Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-07-01 14:19:13 -04:00
parent b30fe748b2
commit fd5ef14999
21 changed files with 1144 additions and 70 deletions
+277
View File
@@ -0,0 +1,277 @@
'use strict';
const conf = require('>/conf');
const { tmdbSearch, tmdbDetails } = require('>/controller/tmdb');
// TPB numeric categories that count as Movies / TV( used for the q.php search and to
// keep the LLM from ever seeing non-video results).
const MOVIE_CATS = [201, 202, 207, 209, 211];
const TV_CATS = [205, 208, 212];
function humanSize(bytes){
bytes = Number(bytes) || 0;
let units = ['B', 'KB', 'MB', 'GB', 'TB'];
let i = 0;
while(bytes >= 1024 && i < units.length - 1){
bytes /= 1024;
i++;
}
return `${bytes.toFixed(bytes < 10 && i > 0 ? 1 : 0)} ${units[i]}`;
}
async function fetchJSON(url, options){
let res = await fetch(url, options);
if(!res.ok){
let error = new Error(`UpstreamError`);
error.message = `Request to ${url.split('?')[0]} failed( ${res.status})`;
error.status = 502;
throw error;
}
return await res.json();
}
// Turn a raw TPB category id into 'movie' | 'tv' | null.
function videoKind(category){
category = parseInt(category, 10);
if(TV_CATS.includes(category)) return 'tv';
if(MOVIE_CATS.includes(category) || (category >= 200 && category < 300)) return 'movie';
return null;
}
// --- TPB HTML search ------------------------------------------------------
const SIZE_UNITS = { B: 1, KIB: 1024, MIB: 1024 ** 2, GIB: 1024 ** 3, TIB: 1024 ** 4 };
function sizeToBytes(value, unit){
return Math.round(parseFloat(value) * (SIZE_UNITS[String(unit).toUpperCase()] || 1));
}
function decodeEntities(text){
return String(text)
.replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
.replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&apos;/g, "'");
}
// Parse the classic TPB HTML result table( category cell, details link name, magnet,
// then right-aligned size / seeders / leechers cells) into apibay-shaped objects.
function parseTPBHtml(html){
let out = [];
for(let row of html.split(/<tr/i)){
let hash = row.match(/magnet:\?xt=urn:btih:([A-Fa-f0-9]+)/i);
if(!hash) continue;
let cat = row.match(/\/browse\/(\d+)/);
let name = row.match(/title="Details for ([^"]+)"/i);
let size = row.match(/<td align="right">\s*([\d.]+)(?:&nbsp;|\s)+(GiB|MiB|KiB|TiB)\s*<\/td>/i);
let nums = [...row.matchAll(/<td align="right">\s*([\d,]+)\s*<\/td>/gi)].map(m => Number(m[1].replace(/,/g, '')));
if(!name) continue;
// nums are [size, seeders, leechers]; size cell also matched the regex above so
// seeders/leechers are the last two numeric right-aligned cells.
let seeders = nums.length >= 2 ? nums[nums.length - 2] : 0;
let leechers = nums.length >= 1 ? nums[nums.length - 1] : 0;
out.push({
name: decodeEntities(name[1]),
info_hash: hash[1].toLowerCase(),
category: cat ? Number(cat[1]) : 0,
size: size ? sizeToBytes(size[1], size[2]) : 0,
seeders: seeders,
leechers: leechers,
imdb: null,
});
}
return out;
}
async function tpbSearch(title){
// Category 200 = all Video; we narrow to movie/tv subcats in prefilter().
let url = `${conf.search.tpbBase}/search/${encodeURIComponent(title)}/1/99/200`;
let res = await fetch(url, { headers: { 'User-Agent': 'Mozilla/5.0' } });
if(!res.ok){
let error = new Error('UpstreamError');
error.message = `TPB search failed( ${res.status})`;
error.status = 502;
throw error;
}
return parseTPBHtml(await res.text());
}
// Deterministic pre-filter before the torrents ever reach the LLM.
function prefilter(torrents, imdbId){
let out = torrents.filter(t => videoKind(t.category) && Number(t.seeders) > 0);
// If we can positively identify the title by IMDB id, trust it and drop the rest.
if(imdbId){
let matches = out.filter(t => t.imdb && t.imdb === imdbId);
if(matches.length) out = matches;
}
return out
.sort((a, b) => Number(b.seeders) - Number(a.seeders))
.slice(0, 40);
}
function buildMagnet(infoHash, name){
let magnet = `magnet:?xt=urn:btih:${infoHash}&dn=${encodeURIComponent(name)}`;
for(let tracker of conf.search.trackers){
magnet += `&tr=${encodeURIComponent(tracker)}`;
}
return magnet;
}
// --- LLM ranking ----------------------------------------------------------
function buildSystemPrompt(title, year, today){
return [
`You are a torrent-selection assistant. Today's date is ${today}.`,
`Recent releases are legitimate: NEVER reject a torrent for being too new or assume`,
`a current-year release is fake.`,
``,
`The user wants "${title}" (${year || 'unknown year'}). From the candidate list,`,
`select the best releases.`,
year ? `IMPORTANT: only pick releases whose name contains the year ${year}; reject other years or remakes of a same-named title.` : ``,
`Preferences, in order:`,
`- video codec HEVC/x265 (over x264/AVC)`,
`- 1080p resolution`,
`- total size around 1.5 GB (avoid needlessly huge files)`,
`- English audio and English subtitles present`,
`- prefer EXTENDED / UNRATED / UNCUT / DIRECTOR'S CUT editions`,
`Reject: CAM, TS, TC, TELESYNC, HDCAM, SCREENER/SCR, and non-English-only copies.`,
``,
`Return STRICT JSON only, shape:`,
`{"options":[{"role":"recommended|uhd|other","label":"...","info_hash":"...",`,
`"name":"...","resolution":"...","codec":"...","hasSubs":true,"cut":"...",`,
`"warning":"...","why":"..."}]}`,
`Rules: exactly one "recommended" (the 1080p sweet spot). Include one "uhd" ONLY`,
`if a 4K/2160p release exists, and set its "warning" to note it is a much larger,`,
`slower download. Add "other" entries for genuinely distinct useful releases`,
`(e.g. a different cut or a much smaller copy). "why" is one short sentence.`,
`Copy info_hash verbatim from the chosen candidate.`,
].join('\n');
}
// Pull the first JSON object out of a model response( tolerates ```json fences / prose).
function extractJSON(content){
let text = String(content).replace(/```json/gi, '').replace(/```/g, '').trim();
let start = text.indexOf('{');
let end = text.lastIndexOf('}');
if(start === -1 || end === -1) throw new Error('No JSON in model response');
return JSON.parse(text.slice(start, end + 1));
}
async function rankReleases(candidates, meta){
let compact = candidates.map(t => ({
name: t.name,
sizeHuman: humanSize(t.size),
seeders: Number(t.seeders),
info_hash: t.info_hash,
imdb: t.imdb || null,
}));
let body = {
model: conf.ollama.model,
stream: false,
format: 'json',
messages: [
{ role: 'system', content: buildSystemPrompt(meta.title, meta.year, meta.today) },
{ role: 'user', content: JSON.stringify(compact) },
],
};
let data = await fetchJSON(`${conf.ollama.url}/api/chat`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${conf.ollama.apiKey}`,
},
body: JSON.stringify(body),
});
let parsed = extractJSON(data.message && data.message.content);
let options = Array.isArray(parsed.options) ? parsed.options : [];
if(!options.length) throw new Error('Model returned no options');
return options;
}
// Deterministic fallback if the LLM is unavailable or returns junk: pick the most-seeded
// candidate, preferring x265 + 1080p, so the feature degrades instead of failing.
function fallbackReleases(candidates){
let score = t => (/x265|hevc/i.test(t.name) ? 2 : 0) + (/1080p/i.test(t.name) ? 1 : 0);
let best = [...candidates].sort((a, b) =>
(score(b) - score(a)) || (Number(b.seeders) - Number(a.seeders))
)[0];
if(!best) return [];
return [{
role: 'recommended',
label: 'Most seeded',
info_hash: best.info_hash,
name: best.name,
sizeHuman: humanSize(best.size),
seeders: Number(best.seeders),
why: 'Automatically chosen (AI ranking unavailable): most seeders.',
}];
}
// Attach the fields the front end / add flow need to each option and drop any the model
// hallucinated( info_hash must exist in the candidate set).
function decorateOptions(options, candidates){
let byHash = {};
for(let t of candidates) byHash[String(t.info_hash).toLowerCase()] = t;
let out = [];
for(let opt of options){
let src = byHash[String(opt.info_hash).toLowerCase()];
if(!src) continue;
out.push({
...opt,
info_hash: src.info_hash,
name: opt.name || src.name,
category: Number(src.category),
sizeHuman: opt.sizeHuman || humanSize(src.size),
seeders: Number(src.seeders),
magnetLink: buildMagnet(src.info_hash, src.name),
});
}
return out;
}
async function findReleases(tmdbId, mediaType){
let meta = await tmdbDetails(tmdbId, mediaType);
let torrents = await tpbSearch(meta.title);
let candidates = prefilter(torrents, meta.imdbId);
if(!candidates.length){
return { title: meta.title, year: meta.year, options: [] };
}
let today = new Date().toISOString().slice(0, 10);
let options;
try{
options = await rankReleases(candidates, { title: meta.title, year: meta.year, today });
}catch(error){
console.error('rankReleases failed, using fallback:', error.message);
options = fallbackReleases(candidates);
}
options = decorateOptions(options, candidates);
if(!options.length) options = decorateOptions(fallbackReleases(candidates), candidates);
return { title: meta.title, year: meta.year, options };
}
module.exports = {
tmdbSearch,
findReleases,
// exported for unit tests
prefilter,
buildMagnet,
humanSize,
videoKind,
extractJSON,
decorateOptions,
fallbackReleases,
tpbSearch,
parseTPBHtml,
sizeToBytes,
};