718itbiz/tpbproxy
1
0
Fork 0
Code Issues 1 Pull Requests Releases Wiki Activity

Harden auth, add AI smart-search and post-download organization

Browse Source 
Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-01 14:19:13 -04:00
parent b30fe748b2
commit fd5ef14999
21 changed files with 1144 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/proxy.js
+43 -5
View File
@@ -1,19 +1,57 @@
'use static';
'use strict';
const router = require('express').Router();
const path = require('path');
const zlib = require('zlib');
const fs = require('fs');
const https = require('https');
const http = require("http");
const proxy = require('http-proxy-middleware');
const { Auth } = require('>/controller/auth');
const inject = fs.readFileSync('./inject.html', 'utf8');
const mainjs = fs.readFileSync('./static/main.js', 'utf8');
const inject = fs.readFileSync(path.join(__dirname, '..', 'inject.html'), 'utf8');
const mainjs = fs.readFileSync(path.join(__dirname, '..', 'static', 'main.js'), 'utf8');
// Page served to users who are not logged in. It reuses the injected front end
// (jQuery + header partial) so the login dialog is available, but nothing is proxied.
const loginPage = "<html><head><meta name='robots' content='noindex, nofollow'><title>Login</title></head><body>"
+ inject
+ "<script>window.__tbpLoginGate = true;</script>"
+ "</body></html>";
function parseCookies(req){
let out = {};
let header = req.headers.cookie;
if(!header) return out;
for(let pair of header.split(';')){
let idx = pair.indexOf('=');
if(idx < 0) continue;
out[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());
}
return out;
}
// Keep the proxy( and everything it serves) out of search engines.
router.get('/robots.txt', function(req, res){
res.type('text/plain').send('User-agent: *\nDisallow: /\n');
});
// Block all proxying for users who are not logged in. Page navigation can not send
// the auth-token header, so the token is read from a cookie set by the front end.
router.use(async function(req, res, next){
res.set('X-Robots-Tag', 'noindex, nofollow');
try{
await Auth.checkToken(parseCookies(req)['auth-token']);
return next();
}catch(error){
return res.status(401).send(loginPage);
}
});
// app.all("/*.js", function(req, res){res.send('')});
router.all('/static/main.js', function(req,res){
res.write(mainjs);
res.end(mainjs);
});
const proxyTarget = {
@@ -70,7 +108,7 @@ router.all("/*", proxy({
// res.set(key, proxyRes.headers[key].toString().replace('http://', 'https://'))
}
let body = new Buffer('');
let body = Buffer.alloc(0);
proxyRes.on('error', function(e){
console.error('ERROR!', e)
});