From 8148678af86b83bc88e73c1b1af1aa33f62deffb Mon Sep 17 00:00:00 2001 From: jochens Date: Wed, 30 Sep 2026 11:58:52 +0200 Subject: [PATCH] bazarr: reach sonarr and radarr through the mesh; placed dirs; the image ace runs bazarr reached sonarr and radarr as `sonarr:8989` and `radarr:7878`, container names on HAL's shared network, which the mesh does not have. It now requires sonarr-api and radarr-api (provided since #156) and a run-once step writes host, port, TLS, base path and key into bazarr through bazarr's own POST /api/system/settings - the call its settings screen makes - only for the fields that differ, and reads them back. bazarr's config.yaml is not written by the mesh: bazarr holds it in memory and rewrites it, so the two would overwrite each other. The key is tried against the app first; a refused key (a minted pair credential before the operator accepts the app's own) is never written, and the step fails naming the `secret accept` that fixes it. Declared last so its failing gates nothing else (ADR 0136); restart-on its four inputs. The api-key own-secret is gone. bazarr makes its own key and nothing lets the mesh set it, so a minted one could never work; the tools and the step read auth.apikey from bazarr's own config/config.yaml (mounted read-only), which also stays right if the key is regenerated. Nothing to accept. The config dir is a pathless ${dir:config}; config.json and the bindings live in a placed state dir; /var/lib/mesh/bazarr keeps only the broker. The image is pinned to the digest ace runs (v1.6.1-ls364); the old pin was v1.6.0-ls361, older than ace's database. Based on feat/servarr-api-provision (#156); this branch contains it. Verified: catalogue tests with MESH_CATALOGUE pass (not skipped); a resolve of sonarr+radarr+bazarr on a fake ace renders both bindings and sealed credentials into the state dir with every ${} filled, and bazarr alone is refused naming sonarr and radarr; strict tsc passes and the Dockerfile's non-strict compile builds; 8 node tests pass; the compiled step against the pinned image in a throwaway container with fake sonarr/radarr wrote sonarr (ip, port, apikey), refused radarr's minted key and wrote nothing for it, wrote radarr once the key was right, and changed nothing on a third run - the values landed in config.yaml. --- modules/bazarr/Dockerfile | 5 +- modules/bazarr/apikey.ts | 37 ++++ modules/bazarr/client.ts | 12 +- modules/bazarr/module.json | 64 ++++-- modules/bazarr/package.json | 5 + modules/bazarr/servarr/index.ts | 63 ++++++ modules/bazarr/servarr/settings.ts | 290 ++++++++++++++++++++++++++++ modules/bazarr/test/servarr.test.ts | 156 +++++++++++++++ modules/bazarr/tsconfig.json | 2 +- 9 files changed, 617 insertions(+), 17 deletions(-) create mode 100644 modules/bazarr/apikey.ts create mode 100644 modules/bazarr/servarr/index.ts create mode 100644 modules/bazarr/servarr/settings.ts create mode 100644 modules/bazarr/test/servarr.test.ts diff --git a/modules/bazarr/Dockerfile b/modules/bazarr/Dockerfile index 8e9844a..68d1405 100644 --- a/modules/bazarr/Dockerfile +++ b/modules/bazarr/Dockerfile @@ -13,7 +13,7 @@ ARG RUNTIME_BASE FROM ${BUILD_BASE} AS build WORKDIR /app/modules/bazarr COPY . . -RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \ +RUN node /app/node_modules/typescript/bin/tsc apikey.ts client.ts index.ts tools/index.ts servarr/settings.ts servarr/index.ts \ --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist FROM ${RUNTIME_BASE} @@ -22,3 +22,6 @@ COPY --from=build /app/modules/bazarr/dist /app/modules/bazarr/dist # provider's provisioner runs its reconcile loop in the same process, with the broker connected — # the convention novox/hq issues 060/061 settled. ENV MESH_TOOL_MODULES=/app/modules/bazarr/dist/index.js,/app/modules/bazarr/dist/tools/index.js +# NOT dist/servarr/index.js: that is a step the host runs to completion, named by the `servarr` +# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the +# serving sidecar too, and exit it. diff --git a/modules/bazarr/apikey.ts b/modules/bazarr/apikey.ts new file mode 100644 index 0000000..2204994 --- /dev/null +++ b/modules/bazarr/apikey.ts @@ -0,0 +1,37 @@ +// bazarr's own API key, found where bazarr keeps it. Shared by the client (tools, events) and the +// Servarr step, and kept apart from client.ts so the step and its test load it without the client. + +import { readFileSync } from "node:fs"; + +/** + * bazarr's own API key, read from where bazarr keeps it: `auth.apikey` in `config/config.yaml` under + * its config directory. bazarr makes this key itself on first start and nothing lets the mesh set it, + * so a key the mesh minted could never work; reading bazarr's own file needs nothing accepted and + * stays right if the operator regenerates the key in bazarr's settings screen. The file is read, never + * written. Undefined when the file or the key is not there. + */ +export function apiKeyFromConfigDir(configDir?: string): string | undefined { + if (!configDir) return undefined; + let text: string; + try { text = readFileSync(`${configDir.replace(/\/$/, "")}/config/config.yaml`, "utf8"); } + catch { return undefined; } + return apiKeyFromConfigYaml(text); +} + +/** `auth.apikey` from the text of bazarr's config.yaml — a top-level `auth:` mapping, one level deep. */ +export function apiKeyFromConfigYaml(text: string): string | undefined { + let inAuth = false; + for (const line of text.split(/\r?\n/)) { + if (/^\S/.test(line)) { + inAuth = /^auth:\s*$/.test(line); + continue; + } + if (!inAuth) continue; + const m = line.match(/^\s+apikey:\s*(.*?)\s*$/); + if (m) { + const v = m[1].replace(/^(['"])(.*)\1$/, "$2").trim(); + return v || undefined; + } + } + return undefined; +} diff --git a/modules/bazarr/client.ts b/modules/bazarr/client.ts index cead9ba..1da81b7 100644 --- a/modules/bazarr/client.ts +++ b/modules/bazarr/client.ts @@ -5,6 +5,8 @@ import { readFileSync } from "node:fs"; +import { apiKeyFromConfigDir } from "./apikey.js"; + export interface WantedSubtitle { kind: "episode" | "movie"; title: string; // series + episode, or movie title @@ -47,7 +49,7 @@ function meshConfig(file?: string): Record { * absent or unreadable yields undefined so callers fall back rather than crash. */ function readSecret(file?: string): string | undefined { if (!file) return undefined; - try { return readFileSync(file, "utf8").trim(); } + try { return readFileSync(file, "utf8").trim() || undefined; } catch { return undefined; } } @@ -66,9 +68,13 @@ export class BazarrClient { static fromEnv(env: NodeJS.ProcessEnv = process.env): BazarrClient { const cfg = meshConfig(env.MESH_BAZARR_CONFIG_FILE); const url = cfg.url ?? env.MESH_BAZARR_URL; - const apiKey = cfg.apiKey ?? readSecret(env.MESH_BAZARR_API_KEY_FILE) ?? env.MESH_BAZARR_API_KEY; + const apiKey = + cfg.apiKey ?? + apiKeyFromConfigDir(env.MESH_BAZARR_CONFIG_DIR) ?? + readSecret(env.MESH_BAZARR_API_KEY_FILE) ?? + env.MESH_BAZARR_API_KEY; if (!url) throw new Error("no Bazarr URL — set MESH_BAZARR_URL"); - if (!apiKey) throw new Error("no Bazarr API key — set MESH_BAZARR_API_KEY"); + if (!apiKey) throw new Error("no Bazarr API key — bazarr's config/config.yaml under MESH_BAZARR_CONFIG_DIR has none"); return new BazarrClient(url, apiKey); } diff --git a/modules/bazarr/module.json b/modules/bazarr/module.json index abe03c9..ff9ccd3 100644 --- a/modules/bazarr/module.json +++ b/modules/bazarr/module.json @@ -8,8 +8,7 @@ "subtitle.downloaded" ], "own-secrets": { - "broker": "/var/lib/mesh/bazarr/broker", - "api-key": "/var/lib/mesh/bazarr/api-key" + "broker": "/var/lib/mesh/bazarr/broker" }, "listens": [ { @@ -45,10 +44,15 @@ "path": "/var/lib/mesh/bazarr", "mode": "0700" }, + { + "id": "state", + "type": "directory", + "mode": "0700", + "place": "." + }, { "id": "config", "type": "directory", - "path": "/services/bazarr/config", "mode": "0700", "owner": "1000:1000" }, @@ -56,7 +60,7 @@ "id": "server", "type": "container", "name": "bazarr", - "image": "lscr.io/linuxserver/bazarr@sha256:3a820372f19fcb2981ea19fe4b5382934d67414afaba974bce831ddda0a64a02", + "image": "lscr.io/linuxserver/bazarr@sha256:d24bd0048c759a468970989e9df11a6b96a7628d556d00f923e60a35ba59237b", "env": { "PUID": "1000", "PGID": "1000", @@ -66,7 +70,7 @@ "6767" ], "volumes": [ - "/services/bazarr/config:/config", + "${dir:config}:/config", "/services/media/movies:/movies", "/services/media/series:/series", "/services/media/anime:/anime", @@ -76,7 +80,7 @@ { "id": "runtime-config", "type": "file", - "path": "/var/lib/mesh/bazarr/config.json", + "path": "${dir:state}/config.json", "mode": "0600", "content": "{}\n", "merge": "json" @@ -88,14 +92,12 @@ "network": "host", "volumes": [ "/var/lib/mesh/bazarr/broker:/run/secrets/broker:ro", - "/var/lib/mesh/bazarr/api-key:/run/secrets/api-key:ro", - "/var/lib/mesh/bazarr/config.json:/run/config/config.json:ro", - "/services/bazarr/config:/var/lib/bazarr/config:ro" + "${dir:state}/config.json:/run/config/config.json:ro", + "${dir:config}:/var/lib/bazarr/config:ro" ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}", - "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key", "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json", "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config" }, @@ -103,10 +105,42 @@ "runtime-config" ], "artifact": "runtime" + }, + { + "id": "servarr", + "type": "container", + "name": "mesh-bazarr-servarr", + "network": "host", + "run-once": true, + "volumes": [ + "${dir:config}:/var/lib/bazarr/config:ro", + "${dir:state}/sonarr-api.json:/run/servarr/sonarr-api.json:ro", + "${dir:state}/sonarr-api.secret:/run/servarr/sonarr-api.secret:ro", + "${dir:state}/radarr-api.json:/run/servarr/radarr-api.json:ro", + "${dir:state}/radarr-api.secret:/run/servarr/radarr-api.secret:ro" + ], + "env": { + "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}", + "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config", + "MESH_SERVARR_DIR": "/run/servarr" + }, + "args": [ + "run", + "/app/modules/bazarr/dist/servarr/index.js" + ], + "restart-on": [ + "bound-sonarr-api", + "secret-sonarr-api", + "bound-radarr-api", + "secret-radarr-api" + ], + "artifact": "runtime" } ], "requires": [ - "route" + "radarr-api", + "route", + "sonarr-api" ], "contributes": { "route": { @@ -115,7 +149,13 @@ } }, "binds": { - "route": "/var/lib/mesh/bazarr/route.json" + "route": "${dir:state}/route.json", + "sonarr-api": "${dir:state}/sonarr-api.json", + "radarr-api": "${dir:state}/radarr-api.json" + }, + "secrets": { + "sonarr-api": "${dir:state}/sonarr-api.secret", + "radarr-api": "${dir:state}/radarr-api.secret" }, "build": { "on": [ diff --git a/modules/bazarr/package.json b/modules/bazarr/package.json index de4a2cf..4192c12 100644 --- a/modules/bazarr/package.json +++ b/modules/bazarr/package.json @@ -4,6 +4,11 @@ "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0039).", "type": "module", "private": true, + "scripts": { + "build": "tsc apikey.ts client.ts index.ts tools/index.ts servarr/settings.ts servarr/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist", + "typecheck": "tsc -p tsconfig.json", + "test": "node --test --experimental-strip-types 'test/*.test.ts'" + }, "dependencies": { "@novox/mesh-sdk": "^0.1.0" }, diff --git a/modules/bazarr/servarr/index.ts b/modules/bazarr/servarr/index.ts new file mode 100644 index 0000000..e4ca621 --- /dev/null +++ b/modules/bazarr/servarr/index.ts @@ -0,0 +1,63 @@ +// bazarr's Servarr step — run once by the host after bazarr's server starts, and run again whenever a +// binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099). +// +// **A step, not a loop**: everything it does is a function of files the mesh writes, and the host +// already knows when they change. It connects to no broker. +// +// Exits non-zero when any app could not be put right — a refused credential, an unreachable app, a +// bazarr that would not keep the settings — so the node reports the step failed and the host runs it +// again on the next apply. Declared last in the manifest, so its failing gates nothing else of +// bazarr's (novox/hq ADR 0136). +// +// Reads, per app, `/.json` (the binding) and `/.secret` (the pair +// credential), where is MESH_SERVARR_DIR; and bazarr's own key from bazarr's own config.yaml +// under MESH_BAZARR_CONFIG_DIR. Never prints a key. + +import { join } from "node:path"; + +import { apiKeyFromConfigDir } from "../apikey.js"; +import { APPS, bazarrReady, readBinding, readIfThere, reconcileApp, type Http } from "./settings.js"; + +const dir = process.env.MESH_SERVARR_DIR ?? "/run/servarr"; +const url = process.env.MESH_BAZARR_URL ?? "http://127.0.0.1:6767"; +const waitSeconds = Number(process.env.MESH_BAZARR_WAIT_SECONDS ?? "180"); + +const http: Http = { fetch: (u, init) => fetch(u, init) }; + +const bazarrUp = await bazarrReady(http, { url, apiKey: "" }, waitSeconds * 1000); +if (!bazarrUp) { + console.error(`[bazarr-servarr] bazarr did not answer at ${url} within ${waitSeconds}s`); + process.exit(1); +} + +// Read after bazarr answers: on a first start bazarr writes its config.yaml, key included, as it boots. +const apiKey = apiKeyFromConfigDir(process.env.MESH_BAZARR_CONFIG_DIR); +if (!apiKey) { + console.error("[bazarr-servarr] no bazarr API key in bazarr's config/config.yaml under MESH_BAZARR_CONFIG_DIR"); + process.exit(1); +} +const bazarr = { url, apiKey }; + +let failed = 0; +for (const spec of APPS) { + const outcome = await reconcileApp( + http, + bazarr, + spec, + await readBinding(join(dir, `${spec.provision}.json`)), + await readIfThere(join(dir, `${spec.provision}.secret`)), + ); + switch (outcome.result) { + case "unchanged": + console.log(`[bazarr-servarr] ${outcome.app}: already as the mesh says; key taken by ${outcome.app}`); + break; + case "written": + console.log(`[bazarr-servarr] ${outcome.app}: wrote ${outcome.fields.join(", ")}; key taken by ${outcome.app}`); + break; + case "refused": + failed++; + console.error(`[bazarr-servarr] ${outcome.app}: ${outcome.problem}`); + break; + } +} +process.exitCode = failed > 0 ? 1 : 0; diff --git a/modules/bazarr/servarr/settings.ts b/modules/bazarr/servarr/settings.ts new file mode 100644 index 0000000..13888d3 --- /dev/null +++ b/modules/bazarr/servarr/settings.ts @@ -0,0 +1,290 @@ +// Where bazarr reaches Sonarr and Radarr — decided by the mesh, written into bazarr by bazarr's own +// API. +// +// **Why this exists.** bazarr keeps its connection to each app in its own `config/config.yaml`, which +// it holds in memory and writes back whenever its settings change — so the mesh cannot own that file +// without the two overwriting each other. bazarr requires `sonarr-api` and `radarr-api`; the mesh +// delivers, for each, a binding (where the app is: `at`, and what it serves: `port`, `scheme`, +// `url-base`) and a pair credential (the app's API key, accepted by the operator — a Servarr app has +// exactly one key and the mesh cannot mint it, novox/hq ADR 0092). This step reads those files and +// makes bazarr's settings say the same thing, through `POST /api/system/settings` — the call bazarr's +// own settings screen makes, which also restarts bazarr's SignalR feed from the app. +// +// **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. Whether +// bazarr uses the app at all (`general.use_sonarr`), sync intervals, excluded tags, path mappings and +// every other choice the operator made are left exactly as they are: the mesh knows where the app is, +// not what bazarr should do with it. +// +// **A credential the app refuses is never written.** Until the operator accepts the app's key for this +// pair the mesh delivers a value it minted, which no Servarr app accepts. Writing it would replace a +// working key in bazarr with a dead one, so the key is tried against the app first; refused, nothing +// for that app is written and the step fails naming the `secret accept` that fixes it. +// +// The same shape as ombi's step (modules/ombi/servarr), repeated rather than shared because a module +// is built from its own directory and nothing else (novox/hq ADR 0069). Pure logic and a small HTTP +// seam, tested against fakes (test/servarr.test.ts). + +import { readFile } from "node:fs/promises"; + +/** One Servarr app bazarr connects to. */ +export interface ServarrApp { + /** The section of bazarr's settings that holds the connection: settings..* */ + app: "sonarr" | "radarr"; + /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */ + provision: string; + /** The app's own status endpoint, which answers 401 to a wrong key. */ + statusPath: string; +} + +export const APPS: readonly ServarrApp[] = [ + { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" }, + { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status" }, +]; + +/** The connection fields bazarr keeps for an app — the only ones this step ever writes. */ +export interface Connection { + ip: string; + port: number; + ssl: boolean; + /** bazarr's base_url: "" at the root, otherwise "/base". */ + base_url: string; + apikey: string; +} + +/** What the mesh wrote at `binds.`: the binding document. */ +export interface Binding { + provision?: string; + from?: string; + at?: string; + as?: string; + serves?: Record; +} + +export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string }; + +/** + * The connection the mesh says bazarr should use. Refused rather than guessed when the binding cannot + * be dialled from bazarr's own container: a loopback `at` is bazarr's container itself. + */ +export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted { + if (!binding) { + return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` }; + } + const at = typeof binding.at === "string" ? binding.at.trim() : ""; + const serves = binding.serves ?? {}; + const port = Number(serves.port); + if (!at) return { ok: false, problem: `the ${spec.provision} binding names no host (at)` }; + if (isLoopback(at)) { + return { + ok: false, + problem: + `the ${spec.provision} binding says ${spec.app} is at ${at}, which from bazarr's own container is ` + + `bazarr itself. The mesh hands loopback to a machine that is not on the private network; put it ` + + `on the private network so ${spec.app} has an address bazarr can dial`, + }; + } + if (!Number.isInteger(port) || port <= 0 || port > 65535) { + return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` }; + } + const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http"; + if (scheme !== "http" && scheme !== "https") { + return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which bazarr cannot dial` }; + } + const key = (credential ?? "").trim(); + if (!key) return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` }; + return { + ok: true, + from: typeof binding.from === "string" ? binding.from : "", + connection: { ip: at, port, ssl: scheme === "https", base_url: baseUrlOf(serves["url-base"]), apikey: key }, + }; +} + +/** A URL base as bazarr stores it: "" for none, else one leading slash and no trailing one. */ +export function baseUrlOf(urlBase: unknown): string { + const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : ""; + return trimmed === "" ? "" : `/${trimmed}`; +} + +function isLoopback(host: string): boolean { + const h = host.toLowerCase(); + return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h); +} + +/** Which connection fields differ between what bazarr holds and what the mesh says. Names only. */ +export function differing(current: Record | undefined, want: Connection): (keyof Connection)[] { + const now = current ?? {}; + const out: (keyof Connection)[] = []; + if (String(now.ip ?? "") !== want.ip) out.push("ip"); + if (Number(now.port ?? 0) !== want.port) out.push("port"); + if (Boolean(now.ssl) !== want.ssl) out.push("ssl"); + if (baseUrlOf(now.base_url) !== want.base_url) out.push("base_url"); + if (String(now.apikey ?? "") !== want.apikey) out.push("apikey"); + return out; +} + +/** + * The form bazarr's settings endpoint takes for the differing fields: `settings--`. + * bazarr casts "true"/"false" to booleans and digit strings to integers itself. + */ +export function settingsForm(spec: ServarrApp, want: Connection, fields: readonly (keyof Connection)[]): URLSearchParams { + const form = new URLSearchParams(); + for (const f of fields) { + const v = want[f]; + form.append(`settings-${spec.app}-${f}`, typeof v === "boolean" ? (v ? "true" : "false") : String(v)); + } + return form; +} + +/** The app's base URL as the step dials it — the same host and port bazarr will be given. */ +export function appUrl(want: Connection): string { + const scheme = want.ssl ? "https" : "http"; + const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip; + return `${scheme}://${host}:${want.port}${want.base_url}`; +} + +/** How one app came out. */ +export type Outcome = + | { app: string; result: "unchanged" } + | { app: string; result: "written"; fields: string[] } + | { app: string; result: "refused"; problem: string }; + +/** The HTTP the step needs, so a test can stand fakes in for bazarr and the apps. */ +export interface Http { + fetch(url: string, init?: { method?: string; headers?: Record; body?: string }): Promise<{ + status: number; + text(): Promise; + }>; +} + +export interface Bazarr { + url: string; + apiKey: string; +} + +async function bazarrCall(http: Http, bazarr: Bazarr, method: string, path: string, form?: URLSearchParams): Promise { + const res = await http.fetch(`${bazarr.url.replace(/\/$/, "")}/api${path}`, { + method, + headers: { + "X-API-KEY": bazarr.apiKey, + Accept: "application/json", + ...(form ? { "Content-Type": "application/x-www-form-urlencoded" } : {}), + }, + body: form ? form.toString() : undefined, + }); + const text = await res.text(); + if (res.status < 200 || res.status >= 300) { + // bazarr's error body is a message, never a request echo, so it carries no key. + throw new Error(`bazarr ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`); + } + return text ? (JSON.parse(text) as unknown) : undefined; +} + +/** + * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error + * when it could not be asked. + */ +export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise { + const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, { + method: "GET", + headers: { "X-Api-Key": want.apikey, Accept: "application/json" }, + }); + if (res.status === 401 || res.status === 403) return false; + if (res.status >= 200 && res.status < 300) return true; + throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`); +} + +/** The remedy for a refused key, in the controller's own words (ADR 0092). */ +export function acceptRemedy(spec: ServarrApp, from: string): string { + return ( + `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` + + `into bazarr. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` + + `key for this pair — \`secret accept bazarr ${spec.provision} --provider ${from || ""} ` + + `--from \`` + ); +} + +/** + * Bring bazarr's connection to one app in line with the mesh: check the key against the app, compare, + * write only the differing connection fields, then read bazarr's settings back to confirm they took. + * Never throws: every failure is an outcome with a reason. + */ +export async function reconcileApp( + http: Http, + bazarr: Bazarr, + spec: ServarrApp, + binding: Binding | undefined, + credential: string | undefined, +): Promise { + const w = wanted(spec, binding, credential); + // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not + // narrow. + if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem }; + const want = w.connection; + + try { + if (!(await appTakes(http, spec, want))) { + return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) }; + } + } catch (err) { + return { + app: spec.app, + result: "refused", + problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`, + }; + } + + try { + const before = await sectionOf(http, bazarr, spec); + const fields = differing(before, want); + if (fields.length === 0) return { app: spec.app, result: "unchanged" }; + await bazarrCall(http, bazarr, "POST", "/system/settings", settingsForm(spec, want, fields)); + const still = differing(await sectionOf(http, bazarr, spec), want); + if (still.length > 0) { + return { app: spec.app, result: "refused", problem: `bazarr did not keep its ${spec.app} settings (${still.join(", ")})` }; + } + return { app: spec.app, result: "written", fields }; + } catch (err) { + return { app: spec.app, result: "refused", problem: message(err) }; + } +} + +async function sectionOf(http: Http, bazarr: Bazarr, spec: ServarrApp): Promise | undefined> { + const doc = (await bazarrCall(http, bazarr, "GET", "/system/settings")) as Record | undefined; + return doc?.[spec.app] as Record | undefined; +} + +/** Wait for bazarr to answer, because the step runs right after its container starts. */ +export async function bazarrReady(http: Http, bazarr: Bazarr, waitMs: number, pauseMs = 2000): Promise { + const until = Date.now() + waitMs; + for (;;) { + try { + const res = await http.fetch(`${bazarr.url.replace(/\/$/, "")}/api/system/ping`, { method: "GET" }); + if (res.status === 200) return true; + } catch { + // not listening yet + } + if (Date.now() >= until) return false; + await new Promise((r) => setTimeout(r, pauseMs)); + } +} + +/** A file the mesh wrote, or undefined when it is not there. */ +export async function readIfThere(path: string | undefined): Promise { + if (!path) return undefined; + return readFile(path, "utf8").catch(() => undefined); +} + +/** A binding file parsed, or undefined when absent or not JSON. */ +export async function readBinding(path: string | undefined): Promise { + const raw = await readIfThere(path); + if (raw === undefined) return undefined; + try { + return JSON.parse(raw) as Binding; + } catch { + return undefined; + } +} + +function message(err: unknown): string { + return err instanceof Error ? err.message : String(err); +} diff --git a/modules/bazarr/test/servarr.test.ts b/modules/bazarr/test/servarr.test.ts new file mode 100644 index 0000000..60c335d --- /dev/null +++ b/modules/bazarr/test/servarr.test.ts @@ -0,0 +1,156 @@ +// What holds bazarr's Servarr step (servarr/settings.ts): the connection bazarr keeps for Sonarr and +// Radarr is made to say what the mesh bound — host, port, TLS, base path, key — and nothing else +// bazarr keeps is sent; nothing is written when nothing differs; and a key the app refuses (the mesh's +// own minted value, before the operator accepts the app's key) is never written, with the +// `secret accept` that fixes it named. Also: bazarr's own key is found in its config.yaml's `auth` +// section and not in the `sonarr`/`radarr` sections that also carry an `apikey`. +// +// bazarr and the apps are fakes answering as the real ones do (checked against +// lscr.io/linuxserver/bazarr v1.6.1-ls364: GET/POST /api/system/settings with X-API-KEY, the form +// keys `settings-
-`, 204 on save). + +import { test } from "node:test"; +import assert from "node:assert/strict"; + +import { apiKeyFromConfigYaml } from "../apikey.ts"; +import { APPS, baseUrlOf, differing, reconcileApp, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts"; + +const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp; +const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp; +const THE_KEY = "the-apps-own-key"; +const BAZARR = { url: "http://127.0.0.1:6767", apiKey: "bazarr-key" }; + +function binding(provision: string, port: number, at = "ace.internal"): Binding { + return { binding: 1, provision, from: "ace", at, as: "mesh_ace_bazarr", serves: { scheme: "http", port, "url-base": "" } } as Binding; +} + +interface Call { + method: string; + url: string; + body?: string; +} + +/** bazarr's settings (one document, sections per app) and the apps' key check, behind one fetch. */ +function fakes(settings: Record>, opts: { appKey?: string; reachable?: boolean } = {}) { + const calls: Call[] = []; + const appKey = opts.appKey ?? THE_KEY; + const http: Http = { + async fetch(url, init) { + const method = init?.method ?? "GET"; + calls.push({ method, url, body: init?.body }); + const reply = (status: number, value?: unknown) => ({ + status, + text: async () => (value === undefined ? "" : JSON.stringify(value)), + }); + const u = new URL(url); + if (u.pathname.endsWith("/system/status")) { + if (opts.reachable === false) throw new Error("connect ECONNREFUSED"); + return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401); + } + if (init?.headers?.["X-API-KEY"] !== BAZARR.apiKey) return reply(401); + if (u.pathname !== "/api/system/settings") return reply(404); + if (method === "GET") return reply(200, settings); + // bazarr's save_settings: split the key, cast as bazarr casts, store. + for (const [k, raw] of new URLSearchParams(init?.body ?? "")) { + const [, section, field] = k.split("-"); + let v: unknown = raw; + if (raw === "true") v = true; + else if (raw === "false") v = false; + else if (/^\d+$/.test(raw)) v = Number(raw); + settings[section] = { ...(settings[section] ?? {}), [field]: v }; + } + return reply(204); + }, + }; + return { http, calls, settings }; +} + +/** ace's bazarr today: the apps by container name on HAL's shared network. */ +function aceToday(): Record> { + return { + general: { use_sonarr: true, use_radarr: true, port: 6767 }, + sonarr: { ip: "sonarr", port: 8989, ssl: false, base_url: "", apikey: THE_KEY, series_sync: 15, excluded_series_types: ["anime"] }, + radarr: { ip: "radarr", port: 7878, ssl: false, base_url: "", apikey: THE_KEY, movies_sync: 15 }, + }; +} + +test("moving an app writes only host and port, and leaves every other setting alone", async () => { + const f = fakes(aceToday()); + const out = await reconcileApp(f.http, BAZARR, SONARR, binding("sonarr-api", 20010), THE_KEY); + assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port"] }); + const post = f.calls.find((c) => c.method === "POST"); + assert.ok(post); + assert.deepEqual([...new URLSearchParams(post.body ?? "").keys()].sort(), ["settings-sonarr-ip", "settings-sonarr-port"]); + assert.equal(f.settings.sonarr.ip, "ace.internal"); + assert.equal(f.settings.sonarr.port, 20010); + assert.deepEqual(f.settings.sonarr.excluded_series_types, ["anime"]); + assert.equal(f.settings.radarr.ip, "radarr", "radarr is its own app and was not touched"); +}); + +test("nothing is written when bazarr already says what the mesh says", async () => { + const s = aceToday(); + s.radarr = { ...s.radarr, ip: "ace.internal", port: 20011 }; + const f = fakes(s); + const out = await reconcileApp(f.http, BAZARR, RADARR, binding("radarr-api", 20011), THE_KEY); + assert.deepEqual(out, { app: "radarr", result: "unchanged" }); + assert.equal(f.calls.filter((c) => c.method === "POST").length, 0); +}); + +test("a key the app refuses is never written, and the remedy is named", async () => { + const f = fakes(aceToday()); + const out = await reconcileApp(f.http, BAZARR, SONARR, binding("sonarr-api", 20010), "a-value-the-mesh-minted"); + assert.equal(out.result, "refused"); + assert.match((out as { problem: string }).problem, /secret accept bazarr sonarr-api --provider ace/); + assert.equal(f.calls.filter((c) => c.method === "POST").length, 0); + assert.equal(f.settings.sonarr.apikey, THE_KEY, "the working key stays"); + assert.equal(f.settings.sonarr.ip, "sonarr", "nothing moved either"); +}); + +test("an unreachable app writes nothing", async () => { + const f = fakes(aceToday(), { reachable: false }); + const out = await reconcileApp(f.http, BAZARR, SONARR, binding("sonarr-api", 20010), THE_KEY); + assert.equal(out.result, "refused"); + assert.equal(f.calls.filter((c) => c.method === "POST").length, 0); +}); + +test("a loopback binding is refused: from bazarr's container that is bazarr", () => { + const w = wanted(SONARR, binding("sonarr-api", 8989, "127.0.0.1"), THE_KEY); + assert.equal(w.ok, false); +}); + +test("a new key is written when the operator accepted a different one", async () => { + const s = aceToday(); + s.sonarr = { ...s.sonarr, ip: "ace.internal", port: 20010, apikey: "an-old-key" }; + const f = fakes(s); + const out = await reconcileApp(f.http, BAZARR, SONARR, binding("sonarr-api", 20010), THE_KEY); + assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["apikey"] }); + assert.equal(f.settings.sonarr.apikey, THE_KEY); +}); + +test("base paths compare as bazarr stores them", () => { + assert.equal(baseUrlOf(""), ""); + assert.equal(baseUrlOf("/"), ""); + assert.equal(baseUrlOf("sonarr/"), "/sonarr"); + const want = { ip: "a", port: 1, ssl: false, base_url: "", apikey: "k" }; + assert.deepEqual(differing({ ip: "a", port: 1, ssl: false, base_url: "/", apikey: "k" }, want), []); +}); + +test("bazarr's own key is auth.apikey, not an app's", () => { + const yaml = [ + "analytics:", + " enabled: false", + "auth:", + " apikey: 0123456789abcdef0123456789abcdef", + " password: ''", + " type: form", + "general:", + " port: 6767", + "sonarr:", + " apikey: not-this-one", + "", + ].join("\n"); + assert.equal(apiKeyFromConfigYaml(yaml), "0123456789abcdef0123456789abcdef"); + assert.equal(apiKeyFromConfigYaml("sonarr:\n apikey: x\n"), undefined); + assert.equal(apiKeyFromConfigYaml("auth:\n apikey: ''\n"), undefined); + assert.equal(apiKeyFromConfigYaml("auth:\r\n apikey: 'abc'\r\n"), "abc"); +}); diff --git a/modules/bazarr/tsconfig.json b/modules/bazarr/tsconfig.json index 3677859..803dfeb 100644 --- a/modules/bazarr/tsconfig.json +++ b/modules/bazarr/tsconfig.json @@ -8,5 +8,5 @@ "skipLibCheck": true, "noEmit": true }, - "include": ["client.ts", "index.ts", "tools/index.ts"] + "include": ["apikey.ts", "client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "servarr/index.ts"] }