advplyr
6b60beff6e
Extract out rss feed image URL construction into a separate function
2026-10-01 18:13:09 -05:00
zsh
94400acdcd
fix: add cache-busting timestamp to RSS feed cover image URLs
...
Feed cover image URLs were built only from the item's slug and file
extension, so the URL never changed when the cover image itself
changed. Podcast clients that cache by URL would keep showing the old
cover after an update.
Add a '?ts=' query parameter using the already-computed
entityUpdatedAt value, matching the same cache-busting convention
already used elsewhere in the app (see the updatedAt comment in
LibraryItemController.updateCover).
Applies to all three feed types: single item, collection, and series.
Fixes #5306
2026-07-31 10:28:21 +12:00
mikiher
32fae4a7c6
Fix podcast rescan emitting stale episodes on item_updated
2026-07-28 12:26:32 +03:00
advplyr
c86f336536
Update delete session to return status 200 instead of json
2026-07-26 17:40:14 -05:00
advplyr
1876bfbfe7
Add delete auth session endpoint to logout individual session
2026-07-26 17:36:36 -05:00
advplyr
a7b380cd7a
Add pagination to /me/sessions endpoint & sessions account page table
2026-07-26 17:11:03 -05:00
advplyr
35a2c5e87c
Add /me/sessions endpoint and show sessions table on account page
2026-07-25 17:18:38 -05:00
advplyr
e56c1099e6
Add logout all devices button and extend auth logout endpoint
2026-07-24 17:44:03 -05:00
advplyr
c900676be7
User password changes invalidate sessions
2026-07-23 17:21:25 -05:00
advplyr
e9b533637f
Merge pull request #5376 from DanielAshley/contrib/refresh-grace-period
...
Make refresh-token grace period configurable (default 10 min)
2026-07-22 18:01:32 -04:00
advplyr
37b42601ef
Merge pull request #5363 from Vito0912/feat/newEndpoints
...
add progress and bookmarks specific endpoints
2026-07-22 17:10:51 -04:00
advplyr
4c65a87d5c
Update bookmarks endpoints to use json object as root
2026-07-22 16:05:37 -05:00
Finn Dittmar and advplyr
0e5618dcd8
Apply suggestions from code review
...
Co-authored-by: advplyr <dev@advplyr.com >
2026-07-22 10:20:41 +02:00
advplyr
d063d851e1
Merge pull request #5388 from mikiher/fix/bulk-download-permissions
...
Enforce per-item access checks on bulk library download
2026-07-21 18:34:13 -04:00
advplyr
6458e6d3d2
Merge pull request #5387 from mikiher/fix/refresh-token-auth
...
Reject refresh tokens on API and WebSocket authentication
2026-07-21 18:20:57 -04:00
advplyr
2d9f63963e
Merge pull request #5370 from mikiher/fix/root-user-delete-protection
...
Prevent admin users from deleting the root account
2026-07-20 18:35:32 -04:00
advplyr
f12abca3fc
Simplify user delete checks
2026-07-20 17:33:15 -05:00
advplyr
528d03fef3
Merge pull request #5386 from mikiher/fix/oidc-url-validation
...
Fix oidc url validation
2026-07-20 18:08:51 -04:00
advplyr
b93c3133a9
Update x-forwarded-proto to check comma separated value
2026-07-20 17:06:21 -05:00
advplyr
08bbf9cd9d
Update server settings to include host timezone for use in cron scheduler next run dates
2026-07-19 17:31:00 -05:00
Daniel
95af4812cd
Make the refresh-token grace period configurable (default 10 min)
...
When /auth/refresh rotates the refresh token, the previous token is kept
valid for a short grace period so a client that never received the
rotation response (e.g. a dropped or suspended mobile request) can retry
with the old token and get back the already-rotated current token
instead of a 401.
That window was hardcoded to 60 seconds, which is too short for real
mobile conditions: iOS backgrounding, VPN/proxy timeouts, or network
handoff can delay the retry past a minute, permanently locking the
session out (#5281 ).
Make it configurable via REFRESH_TOKEN_GRACE_PERIOD (seconds), following
the existing REFRESH_TOKEN_EXPIRY / ACCESS_TOKEN_EXPIRY pattern, and
raise the default to 10 minutes. Adds unit tests for the new config.
Fixes #5281
2026-07-18 21:42:06 -04:00
mikiher
8ec547e302
fix(auth): refresh tokens authentication in API and WebSocket requests
2026-07-16 18:58:44 +03:00
mikiher
32e4da8c92
fix(permissions): enforce per-item access on bulk library download
2026-07-16 18:11:19 +03:00
mikiher
0ce37004af
fix(auth): harden OIDC web callback URL validation
2026-07-16 17:11:11 +03:00
mikiher
527745b54e
refactor(server): centralize request HTTPS and origin detection
2026-07-16 17:10:42 +03:00
mikiher
3c016314e6
fix(auth): prevent admin users from deleting the root account
2026-07-15 20:34:02 +03:00
advplyr
59c7d0275c
Merge pull request #5354 from mikiher/scan-author-events
...
Emit author socket events when book scans create or link authors
2026-07-13 19:27:31 -04:00
Finn Dittmar
4883d0f60c
add progress and bookmarks specific endpoints
2026-07-13 11:41:49 +02:00
mikiher
9d9ab49664
Batch author numBooks updates at scan end via authors_num_books_updated
2026-07-10 17:37:31 +03:00
mikiher
7ee5e1bdf6
Emit author socket events when book scans create or link authors
2026-07-09 10:35:18 +03:00
mikiher
3bb53d939d
Add all minified fields to expanded library item JSON so socket updates remain a strict superset of shelf payloads
2026-07-01 22:30:21 +03:00
mikiher
56e60b8420
Server.js: Let next.js handle file uploads through internal-api routes
2026-06-23 14:08:16 +03:00
mikiher
3417c0c721
Enhance PodcastController to handle enclosure updates, allowing for null values and object structure validation for enclosure properties.
2026-06-18 12:39:50 +03:00
advplyr
e70e4b9d40
Fix typo on onTest notification body
2026-05-30 15:43:50 -05:00
advplyr
499b52b4dd
Update Sequelize where query for User username/email case insensitive
2026-05-28 14:49:49 -05:00
advplyr
1bad2d9072
Cleanup abmetadata file parsing & fix server crash #5268 #4287 #5142
2026-05-27 17:33:14 -05:00
advplyr
c009db9f28
Merge pull request #5256 from nichwall/fix-bookauthor-collision-on-rename
...
Fix duplicate bookAuthor creation when renaming authors
2026-05-22 15:43:13 -05:00
Nicholas Wallace
c97b36e11c
Add ignoreDuplicates for bookAuthor when renaming to respect unique index
2026-05-21 21:06:17 -07:00
Nicholas Wallace
e944b2a2f5
Add unique UUID to access and refresh tokens
2026-05-21 17:08:39 -07:00
advplyr
cac74f3477
Merge pull request #5004 from nichwall/token_refresh_race_condition
...
Access token refresh grace period
2026-05-17 14:16:58 -05:00
advplyr
c010f0e1eb
Fix android device sdkVersion not handling it using number type, causing android session device names to show as iOS
2026-05-15 13:13:14 -05:00
advplyr
eee377e081
Cleanup TokenManager logs
2026-05-13 16:23:26 -05:00
advplyr
b0aaa24660
Update socket events to check client is admin & validate log level
2026-05-12 16:57:28 -05:00
advplyr
47ea6b5092
Update book/podcast scanner to sanitize description pulled from metadata
2026-05-05 17:18:49 -05:00
Brandon
40869bcf39
fix: set correct Content-Type for RSS feed audio files
...
Express's mime package does not recognize .m4b, causing it to fall back
to application/octet-stream. This reuses the existing
getAudioMimeTypeFromExtname utility (already applied to the download
endpoint) to set the correct audio/mp4 header before sendFile.
Fixes #5041
2026-05-02 22:13:35 -04:00
advplyr
3942805129
Cleanup rotateTokensForSession
2026-04-30 16:25:43 -05:00
advplyr
dc446862c1
Rename migration to v2.35.0 & merge master
2026-04-30 16:08:24 -05:00
advplyr
379f6c716a
Merge branch 'master' into token_refresh_race_condition
2026-04-30 15:59:22 -05:00
advplyr
92df92ec99
Fix recent episodes endpoint cache not being cleared when updating media progress #5159
2026-04-26 16:51:08 -05:00
advplyr
2c3108a1fa
Merge pull request #5163 from pjkottke/master
...
The timestamp in the share URL should override the saved position for the user.
2026-04-25 17:15:23 -05:00
advplyr
zsh
mikiher
Finn Dittmarandadvplyr
Daniel
Nicholas Wallace
Brandon