Files
bookhoard/web/src/series.ts
T
John O'Keefe 431fec05ad feat(security): library visibility enforced at the source; per-library series; annotation ownership; admin user creation
The family-lens hardening: library_visibility was only enforced where
file bytes flowed (download/reader/OPDS) — metadata surfaces leaked
hidden libraries to any authenticated account, and registration was
open by default with no admin-side user creation.

- Series are grouped PER LIBRARY now (same name in two libraries =
  two entries: manga adaptations / LN splits no longer merge);
  /api/series aggregates only the requester's VISIBLE libraries and
  /api/series/books REQUIRES a visible library_id (breaking contract;
  web + app clients updated in the same change).
- /api/media-items, item detail, and the reader content endpoints
  (chapters/panels/outline/THUMBNAILS — page images leaked unguarded
  next to a gated GetPage) all enforce the visible set; resolveLibrary
  no longer honors a hand-typed library_id outside the visible set.
- Annotation/note/bookmark mutations (update/delete/tombstone, sync
  LWW paths incl. conflict resolution) carry ownership predicates:
  another account's bare row id is a 404, not a silent delete.
- Admin user creation: POST /api/auth/users (AdminMiddleware) + a
  Create User card in the admin Users UI — accounts stay creatable
  with self-service registration OFF, which is now the schema default
  (fresh installs; the first-admin bootstrap exception is unchanged).
- Tests: series contract re-pinned (per-library, visibility 403s),
  new ownership + admin-create integration suites, OPDS all=1 test
  now passes an explicit page size (shared-DB growth made the fresh
  books fall off page 1), device-cap helper switched to the admin
  endpoint.
2026-10-13 12:03:01 -04:00

129 lines
4.5 KiB
TypeScript

import { Alpine } from "./alpine";
import { showToast } from "./toast";
import { initLibrarySwitcher, switchWithTransition } from "./library-switcher";
interface SeriesItem {
name: string;
library_id: string;
book_count: number;
total_in_series: number;
cover_paths: string[];
last_entry_at: string;
}
function renderSeriesCard(series: SeriesItem): string {
const href = `/series/detail?name=${encodeURIComponent(series.name)}&library_id=${encodeURIComponent(series.library_id ?? "")}`;
const coverCount = series.cover_paths.length;
const coverClass = `cover-count-${coverCount}`;
let coversHtml = "";
for (let i = 0; i < coverCount; i++) {
coversHtml += `<img src="${series.cover_paths[i]}" class="cover-img cover-${i}" alt="${series.name}" loading="lazy" onerror="this.src='/static/placeholder-book.svg'">`;
}
if (coverCount === 0) {
coversHtml = `<div class="cover-img cover-0 flex items-center justify-center" style="background: var(--bg-primary);"><span class="text-3xl">📚</span></div>`;
}
return `
<a href="${href}" class="block">
<div class="series-card rounded-lg overflow-hidden cursor-pointer hover:shadow-lg transition-shadow" style="background-color: var(--bg-secondary);">
<div class="stacked-covers ${coverClass}">
${coversHtml}
</div>
<div class="series-card-info px-3 py-2">
<h3 class="font-semibold text-sm line-clamp-2" style="color: var(--text-primary)">${series.name}</h3>
<p class="text-xs mt-1" style="color: var(--text-secondary)">
${series.book_count} of ${series.total_in_series} books
</p>
</div>
</div>
</a>`;
}
function renderSeriesContent(
seriesList: SeriesItem[],
libraryId: string,
totalPages: number,
currentPage: number,
): string {
if (seriesList.length === 0) {
return `
<main class="w-full px-4 py-8">
<h1 class="text-3xl font-bold mb-6" style="color: var(--text-primary)">Series</h1>
<div class="text-center py-16" style="color: var(--text-secondary)">
<div class="text-6xl mb-4">📚</div>
<h3 class="text-xl font-semibold mb-2" style="color: var(--text-primary)">No Series Found</h3>
<p>Books with series metadata will appear here</p>
</div>
</main>`;
}
const cardsHtml = seriesList.map((s) => renderSeriesCard(s)).join("");
let paginationHtml = "";
if (totalPages > 1) {
const libParam = libraryId ? `library_id=${libraryId}&` : "";
const prevLink =
currentPage > 1
? `<a href="/series?${libParam}page=${currentPage - 1}" class="px-4 py-2 rounded-lg border" style="border-color: var(--border); color: var(--text-primary);">← Previous</a>`
: "";
const nextLink =
currentPage < totalPages
? `<a href="/series?${libParam}page=${currentPage + 1}" class="px-4 py-2 rounded-lg border" style="border-color: var(--border); color: var(--text-primary);">Next →</a>`
: "";
paginationHtml = `
<div class="flex justify-center items-center gap-4 mt-8">
${prevLink}
<span class="text-sm" style="color: var(--text-secondary)">Page ${currentPage} of ${totalPages}</span>
${nextLink}
</div>`;
}
return `
<main class="w-full px-4 py-8">
<h1 class="text-3xl font-bold mb-6" style="color: var(--text-primary)">Series</h1>
<div class="grid grid-cols-2 md:grid-cols-4 lg:grid-cols-6 gap-6">
${cardsHtml}
</div>
${paginationHtml}
</main>`;
}
async function switchLibrary(libraryId: string): Promise<void> {
await switchWithTransition("series-container", async () => {
const param = libraryId ? `library_id=${libraryId}&` : "";
const response = await fetch(
`/api/series?${param}limit=24&offset=0`,
{
headers: {
Authorization: `Bearer ${localStorage.getItem("token")}`,
"Content-Type": "application/json",
},
},
);
if (!response.ok) {
throw new Error("Failed to load series");
}
const data = await response.json();
const seriesList: SeriesItem[] = data.series || [];
const total: number = data.total || 0;
const totalPages = Math.max(1, Math.ceil(total / 24));
const container = document.getElementById("series-container");
if (container) {
container.innerHTML = renderSeriesContent(seriesList, libraryId, totalPages, 1);
}
});
}
Alpine.data("seriesPage", () => ({
initSeriesPage() {
initLibrarySwitcher({
onSwitch: switchLibrary,
});
},
}));