Harden auth, add AI smart-search and post-download organization
Security & correctness hardening: - Gate /__api/token/auth behind auth and self-scope every handler to the caller (was fully unauthenticated — account-takeover hole). - Escape LDAP filter values (injection) and reject empty-password binds. - Enforce per-torrent ownership so private torrents aren't exposed via IDOR. - Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads, res.statusCode in the error handler, const-scope pubsub. Login-gated proxy + anti-indexing: - Block all proxying for logged-out users via an auth-token cookie the front end mirrors from its token; serve a local login page instead of hitting TPB. - robots.txt disallow-all + X-Robots-Tag noindex. Torrent category: - Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped from the TPB category id; captured at add time (migration). Smart Search (movies/TV): - New /__api/search: TMDB title confirm -> scrape piratebay.party HTML -> Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs, prefer uncut) returning a recommended pick, optional warned 4K, and other editions. Front-end Smart Search box + dialog feeding the existing add flow. Post-download organization -> Emby (public Movie/TV only): - Completion watcher files finished torrents: Ollama parses the release name, TMDB canonicalizes title/year, files main video (+subs) into the library with edition/quality-aware names (movies + TV SxxExx), stops seeding, and triggers an Emby library scan. Low-confidence matches are flagged, not mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns. Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,277 @@
|
||||
'use strict';
|
||||
|
||||
const conf = require('>/conf');
|
||||
const { tmdbSearch, tmdbDetails } = require('>/controller/tmdb');
|
||||
|
||||
// TPB numeric categories that count as Movies / TV( used for the q.php search and to
|
||||
// keep the LLM from ever seeing non-video results).
|
||||
const MOVIE_CATS = [201, 202, 207, 209, 211];
|
||||
const TV_CATS = [205, 208, 212];
|
||||
|
||||
function humanSize(bytes){
|
||||
bytes = Number(bytes) || 0;
|
||||
let units = ['B', 'KB', 'MB', 'GB', 'TB'];
|
||||
let i = 0;
|
||||
while(bytes >= 1024 && i < units.length - 1){
|
||||
bytes /= 1024;
|
||||
i++;
|
||||
}
|
||||
return `${bytes.toFixed(bytes < 10 && i > 0 ? 1 : 0)} ${units[i]}`;
|
||||
}
|
||||
|
||||
async function fetchJSON(url, options){
|
||||
let res = await fetch(url, options);
|
||||
if(!res.ok){
|
||||
let error = new Error(`UpstreamError`);
|
||||
error.message = `Request to ${url.split('?')[0]} failed( ${res.status})`;
|
||||
error.status = 502;
|
||||
throw error;
|
||||
}
|
||||
return await res.json();
|
||||
}
|
||||
|
||||
// Turn a raw TPB category id into 'movie' | 'tv' | null.
|
||||
function videoKind(category){
|
||||
category = parseInt(category, 10);
|
||||
if(TV_CATS.includes(category)) return 'tv';
|
||||
if(MOVIE_CATS.includes(category) || (category >= 200 && category < 300)) return 'movie';
|
||||
return null;
|
||||
}
|
||||
|
||||
// --- TPB HTML search ------------------------------------------------------
|
||||
|
||||
const SIZE_UNITS = { B: 1, KIB: 1024, MIB: 1024 ** 2, GIB: 1024 ** 3, TIB: 1024 ** 4 };
|
||||
|
||||
function sizeToBytes(value, unit){
|
||||
return Math.round(parseFloat(value) * (SIZE_UNITS[String(unit).toUpperCase()] || 1));
|
||||
}
|
||||
|
||||
function decodeEntities(text){
|
||||
return String(text)
|
||||
.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>')
|
||||
.replace(/"/g, '"').replace(/�?39;/g, "'").replace(/'/g, "'");
|
||||
}
|
||||
|
||||
// Parse the classic TPB HTML result table( category cell, details link name, magnet,
|
||||
// then right-aligned size / seeders / leechers cells) into apibay-shaped objects.
|
||||
function parseTPBHtml(html){
|
||||
let out = [];
|
||||
for(let row of html.split(/<tr/i)){
|
||||
let hash = row.match(/magnet:\?xt=urn:btih:([A-Fa-f0-9]+)/i);
|
||||
if(!hash) continue;
|
||||
|
||||
let cat = row.match(/\/browse\/(\d+)/);
|
||||
let name = row.match(/title="Details for ([^"]+)"/i);
|
||||
let size = row.match(/<td align="right">\s*([\d.]+)(?: |\s)+(GiB|MiB|KiB|TiB)\s*<\/td>/i);
|
||||
let nums = [...row.matchAll(/<td align="right">\s*([\d,]+)\s*<\/td>/gi)].map(m => Number(m[1].replace(/,/g, '')));
|
||||
|
||||
if(!name) continue;
|
||||
// nums are [size, seeders, leechers]; size cell also matched the regex above so
|
||||
// seeders/leechers are the last two numeric right-aligned cells.
|
||||
let seeders = nums.length >= 2 ? nums[nums.length - 2] : 0;
|
||||
let leechers = nums.length >= 1 ? nums[nums.length - 1] : 0;
|
||||
|
||||
out.push({
|
||||
name: decodeEntities(name[1]),
|
||||
info_hash: hash[1].toLowerCase(),
|
||||
category: cat ? Number(cat[1]) : 0,
|
||||
size: size ? sizeToBytes(size[1], size[2]) : 0,
|
||||
seeders: seeders,
|
||||
leechers: leechers,
|
||||
imdb: null,
|
||||
});
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
async function tpbSearch(title){
|
||||
// Category 200 = all Video; we narrow to movie/tv subcats in prefilter().
|
||||
let url = `${conf.search.tpbBase}/search/${encodeURIComponent(title)}/1/99/200`;
|
||||
let res = await fetch(url, { headers: { 'User-Agent': 'Mozilla/5.0' } });
|
||||
if(!res.ok){
|
||||
let error = new Error('UpstreamError');
|
||||
error.message = `TPB search failed( ${res.status})`;
|
||||
error.status = 502;
|
||||
throw error;
|
||||
}
|
||||
return parseTPBHtml(await res.text());
|
||||
}
|
||||
|
||||
// Deterministic pre-filter before the torrents ever reach the LLM.
|
||||
function prefilter(torrents, imdbId){
|
||||
let out = torrents.filter(t => videoKind(t.category) && Number(t.seeders) > 0);
|
||||
|
||||
// If we can positively identify the title by IMDB id, trust it and drop the rest.
|
||||
if(imdbId){
|
||||
let matches = out.filter(t => t.imdb && t.imdb === imdbId);
|
||||
if(matches.length) out = matches;
|
||||
}
|
||||
|
||||
return out
|
||||
.sort((a, b) => Number(b.seeders) - Number(a.seeders))
|
||||
.slice(0, 40);
|
||||
}
|
||||
|
||||
function buildMagnet(infoHash, name){
|
||||
let magnet = `magnet:?xt=urn:btih:${infoHash}&dn=${encodeURIComponent(name)}`;
|
||||
for(let tracker of conf.search.trackers){
|
||||
magnet += `&tr=${encodeURIComponent(tracker)}`;
|
||||
}
|
||||
return magnet;
|
||||
}
|
||||
|
||||
// --- LLM ranking ----------------------------------------------------------
|
||||
|
||||
function buildSystemPrompt(title, year, today){
|
||||
return [
|
||||
`You are a torrent-selection assistant. Today's date is ${today}.`,
|
||||
`Recent releases are legitimate: NEVER reject a torrent for being too new or assume`,
|
||||
`a current-year release is fake.`,
|
||||
``,
|
||||
`The user wants "${title}" (${year || 'unknown year'}). From the candidate list,`,
|
||||
`select the best releases.`,
|
||||
year ? `IMPORTANT: only pick releases whose name contains the year ${year}; reject other years or remakes of a same-named title.` : ``,
|
||||
`Preferences, in order:`,
|
||||
`- video codec HEVC/x265 (over x264/AVC)`,
|
||||
`- 1080p resolution`,
|
||||
`- total size around 1.5 GB (avoid needlessly huge files)`,
|
||||
`- English audio and English subtitles present`,
|
||||
`- prefer EXTENDED / UNRATED / UNCUT / DIRECTOR'S CUT editions`,
|
||||
`Reject: CAM, TS, TC, TELESYNC, HDCAM, SCREENER/SCR, and non-English-only copies.`,
|
||||
``,
|
||||
`Return STRICT JSON only, shape:`,
|
||||
`{"options":[{"role":"recommended|uhd|other","label":"...","info_hash":"...",`,
|
||||
`"name":"...","resolution":"...","codec":"...","hasSubs":true,"cut":"...",`,
|
||||
`"warning":"...","why":"..."}]}`,
|
||||
`Rules: exactly one "recommended" (the 1080p sweet spot). Include one "uhd" ONLY`,
|
||||
`if a 4K/2160p release exists, and set its "warning" to note it is a much larger,`,
|
||||
`slower download. Add "other" entries for genuinely distinct useful releases`,
|
||||
`(e.g. a different cut or a much smaller copy). "why" is one short sentence.`,
|
||||
`Copy info_hash verbatim from the chosen candidate.`,
|
||||
].join('\n');
|
||||
}
|
||||
|
||||
// Pull the first JSON object out of a model response( tolerates ```json fences / prose).
|
||||
function extractJSON(content){
|
||||
let text = String(content).replace(/```json/gi, '').replace(/```/g, '').trim();
|
||||
let start = text.indexOf('{');
|
||||
let end = text.lastIndexOf('}');
|
||||
if(start === -1 || end === -1) throw new Error('No JSON in model response');
|
||||
return JSON.parse(text.slice(start, end + 1));
|
||||
}
|
||||
|
||||
async function rankReleases(candidates, meta){
|
||||
let compact = candidates.map(t => ({
|
||||
name: t.name,
|
||||
sizeHuman: humanSize(t.size),
|
||||
seeders: Number(t.seeders),
|
||||
info_hash: t.info_hash,
|
||||
imdb: t.imdb || null,
|
||||
}));
|
||||
|
||||
let body = {
|
||||
model: conf.ollama.model,
|
||||
stream: false,
|
||||
format: 'json',
|
||||
messages: [
|
||||
{ role: 'system', content: buildSystemPrompt(meta.title, meta.year, meta.today) },
|
||||
{ role: 'user', content: JSON.stringify(compact) },
|
||||
],
|
||||
};
|
||||
|
||||
let data = await fetchJSON(`${conf.ollama.url}/api/chat`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
'Authorization': `Bearer ${conf.ollama.apiKey}`,
|
||||
},
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
|
||||
let parsed = extractJSON(data.message && data.message.content);
|
||||
let options = Array.isArray(parsed.options) ? parsed.options : [];
|
||||
if(!options.length) throw new Error('Model returned no options');
|
||||
return options;
|
||||
}
|
||||
|
||||
// Deterministic fallback if the LLM is unavailable or returns junk: pick the most-seeded
|
||||
// candidate, preferring x265 + 1080p, so the feature degrades instead of failing.
|
||||
function fallbackReleases(candidates){
|
||||
let score = t => (/x265|hevc/i.test(t.name) ? 2 : 0) + (/1080p/i.test(t.name) ? 1 : 0);
|
||||
let best = [...candidates].sort((a, b) =>
|
||||
(score(b) - score(a)) || (Number(b.seeders) - Number(a.seeders))
|
||||
)[0];
|
||||
if(!best) return [];
|
||||
return [{
|
||||
role: 'recommended',
|
||||
label: 'Most seeded',
|
||||
info_hash: best.info_hash,
|
||||
name: best.name,
|
||||
sizeHuman: humanSize(best.size),
|
||||
seeders: Number(best.seeders),
|
||||
why: 'Automatically chosen (AI ranking unavailable): most seeders.',
|
||||
}];
|
||||
}
|
||||
|
||||
// Attach the fields the front end / add flow need to each option and drop any the model
|
||||
// hallucinated( info_hash must exist in the candidate set).
|
||||
function decorateOptions(options, candidates){
|
||||
let byHash = {};
|
||||
for(let t of candidates) byHash[String(t.info_hash).toLowerCase()] = t;
|
||||
|
||||
let out = [];
|
||||
for(let opt of options){
|
||||
let src = byHash[String(opt.info_hash).toLowerCase()];
|
||||
if(!src) continue;
|
||||
out.push({
|
||||
...opt,
|
||||
info_hash: src.info_hash,
|
||||
name: opt.name || src.name,
|
||||
category: Number(src.category),
|
||||
sizeHuman: opt.sizeHuman || humanSize(src.size),
|
||||
seeders: Number(src.seeders),
|
||||
magnetLink: buildMagnet(src.info_hash, src.name),
|
||||
});
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
async function findReleases(tmdbId, mediaType){
|
||||
let meta = await tmdbDetails(tmdbId, mediaType);
|
||||
let torrents = await tpbSearch(meta.title);
|
||||
let candidates = prefilter(torrents, meta.imdbId);
|
||||
|
||||
if(!candidates.length){
|
||||
return { title: meta.title, year: meta.year, options: [] };
|
||||
}
|
||||
|
||||
let today = new Date().toISOString().slice(0, 10);
|
||||
let options;
|
||||
try{
|
||||
options = await rankReleases(candidates, { title: meta.title, year: meta.year, today });
|
||||
}catch(error){
|
||||
console.error('rankReleases failed, using fallback:', error.message);
|
||||
options = fallbackReleases(candidates);
|
||||
}
|
||||
|
||||
options = decorateOptions(options, candidates);
|
||||
if(!options.length) options = decorateOptions(fallbackReleases(candidates), candidates);
|
||||
|
||||
return { title: meta.title, year: meta.year, options };
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
tmdbSearch,
|
||||
findReleases,
|
||||
// exported for unit tests
|
||||
prefilter,
|
||||
buildMagnet,
|
||||
humanSize,
|
||||
videoKind,
|
||||
extractJSON,
|
||||
decorateOptions,
|
||||
fallbackReleases,
|
||||
tpbSearch,
|
||||
parseTPBHtml,
|
||||
sizeToBytes,
|
||||
};
|
||||
Reference in New Issue
Block a user