fix: address #93 adversarial review findings

Backend: 401 documented on all mutating settings/resolution routes;
resolution delete distinguishes 404 (unknown) from 422 (not custom);
XMLTV enum bridging via exhaustive switch instead of int casts;
field-level Arg.Is assertions incl. non-null watermark/filler flow.

Frontend: resolution add/delete failures surfaced inline (were
silent); partial saves merge succeeded groups via allSettled; empty
numeric fields invalid + tunerCount min 1; HLS Direct select shows
out-of-list wire values; media-source rows show derived last-scan.

ErsatzTV.Tests 495; web suite 145.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ErsatzTV/Controllers/Api/Requests/UpdateXmltvSettingsRequest.cs

@@ -11,7 +11,23 @@ public record UpdateXmltvSettingsRequest(int DaysToBuild, ApiXmltvTimeZone TimeZ
             new XmltvSettingsViewModel
             {
                 DaysToBuild = DaysToBuild,
-                TimeZone = (XmltvTimeZone)(int)TimeZone,
-                BlockBehavior = (XmltvBlockBehavior)(int)BlockBehavior
+                TimeZone = ToVmTimeZone(TimeZone),
+                BlockBehavior = ToVmBlockBehavior(BlockBehavior)
             });
+
+    private static XmltvTimeZone ToVmTimeZone(ApiXmltvTimeZone timeZone) =>
+        timeZone switch
+        {
+            ApiXmltvTimeZone.Local => XmltvTimeZone.Local,
+            ApiXmltvTimeZone.Utc => XmltvTimeZone.Utc,
+            _ => throw new ArgumentOutOfRangeException(nameof(timeZone), timeZone, null)
+        };
+
+    private static XmltvBlockBehavior ToVmBlockBehavior(ApiXmltvBlockBehavior blockBehavior) =>
+        blockBehavior switch
+        {
+            ApiXmltvBlockBehavior.SplitTimeEvenly => XmltvBlockBehavior.SplitTimeEvenly,
+            ApiXmltvBlockBehavior.UseActualTimes => XmltvBlockBehavior.UseActualTimes,
+            _ => throw new ArgumentOutOfRangeException(nameof(blockBehavior), blockBehavior, null)
+        };
 }

ErsatzTV/Controllers/Api/ResolutionController.cs

@@ -35,6 +35,7 @@ public class ResolutionController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Create a custom resolution")]
     [ProducesResponseType(typeof(ResolutionResponseModel), StatusCodes.Status201Created)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> Create(
         [Required] [FromBody]
@@ -61,6 +62,8 @@ public class ResolutionController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Delete a custom resolution")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> Delete(int id, CancellationToken cancellationToken)
     {

ErsatzTV/Controllers/Api/SettingsController.cs

@@ -11,6 +11,8 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using ApiXmltvBlockBehavior = ErsatzTV.Core.Api.Settings.XmltvBlockBehavior;
 using ApiXmltvTimeZone = ErsatzTV.Core.Api.Settings.XmltvTimeZone;
+using VmXmltvBlockBehavior = ErsatzTV.Application.Configuration.XmltvBlockBehavior;
+using VmXmltvTimeZone = ErsatzTV.Application.Configuration.XmltvTimeZone;
 
 namespace ErsatzTV.Controllers.Api;
 
@@ -34,6 +36,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update global FFmpeg settings")]
     [ProducesResponseType(typeof(FFmpegSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateFfmpeg(
         [Required] [FromBody]
@@ -66,6 +69,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update global playout settings")]
     [ProducesResponseType(typeof(PlayoutSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdatePlayout(
         [Required] [FromBody]
@@ -98,6 +102,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update global XMLTV settings")]
     [ProducesResponseType(typeof(XmltvSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateXmltv(
         [Required] [FromBody]
@@ -130,6 +135,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update library scan cadence")]
     [ProducesResponseType(typeof(ScannerSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateScanner(
         [Required] [FromBody]
@@ -162,6 +168,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update per-area minimum log levels")]
     [ProducesResponseType(typeof(LoggingSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateLogging(
         [Required] [FromBody]
@@ -194,6 +201,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update UI preferences")]
     [ProducesResponseType(typeof(UiSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateUi(
         [Required] [FromBody]
@@ -223,6 +231,7 @@ public class SettingsController(IMediator mediator) : ControllerBase
     [Tags("Settings")]
     [EndpointSummary("Update HDHomeRun emulation settings")]
     [ProducesResponseType(typeof(HdhrSettingsResponseModel), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
     public async Task<IActionResult> UpdateHdhr(
         [Required] [FromBody]
@@ -264,7 +273,23 @@ public class SettingsController(IMediator mediator) : ControllerBase
         new(vm.DaysToBuild, vm.SkipMissingItems, vm.ScriptedScheduleTimeoutSeconds);
 
     private static XmltvSettingsResponseModel ProjectToResponseModel(XmltvSettingsViewModel vm) =>
-        new(vm.DaysToBuild, (ApiXmltvTimeZone)(int)vm.TimeZone, (ApiXmltvBlockBehavior)(int)vm.BlockBehavior);
+        new(vm.DaysToBuild, ToApiTimeZone(vm.TimeZone), ToApiBlockBehavior(vm.BlockBehavior));
+
+    private static ApiXmltvTimeZone ToApiTimeZone(VmXmltvTimeZone timeZone) =>
+        timeZone switch
+        {
+            VmXmltvTimeZone.Local => ApiXmltvTimeZone.Local,
+            VmXmltvTimeZone.Utc => ApiXmltvTimeZone.Utc,
+            _ => throw new ArgumentOutOfRangeException(nameof(timeZone), timeZone, null)
+        };
+
+    private static ApiXmltvBlockBehavior ToApiBlockBehavior(VmXmltvBlockBehavior blockBehavior) =>
+        blockBehavior switch
+        {
+            VmXmltvBlockBehavior.SplitTimeEvenly => ApiXmltvBlockBehavior.SplitTimeEvenly,
+            VmXmltvBlockBehavior.UseActualTimes => ApiXmltvBlockBehavior.UseActualTimes,
+            _ => throw new ArgumentOutOfRangeException(nameof(blockBehavior), blockBehavior, null)
+        };
 
     private static LoggingSettingsResponseModel ProjectToResponseModel(LoggingSettingsViewModel vm) =>
         new(

ErsatzTV/wwwroot/openapi/v1.json

@@ -3295,6 +3295,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -3340,6 +3360,46 @@
           "204": {
             "description": "No Content"
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4219,6 +4279,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4324,6 +4404,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4429,6 +4529,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4534,6 +4654,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4639,6 +4779,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4744,6 +4904,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {
@@ -4849,6 +5029,26 @@
               }
             }
           },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "text/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
           "422": {
             "description": "Unprocessable Entity",
             "content": {