Merge from Dev branch

.env.example

@@ -33,12 +33,12 @@ INITIAL_ADMIN_DISCORD_ID=your_discord_user_id
 EMAIL_ENABLED=true
 SMTP_HOST=mail-eu.smtp2go.com
 SMTP_PORT=587
-SMTP_USERNAME=no-reply@m.plexdev.live
+SMTP_USERNAME=no-reply@m.plexdev.xyz
 SMTP_PASSWORD=your_smtp_password
 SMTP_USE_TLS=true
-EMAIL_FROM_ADDRESS=no-reply@m.plexdev.live
+EMAIL_FROM_ADDRESS=no-reply@m.plexdev.xyz
 EMAIL_FROM_NAME=PlexAddons
-ADMIN_NOTIFICATION_EMAIL=contact@plexdev.live
+ADMIN_NOTIFICATION_EMAIL=contact@plexdev.xyz
 
 # Discord Bot (separate from OAuth2 - for DM notifications)
 DISCORD_BOT_TOKEN=your_discord_bot_token

.github/workflows/ci.yml

@@ -0,0 +1,114 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  backend-lint:
+    name: Backend Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: plexaddons-api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip install -r requirements.txt
+      - name: Syntax check
+        run: |
+          python -c "
+          import ast, pathlib, sys
+          errors = []
+          for p in pathlib.Path('app').rglob('*.py'):
+              try:
+                  ast.parse(p.read_text())
+              except SyntaxError as e:
+                  errors.append(f'{p}: {e}')
+          if errors:
+              for e in errors: print(e)
+              sys.exit(1)
+          print(f'All {len(list(pathlib.Path(\"app\").rglob(\"*.py\")))} files OK')
+          "
+
+  backend-test:
+    name: Backend Tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: plexaddons-api
+    env:
+      SECRET_KEY: test-secret-key-ci
+      DATABASE_URL: sqlite+aiosqlite:///test.db
+      REDIS_URL: redis://localhost:6379/15
+      DISCORD_CLIENT_ID: test
+      DISCORD_CLIENT_SECRET: test
+      DISCORD_REDIRECT_URI: http://localhost/callback
+      STRIPE_SECRET_KEY: sk_test_fake
+      STRIPE_WEBHOOK_SECRET: whsec_test
+      STRIPE_PRO_PRICE_ID: price_pro
+      STRIPE_PREMIUM_PRICE_ID: price_premium
+      PAYPAL_CLIENT_ID: test
+      PAYPAL_CLIENT_SECRET: test
+      PAYPAL_WEBHOOK_ID: test
+      PAYPAL_PRO_PLAN_ID: P-test
+      PAYPAL_PREMIUM_PLAN_ID: P-test
+      ENVIRONMENT: testing
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip install -r requirements.txt
+      - run: python -m pytest tests/ -v --tb=short
+
+  frontend-lint:
+    name: Frontend Lint & Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: plexaddons-web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: plexaddons-web/package-lock.json
+      - run: npm ci
+      - run: npx tsc --noEmit
+      - run: npm run build
+
+  frontend-test:
+    name: Frontend Tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: plexaddons-web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: plexaddons-web/package-lock.json
+      - run: npm ci
+      - run: npm test
+
+  docker-build:
+    name: Docker Build Check
+    runs-on: ubuntu-latest
+    needs: [backend-test, frontend-test]
+    if: github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build API image
+        run: docker build -t plexaddons-api:ci plexaddons-api/
+      - name: Build Web image
+        run: docker build -t plexaddons-web:ci plexaddons-web/

.gitignore

@@ -57,4 +57,7 @@ secrets/
 # Coverage
 .coverage
 htmlcov/
+
+# Audit
+AUDIT_FINDINGS.txt
 .pytest_cache/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "version-checker/pavc"]
+	path = version-checker/pavc
+	url = https://github.com/Bali0531-RC/pavc

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   api:
     build:
@@ -26,7 +24,7 @@ services:
       - PAYPAL_PRO_PLAN_ID=${PAYPAL_PRO_PLAN_ID}
       - PAYPAL_PREMIUM_PLAN_ID=${PAYPAL_PREMIUM_PLAN_ID}
       - INITIAL_ADMIN_DISCORD_ID=${INITIAL_ADMIN_DISCORD_ID}
-      - FRONTEND_URL=${FRONTEND_URL:-https://addons.plexdev.live}
+      - FRONTEND_URL=${FRONTEND_URL:-https://addons.plexdev.xyz}
       - ENVIRONMENT=${ENVIRONMENT:-production}
       # Email (SMTP)
       - EMAIL_ENABLED=${EMAIL_ENABLED:-true}
@@ -35,7 +33,7 @@ services:
       - SMTP_USERNAME=${SMTP_USERNAME}
       - SMTP_PASSWORD=${SMTP_PASSWORD}
       - SMTP_USE_TLS=${SMTP_USE_TLS:-true}
-      - EMAIL_FROM_ADDRESS=${EMAIL_FROM_ADDRESS:-no-reply@m.plexdev.live}
+      - EMAIL_FROM_ADDRESS=${EMAIL_FROM_ADDRESS:-no-reply@m.plexdev.xyz}
       - EMAIL_FROM_NAME=${EMAIL_FROM_NAME:-PlexAddons}
       - ADMIN_NOTIFICATION_EMAIL=${ADMIN_NOTIFICATION_EMAIL}
       # Discord Bot (for DM notifications)
@@ -67,7 +65,7 @@ services:
     ports:
       - "3310:80"
     environment:
-      - VITE_API_URL=${API_URL:-https://addons.plexdev.live/api}
+      - VITE_API_URL=${API_URL:-https://addons.plexdev.xyz/api}
       - VITE_DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}
       - VITE_STRIPE_PUBLISHABLE_KEY=${STRIPE_PUBLISHABLE_KEY}
       - VITE_PAYPAL_CLIENT_ID=${PAYPAL_CLIENT_ID}

examples/.github/workflows/publish-addon.yml

@@ -0,0 +1,167 @@
+# PlexAddons CI/CD - Publish Addon Version
+#
+# This workflow automatically publishes a new version of your addon
+# to addons.plexdev.xyz when you create a GitHub release or push a tag.
+#
+# Prerequisites:
+#   1. Create an API key at https://addons.plexdev.xyz/dashboard/api-keys
+#      - Required scope: "versions:write"
+#      - Pro tier: up to 3 keys | Premium tier: up to 10 keys
+#   2. Add the API key as a repository secret named PLEXADDONS_API_KEY
+#      - Go to Settings → Secrets and variables → Actions → New repository secret
+#   3. Your addon must already exist on addons.plexdev.xyz
+#
+# Usage:
+#   Option A: Triggered on GitHub Release
+#     - Create a release in GitHub with a tag like "v1.2.3"
+#     - The workflow extracts the version from the tag and publishes it
+#
+#   Option B: Triggered on tag push
+#     - Push a tag: git tag v1.2.3 && git push origin v1.2.3
+#
+# Customize the env variables below for your addon.
+
+name: Publish to PlexAddons
+
+on:
+  release:
+    types: [published]
+  push:
+    tags:
+      - 'v*'
+
+env:
+  # ─── CONFIGURE THESE ───────────────────────────────────────────
+  ADDON_SLUG: "my-addon"                          # Your addon's slug on addons.plexdev.xyz
+  DOWNLOAD_URL_TEMPLATE: "https://github.com/${{ github.repository }}/releases/download/${TAG}/addon.zip"
+  # Optional:
+  CHANNEL: "stable"                                # stable | beta | alpha | canary (Pro+ feature)
+  ROLLOUT_PERCENTAGE: "100"                        # 0-100, gradual rollout (Premium feature)
+  # ────────────────────────────────────────────────────────────────
+
+jobs:
+  publish:
+    name: Publish Version
+    runs-on: ubuntu-latest
+    # Only run once if both release and tag events fire
+    if: github.event_name == 'release' || !startsWith(github.ref, 'refs/tags/')
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for changelog
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          VERSION="${TAG#v}"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "📦 Publishing version: $VERSION"
+
+      - name: Build download URL
+        id: url
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          # Replace ${TAG} placeholder in the template
+          URL=$(echo "$DOWNLOAD_URL_TEMPLATE" | sed "s/\${TAG}/$TAG/g")
+          echo "download_url=$URL" >> "$GITHUB_OUTPUT"
+          echo "🔗 Download URL: $URL"
+
+      - name: Generate changelog from commits
+        id: changelog
+        run: |
+          # Get commits since the previous tag
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+          if [ -n "$PREV_TAG" ]; then
+            CHANGES=$(git log --pretty=format:"- %s" "$PREV_TAG"..HEAD 2>/dev/null || echo "")
+          else
+            CHANGES=$(git log --pretty=format:"- %s" -20 2>/dev/null || echo "")
+          fi
+
+          # Use release body if available, otherwise use commit log
+          if [ "${{ github.event_name }}" = "release" ] && [ -n "${{ github.event.release.body }}" ]; then
+            CHANGELOG="${{ github.event.release.body }}"
+          else
+            CHANGELOG="$CHANGES"
+          fi
+
+          # Write to file to handle multiline
+          echo "$CHANGELOG" > /tmp/changelog.txt
+          echo "has_changelog=true" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to PlexAddons
+        env:
+          PLEXADDONS_API_KEY: ${{ secrets.PLEXADDONS_API_KEY }}
+        run: |
+          CHANGELOG=$(cat /tmp/changelog.txt)
+
+          # Check if this is a breaking or urgent release
+          BREAKING=false
+          URGENT=false
+          if echo "${{ steps.version.outputs.tag }}" | grep -qi "breaking"; then
+            BREAKING=true
+          fi
+          # Mark pre-1.0 major bumps or releases labeled "urgent" as urgent
+          if [ "${{ github.event_name }}" = "release" ]; then
+            LABELS='${{ toJson(github.event.release.body) }}'
+            if echo "$LABELS" | grep -qi "urgent"; then
+              URGENT=true
+            fi
+          fi
+
+          # Build the JSON payload
+          PAYLOAD=$(jq -n \
+            --arg version "${{ steps.version.outputs.version }}" \
+            --arg download_url "${{ steps.url.outputs.download_url }}" \
+            --arg description "Release ${{ steps.version.outputs.tag }}" \
+            --arg changelog_content "$CHANGELOG" \
+            --argjson breaking "$BREAKING" \
+            --argjson urgent "$URGENT" \
+            --arg channel "$CHANNEL" \
+            --argjson rollout_percentage "${ROLLOUT_PERCENTAGE}" \
+            '{
+              version: $version,
+              download_url: $download_url,
+              description: $description,
+              changelog_content: $changelog_content,
+              breaking: $breaking,
+              urgent: $urgent,
+              channel: $channel,
+              rollout_percentage: ($rollout_percentage | tonumber)
+            }')
+
+          echo "📤 Publishing to PlexAddons API..."
+          RESPONSE=$(curl -s -w "\n%{http_code}" \
+            -X POST \
+            -H "Content-Type: application/json" \
+            -H "X-API-Key: $PLEXADDONS_API_KEY" \
+            -d "$PAYLOAD" \
+            "https://addons.plexdev.xyz/api/v1/addons/${ADDON_SLUG}/versions")
+
+          HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+          BODY=$(echo "$RESPONSE" | sed '$d')
+
+          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+            echo "✅ Successfully published version ${{ steps.version.outputs.version }}"
+            echo "$BODY" | jq .
+          else
+            echo "❌ Failed to publish (HTTP $HTTP_CODE)"
+            echo "$BODY" | jq . 2>/dev/null || echo "$BODY"
+            exit 1
+          fi
+
+      - name: Summary
+        if: success()
+        run: |
+          echo "### ✅ Published to PlexAddons" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
+          echo "|-------|-------|" >> "$GITHUB_STEP_SUMMARY"
+          echo "| **Addon** | \`${ADDON_SLUG}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| **Version** | \`${{ steps.version.outputs.version }}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| **Channel** | \`${CHANNEL}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| **Rollout** | ${ROLLOUT_PERCENTAGE}% |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| **Download** | ${{ steps.url.outputs.download_url }} |" >> "$GITHUB_STEP_SUMMARY"