@digitalpaws/starr 0.0.1

package/src/web/routes/library-management.ts

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type { FastifyPluginAsync } from "fastify";
+import type { LibraryService, LibraryInput } from "../../library/library-service.js";
+
+let libraryService: LibraryService | null = null;
+
+export function initLibraryManagementRoutes(ls: LibraryService): void {
+  libraryService = ls;
+}
+
+function requireAdmin(request: any, reply: any): boolean {
+  const user = (request as any).user;
+  if (!user || user.role !== "admin") {
+    reply.status(403).send({ error: "Forbidden: admin role required" });
+    return false;
+  }
+  return true;
+}
+
+const libraryManagementRoutes: FastifyPluginAsync = async (server) => {
+  // GET /api/libraries — list all libraries
+  server.get("/api/libraries", async (request, reply) => {
+    if (!requireAdmin(request, reply)) return;
+    if (!libraryService) {
+      reply.status(500).send({ error: "library service not available" });
+      return;
+    }
+    const libraries = libraryService.list();
+    return { libraries };
+  });
+
+  // POST /api/libraries — create a new library
+  server.post<{ Body: LibraryInput }>(
+    "/api/libraries",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      try {
+        const lib = libraryService.create(request.body);
+        reply.status(201).send(lib);
+      } catch (err: any) {
+        reply.status(400).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/libraries/:id — get a single library (including content type defaults)
+  server.get<{ Params: { id: string } }>(
+    "/api/libraries/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      const lib = libraryService.get(request.params.id);
+      if (!lib) {
+        reply.status(404).send({ error: "library not found" });
+        return;
+      }
+      const contentTypes = libraryService.getContentTypeDefaults(request.params.id);
+      return { ...lib, contentTypeDefaults: contentTypes };
+    },
+  );
+
+  // PUT /api/libraries/:id — update a library
+  server.put<{ Params: { id: string }; Body: LibraryInput }>(
+    "/api/libraries/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      try {
+        const lib = libraryService.update(request.params.id, request.body);
+        return lib;
+      } catch (err: any) {
+        reply.status(400).send({ error: err.message });
+      }
+    },
+  );
+
+  // DELETE /api/libraries/:id — delete a library
+  server.delete<{ Params: { id: string } }>(
+    "/api/libraries/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      try {
+        libraryService.delete(request.params.id);
+        return { deleted: true };
+      } catch (err: any) {
+        reply.status(400).send({ error: err.message });
+      }
+    },
+  );
+
+  // PUT /api/libraries/:id/content-types — set content type defaults for a library
+  server.put<{ Params: { id: string }; Body: { contentTypeIds: string[] } }>(
+    "/api/libraries/:id/content-types",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      try {
+        libraryService.setContentTypeDefaults(request.params.id, request.body.contentTypeIds);
+        return { ok: true };
+      } catch (err: any) {
+        reply.status(400).send({ error: err.message });
+      }
+    },
+  );
+
+  // GET /api/libraries/:id/content-types — get content type defaults for a library
+  server.get<{ Params: { id: string } }>(
+    "/api/libraries/:id/content-types",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!libraryService) {
+        reply.status(500).send({ error: "library service not available" });
+        return;
+      }
+      const defaults = libraryService.getContentTypeDefaults(request.params.id);
+      return { contentTypeIds: defaults };
+    },
+  );
+};
+
+export default libraryManagementRoutes;

package/src/web/routes/library.ts

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type { FastifyPluginAsync } from "fastify";
+import type { LibraryCache } from "../../library/library-cache.js";
+
+let cache: LibraryCache | null = null;
+
+export function initLibraryRoutes(lc: LibraryCache): void {
+  cache = lc;
+}
+
+const libraryRoutes: FastifyPluginAsync = async (server) => {
+  // GET /api/library/items — list imported/library items
+  server.get<{
+    Querystring: {
+      type?: string;
+      offset?: string;
+      limit?: string;
+    };
+  }>(
+    "/api/library/items",
+    async (request, reply) => {
+      if (!cache) {
+        reply.status(500).send({ error: "library cache not available" });
+        return;
+      }
+
+      const contentTypeId = request.query.type || undefined;
+      const offset = parseInt(request.query.offset ?? "0", 10) || 0;
+      const limit = parseInt(request.query.limit ?? "50", 10) || 50;
+
+      const allItems = cache.getItems(contentTypeId);
+      const paged = allItems.slice(offset, offset + limit);
+
+      return {
+        items: paged,
+        total: allItems.length,
+        offset,
+        limit,
+      };
+    },
+  );
+};
+
+export default libraryRoutes;

package/src/web/routes/oidc.ts

@@ -0,0 +1,260 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type { FastifyPluginAsync } from "fastify";
+import type { AuthService } from "../../auth/auth-service.js";
+import type { OidcProviderService } from "../../auth/oidc/oidc-provider-service.js";
+import type { OidcFlow } from "../../auth/oidc/oidc-flow.js";
+import type { UserService } from "../../auth/oidc/user-service.js";
+import { rateLimit } from "../../auth/rate-limiter.js";
+
+let authService: AuthService | null = null;
+let oidcProviderService: OidcProviderService | null = null;
+let oidcFlow: OidcFlow | null = null;
+let userService: UserService | null = null;
+
+export function initOidcRoutes(
+  auth: AuthService,
+  oidcProviders: OidcProviderService,
+  flow: OidcFlow,
+  users: UserService,
+): void {
+  authService = auth;
+  oidcProviderService = oidcProviders;
+  oidcFlow = flow;
+  userService = users;
+}
+
+const SESSION_COOKIE = "starr_sid";
+const COOKIE_OPTS = {
+  httpOnly: true,
+  sameSite: "strict" as const,
+  path: "/",
+  secure: false,
+  maxAge: parseInt(process.env.STARR_SESSION_TTL_HOURS ?? "168", 10) * 3600,
+};
+
+const oidcRoutes: FastifyPluginAsync = async (server) => {
+  // ── Public OIDC endpoints (no auth required) ──
+
+  // GET /api/oidc/providers — list enabled OIDC providers (for login page)
+  server.get("/api/oidc/providers", async (_request, reply) => {
+    if (!oidcProviderService) {
+      reply.status(500).send({ error: "OIDC service not available" });
+      return;
+    }
+    return { providers: oidcProviderService.listEnabled() };
+  });
+
+  // GET /api/oidc/login/:providerId — initiate OIDC login (rate-limited)
+  server.get<{ Params: { providerId: string } }>(
+    "/api/oidc/login/:providerId",
+    { preHandler: rateLimit(10, 1) },
+    async (request, reply) => {
+      if (!oidcFlow) {
+        reply.status(500).send({ error: "OIDC flow not available" });
+        return;
+      }
+
+      try {
+        const query = request.query as Record<string, string>;
+        const redirectTo = query?.redirect ?? "/browse";
+        const authUrl = await oidcFlow.initiateLogin(
+          request.params.providerId,
+          redirectTo,
+        );
+        // Redirect the browser to the OIDC provider
+        reply.redirect(authUrl, 302);
+      } catch (err: any) {
+        reply.status(400).send({ error: err.message ?? "Failed to initiate OIDC login" });
+      }
+    },
+  );
+
+  // GET /api/oidc/callback/:providerId — OIDC callback (rate-limited)
+  server.get<{
+    Params: { providerId: string };
+    Querystring: { code?: string; state?: string };
+  }>(
+    "/api/oidc/callback/:providerId",
+    { preHandler: rateLimit(20, 1) },
+    async (request, reply) => {
+      if (!oidcFlow || !authService) {
+        reply.status(500).send({ error: "OIDC service not available" });
+        return;
+      }
+
+      const { code, state } = request.query;
+      if (!code || !state) {
+        reply.status(400).send({ error: "Missing code or state parameter" });
+        return;
+      }
+
+      try {
+        const { user, redirectTo } = await oidcFlow.handleCallback(
+          request.params.providerId,
+          code,
+          state,
+        );
+
+        // Create a Starr session (JWT) for the user
+        const jwt = authService.loginOidc(user.id, user.role);
+        reply.setCookie(SESSION_COOKIE, jwt, COOKIE_OPTS);
+
+        // Redirect to the original target page (or /browse by default)
+        reply.redirect(redirectTo, 302);
+      } catch (err: any) {
+        reply.status(401).send({ error: err.message ?? "OIDC login failed" });
+      }
+    },
+  );
+
+  /** Reusable admin-role guard for admin-only routes. */
+  function requireAdmin(request: any, reply: any): boolean {
+    const user = (request as any).user;
+    if (!user) {
+      reply.status(401).send({ error: "Unauthorized" });
+      return false;
+    }
+    if (user.role !== "admin") {
+      reply.status(403).send({ error: "Forbidden: admin role required" });
+      return false;
+    }
+    return true;
+  }
+
+  // ── Admin OIDC provider management (auth required, admin-only) ──
+
+  // GET /api/auth/oidc/providers — list all providers (secrets masked)
+  server.get("/api/auth/oidc/providers", async (request, reply) => {
+    if (!requireAdmin(request, reply)) return;
+    if (!oidcProviderService) {
+      reply.status(500).send({ error: "Service not available" });
+      return;
+    }
+    const providers = oidcProviderService.list();
+    const masked = providers.map((p) => ({
+      ...p,
+      clientSecret: p.clientSecret ? "••••••••" : "",
+    }));
+    return { providers: masked };
+  });
+
+  // GET /api/auth/oidc/providers/:id — get single provider
+  server.get<{ Params: { id: string } }>(
+    "/api/auth/oidc/providers/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!oidcProviderService) {
+        reply.status(500).send({ error: "Service not available" });
+        return;
+      }
+      const provider = oidcProviderService.get(request.params.id);
+      if (!provider) {
+        reply.status(404).send({ error: "Provider not found" });
+        return;
+      }
+      return {
+        ...provider,
+        clientSecret: provider.clientSecret ? "••••••••" : "",
+      };
+    },
+  );
+
+  // POST /api/auth/oidc/providers — create provider
+  server.post("/api/auth/oidc/providers", async (request, reply) => {
+    if (!requireAdmin(request, reply)) return;
+    if (!oidcProviderService) {
+      reply.status(500).send({ error: "Service not available" });
+      return;
+    }
+    try {
+      const provider = oidcProviderService.create(request.body as any);
+      reply.status(201).send({ ...provider, clientSecret: "••••••••" });
+    } catch (err: any) {
+      reply.status(400).send({ error: err.message ?? "Failed to create provider" });
+    }
+  });
+
+  // PUT /api/auth/oidc/providers/:id — update provider
+  server.put<{ Params: { id: string } }>(
+    "/api/auth/oidc/providers/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!oidcProviderService) {
+        reply.status(500).send({ error: "Service not available" });
+        return;
+      }
+      const provider = oidcProviderService.update(
+        request.params.id,
+        request.body as any,
+      );
+      if (!provider) {
+        reply.status(404).send({ error: "Provider not found" });
+        return;
+      }
+      return { ...provider, clientSecret: "••••••••" };
+    },
+  );
+
+  // DELETE /api/auth/oidc/providers/:id — delete provider
+  server.delete<{ Params: { id: string } }>(
+    "/api/auth/oidc/providers/:id",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!oidcProviderService) {
+        reply.status(500).send({ error: "Service not available" });
+        return;
+      }
+      const deleted = oidcProviderService.delete(request.params.id);
+      if (!deleted) {
+        reply.status(404).send({ error: "Provider not found" });
+        return;
+      }
+      return { ok: true };
+    },
+  );
+
+  // ── Admin user management ──
+
+  // GET /api/auth/users — list all users
+  server.get("/api/auth/users", async (request, reply) => {
+    if (!requireAdmin(request, reply)) return;
+    if (!userService) {
+      reply.status(500).send({ error: "Service not available" });
+      return;
+    }
+    return { users: userService.list() };
+  });
+
+  // PATCH /api/auth/users/:id/role — change user role
+  server.patch<{ Params: { id: string }; Body: { role: "admin" | "user" } }>(
+    "/api/auth/users/:id/role",
+    async (request, reply) => {
+      if (!requireAdmin(request, reply)) return;
+      if (!userService) {
+        reply.status(500).send({ error: "Service not available" });
+        return;
+      }
+
+      const { role } = request.body;
+      if (role !== "admin" && role !== "user") {
+        reply.status(400).send({ error: "Role must be 'admin' or 'user'" });
+        return;
+      }
+
+      try {
+        const user = userService.setRole(request.params.id, role);
+        if (!user) {
+          reply.status(404).send({ error: "User not found" });
+          return;
+        }
+        return { user };
+      } catch (err: any) {
+        reply.status(403).send({ error: err.message ?? "Failed to change role" });
+      }
+    },
+  );
+};
+
+export default oidcRoutes;

package/src/web/routes/requests.ts

@@ -0,0 +1,250 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type { FastifyPluginAsync } from "fastify";
+import type { ContentItemBase } from "@digitalpaws/starr-types-core";
+import type { Starr } from "../../host.js";
+import { requestIntake } from "../../state/request-intake.js";
+
+/**
+ * In-memory debounce map to prevent rapid retries.
+ * Maps requestId → timestamp of last retry.
+ */
+const retryDebounceMap = new Map<string, number>();
+const RETRY_DEBOUNCE_MS = 10_000; // 10 seconds
+
+class RouteError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+  }
+}
+
+/**
+ * Retry a failed or missing content request.
+ *
+ * 1. Look up the TrackedRequest; 404 if not found.
+ * 2. Check status guards: must be 'failed' or 'downloaded'.
+ * 3. Debounce: reject if retried within 10 seconds.
+ * 4. Reset the request status and emit a fresh content.requested.
+ *
+ * Returns the updated request.
+ */
+async function retryRequest(
+  requestId: string,
+  userId: string,
+  starr: Starr,
+): Promise<{ requestId: string; status: string }> {
+  const stateStore = starr.getStateStore();
+  const logger = starr.logger;
+
+  // 1. Look up the request
+  const req = stateStore.getByRequestId(requestId);
+  if (!req) {
+    throw new RouteError(404, "Request not found");
+  }
+
+  // 2. Status guard: only failed or downloaded can be retried
+  if (req.status === "searching" || req.status === "downloading" || req.status === "requested") {
+    throw new RouteError(
+      409,
+      `Cannot retry request in status "${req.status}". Wait for the current run to finish.`,
+    );
+  }
+
+  // 3. Debounce check
+  const now = Date.now();
+  const lastRetry = retryDebounceMap.get(requestId);
+  if (lastRetry && now - lastRetry < RETRY_DEBOUNCE_MS) {
+    const remaining = Math.ceil((RETRY_DEBOUNCE_MS - (now - lastRetry)) / 1000);
+    throw new RouteError(
+      429,
+      `Please wait ${remaining}s before retrying again.`,
+    );
+  }
+  retryDebounceMap.set(requestId, now);
+
+  // Cleanup stale entries from debounce map (older than 1 minute)
+  for (const [key, ts] of retryDebounceMap) {
+    if (now - ts > 60_000) retryDebounceMap.delete(key);
+  }
+
+  logger.info("manual retry initiated", {
+    requestId,
+    previousStatus: req.status,
+    userId,
+  });
+
+  // 4. Reset and re-emit
+  stateStore.resetAndRetry(requestId);
+
+  // Re-emit content.requested to restart the pipeline
+  starr.coreBus.emit("content.requested", {
+    requestId,
+    userId: req.ownerUserId,
+    contentTypeId: req.contentTypeId,
+    item: req.item,
+    libraryId: req.libraryId,
+  });
+
+  return { requestId, status: "requested" };
+}
+
+let starrInstance: Starr | null = null;
+
+export function initRequestRoutes(starr: Starr): void {
+  starrInstance = starr;
+}
+
+const requestRoutes: FastifyPluginAsync = async (server) => {
+  // POST /api/requests — create a content request
+  server.post<{ Body: ContentItemBase }>(
+    "/api/requests",
+    async (request, reply) => {
+      if (!starrInstance) {
+        reply.status(500).send({ error: "host not available" });
+        return;
+      }
+
+      const item = request.body;
+      const user = (request as any).user;
+
+      if (!item || !item.contentTypeId || !item.title) {
+        reply.status(400).send({ error: "invalid content item" });
+        return;
+      }
+
+      const stateStore = starrInstance.getStateStore();
+      const registry = starrInstance.contentTypeRegistry;
+      const libraryService = starrInstance.libraryService ?? undefined;
+
+      try {
+        const requestId = requestIntake(
+          { userId: user.username, item },
+          stateStore,
+          registry,
+          starrInstance.coreBus,
+          starrInstance.logger,
+          libraryService,
+        );
+
+        // Check if this was a new request or re-attach to existing
+        const req = stateStore.getByRequestId(requestId);
+        const existing = req && req.ownerUserId !== user.username;
+
+        reply.status(201).send({ requestId, existing });
+      } catch (err: any) {
+        reply.status(500).send({ error: String(err) });
+      }
+    },
+  );
+
+  // GET /api/requests — list tracked requests
+  server.get("/api/requests", async (request, reply) => {
+    if (!starrInstance) {
+      reply.status(500).send({ error: "host not available" });
+      return;
+    }
+
+    const user = (request as any).user;
+    const stateStore = starrInstance.getStateStore();
+
+    if (user.role === "admin") {
+      // Admin sees all requests
+      const requests = stateStore.getAllRequests();
+      return { requests };
+    } else {
+      // Regular user sees only their own + watched
+      const requests = stateStore.listByUser(user.username);
+      return { requests };
+    }
+  });
+
+  // GET /api/requests/:id — get single request detail
+  server.get<{ Params: { id: string } }>(
+    "/api/requests/:id",
+    async (request, reply) => {
+      if (!starrInstance) {
+        reply.status(500).send({ error: "host not available" });
+        return;
+      }
+
+      const req = starrInstance.getStateStore().getByRequestId(request.params.id);
+      if (!req) {
+        reply.status(404).send({ error: "request not found" });
+        return;
+      }
+      return req;
+    },
+  );
+
+  // POST /api/requests/:id/retry — manually retry a failed or missing request
+  server.post<{ Params: { id: string } }>(
+    "/api/requests/:id/retry",
+    async (request, reply) => {
+      if (!starrInstance) {
+        reply.status(500).send({ error: "host not available" });
+        return;
+      }
+
+      const requestId = request.params.id;
+      const user = (request as any).user;
+
+      try {
+        const result = await retryRequest(
+          requestId,
+          user.username,
+          starrInstance,
+        );
+        return result;
+      } catch (err: any) {
+        if (err.status && err.message) {
+          reply.status(err.status).send({ error: err.message });
+        } else {
+          reply.status(500).send({ error: String(err) });
+        }
+      }
+    },
+  );
+
+  // DELETE /api/requests/:id — permanently remove a request
+  server.delete<{ Params: { id: string } }>(
+    "/api/requests/:id",
+    async (request, reply) => {
+      if (!starrInstance) {
+        reply.status(500).send({ error: "host not available" });
+        return;
+      }
+
+      const requestId = request.params.id;
+      const user = (request as any).user;
+      const stateStore = starrInstance.getStateStore();
+
+      const req = stateStore.getByRequestId(requestId);
+      if (!req) {
+        reply.status(404).send({ error: "Request not found" });
+        return;
+      }
+
+      const previousStatus = req.status;
+      stateStore.deleteRequest(requestId);
+
+      // Notify plugins so they can clean up storage and cancel in-flight operations
+      starrInstance.coreBus.emit("request.deleted", {
+        requestId,
+        previousStatus,
+      });
+
+      starrInstance.logger.info("request deleted via API", {
+        requestId,
+        userId: user.username,
+        previousStatus,
+      });
+
+      return { deleted: true, requestId };
+    },
+  );
+};
+
+export default requestRoutes;