })
-
- describe('Podcast', () => {
- it('toOldJSONExpanded is a strict superset of toOldJSONMinified', async () => {
- const libraryItem = await Database.libraryItemModel.getExpandedById(podcastLibraryItemId)
- const minified = libraryItem.media.toOldJSONMinified()
- const expanded = libraryItem.media.toOldJSONExpanded(libraryItem.id)
-
- assertExpandedSuperset(minified, expanded)
-
- expect(expanded).to.have.property('libraryItemId', libraryItem.id)
- expect(expanded).to.have.property('episodes')
- expect(expanded.numEpisodes).to.equal(expanded.episodes.length)
- })
- })
-
- describe('LibraryItem', () => {
- it('book library item expanded is a strict superset of minified', async () => {
- const libraryItem = await Database.libraryItemModel.getExpandedById(bookLibraryItemId)
- const minified = libraryItem.toOldJSONMinified()
- const expanded = libraryItem.toOldJSONExpanded()
-
- assertExpandedSuperset(minified, expanded)
-
- expect(expanded).to.have.property('libraryFiles')
- expect(expanded).to.have.property('lastScan')
- expect(expanded.numFiles).to.equal(expanded.libraryFiles.length)
- expect(expanded.media.numTracks).to.equal(expanded.media.tracks.length)
- })
-
- it('podcast library item expanded is a strict superset of minified', async () => {
- const libraryItem = await Database.libraryItemModel.getExpandedById(podcastLibraryItemId)
- const minified = libraryItem.toOldJSONMinified()
- const expanded = libraryItem.toOldJSONExpanded()
-
- assertExpandedSuperset(minified, expanded)
-
- expect(expanded).to.have.property('libraryFiles')
- expect(expanded.media.numEpisodes).to.equal(expanded.media.episodes.length)
- })
- })
-})
diff --git a/test/server/utils/parsers/parseNfoMetadata.test.js b/test/server/utils/parsers/parseNfoMetadata.test.js
index ba11ddff2..9ff51fbe5 100644
--- a/test/server/utils/parsers/parseNfoMetadata.test.js
+++ b/test/server/utils/parsers/parseNfoMetadata.test.js
@@ -21,20 +21,6 @@ describe('parseNfoMetadata', () => {
expect(result.subtitle).to.equal('A Novel')
})
- it('does not split title on bare colon without space', () => {
- const nfoText = 'Title: 10:04'
- const result = parseNfoMetadata(nfoText)
- expect(result.title).to.equal('10:04')
- expect(result.subtitle).to.be.undefined
- })
-
- it('does not split title on colon between words without space', () => {
- const nfoText = 'Title: Making the Mission:Impossible Movies'
- const result = parseNfoMetadata(nfoText)
- expect(result.title).to.equal('Making the Mission:Impossible Movies')
- expect(result.subtitle).to.be.undefined
- })
-
it('parses authors', () => {
const nfoText = 'Author: F. Scott Fitzgerald'
const result = parseNfoMetadata(nfoText)
{{ message }}
+') - .replace(/<code>/gi, '
')
- .replace(/<\/code>/gi, '')
- },
callback() {
return this.confirmPromptOptions.callback
},
@@ -115,14 +103,6 @@ export default {
if (this.callback) this.callback(true, this.checkboxValue)
this.show = false
},
- escapeHtml(value) {
- return String(value)
- .replace(/&/g, '&')
- .replace(//g, '>')
- .replace(/"/g, '"')
- .replace(/'/g, ''')
- },
setShow() {
this.checkboxValue = this.checkboxDefaultValue
this.$eventBus.$emit('showing-prompt', true)
diff --git a/client/components/stats/DailyListeningChart.vue b/client/components/stats/DailyListeningChart.vue
index 55752fc5d..c0f3acb32 100644
--- a/client/components/stats/DailyListeningChart.vue
+++ b/client/components/stats/DailyListeningChart.vue
@@ -14,7 +14,7 @@
-
+
@@ -186,16 +186,10 @@ export default {
daysInARow() {
var count = 0
while (true) {
- const _date = this.$addDaysToToday(count * -1 - 1)
- const datestr = this.$formatJsDate(_date, 'yyyy-MM-dd')
+ var _date = this.$addDaysToToday(count * -1)
+ var datestr = this.$formatJsDate(_date, 'yyyy-MM-dd')
if (!this.listeningStatsDays[datestr] || this.listeningStatsDays[datestr] === 0) {
- // don't require listening today to count towards days in a row, but do count it if already listened today
- const today = this.$formatJsDate(new Date(), 'yyyy-MM-dd')
- if (this.listeningStatsDays[today]) {
- count++
- }
-
return count
}
count++
diff --git a/client/components/ui/LoadingIndicator.vue b/client/components/ui/LoadingIndicator.vue
index 3b4b6e049..d984bf35e 100644
--- a/client/components/ui/LoadingIndicator.vue
+++ b/client/components/ui/LoadingIndicator.vue
@@ -1,5 +1,5 @@
-
+
-
+
@@ -25,9 +23,6 @@ export default {
computed: {
message() {
return this.text || this.$strings.MessagePleaseWait
- },
- hasSlotContent() {
- return this.$slots.default && this.$slots.default.length > 0
}
}
}
diff --git a/client/components/ui/MultiSelect.vue b/client/components/ui/MultiSelect.vue
index 3dcfb0495..c7572ba50 100644
--- a/client/components/ui/MultiSelect.vue
+++ b/client/components/ui/MultiSelect.vue
@@ -278,7 +278,7 @@ export default {
})
},
insertNewItem(item) {
- if (!this.selected.includes(item)) this.selected.push(item)
+ this.selected.push(item)
this.$emit('input', this.selected)
this.$emit('newItem', item)
this.textInput = null
diff --git a/client/components/ui/MultiSelectQueryInput.vue b/client/components/ui/MultiSelectQueryInput.vue
index 4bc434cbd..18abc66e7 100644
--- a/client/components/ui/MultiSelectQueryInput.vue
+++ b/client/components/ui/MultiSelectQueryInput.vue
@@ -287,7 +287,7 @@ export default {
})
},
insertNewItem(item) {
- if (!this.selected.find((i) => i.name === item.name)) this.selected.push(item)
+ this.selected.push(item)
this.$emit('input', this.selected)
this.$emit('newItem', item)
this.textInput = null
diff --git a/client/components/ui/TextInput.vue b/client/components/ui/TextInput.vue
index cd3bc6d2d..dd0eaa738 100644
--- a/client/components/ui/TextInput.vue
+++ b/client/components/ui/TextInput.vue
@@ -1,6 +1,6 @@
-
-
+
@@ -594,14 +594,6 @@ export default {
this.hasChanges = hasChanges
},
- getAudioTrackForTime(time) {
- if (typeof time !== 'number') {
- return null
- }
- return this.tracks.find((at) => {
- return time >= at.startOffset && time < at.startOffset + at.duration
- })
- },
playChapter(chapter) {
console.log('Play Chapter', chapter.id)
if (this.selectedChapterId === chapter.id) {
@@ -616,12 +608,9 @@ export default {
this.destroyAudioEl()
}
- const audioTrack = this.getAudioTrackForTime(chapter.start)
- if (!audioTrack) {
- console.error('No audio track found for chapter', chapter)
- return
- }
-
+ const audioTrack = this.tracks.find((at) => {
+ return chapter.start >= at.startOffset && chapter.start < at.startOffset + at.duration
+ })
this.selectedChapter = chapter
this.isLoadingChapter = true
diff --git a/client/pages/config/index.vue b/client/pages/config/index.vue
index 7fb84d468..3d030bb32 100644
--- a/client/pages/config/index.vue
+++ b/client/pages/config/index.vue
@@ -247,8 +247,7 @@ export default {
return this.$store.state.serverSettings
},
providers() {
- // Use book cover providers for the cover provider dropdown
- return this.$store.state.scanners.bookCoverProviders || []
+ return this.$store.state.scanners.providers
},
dateFormats() {
return this.$store.state.globals.dateFormats
@@ -390,8 +389,8 @@ export default {
},
purgeItemsCache() {
const payload = {
+ // message: `This will delete the entire folder at
Are you sure you want to purge items cache?`, message: this.$strings.MessageConfirmPurgeItemsCache, - allowHtml: true, callback: (confirmed) => { if (confirmed) { this.sendPurgeItemsCache() @@ -417,8 +416,6 @@ export default { }, mounted() { this.initServerSettings() - // Fetch providers if not already loaded (for cover provider dropdown) - this.$store.dispatch('scanners/fetchProviders') } } diff --git a/client/pages/config/item-metadata-utils/genres.vue b/client/pages/config/item-metadata-utils/genres.vue index 8abe34eef..87e14bbd8 100644 --- a/client/pages/config/item-metadata-utils/genres.vue +++ b/client/pages/config/item-metadata-utils/genres.vue @@ -90,9 +90,9 @@ export default { let message = this.$getString('MessageConfirmRenameGenre', [this.editingGenre, this.newGenreName]) if (genreNameExists) { - message += ` ${this.$strings.MessageConfirmRenameGenreMergeNote}` + message += `
${this.$strings.MessageConfirmRenameGenreMergeNote}` } else if (genreNameExistsOfDifferentCase) { - message += ` ${this.$getString('MessageConfirmRenameGenreWarning', [genreNameExistsOfDifferentCase])}` + message += `
${this.$getString('MessageConfirmRenameGenreWarning', [genreNameExistsOfDifferentCase])}` } const payload = { diff --git a/client/pages/config/item-metadata-utils/tags.vue b/client/pages/config/item-metadata-utils/tags.vue index 4dfc39424..2fe5c0f1a 100644 --- a/client/pages/config/item-metadata-utils/tags.vue +++ b/client/pages/config/item-metadata-utils/tags.vue @@ -86,9 +86,9 @@ export default { let message = this.$getString('MessageConfirmRenameTag', [this.editingTag, this.newTagName]) if (tagNameExists) { - message += ` ${this.$strings.MessageConfirmRenameTagMergeNote}` + message += `
${this.$strings.MessageConfirmRenameTagMergeNote}` } else if (tagNameExistsOfDifferentCase) { - message += ` ${this.$getString('MessageConfirmRenameTagWarning', [tagNameExistsOfDifferentCase])}` + message += `
${this.$getString('MessageConfirmRenameTagWarning', [tagNameExistsOfDifferentCase])}` } const payload = { diff --git a/client/pages/config/sessions.vue b/client/pages/config/sessions.vue index 4341ea07d..86ec7eec6 100644 --- a/client/pages/config/sessions.vue +++ b/client/pages/config/sessions.vue @@ -66,11 +66,7 @@
-
-
-
') }, getPlayMethodName(playMethod) { if (playMethod === this.$constants.PlayMethod.DIRECTPLAY) return 'Direct Play' diff --git a/client/pages/config/users/_id/sessions.vue b/client/pages/config/users/_id/sessions.vue index cb18f5ee3..060f34be8 100644 --- a/client/pages/config/users/_id/sessions.vue +++ b/client/pages/config/users/_id/sessions.vue @@ -38,12 +38,8 @@
-
+
+
@@ -197,16 +193,16 @@ export default {
this.selectedSession = session
this.showSessionModal = true
},
- getDeviceInfoLines(deviceInfo) {
- if (!deviceInfo) return []
- const lines = []
+ getDeviceInfoString(deviceInfo) {
+ if (!deviceInfo) return ''
+ var lines = []
if (deviceInfo.clientName) lines.push(`${deviceInfo.clientName} ${deviceInfo.clientVersion || ''}`)
if (deviceInfo.osName) lines.push(`${deviceInfo.osName} ${deviceInfo.osVersion}`)
if (deviceInfo.browserName) lines.push(deviceInfo.browserName)
if (deviceInfo.manufacturer && deviceInfo.model) lines.push(`${deviceInfo.manufacturer} ${deviceInfo.model}`)
if (deviceInfo.sdkVersion) lines.push(`SDK Version: ${deviceInfo.sdkVersion}`)
- return lines
+ return lines.join('
') }, getPlayMethodName(playMethod) { if (playMethod === this.$constants.PlayMethod.DIRECTPLAY) return 'Direct Play' diff --git a/client/pages/login.vue b/client/pages/login.vue index cec150e71..ef3827afe 100644 --- a/client/pages/login.vue +++ b/client/pages/login.vue @@ -17,9 +17,9 @@
@@ -57,17 +57,21 @@ Try it out on the [Google Play Store](https://play.google.com/store/apps/details
Using Test Flight: https://testflight.apple.com/join/wiic7QIW **_(beta is full)_**
+### Build your own tools & clients
+
+Check out the [API documentation](https://api.audiobookshelf.org/)
+
@@ -7,9 +7,7 @@
- {{ message }}
- {{ message }}
-
+
@@ -26,8 +26,7 @@ export default {
disabled: Boolean,
inputClass: String,
showCopy: Boolean,
- trimWhitespace: Boolean,
- autocomplete: String
+ trimWhitespace: Boolean
},
data() {
return {}
diff --git a/client/components/ui/Tooltip.vue b/client/components/ui/Tooltip.vue
index c858cbfec..e6ab0117b 100644
--- a/client/components/ui/Tooltip.vue
+++ b/client/components/ui/Tooltip.vue
@@ -22,8 +22,7 @@ export default {
type: Number,
default: 0
},
- disabled: Boolean,
- plaintext: Boolean
+ disabled: Boolean
},
data() {
return {
@@ -47,11 +46,7 @@ export default {
methods: {
updateText() {
if (this.tooltip) {
- if (this.plaintext) {
- this.tooltip.textContent = this.text
- } else {
- this.tooltip.innerHTML = this.text
- }
+ this.tooltip.innerHTML = this.text
this.setTooltipPosition(this.tooltip)
}
},
@@ -63,11 +58,7 @@ export default {
tooltip.className = 'tooltip-wrapper absolute px-2 py-1 text-white text-xs rounded-sm shadow-lg max-w-xs text-center hidden sm:block'
tooltip.style.zIndex = 100
tooltip.style.backgroundColor = 'rgba(0,0,0,0.85)'
- if (this.plaintext) {
- tooltip.textContent = this.text
- } else {
- tooltip.innerHTML = this.text
- }
+ tooltip.innerHTML = this.text
tooltip.addEventListener('mouseover', this.cancelHide)
tooltip.addEventListener('mouseleave', this.hideTooltip)
diff --git a/client/components/widgets/ItemSlider.vue b/client/components/widgets/ItemSlider.vue
index 5b96e51b4..880654a44 100644
--- a/client/components/widgets/ItemSlider.vue
+++ b/client/components/widgets/ItemSlider.vue
@@ -132,10 +132,10 @@ export default {
editAuthor(author) {
this.$store.commit('globals/showEditAuthorModal', author)
},
- editItem(libraryItem, tab = 'details') {
+ editItem(libraryItem) {
var itemIds = this.items.map((e) => e.id)
this.$store.commit('setBookshelfBookIds', itemIds)
- this.$store.commit('showEditModalOnTab', { libraryItem, tab: tab || 'details' })
+ this.$store.commit('showEditModal', libraryItem)
},
selectItem(payload) {
this.$emit('selectEntity', payload)
diff --git a/client/layouts/default.vue b/client/layouts/default.vue
index 75753b214..4b9729248 100644
--- a/client/layouts/default.vue
+++ b/client/layouts/default.vue
@@ -371,13 +371,11 @@ export default {
},
customMetadataProviderAdded(provider) {
if (!provider?.id) return
- // Refresh providers cache
- this.$store.dispatch('scanners/refreshProviders')
+ this.$store.commit('scanners/addCustomMetadataProvider', provider)
},
customMetadataProviderRemoved(provider) {
if (!provider?.id) return
- // Refresh providers cache
- this.$store.dispatch('scanners/refreshProviders')
+ this.$store.commit('scanners/removeCustomMetadataProvider', provider)
},
initializeSocket() {
if (this.$root.socket) {
diff --git a/client/mixins/bookshelfCardsHelpers.js b/client/mixins/bookshelfCardsHelpers.js
index f1571f70e..fc8a41256 100644
--- a/client/mixins/bookshelfCardsHelpers.js
+++ b/client/mixins/bookshelfCardsHelpers.js
@@ -118,8 +118,8 @@ export default {
propsData: props,
parent: this,
created() {
- this.$on('edit', (entity, tab) => {
- if (_this.editEntity) _this.editEntity(entity, tab)
+ this.$on('edit', (entity) => {
+ if (_this.editEntity) _this.editEntity(entity)
})
this.$on('select', ({ entity, shiftKey }) => {
if (_this.selectEntity) _this.selectEntity(entity, shiftKey)
diff --git a/client/package-lock.json b/client/package-lock.json
index 502ba4b03..0d2699ed1 100644
--- a/client/package-lock.json
+++ b/client/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "audiobookshelf-client",
- "version": "2.35.1",
+ "version": "2.30.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "audiobookshelf-client",
- "version": "2.35.1",
+ "version": "2.30.0",
"license": "ISC",
"dependencies": {
"@nuxtjs/axios": "^5.13.6",
diff --git a/client/package.json b/client/package.json
index 0ec070b32..50fd0b713 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
{
"name": "audiobookshelf-client",
- "version": "2.35.1",
+ "version": "2.30.0",
"buildNumber": 1,
"description": "Self-hosted audiobook and podcast client",
"main": "index.js",
diff --git a/client/pages/audiobook/_id/chapters.vue b/client/pages/audiobook/_id/chapters.vue
index e91a8846d..cf254165b 100644
--- a/client/pages/audiobook/_id/chapters.vue
+++ b/client/pages/audiobook/_id/chapters.vue
@@ -117,16 +117,16 @@
close
@@ -41,8 +41,7 @@ export default {
step: [String, Number],
min: [String, Number],
customInputClass: String,
- trimWhitespace: Boolean,
- autocomplete: String
+ trimWhitespace: Boolean
},
data() {
return {
diff --git a/client/components/ui/TextInputWithLabel.vue b/client/components/ui/TextInputWithLabel.vue
index a755a407d..81c5516b1 100644
--- a/client/components/ui/TextInputWithLabel.vue
+++ b/client/components/ui/TextInputWithLabel.vue
@@ -6,7 +6,7 @@
{{ note }}
- {{ elapsedTime }}s
/metadata/cache/items.Are you sure you want to purge items cache?`, message: this.$strings.MessageConfirmPurgeItemsCache, - allowHtml: true, callback: (confirmed) => { if (confirmed) { this.sendPurgeItemsCache() @@ -417,8 +416,6 @@ export default { }, mounted() { this.initServerSettings() - // Fetch providers if not already loaded (for cover provider dropdown) - this.$store.dispatch('scanners/fetchProviders') } } diff --git a/client/pages/config/item-metadata-utils/genres.vue b/client/pages/config/item-metadata-utils/genres.vue index 8abe34eef..87e14bbd8 100644 --- a/client/pages/config/item-metadata-utils/genres.vue +++ b/client/pages/config/item-metadata-utils/genres.vue @@ -90,9 +90,9 @@ export default { let message = this.$getString('MessageConfirmRenameGenre', [this.editingGenre, this.newGenreName]) if (genreNameExists) { - message += ` ${this.$strings.MessageConfirmRenameGenreMergeNote}` + message += `
${this.$strings.MessageConfirmRenameGenreMergeNote}` } else if (genreNameExistsOfDifferentCase) { - message += ` ${this.$getString('MessageConfirmRenameGenreWarning', [genreNameExistsOfDifferentCase])}` + message += `
${this.$getString('MessageConfirmRenameGenreWarning', [genreNameExistsOfDifferentCase])}` } const payload = { diff --git a/client/pages/config/item-metadata-utils/tags.vue b/client/pages/config/item-metadata-utils/tags.vue index 4dfc39424..2fe5c0f1a 100644 --- a/client/pages/config/item-metadata-utils/tags.vue +++ b/client/pages/config/item-metadata-utils/tags.vue @@ -86,9 +86,9 @@ export default { let message = this.$getString('MessageConfirmRenameTag', [this.editingTag, this.newTagName]) if (tagNameExists) { - message += ` ${this.$strings.MessageConfirmRenameTagMergeNote}` + message += `
${this.$strings.MessageConfirmRenameTagMergeNote}` } else if (tagNameExistsOfDifferentCase) { - message += ` ${this.$getString('MessageConfirmRenameTagWarning', [tagNameExistsOfDifferentCase])}` + message += `
${this.$getString('MessageConfirmRenameTagWarning', [tagNameExistsOfDifferentCase])}` } const payload = { diff --git a/client/pages/config/sessions.vue b/client/pages/config/sessions.vue index 4341ea07d..86ec7eec6 100644 --- a/client/pages/config/sessions.vue +++ b/client/pages/config/sessions.vue @@ -66,11 +66,7 @@
{{ getPlayMethodName(session.playMethod) }}
-
-
{{ line }}
-
-
{{ $elapsedPrettyLocalized(session.timeListening) }}
@@ -134,11 +130,7 @@{{ getPlayMethodName(session.playMethod) }}
-
-
{{ line }}
-
-
{{ $elapsedPretty(session.timeListening) }}
@@ -180,11 +172,7 @@{{ getPlayMethodName(session.playMethod) }}
-
-
{{ line }}
-
-
{{ $secondsToTimestamp(session.currentTime) }}
@@ -445,16 +433,16 @@ export default { this.selectedSession = session this.showSessionModal = true }, - getDeviceInfoLines(deviceInfo) { - if (!deviceInfo) return [] - const lines = [] + getDeviceInfoString(deviceInfo) { + if (!deviceInfo) return '' + var lines = [] if (deviceInfo.clientName) lines.push(`${deviceInfo.clientName} ${deviceInfo.clientVersion || ''}`) if (deviceInfo.osName) lines.push(`${deviceInfo.osName} ${deviceInfo.osVersion}`) if (deviceInfo.browserName) lines.push(deviceInfo.browserName) if (deviceInfo.manufacturer && deviceInfo.model) lines.push(`${deviceInfo.manufacturer} ${deviceInfo.model}`) if (deviceInfo.sdkVersion) lines.push(`SDK Version: ${deviceInfo.sdkVersion}`) - return lines + return lines.join('') }, getPlayMethodName(playMethod) { if (playMethod === this.$constants.PlayMethod.DIRECTPLAY) return 'Direct Play' diff --git a/client/pages/config/users/_id/sessions.vue b/client/pages/config/users/_id/sessions.vue index cb18f5ee3..060f34be8 100644 --- a/client/pages/config/users/_id/sessions.vue +++ b/client/pages/config/users/_id/sessions.vue @@ -38,12 +38,8 @@
{{ getPlayMethodName(session.playMethod) }}
-
-
{{ line }}
-
-
{{ $elapsedPrettyLocalized(session.timeListening) }}
') }, getPlayMethodName(playMethod) { if (playMethod === this.$constants.PlayMethod.DIRECTPLAY) return 'Direct Play' diff --git a/client/pages/login.vue b/client/pages/login.vue index cec150e71..ef3827afe 100644 --- a/client/pages/login.vue +++ b/client/pages/login.vue @@ -17,9 +17,9 @@
-# Organizing your media +# Organizing your audiobooks #### Directory structure and folder names are important to Audiobookshelf! -See [library docs](https://audiobookshelf.org/docs/category/libraries) for supported directory structures, folder naming conventions, and audio file metadata usage. +See [documentation](https://audiobookshelf.org/docs#book-directory-structure) for supported directory structure, folder naming conventions, and audio file metadata usage.
@@ -83,25 +87,276 @@ See [install docs](https://www.audiobookshelf.org/docs) #### Note: Using a subfolder is supported with no additional changes but the path must be `/audiobookshelf` (this is not changeable). See [discussion](https://github.com/advplyr/audiobookshelf/discussions/3535) -See [reverse proxy docs](https://audiobookshelf.org/docs/category/reverse-proxy) +### NGINX Proxy Manager -
+Toggle websockets support. -# Contributing +
-See [contributing docs](https://audiobookshelf.org/docs/contributing/general/)
+### NGINX Reverse Proxy
-### Localization
+Add this to the site config file on your nginx server after you have changed the relevant parts in the <> brackets, and inserted your certificate paths.
-Thank you to [Weblate](https://hosted.weblate.org/engage/audiobookshelf/) for hosting our localization infrastructure pro-bono. If you want to see Audiobookshelf in your language, please help us localize. Additional information on helping with the translations [here](https://www.audiobookshelf.org/faq#how-do-i-help-with-translations).
-
+```bash
+server {
+ listen 443 ssl;
+ server_name .+ access_log /var/log/nginx/audiobookshelf.access.log; + error_log /var/log/nginx/audiobookshelf.error.log; + + ssl_certificate /path/to/certificate; + ssl_certificate_key /path/to/key; + + location / { + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $http_host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_http_version 1.1; + + proxy_pass http://
-
+
- accessControlAllowMethods +
- accessControlAllowOriginList +
- accessControlMaxAge +
+ +### Example Caddyfile - [Caddy Reverse Proxy](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy) + +``` +subdomain.domain.com { + encode gzip zstd + reverse_proxy
+
### Dev Container Setup
The easiest way to begin developing this project is to use a dev container. An introduction to dev containers in VSCode can be found [here](https://code.visualstudio.com/docs/devcontainers/containers).
@@ -192,3 +447,6 @@ If you are using VSCode, this project includes a couple of pre-defined targets t
- `Debug client (nuxt)`—Run the client with live reload.
- `Debug server and client (nuxt)`—Runs both the preceding two debug targets.
+# How to Support
+
+[See the incomplete "How to Support" page](https://www.audiobookshelf.org/support)
diff --git a/server/Server.js b/server/Server.js
index ef0888927..d6f748a1e 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -302,9 +302,7 @@ class Server {
this.server = http.createServer(app)
- // Skip file upload parsing for internal-api routes (Next.js proxies read multipart bodies).
router.use(
- /^(?!\/internal-api).*/,
fileUpload({
defCharset: 'utf8',
defParamCharset: 'utf8',
diff --git a/server/SocketAuthority.js b/server/SocketAuthority.js
index a54231d75..ad55f6605 100644
--- a/server/SocketAuthority.js
+++ b/server/SocketAuthority.js
@@ -3,7 +3,6 @@ const Logger = require('./Logger')
const Database = require('./Database')
const TokenManager = require('./auth/TokenManager')
const CoverSearchManager = require('./managers/CoverSearchManager')
-const { LogLevel } = require('./utils/constants')
/**
* @typedef SocketClient
@@ -86,14 +85,6 @@ class SocketAuthority {
}
}
- requireAdminSocket(socket, eventName) {
- const client = this.clients[socket.id]
- if (client?.user?.isAdminOrUp) return true
-
- Logger.warn(`[SocketAuthority] Unauthorized ${eventName} socket event from socket ${socket.id}`)
- return false
- }
-
/**
* Emits event with library item to all clients that can access the library item
* Note: Emits toOldJSONExpanded()
@@ -188,25 +179,14 @@ class SocketAuthority {
socket.on('auth', (token) => this.authenticateSocket(socket, token))
// Scanning
- socket.on('cancel_scan', (libraryId) => {
- if (!this.requireAdminSocket(socket, 'cancel_scan')) return
- this.cancelScan(libraryId)
- })
+ socket.on('cancel_scan', (libraryId) => this.cancelScan(libraryId))
// Cover search streaming
socket.on('search_covers', (payload) => this.handleCoverSearch(socket, payload))
socket.on('cancel_cover_search', (requestId) => this.handleCancelCoverSearch(socket, requestId))
// Logs
- socket.on('set_log_listener', (level) => {
- if (!this.requireAdminSocket(socket, 'set_log_listener')) return
-
- if (!Number.isInteger(level) || !Object.values(LogLevel).includes(level)) {
- Logger.warn(`[SocketAuthority] Invalid set_log_listener level from socket ${socket.id}`)
- return
- }
- Logger.addSocketListener(socket, level)
- })
+ socket.on('set_log_listener', (level) => Logger.addSocketListener(socket, level))
socket.on('remove_log_listener', () => Logger.removeSocketListener(socket.id))
// Sent automatically from socket.io clients
diff --git a/server/auth/TokenManager.js b/server/auth/TokenManager.js
index 5933209c7..d972b5345 100644
--- a/server/auth/TokenManager.js
+++ b/server/auth/TokenManager.js
@@ -1,5 +1,4 @@
const { Op } = require('sequelize')
-const uuid = require('uuid')
const Database = require('../Database')
const Logger = require('../Logger')
@@ -13,9 +12,9 @@ class TokenManager {
constructor() {
/** @type {number} Refresh token expiry in seconds */
- this.RefreshTokenExpiry = parseInt(process.env.REFRESH_TOKEN_EXPIRY) || 30 * 24 * 60 * 60 // 30 days
+ this.RefreshTokenExpiry = parseInt(process.env.REFRESH_TOKEN_EXPIRY) || 7 * 24 * 60 * 60 // 7 days
/** @type {number} Access token expiry in seconds */
- this.AccessTokenExpiry = parseInt(process.env.ACCESS_TOKEN_EXPIRY) || 1 * 60 * 60 // 1 hour
+ this.AccessTokenExpiry = parseInt(process.env.ACCESS_TOKEN_EXPIRY) || 12 * 60 * 60 // 12 hours
if (parseInt(process.env.REFRESH_TOKEN_EXPIRY) > 0) {
Logger.info(`[TokenManager] Refresh token expiry set from ENV variable to ${this.RefreshTokenExpiry} seconds`)
@@ -116,7 +115,6 @@ class TokenManager {
const payload = {
userId: user.id,
username: user.username,
- jti: uuid.v4(),
type: 'access'
}
const options = {
@@ -140,7 +138,6 @@ class TokenManager {
const payload = {
userId: user.id,
username: user.username,
- jti: uuid.v4(),
type: 'refresh'
}
const options = {
@@ -186,56 +183,20 @@ class TokenManager {
* @param {import('../models/User')} user
* @param {import('express').Request} req
* @param {import('express').Response} res
- * @param {boolean} gracePeriod - whether to use the grace period
* @returns {Promise<{ accessToken:string, refreshToken:string }>}
*/
- async rotateTokensForSession(session, user, req, res, gracePeriod = true) {
- const previousRefreshToken = session.refreshToken
+ async rotateTokensForSession(session, user, req, res) {
+ // Generate new tokens
const newAccessToken = this.generateTempAccessToken(user)
- let newRefreshToken = this.generateRefreshToken(user)
+ const newRefreshToken = this.generateRefreshToken(user)
+
+ // Calculate new expiration time
const newExpiresAt = new Date(Date.now() + this.RefreshTokenExpiry * 1000)
- let lastRefreshToken = null
- let lastRefreshTokenExpiresAt = null
- if (gracePeriod) {
- // Set grace period of old refresh token in case of race condition in token rotation.
- // This grace period may need to be longer if fetching the user data takes longer due to large progress objects
- lastRefreshToken = previousRefreshToken
- lastRefreshTokenExpiresAt = new Date(Date.now() + 60 * 1000) // 1 minute grace period
- }
-
- // Only update if this session row still has the refresh token we read
- const [numUpdated] = await Database.sessionModel.update(
- {
- refreshToken: newRefreshToken,
- expiresAt: newExpiresAt,
- lastRefreshToken,
- lastRefreshTokenExpiresAt
- },
- {
- where: {
- id: session.id,
- refreshToken: previousRefreshToken
- }
- }
- )
-
- if (numUpdated === 0) {
- Logger.debug(`[TokenManager] Race condition in rotateTokensForSession for user ${user.id}, getting new token`)
-
- const updatedSession = await Database.sessionModel.findOne({ where: { id: session.id } })
-
- newRefreshToken = updatedSession.refreshToken
- session.refreshToken = updatedSession.refreshToken
- session.expiresAt = updatedSession.expiresAt
- session.lastRefreshToken = updatedSession.lastRefreshToken
- session.lastRefreshTokenExpiresAt = updatedSession.lastRefreshTokenExpiresAt
- } else {
- session.refreshToken = newRefreshToken
- session.expiresAt = newExpiresAt
- session.lastRefreshToken = lastRefreshToken
- session.lastRefreshTokenExpiresAt = lastRefreshTokenExpiresAt
- }
+ // Update the session with the new refresh token and expiration
+ session.refreshToken = newRefreshToken
+ session.expiresAt = newExpiresAt
+ await session.save()
// Set new refresh token cookie
this.setRefreshTokenCookie(req, res, newRefreshToken)
@@ -273,13 +234,6 @@ class TokenManager {
}
const user = await Database.userModel.getUserById(apiKey.userId)
-
- if (!user?.isActive) {
- // deny login
- done(null, null)
- return
- }
-
done(null, user)
} else {
// JWT based authentication
@@ -333,40 +287,23 @@ class TokenManager {
}
}
- let session = await Database.sessionModel.findOne({
- where: {
- [Op.or]: [{ refreshToken: refreshToken }, { lastRefreshToken: refreshToken }]
- }
+ const session = await Database.sessionModel.findOne({
+ where: { refreshToken: refreshToken }
})
if (!session) {
- Logger.error(`[TokenManager] Failed to refresh token. Session not found`)
+ Logger.error(`[TokenManager] Failed to refresh token. Session not found for refresh token: ${refreshToken}`)
return {
error: 'Invalid refresh token'
}
}
- let isGracePeriod = false
- if (session.refreshToken !== refreshToken) {
- // Token matched lastRefreshToken
- if (session.lastRefreshTokenExpiresAt && session.lastRefreshTokenExpiresAt > new Date()) {
- isGracePeriod = true
- Logger.debug(`[TokenManager] Grace period hit for user ${session.userId}`)
- } else {
- Logger.debug(`[TokenManager] Grace period expired for user ${session.userId}`)
- return {
- error: 'Invalid refresh token'
- }
- }
- } else {
- // Token matched current refreshToken
- // Check if session is expired in database
- if (session.expiresAt < new Date()) {
- Logger.info(`[TokenManager] Session expired in database, cleaning up`)
- await session.destroy()
- return {
- error: 'Refresh token expired'
- }
+ // Check if session is expired in database
+ if (session.expiresAt < new Date()) {
+ Logger.info(`[TokenManager] Session expired in database, cleaning up`)
+ await session.destroy()
+ return {
+ error: 'Refresh token expired'
}
}
@@ -378,20 +315,6 @@ class TokenManager {
}
}
- if (isGracePeriod) {
- // Return the already rotated refresh token store in the database,
- // and generate a new access token without changing the refresh token
- // again
- const accessToken = this.generateTempAccessToken(user)
- this.setRefreshTokenCookie(req, res, session.refreshToken)
-
- return {
- accessToken,
- refreshToken: session.refreshToken,
- user
- }
- }
-
const newTokens = await this.rotateTokensForSession(session, user, req, res)
return {
accessToken: newTokens.accessToken,
@@ -445,7 +368,7 @@ class TokenManager {
// So rotate token for current session
const currentSession = await Database.sessionModel.findOne({ where: { refreshToken: currentRefreshToken } })
if (currentSession) {
- const newTokens = await this.rotateTokensForSession(currentSession, user, req, res, false)
+ const newTokens = await this.rotateTokensForSession(currentSession, user, req, res)
// Invalidate all sessions for the user except the current one
await Database.sessionModel.destroy({
@@ -459,7 +382,7 @@ class TokenManager {
return newTokens.accessToken
} else {
- Logger.error(`[TokenManager] No session found to rotate tokens`)
+ Logger.error(`[TokenManager] No session found to rotate tokens for refresh token ${currentRefreshToken}`)
}
}
@@ -483,7 +406,7 @@ class TokenManager {
try {
const numDeleted = await Database.sessionModel.destroy({ where: { refreshToken: refreshToken } })
- Logger.info(`[TokenManager] Refresh token invalidated, ${numDeleted} sessions deleted`)
+ Logger.info(`[TokenManager] Refresh token ${refreshToken} invalidated, ${numDeleted} sessions deleted`)
return true
} catch (error) {
Logger.error(`[TokenManager] Error invalidating refresh token: ${error.message}`)
diff --git a/server/controllers/AuthorController.js b/server/controllers/AuthorController.js
index 8c2e80aec..50eeda31a 100644
--- a/server/controllers/AuthorController.js
+++ b/server/controllers/AuthorController.js
@@ -10,7 +10,7 @@ const CacheManager = require('../managers/CacheManager')
const CoverManager = require('../managers/CoverManager')
const AuthorFinder = require('../finders/AuthorFinder')
-const { reqSupportsWebp, isValidASIN, clampPositiveInt } = require('../utils/index')
+const { reqSupportsWebp, isValidASIN } = require('../utils/index')
const naturalSort = createNewSortInstance({
comparer: new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' }).compare
@@ -113,7 +113,7 @@ class AuthorController {
payload.lastFirst = Database.authorModel.getLastFirst(payload.name)
}
- // Check if author name matches another author in the same library and merge the authors
+ // Check if author name matches another author and merge the authors
let existingAuthor = null
if (authorNameUpdate) {
existingAuthor = await Database.authorModel.findOne({
@@ -121,8 +121,7 @@ class AuthorController {
id: {
[sequelize.Op.not]: req.author.id
},
- name: payload.name,
- libraryId: req.author.libraryId
+ name: payload.name
}
})
}
@@ -149,7 +148,7 @@ class AuthorController {
})
if (libraryItems.length) {
await Database.bookAuthorModel.removeByIds(req.author.id) // Remove all old BookAuthor
- await Database.bookAuthorModel.bulkCreate(bookAuthorsToCreate, { ignoreDuplicates: true }) // Create all new unique BookAuthor
+ await Database.bookAuthorModel.bulkCreate(bookAuthorsToCreate) // Create all new BookAuthor
for (const libraryItem of libraryItems) {
await libraryItem.saveMetadataFile()
}
@@ -412,8 +411,8 @@ class AuthorController {
const options = {
format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
- height: clampPositiveInt(height ? parseInt(height) : null, 4096),
- width: clampPositiveInt(width ? parseInt(width) : null, 4096)
+ height: height ? parseInt(height) : null,
+ width: width ? parseInt(width) : null
}
return CacheManager.handleAuthorCache(res, authorId, options)
}
diff --git a/server/controllers/CollectionController.js b/server/controllers/CollectionController.js
index bb00ea346..475adfe0f 100644
--- a/server/controllers/CollectionController.js
+++ b/server/controllers/CollectionController.js
@@ -3,7 +3,6 @@ const Sequelize = require('sequelize')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
-const htmlSanitizer = require('../utils/htmlSanitizer')
const RssFeedManager = require('../managers/RssFeedManager')
@@ -32,19 +31,13 @@ class CollectionController {
async create(req, res) {
const reqBody = req.body || {}
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
-
// Validation
- if (!nameCleaned || !reqBody.libraryId) {
+ if (!reqBody.name || !reqBody.libraryId) {
return res.status(400).send('Invalid collection data')
}
if (reqBody.description && typeof reqBody.description !== 'string') {
return res.status(400).send('Invalid collection description')
}
- if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
- Logger.warn(`[CollectionController] User "${req.user.username}" attempted to create collection in inaccessible library ${reqBody.libraryId}`)
- return res.sendStatus(403)
- }
const libraryItemIds = (reqBody.books || []).filter((b) => !!b && typeof b == 'string')
if (!libraryItemIds.length) {
return res.status(400).send('Invalid collection data. No books')
@@ -72,7 +65,7 @@ class CollectionController {
newCollection = await Database.collectionModel.create(
{
libraryId: reqBody.libraryId,
- name: nameCleaned,
+ name: reqBody.name,
description: reqBody.description || null
},
{ transaction }
@@ -113,9 +106,8 @@ class CollectionController {
*/
async findAll(req, res) {
const collectionsExpanded = await Database.collectionModel.getOldCollectionsJsonExpanded(req.user)
- const accessibleCollections = collectionsExpanded.filter((c) => req.user.checkCanAccessLibrary(c.libraryId))
res.json({
- collections: accessibleCollections
+ collections: collectionsExpanded
})
}
@@ -153,12 +145,9 @@ class CollectionController {
collectionUpdatePayload.description = req.body.description
wasUpdated = true
}
- if (req.body.name !== undefined && typeof req.body.name === 'string') {
- const nameCleaned = htmlSanitizer.stripAllTags(req.body.name)
- if (nameCleaned !== req.collection.name) {
- collectionUpdatePayload.name = nameCleaned
- wasUpdated = true
- }
+ if (req.body.name !== undefined && req.body.name !== req.collection.name) {
+ collectionUpdatePayload.name = req.body.name
+ wasUpdated = true
}
if (wasUpdated) {
@@ -436,10 +425,6 @@ class CollectionController {
if (!collection) {
return res.status(404).send('Collection not found')
}
- if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
- Logger.warn(`[CollectionController] User "${req.user.username}" attempted to access collection ${collection.id} in inaccessible library ${collection.libraryId}`)
- return res.status(404).send('Collection not found')
- }
req.collection = collection
}
diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js
index 41e082fd4..4b0a94b39 100644
--- a/server/controllers/FileSystemController.js
+++ b/server/controllers/FileSystemController.js
@@ -117,7 +117,7 @@ class FileSystemController {
filepath = fileUtils.filePathToPOSIX(filepath)
// Ensure filepath is inside library folder (prevents directory traversal)
- if (!fileUtils.isSameOrSubPath(libraryFolder.path, filepath)) {
+ if (!filepath.startsWith(libraryFolder.path)) {
Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)
return res.sendStatus(400)
}
diff --git a/server/controllers/LibraryController.js b/server/controllers/LibraryController.js
index 73b3d5c60..e63441f0b 100644
--- a/server/controllers/LibraryController.js
+++ b/server/controllers/LibraryController.js
@@ -221,11 +221,13 @@ class LibraryController {
const includeArray = (req.query.include || '').split(',')
if (includeArray.includes('filterdata')) {
const filterdata = await libraryFilters.getFilterData(req.library.mediaType, req.library.id)
+ const customMetadataProviders = await Database.customMetadataProviderModel.getForClientByMediaType(req.library.mediaType)
return res.json({
filterdata,
issues: filterdata.numIssues,
numUserPlaylists: await Database.playlistModel.getNumPlaylistsForUserAndLibrary(req.user.id, req.library.id),
+ customMetadataProviders,
library: req.library.toOldJSON()
})
}
@@ -462,7 +464,7 @@ class LibraryController {
}
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" from folder "${folder.path}"`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
if (authorIds.length) {
@@ -563,7 +565,7 @@ class LibraryController {
mediaItemIds.push(libraryItem.mediaId)
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" from library "${req.library.name}"`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
// Set PlaybackSessions libraryId to null
@@ -714,7 +716,7 @@ class LibraryController {
}
}
Logger.info(`[LibraryController] Removing library item "${libraryItem.id}" with issue`)
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, req.library.id)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
}
if (authorIds.length) {
@@ -1435,15 +1437,10 @@ class LibraryController {
const libraryItems = await Database.libraryItemModel.findAll({
attributes: ['id', 'libraryId', 'path', 'isFile'],
where: {
- id: itemIds,
- libraryId: req.library.id
+ id: itemIds
}
})
- if (libraryItems.length < itemIds.length) {
- Logger.warn(`[LibraryController] User "${req.user.username}" requested ${itemIds.length} items but only ${libraryItems.length} are in library "${req.library.id}"`)
- }
-
Logger.info(`[LibraryController] User "${req.user.username}" requested download for items "${itemIds}"`)
const filename = `LibraryItems-${Date.now()}.zip`
diff --git a/server/controllers/LibraryItemController.js b/server/controllers/LibraryItemController.js
index 07b4ee67f..5247dbb06 100644
--- a/server/controllers/LibraryItemController.js
+++ b/server/controllers/LibraryItemController.js
@@ -1,14 +1,13 @@
const { Request, Response, NextFunction } = require('express')
const Path = require('path')
const fs = require('../libs/fsExtra')
-const cron = require('../libs/nodeCron')
const uaParserJs = require('../libs/uaParser')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
const zipHelpers = require('../utils/zipHelpers')
-const { reqSupportsWebp, clampPositiveInt } = require('../utils/index')
+const { reqSupportsWebp } = require('../utils/index')
const { ScanResult, AudioMimeType } = require('../utils/constants')
const { getAudioMimeTypeFromExtname, encodeUriPath } = require('../utils/fileUtils')
const LibraryItemScanner = require('../scanner/LibraryItemScanner')
@@ -37,24 +36,6 @@ const ShareManager = require('../managers/ShareManager')
* @typedef {RequestWithUser & RequestEntityObject & RequestLibraryFileObject} LibraryItemControllerRequestWithFile
*/
-/**
- * Enforce per-item access for batch item routes
- *
- * @param {RequestWithUser} req
- * @param {Response} res
- * @param {import('../models/LibraryItem')[]} libraryItems
- * @returns {boolean} true if the user may access every item; false if 403 was sent
- */
-function ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems) {
- for (const libraryItem of libraryItems) {
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- res.sendStatus(403)
- return false
- }
- }
- return true
-}
-
class LibraryItemController {
constructor() {}
@@ -130,7 +111,7 @@ class LibraryItemController {
}
}
- await this.handleDeleteLibraryItem(req.libraryItem.id, mediaItemIds, req.libraryItem.libraryId)
+ await this.handleDeleteLibraryItem(req.libraryItem.id, mediaItemIds)
if (hardDelete) {
Logger.info(`[LibraryItemController] Deleting library item from file system at "${libraryItemPath}"`)
await fs.remove(libraryItemPath).catch((error) => {
@@ -221,11 +202,6 @@ class LibraryItemController {
} else if (mediaPayload.autoDownloadSchedule !== undefined && req.libraryItem.media.autoDownloadSchedule !== mediaPayload.autoDownloadSchedule) {
isPodcastAutoDownloadUpdated = true
}
-
- if (mediaPayload.autoDownloadSchedule && !cron.validate(mediaPayload.autoDownloadSchedule)) {
- Logger.error(`[LibraryItemController] Invalid auto download schedule cron expression "${mediaPayload.autoDownloadSchedule}" for library item "${req.libraryItem.media.title}"`)
- return res.status(400).send('Invalid auto download schedule cron expression')
- }
}
let hasUpdates = (await req.libraryItem.media.updateFromRequest(mediaPayload)) || mediaPayload.url
@@ -422,8 +398,8 @@ class LibraryItemController {
const options = {
format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
- height: clampPositiveInt(height ? parseInt(height) : null, 4096),
- width: clampPositiveInt(width ? parseInt(width) : null, 4096)
+ height: height ? parseInt(height) : null,
+ width: width ? parseInt(width) : null
}
return CacheManager.handleCoverCache(res, libraryItemId, options)
}
@@ -571,13 +547,7 @@ class LibraryItemController {
return res.sendStatus(404)
}
- // Ensure user has permission to delete these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, itemsToDelete)) {
- return
- }
-
const libraryId = itemsToDelete[0].libraryId
-
for (const libraryItem of itemsToDelete) {
const libraryItemPath = libraryItem.path
Logger.info(`[LibraryItemController] (${hardDelete ? 'Hard' : 'Soft'}) deleting Library Item "${libraryItem.media.title}" with id "${libraryItem.id}"`)
@@ -595,7 +565,7 @@ class LibraryItemController {
authorIds.push(...libraryItem.media.authors.map((au) => au.id))
}
}
- await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds, libraryItem.libraryId)
+ await this.handleDeleteLibraryItem(libraryItem.id, mediaItemIds)
if (hardDelete) {
Logger.info(`[LibraryItemController] Deleting library item from file system at "${libraryItemPath}"`)
await fs.remove(libraryItemPath).catch((error) => {
@@ -611,7 +581,6 @@ class LibraryItemController {
}
await Database.resetLibraryIssuesFilterData(libraryId)
-
res.sendStatus(200)
}
@@ -624,11 +593,6 @@ class LibraryItemController {
* @param {Response} res
*/
async batchUpdate(req, res) {
- if (!req.user.canUpdate) {
- Logger.warn(`[LibraryItemController] User "${req.user.username}" attempted to batch update without permission`)
- return res.sendStatus(403)
- }
-
const updatePayloads = req.body
if (!Array.isArray(updatePayloads) || !updatePayloads.length) {
Logger.error(`[LibraryItemController] Batch update failed. Invalid payload`)
@@ -651,11 +615,6 @@ class LibraryItemController {
return res.sendStatus(404)
}
- // Ensure user has permission to update these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems)) {
- return
- }
-
let itemsUpdated = 0
const seriesIdsRemoved = []
@@ -665,11 +624,6 @@ class LibraryItemController {
const mediaPayload = updatePayload.mediaPayload
const libraryItem = libraryItems.find((li) => li.id === updatePayload.id)
- if (libraryItem.isPodcast && mediaPayload.autoDownloadSchedule && !cron.validate(mediaPayload.autoDownloadSchedule)) {
- Logger.warn(`[LibraryItemController] Invalid auto download schedule cron expression "${mediaPayload.autoDownloadSchedule}" for library item "${libraryItem.media.title}" - skipping update`)
- continue
- }
-
let hasUpdates = await libraryItem.media.updateFromRequest(mediaPayload)
if (libraryItem.isBook && Array.isArray(mediaPayload.metadata?.series)) {
@@ -741,10 +695,6 @@ class LibraryItemController {
const libraryItems = await Database.libraryItemModel.findAllExpandedWhere({
id: libraryItemIds
})
- // Ensure user has permission to access these library items
- if (!ensureUserCanAccessLibraryItemsForBatch(req, res, libraryItems)) {
- return
- }
res.json({
libraryItems: libraryItems.map((li) => li.toOldJSONExpanded())
})
diff --git a/server/controllers/MeController.js b/server/controllers/MeController.js
index c5968f521..51773a5ad 100644
--- a/server/controllers/MeController.js
+++ b/server/controllers/MeController.js
@@ -63,7 +63,7 @@ class MeController {
* @param {Response} res
*/
async getItemListeningSessions(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.libraryItemId)
+ const libraryItem = await Database.libraryItemModel.findByPk(req.params.libraryItemId)
const episode = await Database.podcastEpisodeModel.findByPk(req.params.episodeId)
if (!libraryItem || (libraryItem.isPodcast && !episode)) {
@@ -71,12 +71,6 @@ class MeController {
return res.sendStatus(404)
}
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to access listening sessions for library item "${req.params.libraryItemId}" without access`)
- return res.sendStatus(403)
- }
-
const mediaItemId = episode?.id || libraryItem.mediaId
let listeningSessions = await this.getUserItemListeningSessionsHelper(req.user.id, mediaItemId)
@@ -131,13 +125,6 @@ class MeController {
* @param {Response} res
*/
async removeMediaProgress(req, res) {
- // Verify the media progress belongs to the current user
- const mediaProgress = req.user.mediaProgresses.find((mp) => mp.id === req.params.id)
- if (!mediaProgress) {
- Logger.error(`[MeController] Media progress not found or does not belong to user "${req.user.username}"`)
- return res.sendStatus(404)
- }
-
await Database.mediaProgressModel.removeById(req.params.id)
req.user.mediaProgresses = req.user.mediaProgresses.filter((mp) => mp.id !== req.params.id)
@@ -205,16 +192,7 @@ class MeController {
* @param {Response} res
*/
async createBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to create bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const { time, title } = req.body
if (isNullOrNaN(time)) {
@@ -238,16 +216,7 @@ class MeController {
* @param {Response} res
*/
async updateBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to update bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const { time, title } = req.body
if (isNullOrNaN(time)) {
@@ -276,16 +245,7 @@ class MeController {
* @param {Response} res
*/
async removeBookmark(req, res) {
- const libraryItem = await Database.libraryItemModel.getExpandedById(req.params.id)
- if (!libraryItem) {
- return res.sendStatus(404)
- }
-
- // Check if user has access to this library item
- if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
- Logger.error(`[MeController] User "${req.user.username}" attempted to remove bookmark for library item "${req.params.id}" without access`)
- return res.sendStatus(403)
- }
+ if (!(await Database.libraryItemModel.checkExistsById(req.params.id))) return res.sendStatus(404)
const time = Number(req.params.time)
if (isNaN(time)) {
diff --git a/server/controllers/MiscController.js b/server/controllers/MiscController.js
index 591f8ccf2..c779bdd63 100644
--- a/server/controllers/MiscController.js
+++ b/server/controllers/MiscController.js
@@ -8,7 +8,7 @@ const Database = require('../Database')
const Watcher = require('../Watcher')
const libraryItemFilters = require('../utils/queries/libraryItemFilters')
-const cron = require('../libs/nodeCron')
+const patternValidation = require('../libs/nodeCron/pattern-validation')
const { isObject, getTitleIgnorePrefix } = require('../utils/index')
const { sanitizeFilename } = require('../utils/fileUtils')
@@ -142,9 +142,6 @@ class MiscController {
Logger.warn('Cannot disable iframe when ALLOW_IFRAME is enabled in environment')
return res.status(400).send('Cannot disable iframe when ALLOW_IFRAME is enabled in environment')
}
- if (settingsUpdate.allowedOrigins && !Array.isArray(settingsUpdate.allowedOrigins)) {
- return res.status(400).send('allowedOrigins must be an array')
- }
const madeUpdates = Database.serverSettings.update(settingsUpdate)
if (madeUpdates) {
@@ -605,11 +602,13 @@ class MiscController {
return res.sendStatus(400)
}
- if (!cron.validate(expression)) {
- Logger.warn(`[MiscController] Invalid cron expression ${expression}`)
- return res.status(400).send('Invalid cron expression')
+ try {
+ patternValidation(expression)
+ res.sendStatus(200)
+ } catch (error) {
+ Logger.warn(`[MiscController] Invalid cron expression ${expression}`, error.message)
+ res.status(400).send(error.message)
}
- res.sendStatus(200)
}
/**
diff --git a/server/controllers/PlaylistController.js b/server/controllers/PlaylistController.js
index 6ad7cff9e..972c352a4 100644
--- a/server/controllers/PlaylistController.js
+++ b/server/controllers/PlaylistController.js
@@ -2,7 +2,6 @@ const { Request, Response, NextFunction } = require('express')
const Logger = require('../Logger')
const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
-const htmlSanitizer = require('../utils/htmlSanitizer')
/**
* @typedef RequestUserObject
@@ -30,17 +29,12 @@ class PlaylistController {
const reqBody = req.body || {}
// Validation
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
- if (!nameCleaned || !reqBody.libraryId) {
+ if (!reqBody.name || !reqBody.libraryId) {
return res.status(400).send('Invalid playlist data')
}
if (reqBody.description && typeof reqBody.description !== 'string') {
return res.status(400).send('Invalid playlist description')
}
- if (!req.user.checkCanAccessLibrary(reqBody.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist in inaccessible library ${reqBody.libraryId}`)
- return res.sendStatus(403)
- }
const items = reqBody.items || []
const isPodcast = items.some((i) => i.episodeId)
const libraryItemIds = new Set()
@@ -90,7 +84,7 @@ class PlaylistController {
{
libraryId: reqBody.libraryId,
userId: req.user.id,
- name: nameCleaned,
+ name: reqBody.name,
description: reqBody.description || null
},
{ transaction }
@@ -137,9 +131,8 @@ class PlaylistController {
*/
async findAllForUser(req, res) {
const playlistsForUser = await Database.playlistModel.getOldPlaylistsForUserAndLibrary(req.user.id)
- const accessiblePlaylists = playlistsForUser.filter((p) => req.user.checkCanAccessLibrary(p.libraryId))
res.json({
- playlists: accessiblePlaylists
+ playlists: playlistsForUser
})
}
@@ -181,11 +174,7 @@ class PlaylistController {
}
const playlistUpdatePayload = {}
-
- const nameCleaned = htmlSanitizer.stripAllTags(reqBody.name)
- if (nameCleaned) {
- playlistUpdatePayload.name = nameCleaned
- }
+ if (reqBody.name) playlistUpdatePayload.name = reqBody.name
if (reqBody.description) playlistUpdatePayload.description = reqBody.description
// Update name and description
@@ -513,10 +502,6 @@ class PlaylistController {
if (!collection) {
return res.status(404).send('Collection not found')
}
- if (!req.user.checkCanAccessLibrary(collection.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to create playlist from collection ${collection.id} in inaccessible library ${collection.libraryId}`)
- return res.status(404).send('Collection not found')
- }
// Expand collection to get library items
const collectionExpanded = await collection.getOldJsonExpanded(req.user)
if (!collectionExpanded) {
@@ -582,10 +567,6 @@ class PlaylistController {
Logger.warn(`[PlaylistController] Playlist ${req.params.id} requested by user ${req.user.id} that is not the owner`)
return res.sendStatus(403)
}
- if (!req.user.checkCanAccessLibrary(playlist.libraryId)) {
- Logger.warn(`[PlaylistController] User "${req.user.username}" attempted to access playlist ${playlist.id} in inaccessible library ${playlist.libraryId}`)
- return res.status(404).send('Playlist not found')
- }
req.playlist = playlist
}
diff --git a/server/controllers/PodcastController.js b/server/controllers/PodcastController.js
index 5eaa2a64a..1ebe1d110 100644
--- a/server/controllers/PodcastController.js
+++ b/server/controllers/PodcastController.js
@@ -5,10 +5,9 @@ const SocketAuthority = require('../SocketAuthority')
const Database = require('../Database')
const fs = require('../libs/fsExtra')
-const cron = require('../libs/nodeCron')
const { getPodcastFeed, findMatchingEpisodes } = require('../utils/podcastUtils')
-const { getFileTimestampsWithIno, filePathToPOSIX, isSameOrSubPath } = require('../utils/fileUtils')
+const { getFileTimestampsWithIno, filePathToPOSIX } = require('../utils/fileUtils')
const { validateUrl } = require('../utils/index')
const htmlSanitizer = require('../utils/htmlSanitizer')
@@ -47,11 +46,6 @@ class PodcastController {
return res.status(400).send('Invalid request body. "media" and "media.metadata" are required')
}
- if (payload.media.autoDownloadSchedule && !cron.validate(payload.media.autoDownloadSchedule)) {
- Logger.error(`[PodcastController] Invalid auto download schedule cron expression "${payload.media.autoDownloadSchedule}"`)
- return res.status(400).send('Invalid auto download schedule cron expression')
- }
-
const library = await Database.libraryModel.findByIdWithFolders(payload.libraryId)
if (!library) {
Logger.error(`[PodcastController] Create: Library not found "${payload.libraryId}"`)
@@ -64,18 +58,8 @@ class PodcastController {
return res.status(404).send('Folder not found')
}
- if (typeof payload.path !== 'string' || !payload.path.trim()) {
- return res.status(400).send('Invalid request body. "path" must be a non-empty string')
- }
-
- const libraryFolderPath = filePathToPOSIX(folder.path)
const podcastPath = filePathToPOSIX(payload.path)
- if (!isSameOrSubPath(libraryFolderPath, podcastPath)) {
- Logger.error(`[PodcastController] Create: Podcast path is outside library folder "${libraryFolderPath}": "${podcastPath}"`)
- return res.status(400).send('Podcast path must be inside the selected library folder')
- }
-
// Check if a library item with this podcast folder exists already
const existingLibraryItem =
(await Database.libraryItemModel.count({
@@ -99,7 +83,7 @@ class PodcastController {
const libraryItemFolderStats = await getFileTimestampsWithIno(podcastPath)
- let relPath = podcastPath.replace(libraryFolderPath, '')
+ let relPath = payload.path.replace(folder.fullPath, '')
if (relPath.startsWith('/')) relPath = relPath.slice(1)
let newLibraryItem = null
@@ -428,26 +412,9 @@ class PodcastController {
Logger.debug(`[PodcastController] Sanitized description from "${req.body[key]}" to "${sanitizedDescription}"`)
req.body[key] = sanitizedDescription
}
- } else if (key === 'subtitle' && req.body[key]) {
- const sanitizedSubtitle = htmlSanitizer.sanitize(req.body[key])
- if (sanitizedSubtitle !== req.body[key]) {
- Logger.debug(`[PodcastController] Sanitized subtitle from "${req.body[key]}" to "${sanitizedSubtitle}"`)
- req.body[key] = sanitizedSubtitle
- }
}
updatePayload[key] = req.body[key]
- } else if (key === 'enclosure') {
- const enclosure = req.body.enclosure
- if (enclosure === null) {
- updatePayload.enclosureURL = null
- updatePayload.enclosureSize = null
- updatePayload.enclosureType = null
- } else if (typeof enclosure === 'object' && typeof enclosure.url === 'string') {
- updatePayload.enclosureURL = enclosure.url
- updatePayload.enclosureType = typeof enclosure.type === 'string' ? enclosure.type : null
- updatePayload.enclosureSize = enclosure.length !== undefined && enclosure.length !== null ? enclosure.length : null
- }
} else if (key === 'chapters' && Array.isArray(req.body[key]) && req.body[key].every((ch) => typeof ch === 'object' && ch.title && ch.start)) {
updatePayload[key] = req.body[key]
} else if (key === 'publishedAt' && typeof req.body[key] === 'number') {
diff --git a/server/controllers/SearchController.js b/server/controllers/SearchController.js
index ecd9a41c0..bb3382f71 100644
--- a/server/controllers/SearchController.js
+++ b/server/controllers/SearchController.js
@@ -4,29 +4,7 @@ const BookFinder = require('../finders/BookFinder')
const PodcastFinder = require('../finders/PodcastFinder')
const AuthorFinder = require('../finders/AuthorFinder')
const Database = require('../Database')
-const { isValidASIN, getQueryParamAsString, ValidationError, NotFoundError } = require('../utils')
-
-// Provider name mappings for display purposes
-const providerMap = {
- all: 'All',
- best: 'Best',
- google: 'Google Books',
- itunes: 'iTunes',
- openlibrary: 'Open Library',
- fantlab: 'FantLab.ru',
- audiobookcovers: 'AudiobookCovers.com',
- audible: 'Audible.com',
- 'audible.ca': 'Audible.ca',
- 'audible.uk': 'Audible.co.uk',
- 'audible.au': 'Audible.com.au',
- 'audible.fr': 'Audible.fr',
- 'audible.de': 'Audible.de',
- 'audible.jp': 'Audible.co.jp',
- 'audible.it': 'Audible.it',
- 'audible.in': 'Audible.in',
- 'audible.es': 'Audible.es',
- audnexus: 'Audnexus'
-}
+const { isValidASIN } = require('../utils')
/**
* @typedef RequestUserObject
@@ -38,44 +16,6 @@ const providerMap = {
class SearchController {
constructor() {}
- /**
- * Fetches a library item by ID
- * @param {string} id - Library item ID
- * @param {string} methodName - Name of the calling method for logging
- * @returns {Promise