vinez/seerr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
3118 commits 1 branch 0 tags 56 MiB
Commit graph

888 commits

Author SHA1 Message Date
Lauris
f389909a23 fix(auth): sign session cookie store with sessionSecret, not clientId 
cookie-parser was initialized with settings.clientId (the Plex client
UUID), but express-session signs connect.sid with settings.sessionSecret.
The secrets differ, so cookie-parser's signature check on connect.sid
fails, the cookie is dropped from req.cookies, and the OpenAPI validator
rejects every authenticated request with "cookie 'connect.sid' required"
even though the browser is sending it correctly.

This also matches the signing secret used by the OIDC code-verifier and
state cookies that are stored via res.cookie(..., {signed: true}), which
read back through req.signedCookies during the callback.
 2026-06-29 15:49:40 -04:00
Michael Thomas
93b8a59a60 fix: explicitly set sameSite: strict for OIDC correlation cookies 2026-06-29 15:49:40 -04:00
Michael Thomas
66dbf7df0f fix: normalize email addresses from IDP before lookup / storage 2026-06-29 15:49:40 -04:00
Michael Thomas
3f0f7ec66e fix: only count active OIDC providers as a fallback sign-in method 2026-06-29 15:49:40 -04:00
Michael Thomas
f1b4cf782e fix: ensure that OIDC correlation cookies are present in callback 2026-06-29 15:49:40 -04:00
Michael Thomas
3d6acd721e fix(auth): always send state regardless of PKCE support 
This improves CSRF protection somewhat, and also improves compatibilty
with Authelia and Authentik, which both have strange handling of the
`state` parameter either beyond or non-compliant with the specification.
 2026-06-29 15:49:40 -04:00
Michael Thomas
6127da571f fix(user): filter linkedAccounts from user entity 2026-06-29 15:49:40 -04:00
Michael Thomas
f09d65a49d test: add cookie secret to express app for auth tests 2026-06-29 15:49:40 -04:00
Michael Thomas
5712d0f50a test: ensure test runner does not hang 2026-06-29 15:49:40 -04:00
Michael Thomas
b727361c0e fix: update unlink account endpoint guards to match client-side logic 2026-06-29 15:49:39 -04:00
Michael Thomas
31ecc927ef style: error condition null check -> truthiness check 2026-06-29 15:49:39 -04:00
Michael Thomas
1e54f15abe refactor: for new user login, save user and linked account entities in single transaction 2026-06-29 15:49:39 -04:00
Michael Thomas
0f2ec32c87 fix: use signed session cookie to persist state & code_verifier, clear after login 2026-06-29 15:49:39 -04:00
Michael Thomas
8a1bd4d5f5 fix: add indexes and constraints for linked accounts 2026-06-29 15:49:39 -04:00
Michael Thomas
f3b3e207ef test(auth): add tests for OpenID Connect endpoints 2026-06-29 15:49:39 -04:00
Michael Thomas
e56ff623fa feat: support login with OpenID Connect 2026-06-29 15:49:39 -04:00
Michael Thomas
61ee8dd00f feat: support linking OpenID Connect accounts to users 2026-06-29 15:49:39 -04:00
Michael Thomas
ff4867c98c feat: add OpenID Connect provider settings 2026-06-29 15:49:39 -04:00
fallenbagel
8ad191f42b
fix(proxy): proxy clients built before proxy init (#3196) 2026-06-25 01:49:58 +02:00
fallenbagel
ef9edc832f
fix(i18n): fallback to server locale for "Default" user lang in notifs (#3190) 2026-06-23 17:07:34 +08:00
Weblate
8d351bce65 chore(i18n): update translations from Weblate 
Co-authored-by: Kisnov <gabrielmarfil0@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-18 17:39:02 +02:00
0xsysr3ll
72536da50e
feat(requests): allow admins to bypass user quota limits (#2026) 2026-06-18 12:37:07 +02:00
Weblate
3f3384265e chore(i18n): update translations from Weblate 
Co-authored-by: Kisnov <gabrielmarfil0@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
Co-authored-by: dtalens <dtalens@users.noreply.translate.seerr.dev>
 2026-06-16 16:02:25 +02:00
Weblate
6c8527fea3 chore(i18n): update translations from Weblate 
Co-authored-by: Anatoly Tarasenko <fm.ksbw@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-14 14:58:55 +02:00
Weblate
ab26f068f2 chore(i18n): update translations from Weblate 
Co-authored-by: Daniel G <daniel.guerra.997@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-14 01:54:04 +08:00
fallenbagel
784faa9f84
fix: availability sync demotion and orphan season rollup edge cases (#3148) 2026-06-12 00:04:36 +02:00
Austin
6e9ba06e88
feat(notifications): add Discord thread ID support (#3065) 2026-06-09 10:11:11 +02:00
0xsysr3ll
5f2722da30
feat(api): support userId when creating issues (#3100) 2026-06-08 23:34:00 +02:00
Weblate
0a305f6e18 chore(i18n): update translations from Weblate 
Co-authored-by: Bas <910100490+weblate@proton.me>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-05 11:22:24 +02:00
0xsysr3ll
b66020128b
fix(email): respect hosts file for SMTP connections (#3082) 2026-06-04 19:02:55 +02:00
Weblate
2a249a85ae chore(i18n): update translations from Weblate 
Co-authored-by: Marek <mara.pavelka@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-04 11:02:59 +02:00
Weblate
73fcfd253f chore(i18n): update translations from Weblate 
Co-authored-by: Gökhan GÜRBÜZ <gkhn.gurbuz@hotmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-06-02 10:39:27 +02:00
adis veletanlic
63175f52ce
feat(notifications): support multiple Discord IDs (#2712) 2026-06-01 15:00:06 +02:00
fallenbagel
ff88d528e5
fix(request): restore media status correctly when deleting requests (#3064) 2026-05-25 22:31:03 +02:00
renovate[bot]
26283c0fe5
chore(deps): update dependency @types/mime to v4 (#2946) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-26 02:19:35 +08:00
fallenbagel
2588e49ac6
fix(watchlistsync): re-request deleted media from watchlist (#3072) 2026-05-25 20:15:04 +02:00
fallenbagel
ee915b93a9
fix(media): clean up watchlist on error card delete (#3073) 2026-05-25 20:07:28 +02:00
Gauthier
4ed29cf1c5
fix: update series status to partially available when seasons are missing (#3044) 2026-05-25 03:08:56 +08:00
Felix Schneider
a8f147d083
feat(notification): add support for public seerr logo in email (#3036) 2026-05-18 11:21:25 +02:00
Gauthier
8759263e12
chore(deps): update dependency Next.js to v16 (#3003) 2026-05-13 18:54:35 +02:00
Gauthier
bd27f2de6b
fix(users): correct auth middleware for web push subscription (#3005) 2026-05-09 17:18:22 +08:00
Defendi
99f8520f48
fix(plex-watchlist-sync): handle MediaContainer.Video fallback in watchlist sync (#2992) 2026-05-08 14:09:50 +02:00
Weblate
788311aa02 chore(i18n): update translations from Weblate 
Co-authored-by: RobertRvB <Robert_RB@live.nl>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-05-08 11:28:32 +02:00
renovate[bot]
de11222a37
chore(deps): update dependency express to v5 (#2963) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: gauthier-th <mail@gauthierth.fr>
 2026-05-08 10:39:33 +02:00
Weblate
656e33fb4a chore(i18n): update translations from Weblate 
Co-authored-by: 8emk10 <erikmorten97@gmail.com>
Co-authored-by: Weblate <noreply@weblate.org>
 2026-05-08 06:46:45 +08:00
Burak Emir Sezen
f093c69723
feat(db): add DB_POOL_SIZE environment variable for postgres connection pool (#2990) 2026-05-07 22:11:36 +02:00
Blake L.
9b7b50bff6
feat: add plex media ratingKey and ratingKey4k to webhook payload and… (#1812) 2026-05-07 02:12:17 +08:00
Fredrik Burmester
15296a03ae
feat: add route to fetch user by jellyfin id (#2074) 
Co-authored-by: gauthier-th <mail@gauthierth.fr>
 2026-05-07 02:10:26 +08:00
Gauthier
217fcef34b
chore(deps): remove or replace unused/heavy dependencies to reduce Docker image size (#2974) 
Co-authored-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
 2026-05-05 14:54:26 +02:00
fallenbagel
9c34864ce6
fix(availability-sync): detect deleted seasons when media server retains empty season metadata (#2850) 2026-05-03 17:22:55 +02:00