The static Torrent.create override was validating the input data before
calling Transmission, but hashString isn't known until after addUrl.
Move validation to the final createData object so search/fill can queue
torrents without providing a hash up front.
Signed-off-by: William Mantly <wmantly@gmail.com>
Transmission addUrl sometimes returns a response without a hashString
(e.g. duplicate or malformed response). Extract the info hash from the
magnet link as a fallback, and log the response if neither works.
Signed-off-by: William Mantly <wmantly@gmail.com>
New controller/retry.js wraps async calls with infinite retries, capped
at 30s with jitter. Applied to: TPB search, TMDB, Emby, Ollama chat,
Transmission RPC, and the status/status interval calls inherit it via
a Proxy around the Transmission client.
Also handles ollama package returning pre-parsed JSON objects.
Signed-off-by: William Mantly <wmantly@gmail.com>
When Smart Search finds no good copy of a movie (unreleased / only CAMs), we
now record it instead of dropping it:
- New Wanted model + migration (dedup by tmdbId, status wanted|fulfilled).
- POST /__api/search/releases remembers a movie when it returns no options,
and the UI confirms it was added to the wishlist.
- controller/wantedWatcher re-runs Smart Search for wishlisted items every 6h
(and on boot); when a good copy appears it queues the recommended release,
which then flows through the normal download + organize pipeline, and marks
the item fulfilled.
- GET/DELETE /__api/search/wanted to view/remove the wishlist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
res.statusCode in the error handler, const-scope pubsub.
Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.
Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
from the TPB category id; captured at add time (migration).
Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
prefer uncut) returning a recommended pick, optional warned 4K, and other
editions. Front-end Smart Search box + dialog feeding the existing add flow.
Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
TMDB canonicalizes title/year, files main video (+subs) into the library
with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
triggers an Emby library scan. Low-confidence matches are flagged, not
mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.
Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wmantly