Implement session-scoped media source access and deduplicate Plex playback metadata#30
Implement session-scoped media source access and deduplicate Plex playback metadata#30
Conversation
…ck metadata deduplication
There was a problem hiding this comment.
Pull request overview
This PR tightens server-side media source access to be provider-account scoped (using the current session’s providerAccountId) and improves Plex “currently playing” tracking by deduplicating duplicate session rows and using a more robust playback identity.
Changes:
- Scope media source list/get/update/delete/check routes to
providerAccountId. - Export and use
getMediaSourceForAccountto enforce account-scoped lookups in routes. - Deduplicate Plex
/status/sessionsmetadata and improve session identity selection (sessionKey→Session.id→ fallback).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| apps/server/src/routes/sources.ts | Enforces account-scoped media source operations throughout the sources routes. |
| apps/server/src/routes/media.ts | Filters enabled media sources by the current session’s providerAccountId for currently-playing aggregation. |
| apps/server/src/providers/plex/playback.ts | Adds dedupe utilities for Plex sessions and improves playback session identity stability. |
| apps/server/src/db/mediaSourcesRepository.ts | Exports getMediaSourceForAccount to support account-scoped access patterns from routes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| requireMediaSource(req.params.id as string, session.providerAccountId); | ||
| const source = updateMediaSourceForAccount( | ||
| req.params.id as string, | ||
| existingSource.providerAccountId, | ||
| session.providerAccountId, | ||
| parseSourceUpdate(req.body) |
There was a problem hiding this comment.
In this PATCH handler, requireMediaSource(...) performs an extra DB read but the result is unused. Since updateMediaSourceForAccount(...) is already account-scoped and you already handle the !source case, you can drop the pre-check and rely on the update call to return undefined for non-existent/unauthorized sources (avoids an extra query).
| const source = requireMediaSource(req.params.id as string, session.providerAccountId); | ||
|
|
||
| const deleted = deleteMediaSourceForAccount(source.id, source.providerAccountId); | ||
| const deleted = deleteMediaSourceForAccount(source.id, session.providerAccountId); |
There was a problem hiding this comment.
The DELETE handler loads the full source via requireMediaSource(...) but only needs to delete by id for the current account. Consider calling deleteMediaSourceForAccount(req.params.id, session.providerAccountId) directly and returning 404 when deleted is false, to avoid an extra DB read and simplify the flow.
This pull request introduces several improvements to how media sources are managed and how currently playing Plex sessions are deduplicated and identified. The main changes are focused on ensuring that media source operations are account-scoped for better security and correctness, and on improving the reliability of playback session tracking by deduplicating Plex session data.
Account-scoped media source operations:
providerAccountId, ensuring that only sources belonging to the current account can be accessed or modified. This includes updates to therequireMediaSourcefunction, all route handlers insources.ts, and the media sources listing in bothmedia.tsandsources.ts. [1] [2] [3] [4] [5] [6] [7] [8] [9]Plex playback session deduplication and identification:
playbackFallbackIdentity,playbackDeduplicationKey,dedupeCurrentlyPlayingMetadata) are added to deduplicate currently playing Plex session metadata, addressing issues with duplicate session rows from certain clients. The normalization of current playback now uses deduplicated metadata. [1] [2]sessionKey, thenSession.id, then a fallback identity, ensuring more robust and consistent session tracking.These changes improve both the security of media source management and the accuracy of Plex playback session handling.