Release v1.4.23 with critical bug audit fixes

tests/app-order.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { reorderPackageOrderByDrop } from "../src/renderer/App";
+
+describe("reorderPackageOrderByDrop", () => {
+  it("moves adjacent package down by one on drop", () => {
+    const next = reorderPackageOrderByDrop(["a", "b", "c"], "b", "c");
+    expect(next).toEqual(["a", "c", "b"]);
+  });
+
+  it("moves package after lower drop target", () => {
+    const next = reorderPackageOrderByDrop(["a", "b", "c", "d"], "a", "c");
+    expect(next).toEqual(["b", "c", "a", "d"]);
+  });
+
+  it("returns original order when ids are invalid", () => {
+    const order = ["a", "b", "c"];
+    expect(reorderPackageOrderByDrop(order, "x", "b")).toEqual(order);
+    expect(reorderPackageOrderByDrop(order, "a", "x")).toEqual(order);
+    expect(reorderPackageOrderByDrop(order, "a", "a")).toEqual(order);
+  });
+});

tests/debrid.test.ts

@@ -114,6 +114,44 @@ describe("debrid service", () => {
     expect(result.fileSize).toBe(2048);
   });
 
+  it("sends Bearer auth header to BestDebrid", async () => {
+    const settings = {
+      ...defaultSettings(),
+      token: "",
+      bestToken: "best-token",
+      providerPrimary: "bestdebrid" as const,
+      providerSecondary: "none" as const,
+      providerTertiary: "none" as const,
+      autoProviderFallback: true
+    };
+
+    let authHeader = "";
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("/api/v1/generateLink?link=")) {
+        const headers = init?.headers;
+        if (headers instanceof Headers) {
+          authHeader = headers.get("Authorization") || "";
+        } else if (Array.isArray(headers)) {
+          const tuple = headers.find(([key]) => key.toLowerCase() === "authorization");
+          authHeader = tuple?.[1] || "";
+        } else {
+          authHeader = String((headers as Record<string, unknown> | undefined)?.Authorization || "");
+        }
+        return new Response(JSON.stringify({ download: "https://best.example/file.bin", filename: "file.bin", filesize: 42 }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      return new Response("not-found", { status: 404 });
+    }) as typeof fetch;
+
+    const service = new DebridService(settings);
+    const result = await service.unrestrictLink("https://hoster.example/file/abc");
+    expect(result.provider).toBe("bestdebrid");
+    expect(authHeader).toBe("Bearer best-token");
+  });
+
   it("supports AllDebrid unlock", async () => {
     const settings = {
       ...defaultSettings(),
@@ -216,6 +254,30 @@ describe("debrid service", () => {
     expect(allDebridCalls).toBe(0);
   });
 
+  it("does not use secondary provider when fallback is disabled and primary is missing", async () => {
+    const settings = {
+      ...defaultSettings(),
+      token: "",
+      megaLogin: "user",
+      megaPassword: "pass",
+      providerPrimary: "realdebrid" as const,
+      providerSecondary: "megadebrid" as const,
+      providerTertiary: "none" as const,
+      autoProviderFallback: false
+    };
+
+    const megaWeb = vi.fn(async () => ({
+      fileName: "should-not-run.bin",
+      directUrl: "https://unused",
+      fileSize: null,
+      retriesUsed: 0
+    }));
+
+    const service = new DebridService(settings, { megaWebUnrestrict: megaWeb });
+    await expect(service.unrestrictLink("https://rapidgator.net/file/example.part5.rar.html")).rejects.toThrow(/nicht konfiguriert/i);
+    expect(megaWeb).toHaveBeenCalledTimes(0);
+  });
+
   it("allows disabling secondary and tertiary providers", async () => {
     const settings = {
       ...defaultSettings(),
@@ -367,6 +429,82 @@ describe("debrid service", () => {
       { link: linkFromProvider, fileName: "from-provider.part2.rar" }
     ]));
   });
+
+  it("does not unrestrict rapidgator links during filename scan after page lookup miss", async () => {
+    const settings = {
+      ...defaultSettings(),
+      token: "rd-token",
+      providerPrimary: "realdebrid" as const,
+      providerSecondary: "none" as const,
+      providerTertiary: "none" as const,
+      allDebridToken: ""
+    };
+
+    const link = "https://rapidgator.net/file/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    let unrestrictCalls = 0;
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("api.real-debrid.com/rest/1.0/unrestrict/link")) {
+        unrestrictCalls += 1;
+        return new Response(JSON.stringify({ error: "should-not-be-called" }), {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (url === link) {
+        return new Response("not found", { status: 404 });
+      }
+      return new Response("not-found", { status: 404 });
+    }) as typeof fetch;
+
+    const service = new DebridService(settings);
+    const resolved = await service.resolveFilenames([link]);
+    expect(resolved.size).toBe(0);
+    expect(unrestrictCalls).toBe(0);
+  });
+
+  it("does not map AllDebrid filename infos by index when response link is missing", async () => {
+    const settings = {
+      ...defaultSettings(),
+      token: "",
+      bestToken: "",
+      allDebridToken: "ad-token",
+      providerPrimary: "realdebrid" as const,
+      providerSecondary: "none" as const,
+      providerTertiary: "none" as const,
+      autoProviderFallback: true
+    };
+
+    const linkA = "https://rapidgator.net/file/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    const linkB = "https://rapidgator.net/file/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("api.alldebrid.com/v4/link/infos")) {
+        return new Response(JSON.stringify({
+          status: "success",
+          data: {
+            infos: [
+              { filename: "wrong-a.mkv" },
+              { filename: "wrong-b.mkv" }
+            ]
+          }
+        }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (url === linkA || url === linkB) {
+        return new Response("no title", { status: 404 });
+      }
+      return new Response("not-found", { status: 404 });
+    }) as typeof fetch;
+
+    const service = new DebridService(settings);
+    const resolved = await service.resolveFilenames([linkA, linkB]);
+    expect(resolved.size).toBe(0);
+  });
 });
 
 describe("normalizeResolvedFilename", () => {

tests/download-manager.test.ts

@@ -3636,6 +3636,150 @@ describe("download manager", () => {
     expect(snapshot.session.items[itemId]?.fullStatus).toBe("Entpackt (Quelle fehlt)");
   });
 
+  it("does not delete stale target file when stopping during unrestrict phase", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dm-"));
+    tempDirs.push(root);
+
+    const manager = new DownloadManager(
+      {
+        ...defaultSettings(),
+        token: "rd-token",
+        outputDir: path.join(root, "downloads"),
+        extractDir: path.join(root, "extract"),
+        autoExtract: false,
+        maxParallel: 1
+      },
+      emptySession(),
+      createStoragePaths(path.join(root, "state"))
+    );
+
+    manager.addPackages([{ name: "stop-unrestrict", links: ["https://dummy/slow-unrestrict"] }]);
+    const initialSnapshot = manager.getSnapshot();
+    const pkgId = initialSnapshot.session.packageOrder[0];
+    const itemId = initialSnapshot.session.packages[pkgId]?.itemIds[0] || "";
+    if (!itemId) {
+      throw new Error("item missing");
+    }
+
+    const item = manager.getSnapshot().session.items[itemId];
+    const staleTargetPath = path.join(path.dirname(item.targetPath), "existing-before-start.mkv");
+    fs.mkdirSync(path.dirname(staleTargetPath), { recursive: true });
+    fs.writeFileSync(staleTargetPath, "keep", "utf8");
+
+    const mutableSession = manager.getSnapshot().session;
+    if (mutableSession.items[itemId]) {
+      mutableSession.items[itemId].targetPath = staleTargetPath;
+      mutableSession.items[itemId].fileName = path.basename(staleTargetPath);
+      mutableSession.items[itemId].downloadedBytes = 0;
+      mutableSession.items[itemId].progressPercent = 0;
+    }
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("/unrestrict/link")) {
+        await new Promise((resolve) => setTimeout(resolve, 260));
+        return new Response(
+          JSON.stringify({
+            download: "https://cdn.example/unused.bin",
+            filename: "new-file.mkv",
+            filesize: 1024
+          }),
+          {
+            status: 200,
+            headers: { "Content-Type": "application/json" }
+          }
+        );
+      }
+      return new Response("not-found", { status: 404 });
+    }) as typeof fetch;
+
+    manager.start();
+    await new Promise((resolve) => setTimeout(resolve, 40));
+    manager.stop();
+    await waitFor(() => manager.getSnapshot().session.items[itemId]?.status === "cancelled", 12000);
+    expect(fs.existsSync(staleTargetPath)).toBe(true);
+  });
+
+  it("counts re-enabled package items in run summary totals", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dm-"));
+    tempDirs.push(root);
+
+    const payload = Buffer.alloc(96 * 1024, 5);
+    const server = http.createServer((req, res) => {
+      if ((req.url || "") !== "/slow") {
+        res.statusCode = 404;
+        res.end("not-found");
+        return;
+      }
+      setTimeout(() => {
+        res.statusCode = 200;
+        res.setHeader("Accept-Ranges", "bytes");
+        res.setHeader("Content-Length", String(payload.length));
+        res.end(payload);
+      }, 180);
+    });
+
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      throw new Error("server address unavailable");
+    }
+    const directUrl = `http://127.0.0.1:${address.port}/slow`;
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("/unrestrict/link")) {
+        return new Response(
+          JSON.stringify({
+            download: directUrl,
+            filename: "episode.mkv",
+            filesize: payload.length
+          }),
+          {
+            status: 200,
+            headers: { "Content-Type": "application/json" }
+          }
+        );
+      }
+      return originalFetch(input);
+    }) as typeof fetch;
+
+    try {
+      const manager = new DownloadManager(
+        {
+          ...defaultSettings(),
+          token: "rd-token",
+          outputDir: path.join(root, "downloads"),
+          extractDir: path.join(root, "extract"),
+          autoExtract: false,
+          maxParallel: 1
+        },
+        emptySession(),
+        createStoragePaths(path.join(root, "state"))
+      );
+
+      manager.addPackages([
+        { name: "pkg-a", links: ["https://dummy/a"] },
+        { name: "pkg-b", links: ["https://dummy/b"] }
+      ]);
+
+      const packageIds = manager.getSnapshot().session.packageOrder;
+      const packageToToggle = packageIds[0];
+      manager.start();
+      await new Promise((resolve) => setTimeout(resolve, 40));
+      manager.togglePackage(packageToToggle);
+      manager.togglePackage(packageToToggle);
+
+      await waitFor(() => !manager.getSnapshot().session.running, 25000);
+      const summary = manager.getSnapshot().summary;
+      expect(summary?.total).toBe(2);
+    } finally {
+      server.close();
+      await once(server, "close");
+    }
+  });
+
   it("auto-renames extracted 4SF scene files to folder format", async () => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dm-"));
     tempDirs.push(root);

tests/storage.test.ts

@@ -149,6 +149,23 @@ describe("settings storage", () => {
     expect(normalized.archivePasswordList).toBe("one\ntwo\nthree");
   });
 
+  it("assigns and preserves bandwidth schedule ids", () => {
+    const normalized = normalizeSettings({
+      ...defaultSettings(),
+      bandwidthSchedules: [{ startHour: 1, endHour: 6, speedLimitKbps: 1024, enabled: true }]
+    });
+
+    const generatedId = normalized.bandwidthSchedules[0]?.id;
+    expect(typeof generatedId).toBe("string");
+    expect(generatedId?.length).toBeGreaterThan(0);
+
+    const normalizedAgain = normalizeSettings({
+      ...defaultSettings(),
+      bandwidthSchedules: normalized.bandwidthSchedules
+    });
+    expect(normalizedAgain.bandwidthSchedules[0]?.id).toBe(generatedId);
+  });
+
   it("resets stale active statuses to queued on session load", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-store-"));
     tempDirs.push(dir);

tests/update.test.ts

@@ -106,7 +106,51 @@ describe("update", () => {
     const result = await installLatestUpdate("owner/repo", prechecked);
     expect(result.started).toBe(true);
     expect(requestedUrls.some((url) => url.includes("/releases/latest/download/"))).toBe(true);
+    expect(requestedUrls.filter((url) => url.includes("stale-setup.exe"))).toHaveLength(1);
   });
+
+  it("aborts hanging update body downloads on idle timeout", async () => {
+    const previousTimeout = process.env.RD_UPDATE_BODY_IDLE_TIMEOUT_MS;
+    process.env.RD_UPDATE_BODY_IDLE_TIMEOUT_MS = "1000";
+
+    try {
+      globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+        const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+        if (url.includes("hang-setup.exe")) {
+          const body = new ReadableStream<Uint8Array>({
+            start(controller) {
+              controller.enqueue(new Uint8Array([1, 2, 3]));
+            }
+          });
+          return new Response(body, {
+            status: 200,
+            headers: { "Content-Type": "application/octet-stream" }
+          });
+        }
+        return new Response("missing", { status: 404 });
+      }) as typeof fetch;
+
+      const prechecked: UpdateCheckResult = {
+        updateAvailable: true,
+        currentVersion: APP_VERSION,
+        latestVersion: "9.9.9",
+        latestTag: "v9.9.9",
+        releaseUrl: "https://github.com/owner/repo/releases/tag/v9.9.9",
+        setupAssetUrl: "https://example.invalid/hang-setup.exe",
+        setupAssetName: ""
+      };
+
+      const result = await installLatestUpdate("owner/repo", prechecked);
+      expect(result.started).toBe(false);
+      expect(result.message).toMatch(/timeout/i);
+    } finally {
+      if (previousTimeout === undefined) {
+        delete process.env.RD_UPDATE_BODY_IDLE_TIMEOUT_MS;
+      } else {
+        process.env.RD_UPDATE_BODY_IDLE_TIMEOUT_MS = previousTimeout;
+      }
+    }
+  }, 20000);
 });
 
 describe("normalizeUpdateRepo extended", () => {

tests/utils.test.ts

@@ -14,6 +14,10 @@ describe("utils", () => {
     expect(sanitizeFilename("   ")).toBe("Paket");
     expect(sanitizeFilename("test\0file.txt")).toBe("testfile.txt");
     expect(sanitizeFilename("\0\0\0")).toBe("Paket");
+    expect(sanitizeFilename("..")).toBe("Paket");
+    expect(sanitizeFilename(".")).toBe("Paket");
+    expect(sanitizeFilename("release... ")).toBe("release");
+    expect(sanitizeFilename(" con ")).toBe("con_");
   });
 
   it("parses package markers", () => {