Merge develop into master for the release

Author: acx10

README.md

@@ -26,8 +26,8 @@ Organize, read, annotate, sync across devices, and share, all without relying on
 <p align="center">
   <a href="https://booklore.org/">🌐 Website</a> ·
   <a href="https://booklore.org/docs/getting-started">📖 Docs</a> ·
-  <a href="#🎮-live-demo">🎮 Demo</a> ·
-  <a href="#🚀-quick-start">🚀 Quick Start</a> ·
+  <a href="#-live-demo">🎮 Demo</a> ·
+  <a href="#-quick-start">🚀 Quick Start</a> ·
   <a href="https://discord.gg/Ee5hd458Uz">💬 Discord</a>
 </p>
 

booklore-api/.gitignore

@@ -35,3 +35,6 @@ out/
 
 ### VS Code ###
 .vscode/
+
+### Local scripts ###
+local/

booklore-api/src/main/java/org/booklore/BookloreApplication.java

@@ -14,6 +14,10 @@
 @SpringBootApplication
 public class BookloreApplication {
 
+    static {
+        System.setProperty("sun.net.http.allowRestrictedHeaders", "true");
+    }
+
     public static void main(String[] args) {
         SpringApplication.run(BookloreApplication.class, args);
     }

booklore-api/src/main/java/org/booklore/config/security/SecurityConfig.java

@@ -262,8 +262,11 @@ public RestTemplate noRedirectRestTemplate() {
                     protected void prepareConnection(HttpURLConnection connection, String httpMethod) throws IOException {
                         super.prepareConnection(connection, httpMethod);
                         connection.setInstanceFollowRedirects(false);
+                        String targetHost = FileService.getTargetHost();
+                        if (targetHost != null) {
+                            connection.setRequestProperty("Host", targetHost);
+                        }
                         if (connection instanceof HttpsURLConnection httpsConnection) {
-                            String targetHost = FileService.getTargetHost();
                             if (targetHost != null) {
                                 // Set original host for SNI (even if connecting to IP)
                                 SSLSocketFactory defaultFactory = httpsConnection.getSSLSocketFactory();

booklore-api/src/main/java/org/booklore/controller/AdditionalFileController.java

@@ -2,7 +2,10 @@
 
 import org.booklore.config.security.annotation.CheckBookAccess;
 import org.booklore.model.dto.BookFile;
+import org.booklore.model.dto.request.DetachBookFileRequest;
+import org.booklore.model.dto.response.DetachBookFileResponse;
 import org.booklore.model.enums.BookFileType;
+import org.booklore.service.book.BookFileDetachmentService;
 import org.booklore.service.file.AdditionalFileService;
 import org.booklore.service.upload.FileUploadService;
 import lombok.AllArgsConstructor;
@@ -22,6 +25,7 @@ public class AdditionalFileController {
 
     private final AdditionalFileService additionalFileService;
     private final FileUploadService fileUploadService;
+    private final BookFileDetachmentService bookFileDetachmentService;
 
     @GetMapping
     @CheckBookAccess(bookIdParam = "bookId")
@@ -69,4 +73,14 @@ public ResponseEntity<Void> deleteAdditionalFile(
         additionalFileService.deleteAdditionalFile(fileId);
         return ResponseEntity.noContent().build();
     }
+
+    @PostMapping("/{fileId}/detach")
+    @CheckBookAccess(bookIdParam = "bookId")
+    @PreAuthorize("@securityUtil.canManageLibrary() or @securityUtil.isAdmin()")
+    public ResponseEntity<DetachBookFileResponse> detachFile(
+            @PathVariable Long bookId,
+            @PathVariable Long fileId,
+            @RequestBody DetachBookFileRequest request) {
+        return ResponseEntity.ok(bookFileDetachmentService.detachBookFile(bookId, fileId, request.copyMetadata()));
+    }
 }

booklore-api/src/main/java/org/booklore/controller/BookController.java

@@ -12,6 +12,7 @@
 import org.booklore.model.dto.request.ReadProgressRequest;
 import org.booklore.model.dto.request.ReadStatusUpdateRequest;
 import org.booklore.model.dto.request.ShelvesAssignmentRequest;
+import org.booklore.model.dto.response.AttachBookFileResponse;
 import org.booklore.model.dto.response.BookDeletionResponse;
 import org.booklore.model.dto.response.BookStatusUpdateResponse;
 import org.booklore.model.dto.response.DuplicateGroup;
@@ -285,7 +286,7 @@ public ResponseEntity<List<DuplicateGroup>> findDuplicates(
     })
     @PostMapping("/{targetBookId}/attach-file")
     @PreAuthorize("@securityUtil.canManageLibrary() or @securityUtil.isAdmin()")
-    public ResponseEntity<Book> attachBookFiles(
+    public ResponseEntity<AttachBookFileResponse> attachBookFiles(
             @Parameter(description = "ID of the target book to attach the files to") @PathVariable Long targetBookId,
             @Parameter(description = "Request containing source book IDs and delete option") @RequestBody @Valid AttachBookFileRequest request) {
         return ResponseEntity.ok(bookFileAttachmentService.attachBookFiles(targetBookId, request.getSourceBookIds(), request.isMoveFiles()));

booklore-api/src/main/java/org/booklore/controller/KomgaController.java

@@ -6,13 +6,16 @@
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.booklore.config.JacksonConfig;
+import org.booklore.config.security.service.AuthenticationService;
+import org.booklore.config.security.userdetails.OpdsUserDetails;
 import org.booklore.mapper.komga.KomgaMapper;
 import org.booklore.model.dto.komga.KomgaBookDto;
 import org.booklore.model.dto.komga.KomgaLibraryDto;
 import org.booklore.model.dto.komga.KomgaPageableDto;
 import org.booklore.model.dto.komga.KomgaSeriesDto;
 import org.booklore.service.book.BookService;
 import org.booklore.service.komga.KomgaService;
+import org.booklore.service.opds.OpdsBookService;
 import org.booklore.service.opds.OpdsUserV2Service;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.core.io.Resource;
@@ -36,6 +39,8 @@ public class KomgaController {
 
     private final KomgaService komgaService;
     private final BookService bookService;
+    private final OpdsBookService opdsBookService;
+    private final AuthenticationService authenticationService;
     private final OpdsUserV2Service opdsUserV2Service;
     private final KomgaMapper komgaMapper;
 
@@ -147,6 +152,7 @@ public ResponseEntity<Resource> getBookPage(
             @Parameter(description = "Book ID") @PathVariable Long bookId,
             @Parameter(description = "Page number") @PathVariable Integer pageNumber,
             @Parameter(description = "Convert image format (e.g., 'png')") @RequestParam(required = false) String convert) {
+        opdsBookService.validateBookContentAccess(bookId, getOpdsUserId());
         try {
             boolean convertToPng = "png".equalsIgnoreCase(convert);
             Resource pageImage = komgaService.getBookPageImage(bookId, pageNumber, convertToPng);
@@ -166,13 +172,15 @@ public ResponseEntity<Resource> getBookPage(
     @GetMapping("/v1/books/{bookId}/file")
     public ResponseEntity<Resource> downloadBook(
             @Parameter(description = "Book ID") @PathVariable Long bookId) {
+        opdsBookService.validateBookContentAccess(bookId, getOpdsUserId());
         return bookService.downloadBook(bookId);
     }
 
     @Operation(summary = "Get book thumbnail")
     @GetMapping("/v1/books/{bookId}/thumbnail")
     public ResponseEntity<Resource> getBookThumbnail(
             @Parameter(description = "Book ID") @PathVariable Long bookId) {
+        opdsBookService.validateBookContentAccess(bookId, getOpdsUserId());
         Resource coverImage = bookService.getBookThumbnail(bookId);
         return ResponseEntity.ok()
                 .header("Content-Type", "image/jpeg")
@@ -208,4 +216,11 @@ public ResponseEntity<String> getCollections(
             @Parameter(description = "Return all collections without paging") @RequestParam(defaultValue = "false") boolean unpaged) {
         return writeJson(komgaService.getCollections(page, size, unpaged));
     }
+
+    private Long getOpdsUserId() {
+        OpdsUserDetails details = authenticationService.getOpdsUser();
+        return details != null && details.getOpdsUserV2() != null
+                ? details.getOpdsUserV2().getUserId()
+                : null;
+    }
 }

booklore-api/src/main/java/org/booklore/controller/OpdsController.java

@@ -1,7 +1,10 @@
 package org.booklore.controller;
 
+import org.booklore.config.security.service.AuthenticationService;
+import org.booklore.config.security.userdetails.OpdsUserDetails;
 import org.booklore.service.book.BookDownloadService;
 import org.booklore.service.book.BookService;
+import org.booklore.service.opds.OpdsBookService;
 import org.booklore.service.opds.OpdsFeedService;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
@@ -34,6 +37,8 @@ public class OpdsController {
     private final OpdsFeedService opdsFeedService;
     private final BookService bookService;
     private final BookDownloadService bookDownloadService;
+    private final OpdsBookService opdsBookService;
+    private final AuthenticationService authenticationService;
 
     @Operation(summary = "Download book file", description = "Download the book file by its ID. Optionally specify a fileId to download a specific format.")
     @ApiResponses({
@@ -44,6 +49,7 @@ public class OpdsController {
     public ResponseEntity<Resource> downloadBook(
             @Parameter(description = "ID of the book to download") @PathVariable("bookId") Long bookId,
             @Parameter(description = "Optional ID of a specific file format to download") @RequestParam(required = false) Long fileId) {
+        opdsBookService.validateBookContentAccess(bookId, getOpdsUserId());
         if (fileId != null) {
             return bookDownloadService.downloadBookFile(bookId, fileId);
         }
@@ -57,6 +63,7 @@ public ResponseEntity<Resource> downloadBook(
     })
     @GetMapping("/{bookId}/cover")
     public ResponseEntity<Resource> getBookCover(@Parameter(description = "ID of the book") @PathVariable long bookId) {
+        opdsBookService.validateBookContentAccess(bookId, getOpdsUserId());
         Resource coverImage = bookService.getBookThumbnail(bookId);
         String contentType = "image/jpeg";
         return ResponseEntity.ok()
@@ -169,4 +176,11 @@ public ResponseEntity<String> getSearchDescription() {
                 .contentType(MediaType.parseMediaType("application/opensearchdescription+xml;charset=utf-8"))
                 .body(searchDoc);
     }
+
+    private Long getOpdsUserId() {
+        OpdsUserDetails details = authenticationService.getOpdsUser();
+        return details != null && details.getOpdsUserV2() != null
+                ? details.getOpdsUserV2().getUserId()
+                : null;
+    }
 }

booklore-api/src/main/java/org/booklore/model/dto/request/DetachBookFileRequest.java

@@ -0,0 +1,3 @@
+package org.booklore.model.dto.request;
+
+public record DetachBookFileRequest(boolean copyMetadata) {}

booklore-api/src/main/java/org/booklore/model/dto/response/AttachBookFileResponse.java

@@ -0,0 +1,7 @@
+package org.booklore.model.dto.response;
+
+import org.booklore.model.dto.Book;
+
+import java.util.List;
+
+public record AttachBookFileResponse(Book updatedBook, List<Long> deletedSourceBookIds) {}