The family-lens hardening: library_visibility was only enforced where file bytes flowed (download/reader/OPDS) — metadata surfaces leaked hidden libraries to any authenticated account, and registration was open by default with no admin-side user creation. - Series are grouped PER LIBRARY now (same name in two libraries = two entries: manga adaptations / LN splits no longer merge); /api/series aggregates only the requester's VISIBLE libraries and /api/series/books REQUIRES a visible library_id (breaking contract; web + app clients updated in the same change). - /api/media-items, item detail, and the reader content endpoints (chapters/panels/outline/THUMBNAILS — page images leaked unguarded next to a gated GetPage) all enforce the visible set; resolveLibrary no longer honors a hand-typed library_id outside the visible set. - Annotation/note/bookmark mutations (update/delete/tombstone, sync LWW paths incl. conflict resolution) carry ownership predicates: another account's bare row id is a 404, not a silent delete. - Admin user creation: POST /api/auth/users (AdminMiddleware) + a Create User card in the admin Users UI — accounts stay creatable with self-service registration OFF, which is now the schema default (fresh installs; the first-admin bootstrap exception is unchanged). - Tests: series contract re-pinned (per-library, visibility 403s), new ownership + admin-create integration suites, OPDS all=1 test now passes an explicit page size (shared-DB growth made the fresh books fall off page 1), device-cap helper switched to the admin endpoint.
173 lines
5.8 KiB
Go
173 lines
5.8 KiB
Go
package services
|
|
|
|
import (
|
|
"bookhoard/internal/database"
|
|
"bookhoard/internal/utils"
|
|
"context"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
)
|
|
|
|
type SeriesInfo struct {
|
|
Name string
|
|
LibraryID string
|
|
BookCount int64
|
|
TotalInSeries int
|
|
CoverPaths []string
|
|
LastEntryAt string
|
|
}
|
|
|
|
type SeriesService struct {
|
|
db *database.Queries
|
|
}
|
|
|
|
func NewSeriesService(db *database.Queries) *SeriesService {
|
|
return &SeriesService{db: db}
|
|
}
|
|
|
|
// GetSeriesPage lists series grouped PER LIBRARY (same name in two
|
|
// libraries = two entries) filtered to the requester's visible libraries.
|
|
// Pass libraryID for a single-library page, or leave it invalid and pass
|
|
// visibleLibraryIDs for an across-my-libraries page. Both filters compose:
|
|
// the handler validates any explicit library_id against the visible set.
|
|
func (s *SeriesService) GetSeriesPage(ctx context.Context, libraryID pgtype.UUID, visibleLibraryIDs []pgtype.UUID, limit, offset int) ([]SeriesInfo, int, error) {
|
|
totalCount, err := s.db.GetDistinctSeriesCount(ctx, database.GetDistinctSeriesCountParams{
|
|
LibraryID: libraryID,
|
|
VisibleLibraryIds: visibleLibraryIDs,
|
|
})
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
|
|
rows, err := s.db.GetDistinctSeries(ctx, database.GetDistinctSeriesParams{
|
|
LibraryID: libraryID,
|
|
VisibleLibraryIds: visibleLibraryIDs,
|
|
Limit: pgtype.Int4{Int32: int32(limit), Valid: true},
|
|
Offset: pgtype.Int4{Int32: int32(offset), Valid: true},
|
|
})
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
|
|
var series []SeriesInfo
|
|
for _, row := range rows {
|
|
seriesName := row.Series.String
|
|
coverPaths, _ := s.GetSeriesCovers(ctx, row.LibraryID, seriesName, 7)
|
|
|
|
totalInSeries := 0
|
|
if row.TotalInSeries != nil {
|
|
if v, ok := row.TotalInSeries.(int32); ok {
|
|
totalInSeries = int(v)
|
|
} else if v, ok := row.TotalInSeries.(int64); ok {
|
|
totalInSeries = int(v)
|
|
}
|
|
}
|
|
|
|
lastEntry := ""
|
|
if row.LastEntryAt != nil {
|
|
switch v := row.LastEntryAt.(type) {
|
|
case pgtype.Timestamptz:
|
|
if v.Valid {
|
|
lastEntry = v.Time.String()
|
|
}
|
|
case string:
|
|
lastEntry = v
|
|
}
|
|
}
|
|
|
|
if totalInSeries == 0 || totalInSeries < int(row.BookCount) {
|
|
totalInSeries = int(row.BookCount)
|
|
}
|
|
|
|
series = append(series, SeriesInfo{
|
|
Name: seriesName,
|
|
LibraryID: uuidFromPG(row.LibraryID),
|
|
BookCount: row.BookCount,
|
|
TotalInSeries: totalInSeries,
|
|
CoverPaths: coverPaths,
|
|
LastEntryAt: lastEntry,
|
|
})
|
|
}
|
|
|
|
if series == nil {
|
|
series = []SeriesInfo{}
|
|
}
|
|
|
|
return series, int(totalCount), nil
|
|
}
|
|
|
|
func (s *SeriesService) GetSeriesCovers(ctx context.Context, libraryID pgtype.UUID, seriesName string, limit int) ([]string, error) {
|
|
covers, err := s.db.GetSeriesCovers(ctx, database.GetSeriesCoversParams{
|
|
LibraryID: libraryID,
|
|
Series: pgtype.Text{String: seriesName, Valid: true},
|
|
Limit: pgtype.Int4{Int32: int32(limit), Valid: true},
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
paths := make([]string, 0, len(covers))
|
|
for _, c := range covers {
|
|
resolved := utils.ResolveMediaURL(c.LibraryID, c.CoverImagePath)
|
|
if resolved != "" {
|
|
paths = append(paths, resolved)
|
|
}
|
|
}
|
|
|
|
return paths, nil
|
|
}
|
|
|
|
func (s *SeriesService) GetSeriesBooks(ctx context.Context, libraryID pgtype.UUID, seriesName string) ([]database.MediaItems, error) {
|
|
return s.db.GetSeriesBooks(ctx, database.GetSeriesBooksParams{
|
|
Series: pgtype.Text{String: seriesName, Valid: true},
|
|
LibraryID: libraryID,
|
|
})
|
|
}
|
|
|
|
// VisibleLibraries exposes the per-user visibility set used by the series
|
|
// handlers to scope listings and validate explicit library_id params.
|
|
func (s *SeriesService) VisibleLibraries(ctx context.Context, userID pgtype.UUID) ([]database.GetUserVisibleLibrariesRow, error) {
|
|
return s.db.GetUserVisibleLibraries(ctx, userID)
|
|
}
|
|
|
|
func uuidFromPG(id pgtype.UUID) string {
|
|
if !id.Valid {
|
|
return ""
|
|
}
|
|
u, err := uuid.FromBytes(id.Bytes[0:16])
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return u.String()
|
|
}
|
|
|
|
func continueSeriesRowToMediaItems(row database.GetContinueSeriesItemsRow) database.MediaItems {
|
|
return database.MediaItems{
|
|
ID: row.ID, LibraryID: row.LibraryID, Title: row.Title, Author: row.Author,
|
|
Isbn: row.Isbn, Description: row.Description, FilePath: row.FilePath,
|
|
FileSize: row.FileSize, MimeType: row.MimeType, CoverImagePath: row.CoverImagePath,
|
|
Series: row.Series, SeriesNumber: row.SeriesNumber, Tags: row.Tags, Asin: row.Asin,
|
|
DatePublished: row.DatePublished, Publisher: row.Publisher, Contributors: row.Contributors,
|
|
Language: row.Language, Edition: row.Edition, PageCount: row.PageCount,
|
|
Genre: row.Genre, CopyrightYear: row.CopyrightYear, GoodreadsID: row.GoodreadsID,
|
|
OpenlibraryID: row.OpenlibraryID, GoogleBooksID: row.GoogleBooksID,
|
|
AddedByAdminID: row.AddedByAdminID, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt,
|
|
FormatGroup: row.FormatGroup, FormatMimetype: row.FormatMimetype,
|
|
IsReflowable: row.IsReflowable, HasFixedLayout: row.HasFixedLayout,
|
|
TotalCharacters: row.TotalCharacters, ChapterCount: row.ChapterCount,
|
|
EntitlementID: row.EntitlementID, RevisionNumber: row.RevisionNumber,
|
|
KoboContentID: row.KoboContentID, KoboMetadata: row.KoboMetadata,
|
|
MangaType: row.MangaType, ReadingDirection: row.ReadingDirection,
|
|
SeriesCount: row.SeriesCount, Volume: row.Volume, Imprint: row.Imprint,
|
|
AgeRating: row.AgeRating, WebUrl: row.WebUrl, StoryArc: row.StoryArc,
|
|
IsBlackAndWhite: row.IsBlackAndWhite, MetadataNotes: row.MetadataNotes,
|
|
CommunityRating: row.CommunityRating, AlternateInfo: row.AlternateInfo,
|
|
ScanInformation: row.ScanInformation, Summary: row.Summary,
|
|
ChapterMetadata: row.ChapterMetadata, LibraryTypeName: row.LibraryTypeName,
|
|
TagsSearch: row.TagsSearch, ContributorsSearch: row.ContributorsSearch,
|
|
FileSha256: row.FileSha256, OpfIdentifier: row.OpfIdentifier,
|
|
OpfUuid: row.OpfUuid, HashConfidence: row.HashConfidence,
|
|
}
|
|
}
|