* feat(interfaces): add the server storage HTTP contract
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): read server storage configuration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): open the server database and track revisions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): playlist and user-state repositories
Playlist documents use the shared desktop row codec, so the server writes
the same rows. keepPayload upserts take the stored playlist/items/header
fields when the client leaves them out. Xtream user data lives in the
server-only server_user_state table, one JSON value per namespace and
playlist.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): storage error mapping and access token guard
Storage errors map to JSON status bodies and are logged by name and code
only. An optional bearer token guards every route except /, /health,
/config.js and /v1/instance, provider proxy routes included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): serve the /v1 server storage API
/v1/instance is always public and reports whether server storage is on.
With storage, /v1/playlists serves whole documents with ETags and 304s,
accepts keepPayload upserts, and deletes playlists with their user state;
/v1/user-state and /v1/app-state store the rest. The proxy routes are
unchanged unless an access token is configured.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(web-backend): open server storage on start and close on shutdown
With IPTVNATOR_STORAGE=server, main.ts opens the database before it
listens and exits with a clear message when the data directory is not
writable. SIGTERM and SIGINT close the server and the database. The
native better-sqlite3 module stays outside the esbuild bundle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): match weakened ETags on playlist reads
nginx weakens the ETag of a gzipped response, and clients send the weak
form back in If-None-Match. The route now compares tags weakly, as RFC 9110
requires for GET, so it answers 304 before reading the document.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(docker): persist server storage on a volume
The image builds better-sqlite3 in a native stage per target platform,
enables server storage on the /data volume, and raises the nginx body
limit to 64 MB for /api with gzip for JSON. The compose file mounts a
named volume and documents the optional access token. The PWA does not
use the storage yet; docs say so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(web-backend): type the storage route responses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): harden server storage reads, deletes and app state
- Metadata reads return the stored document without its payload fields,
so fields that live only in the JSON survive a metadata round-trip.
- A conditional GET checks that the playlist exists before answering 304.
- Deleting a playlist and its user state commits in one transaction; the
ETag moves only after the commit.
- Browser app state is stored under a client: prefix and the instance id
is repaired when empty, so a client write cannot stop the backend.
- User-state buckets have no prototype, so ids like __proto__ round-trip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(self-hosted): keep the access token unset until the PWA sends it
Add the release note for the Docker server storage volume.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): bound shutdown and reject padded playlist ids
- SIGTERM closes idle connections at once and cuts the rest after five
seconds, so a long provider download cannot keep the backend running.
- Playlist ids with surrounding whitespace are rejected: the row codec
trims ids, so storage and ETags would track different keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): clear optional columns on whole-document upserts
The row codec maps empty values to undefined, which ON CONFLICT DO UPDATE
skips, so a cleared User-Agent, Referrer or credential kept its old column
value and came back on the next read. Server upserts now write NULL to
every replaceable column the document no longer sets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(self-hosted): linear token parsing, no-store app state, longer start
- The access guard reads the Bearer token by string scanning instead of a
regular expression that CodeQL flagged as polynomial on long whitespace.
- GET /v1/app-state/:key sends Cache-Control: no-store like the other
state routes, so devices never reuse a stale value.
- The entrypoint waits up to IPTVNATOR_BACKEND_START_TIMEOUT (300 s) for
/health, because the backend migrates its database before it listens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(self-hosted): metadata reads skip payloads, redact JSON parse warnings
List playlist metadata from a server-only payload-free copy of each
document instead of running json_remove over every payload blob, and log
only the error name when a stored JSON value fails to parse, since the
parser's message quotes the stored text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(web-backend): copy carried-over panel clock into playlist metadata
When an upsert keeps the stored serverTimezone, build the metadata copy
from the saved payload so metadata and full reads agree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Publish /download/docker/ so "Self-host it with Docker" no longer sends
visitors off-site to the developer README. The page covers what the
image contains, a four-step quick start with the repository compose
command and an image-only compose snippet, the environment variables
and port that matter, the published tag patterns with the update
command, what the browser version leaves out, and a seven-question FAQ.
It links to docker/README.md for the full reference, to the desktop vs
browser comparison and to the setup guides; the README links back.
The download hub gains a fourth card, the homepage and hub links point
at the page, the platform switcher shows a Docker card on the OS pages,
and the comparison page links both the page and the README. The page
emits SoftwareApplication / FAQPage / BreadcrumbList JSON-LD and is
covered by website-download-pages.test.mjs.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(pwa): tolerate broken IPv6 routes and surface provider error codes
Node's happy-eyeballs racing gives each address attempt only 250 ms, so a
dual-stack provider hostname behind an IPv4-only VPN namespace (Gluetun,
WireGuard) exhausts every attempt and the web backend answered with a bare
502. Raise the per-attempt budget to 2500 ms at startup — keeping the
IPv6->IPv4 fallback automatic — while an explicit
--network-family-autoselection-attempt-timeout from NODE_OPTIONS still wins.
Provider proxy failures now log the target hostname plus the underlying
Node error codes (never the URL query, which carries credentials) and
return the primary code in the error body, so the app shows
"Bad Gateway (ETIMEDOUT)" instead of an unexplained 502.
Closes#1400
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(pwa): surface proxy network codes in import/refresh toasts, document runtime contract
Codex: /parse connection failures arrive as HTTP 500 whose body carries the
new code field, but fetchFromUrl()/refreshPlaylist() mapped only the HTTP
status, so the toast stayed generic. Append the code to the translated
message (regression-covered for both flows).
Greptile: record the web-backend happy-eyeballs/diagnostics runtime contract
in CLAUDE.md's monorepo structure section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(pwa): drop provider reason phrases from logs, honor underscore flag spellings
Codex round 2: the HTTP reason phrase is provider-controlled and can echo
the credential-bearing request URL, so the failure log now carries only the
numeric status; and Node treats underscores and dashes interchangeably in
flag names, so the explicit-override check normalizes spelling before
matching (verified live: --network_family_autoselection_attempt_timeout
applies in both CLI and NODE_OPTIONS forms).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(pwa): match the timeout flag as a complete NODE_OPTIONS token
Codex round 3 (P3): a raw substring search also fired on the flag text
embedded in another option's value, silently skipping the 2500 ms default.
Tokenize NODE_OPTIONS on whitespace and match the normalized option name
exactly or with '='.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
