peter
bc33b2ed16
Each user stores their own login cookies (Netscape cookies.txt) for an auth-walled download host (Facebook, Instagram, X, TikTok, Reddit) in Settings; a download of an auth-walled link on that host is retried with the acting user's cookie. Two load-bearing security controls, both in downloads.credentials as the single source of truth so enqueue and the worker can't drift: - cache privacy: a cookie-authed download salts its MediaAsset format_sig with the user id, so the authed asset is private and never cache-served to another user. The worker attaches a cookie ONLY when the asset it is downloading into IS that private, salted identity. - host scope (SEC-12): a cookie is resolved only for a URL whose netloc the credential owns (netloc-scoped _host_is); a look-alike/unrelated host gets none. cookies_enc is Fernet-encrypted at rest, only decrypted in-worker into a 0600 file under staging/.auth/ (survives the retry wipe + _produced_file scan) and unlinked in finally. The blob is never returned by a route, logged, audited, or written to a job's error/snapshot. cookiefile is set after the adapter's extra merge so an adapter can't clobber it. Settings UI is write-only (host + set/updated only, never echoed). New download_credentials table + migration 0074; per-user routes; HU+EN i18n. Tests: host-scope, cache-privacy (no cross-user serve), encrypt-at-rest, write-only API, worker attach-gate; FE dom test for the write-only field.
129 lines
7.2 KiB
TypeScript
129 lines
7.2 KiB
TypeScript
import type { FeedFilters } from "./api";
|
|
|
|
// Single source of truth for React Query keys. Every key root lives here exactly once, so a typo
|
|
// at one of the ~200 call sites can no longer mint an orphan key that silently never invalidates
|
|
// (the R7 driver: `["feed"]` was hand-written in 15+ files). CONTRACT: each function returns the
|
|
// SAME array shape the call sites used before, so TanStack's partial (prefix) matching is
|
|
// unchanged — `qk.feed()` (`["feed"]`) still invalidates `qk.feed(filters)` (`["feed", filters]`).
|
|
// Deliberately NOT bundling co-invalidations into helpers here: the clusters differ per call site
|
|
// (some invalidate `feed` alone, others `feed` + `feed-count`), so collapsing them would change
|
|
// which queries refetch. Grouped invalidation stays opt-in per domain (see `invalidateDownloads`).
|
|
// Extended per domain as R7 S2 migrates each area (S2a: feed/channels/playlists + shared roots).
|
|
export const qk = {
|
|
// --- shared roots (invalidated from more than one domain) ---
|
|
me: () => ["me"] as const,
|
|
myStatus: () => ["my-status"] as const,
|
|
tags: () => ["tags"] as const,
|
|
// Per-channel suggested user tags, learned from the manual-tag pattern (E8·S4). Separate root so
|
|
// accepting a suggestion can invalidate it without touching the whole tag catalog.
|
|
tagSuggestions: () => ["tag-suggestions"] as const,
|
|
|
|
// --- feed / video ---
|
|
// Every parameterized key guards on `!== undefined` (not truthiness), so "no arg → bare prefix
|
|
// key" is the ONE rule across the factory. It also keeps a nullable segment intact: `q`/`id`
|
|
// accept null because some call sites key on nullable state (`selectedId`, the search string),
|
|
// and a NULL is a real key segment that must be preserved (`["playlist", null]`) rather than
|
|
// silently collapsed to the prefix.
|
|
feed: (filters?: FeedFilters) =>
|
|
filters !== undefined ? (["feed", filters] as const) : (["feed"] as const),
|
|
feedCount: (filters?: FeedFilters) =>
|
|
filters !== undefined ? (["feed-count", filters] as const) : (["feed-count"] as const),
|
|
facets: (filters?: FeedFilters) =>
|
|
filters !== undefined ? (["facets", filters] as const) : (["facets"] as const),
|
|
feedSummary: (filters?: FeedFilters) =>
|
|
filters !== undefined ? (["feed-summary", filters] as const) : (["feed-summary"] as const),
|
|
feedYears: (filters?: FeedFilters) =>
|
|
filters !== undefined ? (["feed-years", filters] as const) : (["feed-years"] as const),
|
|
ytSearch: (q?: string | null, count?: number) =>
|
|
q !== undefined ? (["yt-search", q, count] as const) : (["yt-search"] as const),
|
|
videoDetail: (id: string) => ["video-detail", id] as const,
|
|
|
|
// --- channels ---
|
|
channels: () => ["channels"] as const,
|
|
channel: (id: string) => ["channel", id] as const,
|
|
discoveredChannels: () => ["discovered-channels"] as const,
|
|
blockedChannels: () => ["blocked-channels"] as const,
|
|
|
|
// --- playlists ---
|
|
playlists: () => ["playlists"] as const,
|
|
playlist: (id?: number | null) =>
|
|
id !== undefined ? (["playlist", id] as const) : (["playlist"] as const),
|
|
playlistMembership: (videoId: string) => ["playlist-membership", videoId] as const,
|
|
// Keyed by source ("feed" | "plex") so each module's views cache independently; `savedViews()` (no
|
|
// arg) stays a prefix for a cross-source invalidation.
|
|
savedViews: (...rest: unknown[]) => ["saved-views", ...rest],
|
|
|
|
// --- account / misc (R7 S2b) --- (me/myStatus/tags already declared as shared roots above)
|
|
accounts: () => ["accounts"] as const,
|
|
version: () => ["version"] as const,
|
|
setupStatus: () => ["setup-status"] as const,
|
|
myUsage: () => ["my-usage"] as const,
|
|
scheduler: () => ["scheduler"] as const,
|
|
|
|
// --- notifications ---
|
|
notifications: () => ["notifications"] as const,
|
|
notifUnread: () => ["notif-unread"] as const,
|
|
|
|
// --- messaging ---
|
|
conversations: () => ["conversations"] as const,
|
|
thread: (partnerId: number | null) => ["thread", partnerId] as const,
|
|
messageKey: () => ["message-key"] as const,
|
|
messageUnread: () => ["message-unread"] as const,
|
|
messageUsers: () => ["message-users"] as const,
|
|
shareRecipients: () => ["share-recipients"] as const,
|
|
|
|
// --- downloads ---
|
|
downloads: () => ["downloads"] as const,
|
|
downloadsShared: () => ["downloads-shared"] as const,
|
|
downloadIndex: () => ["download-index"] as const,
|
|
downloadUsage: () => ["download-usage"] as const,
|
|
downloadProfiles: () => ["download-profiles"] as const,
|
|
downloadCredentials: () => ["download-credentials"] as const,
|
|
downloadLinks: (jobId: number) => ["download-links", jobId] as const,
|
|
dlQuota: (userId: number) => ["dl-quota", userId] as const,
|
|
storyboard: (jobId: number) => ["storyboard", jobId] as const,
|
|
|
|
// --- admin ---
|
|
adminUsers: () => ["admin-users"] as const,
|
|
adminInvites: () => ["admin-invites"] as const,
|
|
adminConfig: () => ["admin-config"] as const,
|
|
adminAudit: () => ["admin-audit"] as const,
|
|
adminStorage: () => ["admin-storage"] as const,
|
|
adminDownloads: () => ["admin-downloads"] as const,
|
|
adminQuota: (days: number) => ["admin-quota", days] as const,
|
|
demoWhitelist: () => ["demo-whitelist"] as const,
|
|
|
|
// --- plex ---
|
|
// The composite plex keys carry a heterogeneous arg list (a filters object, a ratingKeys
|
|
// array, a "union"/"group"/"contains" discriminator), so they take a variadic pass-through:
|
|
// the value this factory centralizes is the ROOT string, and TanStack keys are `unknown[]`
|
|
// anyway. Single-id plex keys stay precisely typed.
|
|
plex: () => ["plex"] as const,
|
|
plexWatchLink: () => ["plex-watch-link"] as const,
|
|
plexLibrary: (...rest: unknown[]) => ["plex-library", ...rest],
|
|
// Discover surface (E5 S4): the rail payload keyed by scope+lang; `plexDiscover()` (no args) matches
|
|
// both for a prefix invalidation after a watched-toggle. Surprise is its own key so the ↻ reshuffle
|
|
// refetches it alone.
|
|
plexDiscover: (...rest: unknown[]) => ["plex-discover", ...rest],
|
|
// Variadic like plexDiscover so it can key by scope + lang + the active filters (lang because a genre
|
|
// filter narrows against the language-specific genre column, like the grid); `plexSurprise()` (no args)
|
|
// stays a prefix for the reshuffle/watched-toggle invalidations.
|
|
plexSurprise: (...rest: unknown[]) => ["plex-surprise", ...rest],
|
|
plexSuggest: (...rest: unknown[]) => ["plex-suggest", ...rest],
|
|
// Optional trailing `lang` (E5 S6): a language switch remounts the detail with a new key so HU/EN
|
|
// metadata is cached separately. Omitting it (e.g. for a prefix invalidation) still matches both.
|
|
plexShow: (showId?: string, lang?: string) =>
|
|
showId !== undefined
|
|
? (["plex-show", showId, ...(lang ? [lang] : [])] as const)
|
|
: (["plex-show"] as const),
|
|
plexItem: (id: string, lang?: string) => ["plex-item", id, ...(lang ? [lang] : [])] as const,
|
|
plexPlaylists: (...rest: unknown[]) => ["plex-playlists", ...rest],
|
|
plexPlaylist: (playlistId: number) => ["plex-playlist", playlistId] as const,
|
|
plexCollections: (...rest: unknown[]) => ["plex-collections", ...rest],
|
|
// facetKey is a filters-derived OBJECT segment (not a scalar), so this key is heterogeneous too.
|
|
plexFacets: (...rest: unknown[]) => ["plex-facets", ...rest],
|
|
plexPeopleCards: (scope: string, actors: string[]) =>
|
|
["plex-people-cards", scope, actors] as const,
|
|
plexPerson: (name: string) => ["plex-person", name] as const,
|
|
};
|