From 3e7de1ebc9af039d0b3fc87dc6a5460e5ad7e6d1 Mon Sep 17 00:00:00 2001
From: 4gray <serega05@gmail.com>
Date: Fri, 31 Jul 2026 10:49:47 +0200
Subject: [PATCH] fix(downloads): guard restart artwork URL

---
 .../events/database/download-requests.spec.ts | 33 +++++++++++++++++++
 .../app/events/database/download-requests.ts  |  4 +++
 2 files changed, 37 insertions(+)

diff --git a/apps/electron-backend/src/app/events/database/download-requests.spec.ts b/apps/electron-backend/src/app/events/database/download-requests.spec.ts
index bc327086a..fc4640519 100644
--- a/apps/electron-backend/src/app/events/database/download-requests.spec.ts
+++ b/apps/electron-backend/src/app/events/database/download-requests.spec.ts
@@ -326,6 +326,39 @@ describe('download request metadata snapshots', () => {
         expect(request.db.update).not.toHaveBeenCalled();
         expect(request.enqueueDownload).not.toHaveBeenCalled();
     });
+
+    it('rejects a restart whose poster reuses the replacement stream URL', async () => {
+        const replacementUrl =
+            'https://replacement.example.test/images/live.jpg';
+        const request = await setupStartMetadataRequest({
+            contentType: 'vod',
+            filePath: null,
+            id: 42,
+            metadataSnapshot: null,
+            playlistId: 'playlist-1',
+            status: 'canceled',
+            title: 'Offline Movie',
+            url: 'https://stored.example.test/movie.mp4',
+            xtreamId: 7,
+        });
+
+        await expect(
+            request.startDownloadRequest(
+                {
+                    ...startPayload({
+                        ...metadataSnapshot,
+                        posterUrl: replacementUrl,
+                    }),
+                    url: replacementUrl,
+                },
+                request.authorizer
+            )
+        ).rejects.toThrow('Invalid download metadata snapshot');
+
+        expect(request.db.insert).not.toHaveBeenCalled();
+        expect(request.db.update).not.toHaveBeenCalled();
+        expect(request.enqueueDownload).not.toHaveBeenCalled();
+    });
 });
 
 describe('download requests resume', () => {
diff --git a/apps/electron-backend/src/app/events/database/download-requests.ts b/apps/electron-backend/src/app/events/database/download-requests.ts
index b592dadea..5793ea0a4 100644
--- a/apps/electron-backend/src/app/events/database/download-requests.ts
+++ b/apps/electron-backend/src/app/events/database/download-requests.ts
@@ -171,6 +171,10 @@ export async function startDownloadRequest(
                 normalizedMetadataSnapshot,
                 item.url
             );
+            assertDownloadMetadataArtworkDiffersFromStream(
+                normalizedMetadataSnapshot,
+                data.url
+            );
         }
         if (!['completed', 'failed', 'canceled'].includes(item.status)) {
             return {