4 commits

Author	SHA1	Message	Date
xpltd	4b766bb0e7	Security hardening: API key system, container hardening ... API Key (Sonarr/Radarr style): - Admin panel → Settings: Generate / Show / Copy / Regenerate / Revoke - Persisted in SQLite via settings system - When set, POST /api/downloads requires X-API-Key header or browser origin - Browser users unaffected (X-Requested-With: XMLHttpRequest auto-sent) - No key configured = open access (backward compatible) Container hardening: - Strip SUID/SGID bits from all binaries in image - Make /app source directory read-only (only /downloads and /data writable) Download endpoint: - New _check_api_access guard on POST /api/downloads - Timing-safe key comparison via secrets.compare_digest	2026-03-22 00:42:10 -05:00
xpltd	43ddf43951	Purge intervals: hours→minutes, default ON at 1440min (24h) ... - PurgeConfig: max_age_hours→max_age_minutes (default 1440) - PurgeConfig: privacy_retention_hours→privacy_retention_minutes (default 1440) - PurgeConfig: enabled default False→True - PurgeConfig: cron default every minute (was daily 3am) - Purge scheduler runs every minute for minute-granularity testing - All API fields renamed: purge_max_age_minutes, privacy_retention_minutes - Frontend admin panel inputs show minutes with updated labels - Updated test assertions for new defaults	2026-03-21 20:33:13 -05:00
xpltd	1592407658	First-run admin setup wizard, password persistence, forced setup gate ... - Admin enabled by default (was opt-in via env var) - New /admin/status (public) and /admin/setup (first-run only) endpoints - Setup endpoint locked after first use (returns 403) - Admin password persisted to SQLite config table (survives restarts) - Change password now persists to DB (was in-memory only) - Frontend router guard forces /admin redirect until setup is complete - AdminSetup.vue wizard: username + password + confirm - Public config exposes admin_enabled/admin_setup_complete for frontend - TLS warning only fires when password is actually configured	2026-03-21 20:01:13 -05:00
xpltd	182104e57f	Persistent admin settings + new server config fields ... Settings are now persisted to SQLite (config table) and survive restarts. New admin-configurable settings (migrated from env-var-only): - Max concurrent downloads (1-10, default 3) - Session mode (isolated/shared/open) - Session timeout hours (1-8760, default 72) - Admin username - Auto-purge enabled (bool) - Purge max age hours (1-87600, default 168) Existing admin settings now also persist: - Welcome message - Default video/audio formats - Privacy mode + retention hours Architecture: - New settings service (services/settings.py) handles DB read/write - Startup loads persisted settings and applies to AppConfig - Admin PUT /settings validates, updates live config, and persists - GET /admin/settings returns all configurable fields - DownloadService.update_max_concurrent() hot-swaps the thread pool Also: - Fix footer GitHub URL (jlightner → xpltdco) - Add DEPLOY-TEST-PROMPT.md for deployment testing	2026-03-19 12:11:53 -05:00