Commit Graph

265 Commits

Author SHA1 Message Date
DariusIII 8a63ee6700 Merge pull request #1860 from joemeyer76/fix/category-exclusion-role-permissions
Fix getCategoryExclusionById() excluding every category for role-only users
2026-07-04 09:29:36 +02:00
joemeyer76 b0fd5491a0 Fix NNTPService::getXOVER() TypeError on NNTP error responses
getXOVER() declared its return type as `array|string|NNTPService`, which
does not include DariusIII\NetNntp\Error. The underlying NNTP client
legitimately returns an Error object whenever the server responds with
an error to an XOVER command (e.g. a group with no matching articles,
or a range past the group's high-water mark) -- both call sites in
BinariesService already guard for exactly this case via
NNTPService::isError($result). Because the declared return type
excluded Error, PHP raised a TypeError before either caller ever got a
chance to run that check:

    App\Services\NNTP\NNTPService::getXOVER(): Return value must be of
    type App\Services\NNTP\NNTPService|array|string, DariusIII\NetNntp\Error
    returned

In practice this crashed the first XOVER call that hit any error
response, which made historical backfill (`update:backfill` /
`multiprocessing:backfill`) unusable beyond the very first successful
chunk for a group -- backfill by its nature keeps requesting older and
older ranges until it walks off the group's actual history, at which
point the server error becomes inevitable.

Every sibling method on this class that the NNTP client can answer with
an Error object (doConnect, doQuit, getOverview, getGroups, getMessages,
getMessagesByMessageID) already declares `mixed` for this same reason.
This change brings getXOVER() in line with that existing convention
rather than introducing a new pattern.

Added a regression test that uses reflection to assert getXOVER()'s
return type permits DariusIII\NetNntp\Error (or is unrestricted via
`mixed`), plus a sanity check that NNTPService::isError() correctly
identifies Error instances. Verified the test fails against the old
`array|string|NNTPService` signature and passes against `mixed`.

Manually verified against a live NNTP server: `update:backfill` on a
real group ran 15+ chunks past the point where it previously crashed on
the very first error response, with no exceptions.
2026-07-03 20:21:36 -04:00
joemeyer76 e62724f2cd Fix getCategoryExclusionById() excluding every category for role-only users
RolesAndPermissionsSeeder grants every 'view *' permission via
Role::givePermissionTo() only -- it never grants permissions directly to a
user with User::givePermissionTo(). That is true for every seeded role,
including Admin.

User::getCategoryExclusionById() computed the allowed permission set as:

    $userAllowed = $user->getDirectPermissions()->pluck('name')->toArray();
    $roleAllowed = $user->getAllPermissions()->pluck('name')->toArray();
    $allowed = array_intersect($roleAllowed, $userAllowed);

getAllPermissions() already includes permissions granted via the user's
role(s), so intersecting it with getDirectPermissions() (permissions
assigned directly to the user, bypassing roles) means $allowed is empty
for any user whose permissions come only from their role. Since every
seeded role works this way, this silently excluded every category root
for every user on a fresh install, and any subsequent Newznab/Torznab API
search or browse request returned zero results with no visible error.

Fix: use getAllPermissions() directly, since it already reflects both
role-granted and directly-granted permissions.

Added a regression test (test_role_only_permissions_are_not_excluded)
that mirrors the real seeder setup -- role-only permissions, nothing
granted directly to the user -- to make sure this doesn't regress.
2026-07-03 18:18:46 -04:00
DariusIII 09ad515969 Update proxy blocking 2026-07-02 13:47:12 +02:00
DariusIII ffff25307b Remove xcertain *arr apps 2026-07-02 13:36:14 +02:00
DariusIII 7b5313e97e Update detection 2026-07-02 11:43:08 +02:00
DariusIII 3faeb1d63a Fix blocking issue 2026-07-01 14:44:16 +02:00
DariusIII 0790d2290c Hide sensitive info from log 2026-06-30 19:05:15 +02:00
copilot-swe-agent[bot] 3af1b15f48 fix: add missing array $headers parameter to output() overrides in tests 2026-06-28 19:19:04 +00:00
DariusIII afe6202460 Fix multiple user id queries 2026-06-26 23:19:30 +02:00
DariusIII cfa46e477b Add missing test 2026-06-24 16:56:10 +02:00
DariusIII 8d1d238f5f Update Trakt support 2026-06-19 23:22:16 +02:00
DariusIII 2f96d921df Fix RSS health check 2026-06-17 13:34:13 +02:00
DariusIII ab41b91af5 Add GDPR compliance 2026-06-17 09:49:39 +02:00
DariusIII ca76cebbaf Fix error in admin 2026-06-15 12:31:39 +02:00
DariusIII d9c4cf2d7e Update bulk user actions 2026-06-15 12:15:10 +02:00
DariusIII 96f6900306 Add user bulk actions 2026-06-15 11:36:03 +02:00
DariusIII a7a6479e93 Fix email verification url 2026-06-15 01:26:34 +02:00
Kcchouette e5df723720 fix: correct reversed stripos/strpos arguments in ConsoleService
Fix 5 instances of stripos('literal', ) where arguments were
reversed, causing the needle to be searched inside a short literal
instead of the literal inside the variable:

- Line 599: stripos('dlc', ) → stripos(, 'dlc') — DLC
  branch was never entered for real game titles
- Line 601: stripos('Rock Band Network', ) → stripos(, ...)
  — Rock Band check was dead code inside the dead DLC branch
- Line 603: strpos('-', ) → str_contains(, '-') — DLC
  hyphen splitting never triggered
- Line 622: stripos('PSX2PSP', ) → stripos(, ...)
  — worked by accident (PSX is prefix of PSX2PSP)
- Line 626: stripos('XBLA', ) + stripos('dlc', ) →
  stripos(, ...) + stripos(, ...)

Also adds ConsoleServiceDlcParsingTest (9 tests) covering DLC title
parsing, Rock Band Network handling, hyphen splitting, and XBLA
platform upgrade.
2026-06-13 21:05:15 +02:00
DariusIII 937913cbf8 CS fixes 2026-06-12 10:16:12 +02:00
DariusIII d970bbffc6 Improve security 2026-06-12 10:11:15 +02:00
DariusIII 499d6d8cfc CS fixes 2026-06-11 10:32:38 +02:00
DariusIII 832fb5fb59 Fix couple of security issues 2026-06-11 10:26:29 +02:00
DariusIII 5a837e52af Update release reporting 2026-06-08 16:42:06 +02:00
DariusIII f8294f1b0a Add release report response 2026-06-08 16:31:15 +02:00
DariusIII 87bbf22bdf Fix regexes display issue 2026-06-03 21:52:05 +02:00
DariusIII a0e78e7385 Fix phpstan discovered issues 2026-05-30 23:31:00 +02:00
DariusIII 51aaf2b130 Fix PPA guid char issue 2026-05-30 23:04:58 +02:00
DariusIII f8c52d176e Update expiry email to show pending role. if there is one 2026-05-30 18:15:49 +02:00
DariusIII 6e5940cd81 Add xml helper 2026-05-29 22:52:36 +02:00
DariusIII ed806d27b5 Improve XXX VR categorization 2026-05-21 13:07:34 +02:00
DariusIII bd9aa517d3 Fix bulk insert issue 2026-05-14 11:39:21 +02:00
DariusIII 4b04ac9625 Show unprocessed releases in search 2026-05-14 10:30:35 +02:00
DariusIII 088863f6e0 Fix the manticore limit 2026-05-13 13:58:18 +02:00
DariusIII 282070a2af Update search and indexing 2026-05-13 08:51:11 +02:00
DariusIII 5e74a4d769 CS fixes 2026-05-12 15:41:30 +02:00
DariusIII 4d91912342 Update anime releases categorization 2026-05-12 15:41:02 +02:00
DariusIII 0723dfa3d9 Fix naming on import 2026-05-12 15:38:01 +02:00
DariusIII a6b1cd364d Fix error on passkey login 2026-05-08 19:21:33 +02:00
DariusIII a6a095586f Remove nzb_guid column 2026-05-08 18:52:14 +02:00
DariusIII c0c153fdf9 Update passkeys - logout other devices 2026-05-08 15:53:58 +02:00
DariusIII ac1ac603cb Update emails 2026-05-07 14:03:21 +02:00
DariusIII 97029c4eb1 Update cbp and add FKs back 2026-05-06 10:20:05 +02:00
DariusIII 96364cbae8 Update cbp creation queries and indexes 2026-05-05 13:18:11 +02:00
DariusIII 8ff88fe694 API fix for APIv2 2026-05-01 09:45:22 +02:00
DariusIII 372a637f7f Fix book and music API lookups 2026-05-01 09:41:48 +02:00
DariusIII f98fbba39c Cs fixes 2026-04-30 16:45:15 +02:00
DariusIII dba05ec344 Fix auto refresh 2026-04-30 16:44:53 +02:00
DariusIII c7641d7b4e Constraint binaries to prevent OOM issues 2026-04-29 09:22:43 +02:00
DariusIII e43e54d59f Update collection handling 2026-04-28 15:55:39 +02:00