3 Commits

Include renames

Author	SHA1	Message	Date
timothyandClaude Opus 4.8	ef2bd65c27	feat(api): #286 — mount the whole /api surface at /api/v1 ... Version every /api route to /api/v1 (251 controller routes + ~24 Location headers + the scanner callback URL + the Startup request-log literal), uniform across the machine API, auth, scanner and scripted-build surfaces. Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth headers and query survive — carrying RFC 8594 Deprecation/Sunset headers, so curl / the future MCP server / bookmarks keep working. An already- versioned path passes through; a future /api/v2 is never forced to v1. Standardize the route convention (leading-slash absolute route per method, no class-[Route] — except the two Scanner/Scripted controllers whose ~all actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests (^/api/v\d+/ over the whole Controllers.Api surface; browser-nav /auth/oidc/login is out of scope). Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945 SPA request literals + the test mocks (regex + positional URL parsers). /api/v1 is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases (owner decision) with removal tracked as a Phase-3 follow-up. Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/ blazor-route-parity/e2e-local/domain-model. fixes #286 refs #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:30:20 +02:00
timothyandClaude Opus 4.8	628c9d7228	feat(235): F9 API parity — library deep-scan, external-collections scan, scan-show outcome enum (#235 slice B) ... Closes the two F9 Libraries.razor parity gaps and normalizes scan-show error mapping to ProblemDetails. TASK 1 — library-wide deep scan: - QueueLibraryScanByLibraryId gains optional `bool DeepScan = false`; handler threads it into ForceSynchronize{Plex,Jellyfin,Emby}LibraryById. - POST /api/libraries/{id}/scan?deep=false binds it via [FromQuery]. TASK 2 — external-collections scan (new endpoints): - POST /api/media-sources/{plex|jellyfin|emby}/{id}/scan-collections?deep=false acquires the per-source collections lock (§3b: lock IS the running scan → 409), enqueues Synchronize{X}Collections(id, ForceScan:true, deep) to the scanner channel, returns 202; compensating-unlock on enqueue throw. TASK 3 — scan-show normalization: - New QueueShowScanResult enum; handler returns it instead of bool. - POST /api/libraries/{id}/scan-show now maps 202/404/409/422 (all errors ProblemDetails) instead of 200/404/400-anonymous-object. - Updated the lone Blazor caller (TelevisionSeasonList.razor). Tests: LibrariesController (scan deep=true, scan-show enum→status), the three media-source controllers (scan-collections route/404/409/202/compensating-unlock), and handler tests for both changed handlers (deep threading + show-scan outcomes). Docs: api-conventions §3b exemplar + blazor-route-parity §5 F9 gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 18:02:17 +02:00
timothyandClaude Opus 4.8	c617a01e83	feat(api): add Jellyfin/Emby media-source write API (#202 slice S3) ... New JellyfinMediaSourcesController (/api/media-sources/jellyfin, J1-J9) and EmbyMediaSourcesController (/api/media-sources/emby, E1-E9), wrapping the existing Jellyfin/Emby MediatR commands per the #202 design doc §A.3/§A.4. Secure connection contract (§C3/§B, finding 1): the connection GET returns only { address, hasApiKey } — the API key never crosses the wire. The PUT retains the existing key when the incoming key is blank, sets a new one when non-blank, and 422s "API key is required" on a blank first connect. Finding 7 (lock-release discipline): DisconnectJellyfinHandler and DisconnectEmbyHandler now wrap their work in try/finally so a throw from any awaited dependency (repo delete, search-index commit, secret store) still releases the family lock instead of wedging every future disconnect at 409. Findings 2c/8 (path-replacement cross-source guard): UpdateJellyfinPathReplacementsHandler and UpdateEmbyPathReplacementsHandler now reject, before any write, an incoming positive Id that isn't owned by the route's media source, a null item, or a blank RemotePath/LocalPath — all 422 with no partial mutation. Defense-in-depth repo fix: the Jellyfin/Emby path-replacement UPDATE SQL in MediaSourceRepository now scopes by {Jellyfin,Emby}MediaSourceId (was previously unscoped by Id alone, allowing a PUT to one source to silently overwrite another source's row). The Plex path-replacement method (~line 397) is untouched — that's slice S2's file. Library preferences (§C4a): the controller validates the incoming id set against the source's known libraries (reject foreign ids, require full coverage, no Id=0) before dispatch, then — for §C7 — LockLibrary + enqueues the SynchronizeXLibraries/SynchronizeXLibraryByIdIfNeeded pair per enabled library (compensating unlock if the enqueue throws), and returns the reloaded list (ids are not stable across a disable). 404s on id-taking endpoints come from a controller pre-check (GetXMediaSourceById is None), not a handler NotFoundError, since Either.Apply/ToEitherAsync join any NotFoundError into a flat 422 (finding 9). Tests: controller route/404/409/422 tests for both families; disconnect fault-injection tests proving the lock releases even when a dependency throws; path-replacement handler tests for cross-source-id/blank/null-item rejection and correct add/update/delete merge; a repository-level test proving the SQL fix stops a same-family cross-source path-replacement overwrite. No new commands, no DB migration, no OpenAPI regen (gated until S1-S3 merge per the design doc's build-slice plan). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 15:47:42 +02:00