introduce initial torrent grouping: add torrent_groups table and
group_id on torrent_items. include migrations, ORM models, and DAOs.
expose admin/web endpoints to group by info_hash and by title/size.
propagate tmdb_id across grouped items. non-destructive and backwards
compatible with existing data
Introduce a 4-phase search system where private indexers are grouped by priority:
- Phase 1 (priority_private): always queried first
- Phase 2 (intermediary_private): queried only if private results < minCachedResults
- Phase 3 (fallback_private): queried only if still insufficient
- Phase 4 (public): Yggflix relay position controlled by yggflixPriority toggle
Add rdMinCachedBeforeCheck setting to skip RealDebrid if prior services already found enough cached results, since RD API is slow (~3s) and rate-limited. Default to 3.
Non-blocking magnet cleanup in AllDebrid availability checks via background task. G3MINI now computes info_hash from .torrent files when API omits it. Public indexer results are excluded from final matches unless already cached by a debrid service.
Remove deprecated Sharewood tracker integration and add three new private trackers:
- ABN (Abnormal): keyword-based search with name filtering
- G3MINI (Gemini Tracker): TMDB/IMDB ID-based filtering
- TheOldSchool: TMDB/IMDB ID-based filtering
Includes new API clients, result parsers, and service layers. Updates frontend UI, settings configuration, and credential handling to support the new indexers with proper passkey management.
- Implement Fernet encryption for configuration URLs to protect sensitive user settings
- Add CONFIG_SECRET_KEY environment variable for key derivation
- Add server-side /api/config/encode endpoint for secure config token generation
- Add CSRF token generation and validation for all admin POST routes
- Auto-inject CSRF tokens into admin forms and AJAX requests via JavaScript
- Update frontend to use async server encoding instead of client-side Base64
- Add localStorage fallback for config restoration on /configure pages
- Maintain backward compatibility with existing Base64-encoded URLs
- Log warning at startup if CONFIG_SECRET_KEY is not configured
- Convert debug logs to trace level in TorrentSmartContainer for reduced noise
Introduce a metadata_mappings table with DAO/model layers for admin-managed
IMDB→TMDB/title overrides, and overhaul the admin panel with a modern
Bootstrap 5 sidebar UI.
- Add metadata_mappings table with migrations (search_titles, year_override)
- Add MetadataMappingDAO with standalone session helpers for use outside FastAPI
- Add new admin pages: dashboard, mappings CRUD, maintenance, config, hash/TMDB search
- Integrate DB mapping lookups into Cinemeta and TMDB metadata providers
- Update catalog views to use DB mappings before hitting external APIs
- Rewrite all admin templates with Bootstrap 5, sidebar navigation, French labels
- Add session-based auth for admin routes with Redis session store
Add a two-level caching architecture for debrid service availability lookups:
- L1: Redis (existing) with 10-day TTL for fast in-memory access
- L2: PostgreSQL with 30-day TTL for persistent caching across Redis restarts
Changes:
- Add `debrid_cache` table with unique constraint on (info_hash, service) and indexes for efficient queries
- Create `DebridCacheDAO` with batch get/upsert and invalidation methods
- Add pgCron job to periodically clean up expired cache entries
- Extend `get_availability_bulk_cached` to check PG on Redis miss, warm Redis from PG hits, and write confirmed-cached results to PG
- Add `invalidate_availability_cache` method to remove false positives from both caches when NO_CACHE_VIDEO_URL is returned during playback
- Integrate `db_session` dependency into playback and search views
- Add retry handling to Yggflix API (3 retries, ignore Retry-After headers) and rate-limiting delay (0.3s) between consecutive queries
Lower log verbosity across the codebase by converting info-level logs to debug
and debug-level logs to trace. This reduces noise in production while keeping
detailed information available for debugging when needed.
Affected modules: API key DAO, Real Debrid token manager, C411/Torr9/YGG
indexers, debrid services, torrent container, playback/stream handlers,
search views, and utility modules.
Convert verbose debug messages to trace level for cleaner production logs, improve secret redaction patterns to handle JWT tokens and API key parameters while preserving parameter names, and standardize log messages to English for consistency across the codebase.
Async correctness:
- Wrap blocking time.sleep/requests.get calls with asyncio.to_thread()
in torrent_service.py and torr9_service.py
- Run cache_container_items() as fire-and-forget background task via
asyncio.create_task(asyncio.to_thread(...)) in search/views.py
- Make RDTokenManager.get_access_token() and new_access_token() async,
replace requests.post with aiohttp (token_manager.py)
- Make RealDebrid.get_headers() async, await all callers (realdebrid.py)
Security:
- Remove API key, device code, and PIN values from log output
(auth/views.py, admin/views.py)
- Add WARNING on startup when SESSION_KEY uses the insecure default
value (settings.py)
- Make admin template dir configurable via settings.admin_template_dir
Performance:
- Parallelize TMDB metadata fetches with asyncio.gather() (catalog/views.py)
- Add tmdb_language setting instead of hardcoded "fr-FR"
Deduplication:
- Extract ensure_uuid() to stream_fusion/web/api/utils.py
- Extract get_client_ip() to stream_fusion/web/utils.py
- Replace 8-way if/elif debrid factory with _SERVICE_MAP dict +
_build_service() helper (get_debrid_service.py)
- Extract _model_to_schema() in APIKeyDAO to remove 6 repeated blocks
- Simplify ProxyStreamer: remove manual BytesIO buffer, stream directly
via iter_any() (stream/views.py)
Inspired by commits 823bc77 and e306eb5 from limedrive/develop.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The allow_anonymous_access setting introduced in a previous branch was
partially implemented and breaking: it was only checked in the
/{config}/manifest.json route but ignored entirely in the stream search
route, which always returned 401 anyway. This created an inconsistent
and misleading security posture. The flag has been removed from settings
and the manifest route now unconditionally returns 401 when no API key
is present, consistent with the rest of the API.
Additionally, the SERVER-SIDE INDEXER ENABLE FLAGS (sharewood_enable,
c411_enable, torr9_enable, lacale_enable) were incorrectly tied to the
presence of server-side credentials via check_env_variable(). This was
a breaking regression: users with their own tracker credentials in their
Stremio config were silently blocked from using those indexers whenever
no server-level key was configured. These flags are now True by default
and can be explicitly set to False via environment variable to disable
an indexer server-wide.
A new generationfree_enable flag (True by default) has been added for
consistency. The config page (index.html) now conditionally renders
indexer checkboxes and credential fields based on these enable flags,
mirroring the existing jackett_enable pattern.
Prevents Sharewood passkeys, C411 API keys and Torr9 API keys from
leaking between users via the shared Redis (media: key) and PostgreSQL
(torrent_items table).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Async Streaming: Converted key methods (fill_buffer, stream_content, close, get_stream_link, head_playback) to async for non-blocking streaming and improved scalability.
🔄 Unified Stremthru: Full refactor with dynamic STORE_CODE_TO_NAME / STORE_NAME_TO_TOKEN_KEY mappings and propagation of store_name in all requests (add_magnet, unrestrict_link, etc.). Updated RealDebrid to delegate via Stremthru.
💾 Cache Persistence: Store valid Stremthru links in Redis (stremthru:working:{store_code}:{info_hash}, TTL 7 days) and leverage this cache to mark links as "working" even on cached results.
