@serifpersia/dango 3.3.4

package/server/dist/app-auth.js

@@ -0,0 +1,177 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { CONFIG } from './config.js';
+export const LAN_AUTH_COOKIE = 'dango_lan_auth';
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function sessionsFile() {
+    return path.join(CONFIG.ROOT, 'lan_sessions.json');
+}
+function loadSessions() {
+    try {
+        if (!fs.existsSync(sessionsFile()))
+            return {};
+        const raw = fs.readFileSync(sessionsFile(), 'utf8');
+        const parsed = JSON.parse(raw);
+        const now = Date.now();
+        let dirty = false;
+        for (const [token, expiry] of Object.entries(parsed)) {
+            if (typeof expiry !== 'number' || expiry < now) {
+                delete parsed[token];
+                dirty = true;
+            }
+        }
+        if (dirty)
+            saveSessions(parsed);
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function saveSessions(sessions) {
+    try {
+        fs.mkdirSync(CONFIG.ROOT, { recursive: true });
+        fs.writeFileSync(sessionsFile(), JSON.stringify(sessions));
+    }
+    catch {
+        // sessions won't be saved if disk write fails
+    }
+}
+export function getAppPasswordHash() {
+    return process.env.APP_PASSWORD_HASH || CONFIG.APP_PASSWORD_HASH || '';
+}
+export function hasAppPassword() {
+    return !!getAppPasswordHash();
+}
+export function hashAppPassword(password) {
+    const salt = crypto.randomBytes(16).toString('hex');
+    const hash = crypto.scryptSync(password, salt, 32).toString('hex');
+    return `scrypt:${salt}:${hash}`;
+}
+export function verifyAppPassword(password) {
+    const stored = getAppPasswordHash();
+    if (!stored)
+        return false;
+    const parts = stored.split(':');
+    if (parts.length !== 3 || parts[0] !== 'scrypt')
+        return false;
+    const [, salt, expectedHex] = parts;
+    try {
+        const derived = crypto.scryptSync(password, salt, 32);
+        const expected = Buffer.from(expectedHex, 'hex');
+        if (derived.length !== expected.length)
+            return false;
+        return crypto.timingSafeEqual(derived, expected);
+    }
+    catch {
+        return false;
+    }
+}
+export async function setAppPassword(password) {
+    const { updateEnvFile } = await import('./utils/env.utils.js');
+    if (!password) {
+        await updateEnvFile({ APP_PASSWORD_HASH: '' });
+        CONFIG.APP_PASSWORD_HASH = '';
+        return;
+    }
+    const hash = hashAppPassword(password);
+    await updateEnvFile({ APP_PASSWORD_HASH: hash });
+    CONFIG.APP_PASSWORD_HASH = hash;
+}
+export function createLanSession() {
+    const token = crypto.randomBytes(32).toString('hex');
+    const expiry = Date.now() + SESSION_TTL_MS;
+    const sessions = loadSessions();
+    sessions[token] = expiry;
+    saveSessions(sessions);
+    return { token, expiry };
+}
+export function validateLanSession(token) {
+    if (!token)
+        return false;
+    const sessions = loadSessions();
+    const expiry = sessions[token];
+    if (!expiry)
+        return false;
+    if (expiry < Date.now()) {
+        delete sessions[token];
+        saveSessions(sessions);
+        return false;
+    }
+    return true;
+}
+export function revokeLanSession(token) {
+    if (!token)
+        return;
+    const sessions = loadSessions();
+    if (sessions[token]) {
+        delete sessions[token];
+        saveSessions(sessions);
+    }
+}
+export function clearAllLanSessions() {
+    saveSessions({});
+}
+function normalizeIp(ip) {
+    if (!ip)
+        return '';
+    if (ip.startsWith('::ffff:'))
+        return ip.slice('::ffff:'.length);
+    return ip;
+}
+export function isLoopbackRequest(req) {
+    const candidates = [req.ip, req.socket?.remoteAddress].map((v) => normalizeIp(v));
+    return candidates.includes('127.0.0.1') || candidates.includes('::1');
+}
+export function getRequestToken(req) {
+    const auth = req.headers.authorization;
+    if (auth && auth.toLowerCase().startsWith('bearer ')) {
+        return auth.slice(7).trim() || null;
+    }
+    const cookieHeader = req.headers.cookie;
+    if (cookieHeader) {
+        const parts = cookieHeader.split(';');
+        for (const part of parts) {
+            const idx = part.indexOf('=');
+            if (idx === -1)
+                continue;
+            const name = part.slice(0, idx).trim();
+            if (name === LAN_AUTH_COOKIE) {
+                return decodeURIComponent(part.slice(idx + 1).trim()) || null;
+            }
+        }
+    }
+    return null;
+}
+export function isLanAuthenticated(req) {
+    if (!hasAppPassword())
+        return true;
+    return validateLanSession(getRequestToken(req));
+}
+const PUBLIC_PATHS = new Set([
+    '/api/auth/app-status',
+    '/api/auth/app-login',
+    '/api/auth/app-logout',
+    '/api/internal/shutdown',
+]);
+export function lanAuthMiddleware(req, res, next) {
+    if (!req.path.startsWith('/api/'))
+        return next();
+    if (PUBLIC_PATHS.has(req.path))
+        return next();
+    if (req.path.startsWith('/api/internal/') && isLoopbackRequest(req))
+        return next();
+    if (!hasAppPassword())
+        return next();
+    if (validateLanSession(getRequestToken(req)))
+        return next();
+    return res.status(401).json({ error: 'LAN_AUTH_REQUIRED' });
+}
+export function buildLanCookie(token, expiry) {
+    const maxAge = Math.max(1, Math.floor((expiry - Date.now()) / 1000));
+    return `${LAN_AUTH_COOKIE}=${encodeURIComponent(token)}; HttpOnly; Path=/; Max-Age=${maxAge}; SameSite=Lax`;
+}
+export function clearLanCookie() {
+    return `${LAN_AUTH_COOKIE}=; HttpOnly; Path=/; Max-Age=0; SameSite=Lax`;
+}

package/server/dist/config.js

@@ -0,0 +1,175 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import dotenv from 'dotenv';
+import { SHIPPED_DEFAULTS } from './shipped-defaults.js';
+export const SERVER_ROOT = path.resolve(import.meta.dirname, '..');
+const PACKAGE_ROOT = path.resolve(SERVER_ROOT, '..');
+function resolveDataRoot() {
+    if (process.platform === 'win32' && process.env.APPDATA) {
+        return path.join(process.env.APPDATA, 'dango');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(os.homedir(), 'Library', 'Application Support', 'dango');
+    }
+    if (process.env.XDG_DATA_HOME) {
+        return path.join(process.env.XDG_DATA_HOME, 'dango');
+    }
+    return path.join(os.homedir(), '.local', 'share', 'dango');
+}
+function moveFileIfNeeded(sourcePath, destinationPath) {
+    if (!fs.existsSync(sourcePath) || fs.existsSync(destinationPath)) {
+        return;
+    }
+    try {
+        fs.renameSync(sourcePath, destinationPath);
+    }
+    catch {
+        fs.copyFileSync(sourcePath, destinationPath);
+        fs.unlinkSync(sourcePath);
+    }
+}
+function migrateLegacyData(packageServerRoot, dataRoot) {
+    const legacyFiles = [
+        '.env',
+        'google_tokens.json',
+        'sync_manifest.json',
+        'sync_manifest.dev.json',
+        'anime.db',
+        'anime.db-shm',
+        'anime.db-wal',
+        'anime.dev.db',
+        'anime.dev.db-shm',
+        'anime.dev.db-wal',
+    ];
+    fs.mkdirSync(dataRoot, { recursive: true });
+    for (const filename of legacyFiles) {
+        moveFileIfNeeded(path.join(packageServerRoot, filename), path.join(dataRoot, filename));
+    }
+    // Manga library database + manifests (added after anime DB; migrate if present)
+    for (const filename of [
+        'manga.db',
+        'manga.db-shm',
+        'manga.db-wal',
+        'manga.dev.db',
+        'manga.dev.db-shm',
+        'manga.dev.db-wal',
+        'manga.sync_manifest.json',
+        'manga.sync_manifest.dev.json',
+        'tv.db',
+        'tv.db-shm',
+        'tv.db-wal',
+        'tv.dev.db',
+        'tv.dev.db-shm',
+        'tv.dev.db-wal',
+        'tv.sync_manifest.json',
+        'tv.sync_manifest.dev.json',
+        'asmr.db',
+        'asmr.db-shm',
+        'asmr.db-wal',
+        'asmr.dev.db',
+        'asmr.dev.db-shm',
+        'asmr.dev.db-wal',
+        'asmr.sync_manifest.json',
+        'asmr.sync_manifest.dev.json',
+    ]) {
+        moveFileIfNeeded(path.join(packageServerRoot, filename), path.join(dataRoot, filename));
+    }
+}
+function resolveLegacyDataRoot() {
+    if (process.platform === 'win32' && process.env.APPDATA) {
+        return path.join(process.env.APPDATA, 'ani-web');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(os.homedir(), 'Library', 'Application Support', 'ani-web');
+    }
+    if (process.env.XDG_DATA_HOME) {
+        return path.join(process.env.XDG_DATA_HOME, 'ani-web');
+    }
+    return path.join(os.homedir(), '.local', 'share', 'ani-web');
+}
+function migrateFromAniWeb(dataRoot) {
+    const legacyRoot = resolveLegacyDataRoot();
+    if (legacyRoot === dataRoot)
+        return;
+    if (!fs.existsSync(legacyRoot))
+        return;
+    const filesToMigrate = [
+        '.env',
+        'google_tokens.json',
+        'sync_manifest.json',
+        'sync_manifest.dev.json',
+        'anime.db',
+        'anime.db-shm',
+        'anime.db-wal',
+        'anime.dev.db',
+        'anime.dev.db-shm',
+        'anime.dev.db-wal',
+    ];
+    fs.mkdirSync(dataRoot, { recursive: true });
+    for (const filename of filesToMigrate) {
+        moveFileIfNeeded(path.join(legacyRoot, filename), path.join(dataRoot, filename));
+    }
+}
+const DATA_ROOT = resolveDataRoot();
+const ENV_PATH = path.join(DATA_ROOT, '.env');
+migrateLegacyData(SERVER_ROOT, DATA_ROOT);
+migrateFromAniWeb(DATA_ROOT);
+dotenv.config({ path: path.join(SERVER_ROOT, '.env') });
+dotenv.config({ path: ENV_PATH, override: true });
+const IS_DEV = process.argv.includes('--dev');
+const PORT = 3000;
+const HOST = process.env.HOST || '0.0.0.0';
+const GOOGLE_REDIRECT_URI = IS_DEV
+    ? 'http://localhost:5173/api/auth/google/callback'
+    : `http://localhost:${PORT}/api/auth/google/callback`;
+export const CONFIG = {
+    ROOT: DATA_ROOT,
+    SERVER_ROOT,
+    PACKAGE_ROOT,
+    ENV_PATH,
+    TOKEN_PATH: path.join(DATA_ROOT, 'google_tokens.json'),
+    LOCAL_MANIFEST_PATH: path.join(DATA_ROOT, IS_DEV ? 'sync_manifest.dev.json' : 'sync_manifest.json'),
+    MANGA_LOCAL_MANIFEST_PATH: path.join(DATA_ROOT, IS_DEV ? 'manga.sync_manifest.dev.json' : 'manga.sync_manifest.json'),
+    TV_LOCAL_MANIFEST_PATH: path.join(DATA_ROOT, IS_DEV ? 'tv.sync_manifest.dev.json' : 'tv.sync_manifest.json'),
+    ASMR_LOCAL_MANIFEST_PATH: path.join(DATA_ROOT, IS_DEV ? 'asmr.sync_manifest.dev.json' : 'asmr.sync_manifest.json'),
+    DB_NAME_PROD: 'anime.db',
+    DB_NAME_DEV: 'anime.dev.db',
+    MANGA_DB_NAME_PROD: 'manga.db',
+    MANGA_DB_NAME_DEV: 'manga.dev.db',
+    TV_DB_NAME_PROD: 'tv.db',
+    TV_DB_NAME_DEV: 'tv.dev.db',
+    ASMR_DB_NAME_PROD: 'asmr.db',
+    ASMR_DB_NAME_DEV: 'asmr.dev.db',
+    REMOTE_FOLDER_PROD: 'dango_db',
+    REMOTE_FOLDER_DEV: 'dango_dev_db',
+    MANIFEST_FILENAME: IS_DEV ? 'sync_manifest.dev.json' : 'sync_manifest.json',
+    GOOGLE_SCOPES: [
+        'https://www.googleapis.com/auth/drive.appdata',
+        'https://www.googleapis.com/auth/drive.file',
+        'https://www.googleapis.com/auth/userinfo.email',
+    ],
+    GOOGLE_SYNC_FILENAME: IS_DEV ? 'sync.dev.json' : 'sync.json',
+    MANGA_GOOGLE_SYNC_FILENAME: IS_DEV ? 'manga.sync.dev.json' : 'manga.sync.json',
+    TV_GOOGLE_SYNC_FILENAME: IS_DEV ? 'tv.sync.dev.json' : 'tv.sync.json',
+    ASMR_GOOGLE_SYNC_FILENAME: IS_DEV ? 'asmr.sync.dev.json' : 'asmr.sync.json',
+    RCLONE_SYNC_FILENAME: IS_DEV ? 'sync.dev.json' : 'sync.json',
+    MANGA_RCLONE_SYNC_FILENAME: IS_DEV ? 'manga.sync.dev.json' : 'manga.sync.json',
+    TV_RCLONE_SYNC_FILENAME: IS_DEV ? 'tv.sync.dev.json' : 'tv.sync.json',
+    ASMR_RCLONE_SYNC_FILENAME: IS_DEV ? 'asmr.sync.dev.json' : 'asmr.sync.json',
+    IS_DEV,
+    PORT,
+    HOST,
+    GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID,
+    GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,
+    GOOGLE_REDIRECT_URI: GOOGLE_REDIRECT_URI,
+    GOOGLE_AUTH_WORKER_URL: process.env.GOOGLE_AUTH_WORKER_URL || SHIPPED_DEFAULTS.GOOGLE_AUTH_WORKER_URL || '',
+    RCLONE_REMOTE: process.env.RCLONE_REMOTE,
+    SYNC_PROVIDER: process.env.SYNC_PROVIDER,
+    DISCORD_CLIENT_ID: process.env.DISCORD_CLIENT_ID || SHIPPED_DEFAULTS.DISCORD_CLIENT_ID || undefined,
+    DISCORD_ROLES_WORKER_URL: process.env.DISCORD_ROLES_WORKER_URL || SHIPPED_DEFAULTS.DISCORD_ROLES_WORKER_URL || '',
+    APP_PASSWORD_HASH: process.env.APP_PASSWORD_HASH || '',
+    PROVIDER_REPO_URL: process.env.PROVIDER_REPO_URL || SHIPPED_DEFAULTS.PROVIDER_REPO_URL || '',
+    PROVIDER_ENABLED: process.env.PROVIDER_ENABLED || '',
+    PROVIDER_REPO_REFRESH_MS: parseInt(process.env.PROVIDER_REPO_REFRESH_MS || '', 10) || 21600000,
+};

package/server/dist/controllers/asmr-library.controller.js

@@ -0,0 +1,288 @@
+import logger from '../logger.js';
+import { performAsmrWriteTransaction } from '../sync.js';
+import { dbAll } from '../utils/db-utils.js';
+import { SettingsRepository } from '../repositories/settings.repository.js';
+import { buildAsmrId, ASMR_STATUSES, AsmrLibraryRepository, AsmrProgressRepository, } from '../repositories/asmr.repository.js';
+function asmrDb(req) {
+    const db = req.asmrDb;
+    if (!db || db.isClosedCheck())
+        throw new Error('ASMR database is not ready');
+    return db;
+}
+export class AsmrLibraryController {
+    getLibrary = async (req, res) => {
+        try {
+            const { status, page: pageStr, limit: limitStr } = req.query;
+            const page = Math.max(parseInt(pageStr) || 1, 1);
+            const limit = Math.min(Math.max(parseInt(limitStr) || 24, 1), 100);
+            const offset = (page - 1) * limit;
+            const db = asmrDb(req);
+            const rows = AsmrLibraryRepository.getAll(db, status, limit, offset);
+            const total = AsmrLibraryRepository.getCount(db, status);
+            res.json({ data: rows, total, page, limit });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to get ASMR library');
+            res.status(500).json({ error: 'Failed to load listening list' });
+        }
+    };
+    checkLibrary = async (req, res) => {
+        try {
+            const item = AsmrLibraryRepository.getById(asmrDb(req), req.params.id);
+            res.json({ inLibrary: !!item, status: item?.status ?? null });
+        }
+        catch {
+            res.json({ inLibrary: false, status: null });
+        }
+    };
+    getLibraryIds = async (req, res) => {
+        try {
+            res.json({ ids: AsmrLibraryRepository.getIds(asmrDb(req)) });
+        }
+        catch {
+            res.json({ ids: [] });
+        }
+    };
+    addToLibrary = async (req, res) => {
+        const { rjCode, id: idRaw, title, thumbnail, status, isAdult } = req.body ?? {};
+        const rawCode = String(rjCode || idRaw || '').trim();
+        if (!rawCode) {
+            return res.status(400).json({ error: 'rjCode is required' });
+        }
+        const id = idRaw && String(idRaw).trim() ? buildAsmrId(String(idRaw)) : buildAsmrId(rawCode);
+        const cleanStatus = typeof status === 'string' && ASMR_STATUSES.includes(status)
+            ? status
+            : 'Listening';
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrLibraryRepository.upsert(tx, {
+                    id,
+                    rjCode: buildAsmrId(rawCode),
+                    title: String(title || ''),
+                    thumbnail: String(thumbnail || ''),
+                    status: cleanStatus,
+                    isAdult: isAdult === true || isAdult === 1,
+                });
+            });
+            res.json({ success: true, id });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to add ASMR work to library');
+            res.status(500).json({ error: 'Failed to add to listening list' });
+        }
+    };
+    removeFromLibrary = async (req, res) => {
+        const { id } = req.body ?? {};
+        if (!id)
+            return res.status(400).json({ error: 'id is required' });
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrLibraryRepository.delete(tx, String(id));
+                AsmrProgressRepository.deleteByWork(tx, String(id));
+            });
+            res.json({ success: true });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to remove ASMR work from library');
+            res.status(500).json({ error: 'Failed to remove from listening list' });
+        }
+    };
+    updateStatus = async (req, res) => {
+        const { id, status } = req.body ?? {};
+        if (!id || !ASMR_STATUSES.includes(status)) {
+            return res.status(400).json({ error: 'id and a valid status are required' });
+        }
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrLibraryRepository.updateStatus(tx, String(id), String(status));
+            });
+            res.json({ success: true });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to update ASMR status');
+            res.status(500).json({ error: 'Failed to update status' });
+        }
+    };
+    getProgress = async (req, res) => {
+        try {
+            const rows = AsmrProgressRepository.getByWork(asmrDb(req), req.params.workId);
+            res.json({ progress: rows });
+        }
+        catch {
+            res.json({ progress: [] });
+        }
+    };
+    getLatestProgress = async (req, res) => {
+        try {
+            const row = AsmrProgressRepository.getLatest(asmrDb(req), req.params.workId);
+            res.json(row || { currentTime: 0, duration: 0 });
+        }
+        catch {
+            res.json({ currentTime: 0, duration: 0 });
+        }
+    };
+    saveProgress = async (req, res) => {
+        const { workId, trackIndex, trackLabel, currentTime, duration, title, thumbnail, rjCode, isAdult, } = req.body ?? {};
+        if (!workId) {
+            return res.status(400).json({ error: 'workId is required' });
+        }
+        const trackIndexNum = Math.max(Math.round(Number(trackIndex)) || 0, 0);
+        const timeNum = Math.max(Number(currentTime) || 0, 0);
+        const durationNum = Math.max(Number(duration) || 0, 0);
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrProgressRepository.upsert(tx, {
+                    workId: String(workId),
+                    trackIndex: trackIndexNum,
+                    trackLabel: String(trackLabel || ''),
+                    currentTime: timeNum,
+                    duration: durationNum,
+                    title: title ?? null,
+                    thumbnail: thumbnail ?? null,
+                    rjCode: rjCode ?? null,
+                    isAdult: isAdult != null ? Number(isAdult) : null,
+                });
+                AsmrLibraryRepository.touchProgress(tx, String(workId), {
+                    trackIndex: trackIndexNum,
+                    trackLabel: String(trackLabel || ''),
+                    position: timeNum,
+                });
+            });
+            res.json({ success: true });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to save ASMR progress');
+            res.status(500).json({ error: 'Failed to save progress' });
+        }
+    };
+    getContinueListening = async (req, res) => {
+        try {
+            const limit = Math.min(Math.max(parseInt(req.query.limit) || 24, 1), 100);
+            const ignoreAdultRow = await SettingsRepository.getByKey(req.db, 'asmrIgnoreAdultContent');
+            const ignoreAdult = ignoreAdultRow ? ignoreAdultRow.value !== 'false' : true;
+            const listOnlyRow = await SettingsRepository.getByKey(req.db, 'asmrCwWatchlistOnly');
+            const listOnly = listOnlyRow
+                ? listOnlyRow.value === 'true' || listOnlyRow.value === '1'
+                : false;
+            const rows = AsmrProgressRepository.getContinueListening(asmrDb(req), limit).filter((row) => {
+                if (ignoreAdult && row.isAdult === 1)
+                    return false;
+                if (listOnly && row.watchlistStatus !== 'Listening')
+                    return false;
+                return true;
+            });
+            res.json({ data: rows, total: rows.length });
+        }
+        catch {
+            res.json({ data: [], total: 0 });
+        }
+    };
+    async getAdultNonListWorkIds(db) {
+        const rows = await dbAll(db, `SELECT DISTINCT p.workId as workId
+       FROM asmr_progress p
+       LEFT JOIN asmr_library l ON l.id = p.workId
+       WHERE COALESCE(l.isAdult, p.isAdult) = 1
+         AND l.id IS NULL`);
+        return rows.map((r) => r.workId);
+    }
+    getAdultContinueListeningCount = async (req, res) => {
+        try {
+            const ids = await this.getAdultNonListWorkIds(asmrDb(req));
+            res.json({ count: ids.length });
+        }
+        catch {
+            res.json({ count: 0 });
+        }
+    };
+    purgeAdultContinueListening = async (req, res) => {
+        try {
+            const ids = await this.getAdultNonListWorkIds(asmrDb(req));
+            if (ids.length > 0) {
+                await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                    for (const id of ids)
+                        AsmrProgressRepository.deleteByWork(tx, id);
+                });
+            }
+            res.json({ success: true, removed: ids.length });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to purge adult ASMR progress');
+            res.status(500).json({ error: 'Failed to purge adult entries' });
+        }
+    };
+    removeProgress = async (req, res) => {
+        const { workId, trackIndex } = req.body ?? {};
+        if (!workId)
+            return res.status(400).json({ error: 'workId is required' });
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                if (trackIndex !== undefined && trackIndex !== null) {
+                    AsmrProgressRepository.deleteTrack(tx, String(workId), Number(trackIndex));
+                }
+                else {
+                    AsmrProgressRepository.deleteByWork(tx, String(workId));
+                }
+            });
+            res.json({ success: true });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to remove ASMR progress');
+            res.status(500).json({ error: 'Failed to reset progress' });
+        }
+    };
+    batchUpdateStatus = async (req, res) => {
+        const { ids: idsRaw, status } = req.body ?? {};
+        if (!Array.isArray(idsRaw) || idsRaw.length === 0) {
+            return res.status(400).json({ error: 'ids must be a non-empty array' });
+        }
+        if (!status || !ASMR_STATUSES.includes(status)) {
+            return res.status(400).json({ error: 'a valid status is required' });
+        }
+        const ids = idsRaw.map((id) => String(id));
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrLibraryRepository.updateStatusMany(tx, ids, String(status));
+            });
+            res.json({ success: true, updated: ids.length });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to batch update ASMR status');
+            res.status(500).json({ error: 'Failed to update statuses' });
+        }
+    };
+    batchRemove = async (req, res) => {
+        const { ids: idsRaw } = req.body ?? {};
+        if (!Array.isArray(idsRaw) || idsRaw.length === 0) {
+            return res.status(400).json({ error: 'ids must be a non-empty array' });
+        }
+        const ids = idsRaw.map((id) => String(id));
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrLibraryRepository.deleteMany(tx, ids);
+                AsmrProgressRepository.deleteMany(tx, ids);
+            });
+            res.json({ success: true, removed: ids.length });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to batch remove ASMR works');
+            res.status(500).json({ error: 'Failed to remove from listening list' });
+        }
+    };
+    batchRemoveProgress = async (req, res) => {
+        const { ids: idsRaw } = req.body ?? {};
+        if (!Array.isArray(idsRaw) || idsRaw.length === 0) {
+            return res.status(400).json({ error: 'ids must be a non-empty array' });
+        }
+        const ids = idsRaw.map((id) => String(id));
+        try {
+            await performAsmrWriteTransaction(asmrDb(req), (tx) => {
+                AsmrProgressRepository.deleteMany(tx, ids);
+            });
+            res.json({ success: true, removed: ids.length });
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to batch remove ASMR progress');
+            res.status(500).json({ error: 'Failed to reset progress' });
+        }
+    };
+}