Files
tpbproxy/routes/transmission.js
wmantly fd5ef14999 Harden auth, add AI smart-search and post-download organization
Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-01 14:19:13 -04:00

122 lines
3.0 KiB
JavaScript

'use strict';
const router = require('express').Router();
const {Torrent} = require('>/models');
const organize = require('>/controller/organize');
function authTorrent(torrent, req){
if(torrent && torrent.isPrivate && torrent.added_by !== req.user.username){
let error = new Error('TorrentNotFound');
error.name = 'TorrentNotFound';
error.message = 'Torrent not found';
error.status = 404;
throw error;
}
return torrent;
}
router.get('/', async function(req, res, next){
try{
let username = req.query.username || req.user.username;
let where = {added_by: username};
if(username !== req.user.username) where.isPrivate = false;
res.json({results: await Torrent.findAll({
where,
limit: req.query.limit,
offset: req.query.offset,
order: [
['createdAt', 'DESC'],
],
})});
}catch(error){
next(error);
}
});
router.post("/", async function(req, res, next){
try{
res.json(await Torrent.create({...req.body, added_by: req.user.username}))
}catch(error){
next(error);
}
});
router.get('/server', async function(req, res, next){
try{
res.json(await Torrent.trClient.sessionStats())
}catch(error){
next(error);
}
});
router.get("/:hashString", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
if('latest' in req.query){
torrent = await torrent.getTorrentData();
}
res.json({result: torrent});
}catch(error){
next(error);
}
});
router.delete("/:hashString", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
res.json({result: torrent, activity: await torrent.destroy()});
}catch(error){
next(error);
}
});
router.post("/:hashString/stop", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
res.json({result: torrent, activity: await torrent.stop()});
}catch(error){
next(error);
}
});
router.post("/:hashString/start", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
res.json({result: torrent, activity: await torrent.start()});
}catch(error){
next(error);
}
});
// Manually (re)run organization for a finished torrent.
router.post("/:hashString/organize", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
if(!torrent){ let e = new Error('TorrentNotFound'); e.status = 404; throw e; }
res.json(await organize.fileTorrent(torrent));
}catch(error){
next(error);
}
});
// Correct a wrong match: re-file an already-organized torrent under a chosen TMDB id.
router.post("/:hashString/organize/match", async function(req, res, next){
try{
let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
if(!torrent){ let e = new Error('TorrentNotFound'); e.status = 404; throw e; }
res.json(await organize.refileWithMatch(torrent, req.body.tmdbId, req.body.mediaType));
}catch(error){
next(error);
}
});
module.exports = router;