feat(security): library visibility enforced at the source; per-library series; annotation ownership; admin user creation

The family-lens hardening: library_visibility was only enforced where
file bytes flowed (download/reader/OPDS) — metadata surfaces leaked
hidden libraries to any authenticated account, and registration was
open by default with no admin-side user creation.

- Series are grouped PER LIBRARY now (same name in two libraries =
  two entries: manga adaptations / LN splits no longer merge);
  /api/series aggregates only the requester's VISIBLE libraries and
  /api/series/books REQUIRES a visible library_id (breaking contract;
  web + app clients updated in the same change).
- /api/media-items, item detail, and the reader content endpoints
  (chapters/panels/outline/THUMBNAILS — page images leaked unguarded
  next to a gated GetPage) all enforce the visible set; resolveLibrary
  no longer honors a hand-typed library_id outside the visible set.
- Annotation/note/bookmark mutations (update/delete/tombstone, sync
  LWW paths incl. conflict resolution) carry ownership predicates:
  another account's bare row id is a 404, not a silent delete.
- Admin user creation: POST /api/auth/users (AdminMiddleware) + a
  Create User card in the admin Users UI — accounts stay creatable
  with self-service registration OFF, which is now the schema default
  (fresh installs; the first-admin bootstrap exception is unchanged).
- Tests: series contract re-pinned (per-library, visibility 403s),
  new ownership + admin-create integration suites, OPDS all=1 test
  now passes an explicit page size (shared-DB growth made the fresh
  books fall off page 1), device-cap helper switched to the admin
  endpoint.

internal/handlers/auth.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"html/template"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -686,6 +687,79 @@ func (h *AuthHandler) ListUsers(c *echo.Context) error {
 	return c.JSON(http.StatusOK, users)
 }
 
+// AdminCreateUser handles POST /api/auth/users (AdminMiddleware-gated).
+// The admin's counterpart to public registration: creating an account for
+// someone else must work even when self-service registration is disabled
+// (the family/self-hosted default). The requester's admin role comes from
+// the route group, and the new account NEVER auto-logins — no tokens are
+// issued here, unlike Register.
+func (h *AuthHandler) AdminCreateUser(c *echo.Context) error {
+	var req RegisterRequest
+	if err := c.Bind(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
+	}
+	if err := c.Validate(&req); err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	req.Username = strings.TrimSpace(req.Username)
+	if req.Username == "" {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "username cannot be empty or whitespace"})
+	}
+
+	role := strings.ToLower(req.Role)
+	if role == "" {
+		role = "user"
+	}
+	if role != "user" && role != "admin" {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid role. must be 'user' or 'admin'"})
+	}
+
+	if _, err := h.db.GetUserByEmail(c.Request().Context(), req.Email); err == nil {
+		return c.JSON(http.StatusConflict, map[string]string{"error": "email already exists"})
+	}
+	if _, err := h.db.GetUserByUsername(c.Request().Context(), req.Username); err == nil {
+		return c.JSON(http.StatusConflict, map[string]string{"error": "username already exists"})
+	}
+
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to hash password"})
+	}
+
+	user, err := h.db.CreateUser(c.Request().Context(), database.CreateUserParams{
+		Email:        req.Email,
+		Username:     req.Username,
+		PasswordHash: string(hashedPassword),
+		FirstName:    pgtype.Text{String: req.FirstName, Valid: req.FirstName != ""},
+		LastName:     pgtype.Text{String: req.LastName, Valid: req.LastName != ""},
+		Theme:        pgtype.Text{String: "tokyo-night", Valid: true},
+		Role:         role,
+	})
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	if err := h.CreateDefaultCollectionsForUser(c.Request().Context(), user.ID); err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to create default collections"})
+	}
+
+	// The admin UI posts this via HTMX: refresh the page so the new user
+	// appears in the table, and confirm inline.
+	if c.Request().Header.Get("HX-Request") == "true" {
+		c.Response().Header().Set("HX-Refresh", "true")
+		return c.HTML(http.StatusCreated, `<div class="text-green-500">User "`+template.HTMLEscapeString(user.Username)+`" created.</div>`)
+	}
+
+	return c.JSON(http.StatusCreated, map[string]interface{}{
+		"id":         uuid.UUID(user.ID.Bytes).String(),
+		"email":      user.Email,
+		"username":   user.Username,
+		"role":       user.Role,
+		"created_at": user.CreatedAt,
+	})
+}
+
 // normalizePath cleans and normalizes folder paths for consistent storage and comparison
 func normalizePath(path string) string {
 	fmt.Printf("normalizePath input: '%s'\n", path)

internal/handlers/conflicts.go

@@ -406,6 +406,7 @@ func (h *ConflictHandler) applyHighlightResolution(ctx context.Context, mediaIte
 		LastModifiedAt:    pgtype.Timestamptz{Time: time.Now(), Valid: true},
 		LastModifiedSource: pgtype.Text{String: "conflict_resolution", Valid: true},
 		DeviceSyncData:     existing.DeviceSyncData,
+		UserID:             userID,
 	}
 
 	if v, ok := data["selection_text"].(string); ok {
@@ -451,6 +452,7 @@ func (h *ConflictHandler) applyBookmarkResolution(ctx context.Context, mediaItem
 		LastModifiedAt:    pgtype.Timestamptz{Time: time.Now(), Valid: true},
 		LastModifiedSource: pgtype.Text{String: "conflict_resolution", Valid: true},
 		DeviceSyncData:     existing.DeviceSyncData,
+		UserID:             userID,
 	}
 
 	if v, ok := data["title"].(string); ok {
@@ -486,6 +488,7 @@ func (h *ConflictHandler) applyNoteResolution(ctx context.Context, mediaItemID p
 		LastModifiedAt:     pgtype.Timestamptz{Time: time.Now(), Valid: true},
 		LastModifiedSource: pgtype.Text{String: "conflict_resolution", Valid: true},
 		DeviceSyncData:     existing.DeviceSyncData,
+		UserID:             userID,
 	}
 
 	if v, ok := data["content"].(string); ok {

internal/handlers/media.go

@@ -626,6 +626,29 @@ func (h *MediaHandler) HandleBulkUpdate(c *echo.Context) error {
 	})
 }
 
+// visibleLibrarySet loads the requester's visible libraries — membership
+// map for param checks, id slice for SQL ANY() filters.
+func (mh *MediaHandler) visibleLibrarySet(c *echo.Context) (map[string]bool, []pgtype.UUID, error) {
+	user, ok := c.Get("user").(database.Users)
+	if !ok {
+		return nil, nil, echo.NewHTTPError(http.StatusUnauthorized, "invalid user")
+	}
+	libraries, err := mh.libraryService.GetUserVisibleLibraries(c.Request().Context(), user.ID)
+	if err != nil {
+		return nil, nil, echo.NewHTTPError(http.StatusInternalServerError, "failed to check library access")
+	}
+	set := make(map[string]bool, len(libraries))
+	ids := make([]pgtype.UUID, 0, len(libraries))
+	for _, lib := range libraries {
+		if !lib.ID.Valid {
+			continue
+		}
+		set[uuid.UUID(lib.ID.Bytes).String()] = true
+		ids = append(ids, lib.ID)
+	}
+	return set, ids, nil
+}
+
 // ListMediaItems handles GET /api/media-items
 func (mh *MediaHandler) ListMediaItems(c *echo.Context) error {
 	libraryID := c.QueryParam("library_id")
@@ -678,6 +701,14 @@ func (mh *MediaHandler) ListMediaItems(c *echo.Context) error {
 			return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid library id"})
 		}
 
+		visibleSet, _, err := mh.visibleLibrarySet(c)
+		if err != nil {
+			return err
+		}
+		if !visibleSet[libraryID] {
+			return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+		}
+
 		items, err := mh.db.ListMediaItemsSorted(c.Request().Context(), database.ListMediaItemsSortedParams{
 			LibraryID: pgtype.UUID{Bytes: libUUID, Valid: true},
 			Sort:      pgtype.Text{String: sort, Valid: true},
@@ -691,9 +722,14 @@ func (mh *MediaHandler) ListMediaItems(c *echo.Context) error {
 		return c.JSON(http.StatusOK, map[string]interface{}{"data": items})
 	}
 
+	_, visibleIDs, err := mh.visibleLibrarySet(c)
+	if err != nil {
+		return err
+	}
 	items, err := mh.db.ListMediaItems(c.Request().Context(), database.ListMediaItemsParams{
-		Limit:  int32(limit),
-		Offset: int32(offset),
+		Limit:             int32(limit),
+		Offset:            int32(offset),
+		VisibleLibraryIds: visibleIDs,
 	})
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
@@ -764,6 +800,15 @@ func (mh *MediaHandler) GetMediaItem(c *echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
+	// Visibility gate: hidden libraries don't leak row detail by id.
+	visibleSet, _, err := mh.visibleLibrarySet(c)
+	if err != nil {
+		return err
+	}
+	if !visibleSet[uuid.UUID(item.LibraryID.Bytes).String()] {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+	}
+
 	return c.JSON(http.StatusOK, map[string]interface{}{
 		"id":               uuid.UUID(item.ID.Bytes).String(),
 		"library_id":       uuid.UUID(item.LibraryID.Bytes).String(),
@@ -1666,6 +1711,12 @@ func (mh *MediaHandler) UpdateMediaNote(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid note id"})
 	}
 
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+
 	var req UpdateMediaNoteRequest
 	if err := c.Bind(&req); err != nil {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
@@ -1678,6 +1729,7 @@ func (mh *MediaHandler) UpdateMediaNote(c *echo.Context) error {
 		ID:       pgtype.UUID{Bytes: noteUUID, Valid: true},
 		Content:  req.Content,
 		Position: pgtype.Text{String: req.Position, Valid: req.Position != ""},
+		UserID:   pgtype.UUID{Bytes: userUUID, Valid: true},
 	})
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
@@ -1694,10 +1746,19 @@ func (mh *MediaHandler) DeleteMediaNote(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid note id"})
 	}
 
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+
 	if mh.annotationSvc != nil {
-		err = mh.annotationSvc.TombstoneNoteByID(c.Request().Context(), pgtype.UUID{Bytes: noteUUID, Valid: true})
+		err = mh.annotationSvc.TombstoneNoteByID(c.Request().Context(), pgtype.UUID{Bytes: noteUUID, Valid: true}, pgtype.UUID{Bytes: userUUID, Valid: true})
 	} else {
-		err = mh.db.DeleteMediaNote(c.Request().Context(), pgtype.UUID{Bytes: noteUUID, Valid: true})
+		err = mh.db.DeleteMediaNote(c.Request().Context(), database.DeleteMediaNoteParams{
+			ID:     pgtype.UUID{Bytes: noteUUID, Valid: true},
+			UserID: pgtype.UUID{Bytes: userUUID, Valid: true},
+		})
 	}
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
@@ -1899,6 +1960,12 @@ func (mh *MediaHandler) UpdateMediaHighlight(c *echo.Context) error {
 		return c.JSON(http.StatusOK, result.Highlight)
 	}
 
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+
 	highlight, err := mh.db.UpdateMediaHighlight(c.Request().Context(), database.UpdateMediaHighlightParams{
 		ID:            pgtype.UUID{Bytes: highlightUUID, Valid: true},
 		SelectionText: req.SelectionText,
@@ -1906,6 +1973,7 @@ func (mh *MediaHandler) UpdateMediaHighlight(c *echo.Context) error {
 		EndPosition:   pgtype.Text{String: req.EndPosition, Valid: true},
 		Color:         pgtype.Text{String: color, Valid: true},
 		NoteID:        noteUUID,
+		UserID:        pgtype.UUID{Bytes: userUUID, Valid: true},
 	})
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
@@ -1924,14 +1992,27 @@ func (mh *MediaHandler) DeleteMediaHighlight(c *echo.Context) error {
 
 	pgHighlightID := pgtype.UUID{Bytes: highlightUUID, Valid: true}
 
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+	pgUserID := pgtype.UUID{Bytes: userUUID, Valid: true}
+
 	if mh.annotationSvc != nil {
-		if err := mh.annotationSvc.TombstoneHighlightByID(c.Request().Context(), pgHighlightID, "web"); err != nil {
+		if err := mh.annotationSvc.TombstoneHighlightByID(c.Request().Context(), pgUserID, pgHighlightID, "web"); err != nil {
+			if errors.Is(err, pgx.ErrNoRows) {
+				return c.JSON(http.StatusNotFound, map[string]string{"error": "highlight not found"})
+			}
 			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 		}
 		return c.NoContent(http.StatusNoContent)
 	}
 
-	err = mh.db.DeleteMediaHighlight(c.Request().Context(), pgHighlightID)
+	err = mh.db.DeleteMediaHighlight(c.Request().Context(), database.DeleteMediaHighlightParams{
+		ID:     pgHighlightID,
+		UserID: pgUserID,
+	})
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
@@ -2076,14 +2157,27 @@ func (mh *MediaHandler) DeleteMediaBookmark(c *echo.Context) error {
 
 	pgBookmarkID := pgtype.UUID{Bytes: bookmarkUUID, Valid: true}
 
+	userID := c.Get("user_id").(string)
+	userUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid user"})
+	}
+	pgUserID := pgtype.UUID{Bytes: userUUID, Valid: true}
+
 	if mh.annotationSvc != nil {
-		if err := mh.annotationSvc.TombstoneBookmarkByID(c.Request().Context(), pgBookmarkID, "web"); err != nil {
+		if err := mh.annotationSvc.TombstoneBookmarkByID(c.Request().Context(), pgUserID, pgBookmarkID, "web"); err != nil {
+			if errors.Is(err, pgx.ErrNoRows) {
+				return c.JSON(http.StatusNotFound, map[string]string{"error": "bookmark not found"})
+			}
 			return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 		}
 		return c.NoContent(http.StatusNoContent)
 	}
 
-	if err := mh.db.DeleteMediaBookmark(c.Request().Context(), pgBookmarkID); err != nil {
+	if err := mh.db.DeleteMediaBookmark(c.Request().Context(), database.DeleteMediaBookmarkParams{
+		ID:     pgBookmarkID,
+		UserID: pgUserID,
+	}); err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 

internal/handlers/reader.go

@@ -213,6 +213,27 @@ func (h *ReaderHandler) GetPage(c *echo.Context) error {
 }
 
 // GetChapters returns chapter metadata
+// ensureItemVisible enforces the library-visibility gate for reader
+// content and layout endpoints (same rule GetPage applies): a hidden
+// library leaks nothing by item id.
+func (h *ReaderHandler) ensureItemVisible(c *echo.Context, mediaItem *database.MediaItems) error {
+	user := c.Get("user")
+	if user == nil {
+		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "User not authenticated"})
+	}
+	userData := user.(database.Users)
+	libraries, err := h.libraryService.GetUserVisibleLibraries(c.Request().Context(), userData.ID)
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Failed to check library access"})
+	}
+	for _, lib := range libraries {
+		if lib.ID == mediaItem.LibraryID {
+			return nil
+		}
+	}
+	return c.JSON(http.StatusForbidden, map[string]string{"error": "Access denied to this library"})
+}
+
 func (h *ReaderHandler) GetChapters(c *echo.Context) error {
 	mediaItemID := c.Param("mediaItemId")
 	parsedUUID, err := uuid.Parse(mediaItemID)
@@ -220,6 +241,14 @@ func (h *ReaderHandler) GetChapters(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid media item ID"})
 	}
 
+	mediaItem, err := h.db.GetMediaItem(c.Request().Context(), pgtype.UUID{Bytes: parsedUUID, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "Media item not found"})
+	}
+	if err := h.ensureItemVisible(c, &mediaItem); err != nil {
+		return err
+	}
+
 	// Use reader service to detect chapters
 	chapters, err := h.readerService.DetectChapters(c.Request().Context(), parsedUUID)
 	if err != nil {
@@ -246,6 +275,14 @@ func (h *ReaderHandler) GetPanels(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid page number"})
 	}
 
+	mediaItem, err := h.db.GetMediaItem(c.Request().Context(), pgtype.UUID{Bytes: parsedUUID, Valid: true})
+	if err != nil {
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "Media item not found"})
+	}
+	if err := h.ensureItemVisible(c, &mediaItem); err != nil {
+		return err
+	}
+
 	// Get detection method from query
 	method := c.QueryParam("method")
 	if method == "" {
@@ -398,6 +435,9 @@ func (h *ReaderHandler) GetPDFOutline(c *echo.Context) error {
 	if err != nil {
 		return c.JSON(http.StatusNotFound, map[string]string{"error": "Media item not found"})
 	}
+	if err := h.ensureItemVisible(c, &mediaItem); err != nil {
+		return err
+	}
 
 	// Only PDFs have outlines
 	if mediaItem.FormatGroup != "pdf" {
@@ -438,6 +478,9 @@ func (h *ReaderHandler) GetPDFThumbnail(c *echo.Context) error {
 	if err != nil {
 		return c.JSON(http.StatusNotFound, map[string]string{"error": "Media item not found"})
 	}
+	if err := h.ensureItemVisible(c, &mediaItem); err != nil {
+		return err
+	}
 
 	// Get thumbnail size from query
 	width := c.QueryParam("width")

internal/handlers/series.go

@@ -50,13 +50,25 @@ func (h *SeriesHandler) GetSeries(c *echo.Context) error {
 		}
 	}
 
-	seriesList, total, err := h.seriesService.GetSeriesPage(c.Request().Context(), libUUID, limit, offset)
+	// Visibility scoping: an explicit library_id must be visible to the
+	// requester (403 otherwise); the unscoped aggregate covers only the
+	// requester's visible libraries.
+	visibleSet, visibleIDs, err := h.visibleLibrarySet(c)
+	if err != nil {
+		return err
+	}
+	if libraryID != "" && !visibleSet[libraryID] {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+	}
+
+	seriesList, total, err := h.seriesService.GetSeriesPage(c.Request().Context(), libUUID, visibleIDs, limit, offset)
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Failed to load series"})
 	}
 
 	type SeriesResponse struct {
 		Name          string   `json:"name"`
+		LibraryID     string   `json:"library_id"`
 		BookCount     int64    `json:"book_count"`
 		TotalInSeries int      `json:"total_in_series"`
 		CoverPaths    []string `json:"cover_paths"`
@@ -67,6 +79,7 @@ func (h *SeriesHandler) GetSeries(c *echo.Context) error {
 	for _, s := range seriesList {
 		response = append(response, SeriesResponse{
 			Name:          s.Name,
+			LibraryID:     s.LibraryID,
 			BookCount:     s.BookCount,
 			TotalInSeries: s.TotalInSeries,
 			CoverPaths:    s.CoverPaths,
@@ -82,13 +95,58 @@ func (h *SeriesHandler) GetSeries(c *echo.Context) error {
 	})
 }
 
+// visibleLibrarySet loads the requester's visible libraries. Every series
+// path funnels through this: hidden libraries contribute nothing, and an
+// explicit library_id outside the set is a 403, not a silent pass.
+func (h *SeriesHandler) visibleLibrarySet(c *echo.Context) (map[string]bool, []pgtype.UUID, error) {
+	user, ok := c.Get("user").(database.Users)
+	if !ok {
+		return nil, nil, echo.NewHTTPError(http.StatusUnauthorized, "invalid user")
+	}
+	libraries, err := h.seriesService.VisibleLibraries(c.Request().Context(), user.ID)
+	if err != nil {
+		return nil, nil, echo.NewHTTPError(http.StatusInternalServerError, "failed to check library access")
+	}
+	set := make(map[string]bool, len(libraries))
+	ids := make([]pgtype.UUID, 0, len(libraries))
+	for _, lib := range libraries {
+		if !lib.ID.Valid {
+			continue
+		}
+		libUUID, err := uuid.FromBytes(lib.ID.Bytes[0:16])
+		if err != nil {
+			continue
+		}
+		set[libUUID.String()] = true
+		ids = append(ids, lib.ID)
+	}
+	return set, ids, nil
+}
+
 func (h *SeriesHandler) GetSeriesBooks(c *echo.Context) error {
 	seriesName := c.QueryParam("name")
 	if seriesName == "" {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "name required"})
 	}
 
-	books, err := h.seriesService.GetSeriesBooks(c.Request().Context(), seriesName)
+	libraryID := c.QueryParam("library_id")
+	if libraryID == "" {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "library_id required"})
+	}
+	libUUID, err := uuid.Parse(libraryID)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid library_id"})
+	}
+
+	visibleSet, _, err := h.visibleLibrarySet(c)
+	if err != nil {
+		return err
+	}
+	if !visibleSet[libraryID] {
+		return c.JSON(http.StatusForbidden, map[string]string{"error": "library not accessible"})
+	}
+
+	books, err := h.seriesService.GetSeriesBooks(c.Request().Context(), pgtype.UUID{Bytes: libUUID, Valid: true}, seriesName)
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "Failed to load series books"})
 	}
@@ -105,13 +163,14 @@ func (h *SeriesHandler) GetSeriesBooks(c *echo.Context) error {
 	}
 
 	return c.JSON(http.StatusOK, map[string]interface{}{
-		"name":  seriesName,
-		"books": bookCards,
-		"total": len(bookCards),
+		"name":       seriesName,
+		"library_id": libraryID,
+		"books":      bookCards,
+		"total":      len(bookCards),
 	})
 }
 
-func GetSeriesCardsData(ctx context.Context, db *database.Queries, libraryID pgtype.UUID, limit, offset int) ([]services.SeriesInfo, int, error) {
+func GetSeriesCardsData(ctx context.Context, db *database.Queries, libraryID pgtype.UUID, visibleLibraryIDs []pgtype.UUID, limit, offset int) ([]services.SeriesInfo, int, error) {
 	svc := services.NewSeriesService(db)
-	return svc.GetSeriesPage(ctx, libraryID, limit, offset)
+	return svc.GetSeriesPage(ctx, libraryID, visibleLibraryIDs, limit, offset)
 }