Add SQLite library with API, library desktop apps and MobyGames scraper

src/lib/server/library/auth.ts

@@ -0,0 +1,11 @@
+import { timingSafeEqual } from 'node:crypto';
+import { error } from '@sveltejs/kit';
+import { LIBRARY_API_KEY } from '$app/env/private';
+
+export function requireApiKey(request: Request) {
+	if (!LIBRARY_API_KEY) error(503, 'LIBRARY_API_KEY is not set on the server');
+
+	const given = Buffer.from(request.headers.get('authorization')?.replace(/^Bearer\s+/i, '') ?? '');
+	const expected = Buffer.from(LIBRARY_API_KEY);
+	if (given.length !== expected.length || !timingSafeEqual(given, expected)) error(401, 'Invalid API key');
+}

src/lib/server/library/books.ts

@@ -0,0 +1,176 @@
+import { error } from '@sveltejs/kit';
+import type { Book, BookSeries, BookShelf } from '#lib/content';
+import { timestamp, type SqlDatabase } from './database';
+import { hasImage, imageUrl, removeImage, syncImage } from './images';
+import { readChoice, readHistory, readNumber, readRating, readText, readTextList, type RequestBody } from './input';
+
+interface BookRow {
+	goodreads_id: string;
+	title: string;
+	authors: string;
+	description: string | null;
+	pages: number | null;
+	published: string | null;
+	genres: string;
+	average_rating: number | null;
+	rating_count: number | null;
+	cover_source: string | null;
+	shelf: BookShelf;
+	rating: number | null;
+	series_name: string | null;
+	series_url: string | null;
+	series_position: string | null;
+	added: string | null;
+	started: string | null;
+	finished: string | null;
+}
+
+const bookShelves: BookShelf[] = ['read', 'reading', 'want-to-read'];
+const goodreadsIdPattern = /^\d+$/;
+
+export function isGoodreadsId(text: string): boolean {
+	return goodreadsIdPattern.test(text);
+}
+
+function coverImageId(goodreadsId: string): string {
+	return `book-${goodreadsId}`;
+}
+
+function parseList(text: string): string[] {
+	try {
+		const value = JSON.parse(text);
+		return Array.isArray(value) ? value : [];
+	} catch {
+		return [];
+	}
+}
+
+function seriesOf(row: BookRow): BookSeries | undefined {
+	if (!row.series_name) return undefined;
+	return { name: row.series_name, url: row.series_url ?? '', ...(row.series_position && { position: row.series_position }) };
+}
+
+function toBook(row: BookRow, hasCover: boolean): Book {
+	const series = seriesOf(row);
+	return {
+		goodreadsId: row.goodreads_id,
+		url: `https://www.goodreads.com/book/show/${row.goodreads_id}`,
+		title: row.title,
+		authors: parseList(row.authors),
+		cover: hasCover ? imageUrl(coverImageId(row.goodreads_id)) : row.cover_source,
+		coverSource: row.cover_source,
+		description: row.description,
+		pages: row.pages,
+		published: row.published,
+		genres: parseList(row.genres),
+		averageRating: row.average_rating,
+		ratingCount: row.rating_count,
+		shelf: row.shelf,
+		...(row.rating !== null && { rating: row.rating }),
+		...(row.added && { added: row.added }),
+		...(row.started && { started: row.started }),
+		...(row.finished && { finished: row.finished }),
+		...(series && { series })
+	};
+}
+
+function findRow(database: SqlDatabase, goodreadsId: string): BookRow | null {
+	return (database.prepare('SELECT * FROM books WHERE goodreads_id = ?').get(goodreadsId) as BookRow | undefined) ?? null;
+}
+
+export function listBooks(database: SqlDatabase, imageIds: Set<string>): Book[] {
+	const rows = database.prepare('SELECT * FROM books ORDER BY title COLLATE NOCASE').all() as BookRow[];
+	return rows.map((row) => toBook(row, imageIds.has(coverImageId(row.goodreads_id))));
+}
+
+function readSeries(body: RequestBody, existing: BookRow | null): Pick<BookRow, 'series_name' | 'series_url' | 'series_position'> {
+	const current = {
+		series_name: existing?.series_name ?? null,
+		series_url: existing?.series_url ?? null,
+		series_position: existing?.series_position ?? null
+	};
+	if (!('series' in body)) return current;
+	if (body.series === null) return { series_name: null, series_url: null, series_position: null };
+	if (typeof body.series !== 'object' || Array.isArray(body.series)) error(400, 'series must be an object or null');
+
+	const series = body.series as RequestBody;
+	const name = readText(series, 'name', null);
+	if (!name) error(400, 'series needs a name');
+	return { series_name: name, series_url: readText(series, 'url', null), series_position: readText(series, 'position', null) };
+}
+
+function mergeRow(goodreadsId: string, existing: BookRow | null, body: RequestBody): BookRow {
+	const title = readText(body, 'title', existing?.title ?? null);
+	if (!title) error(400, 'title is required');
+	const shelf = readChoice(body, 'shelf', bookShelves, existing?.shelf ?? 'read');
+	const pages = readNumber(body, 'pages', existing?.pages ?? null);
+
+	return {
+		goodreads_id: goodreadsId,
+		title,
+		authors: JSON.stringify(readTextList(body, 'authors', parseList(existing?.authors ?? '[]'))),
+		description: readText(body, 'description', existing?.description ?? null),
+		pages: pages === null ? null : Math.round(pages),
+		published: readText(body, 'published', existing?.published ?? null),
+		genres: JSON.stringify(readTextList(body, 'genres', parseList(existing?.genres ?? '[]'))),
+		average_rating: readNumber(body, 'averageRating', existing?.average_rating ?? null),
+		rating_count: readNumber(body, 'ratingCount', existing?.rating_count ?? null),
+		cover_source: readText(body, 'coverSource', existing?.cover_source ?? null),
+		shelf,
+		rating: readRating(body, existing?.rating ?? null),
+		...readSeries(body, existing),
+		...readHistory(
+			body,
+			{ added: existing?.added ?? null, started: existing?.started ?? null, finished: existing?.finished ?? null },
+			{ isNew: !existing, previousStatus: existing?.shelf ?? null, status: shelf, activeStatus: 'reading', doneStatus: 'read' }
+		)
+	};
+}
+
+export async function saveBook(database: SqlDatabase, goodreadsId: string, body: RequestBody): Promise<Book> {
+	const row = mergeRow(goodreadsId, findRow(database, goodreadsId), body);
+
+	database
+		.prepare(
+			`INSERT INTO books (goodreads_id, title, authors, description, pages, published, genres, average_rating, rating_count, cover_source,
+				shelf, rating, series_name, series_url, series_position, added, started, finished, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT(goodreads_id) DO UPDATE SET title = excluded.title, authors = excluded.authors, description = excluded.description,
+				pages = excluded.pages, published = excluded.published, genres = excluded.genres, average_rating = excluded.average_rating,
+				rating_count = excluded.rating_count, cover_source = excluded.cover_source, shelf = excluded.shelf, rating = excluded.rating,
+				series_name = excluded.series_name, series_url = excluded.series_url, series_position = excluded.series_position,
+				added = excluded.added, started = excluded.started, finished = excluded.finished, updated_at = excluded.updated_at`
+		)
+		.run(
+			row.goodreads_id,
+			row.title,
+			row.authors,
+			row.description,
+			row.pages,
+			row.published,
+			row.genres,
+			row.average_rating,
+			row.rating_count,
+			row.cover_source,
+			row.shelf,
+			row.rating,
+			row.series_name,
+			row.series_url,
+			row.series_position,
+			row.added,
+			row.started,
+			row.finished,
+			timestamp()
+		);
+
+	if ('coverSource' in body) await syncImage(database, coverImageId(goodreadsId), row.cover_source);
+
+	return toBook(row, hasImage(database, coverImageId(goodreadsId)));
+}
+
+export function deleteBook(database: SqlDatabase, goodreadsId: string): boolean {
+	if (!findRow(database, goodreadsId)) return false;
+	database.prepare('DELETE FROM books WHERE goodreads_id = ?').run(goodreadsId);
+	removeImage(database, coverImageId(goodreadsId));
+	return true;
+}

src/lib/server/library/database.ts

@@ -0,0 +1,70 @@
+import path from 'node:path';
+import { openSqlite, type SqlDatabase } from '../sqlite';
+
+export type { SqlDatabase };
+
+const dataDirectory = path.resolve(process.env.LIBRARY_DATA_DIR ?? 'data/library');
+const databasePath = path.join(dataDirectory, 'library.db');
+
+const schema = `
+	CREATE TABLE IF NOT EXISTS media (
+		imdb_id TEXT PRIMARY KEY,
+		kind TEXT NOT NULL,
+		name TEXT NOT NULL,
+		status TEXT NOT NULL DEFAULT 'watched',
+		rating INTEGER,
+		collection TEXT,
+		year TEXT,
+		genre TEXT,
+		runtime TEXT,
+		plot TEXT,
+		poster_source TEXT,
+		added TEXT,
+		started TEXT,
+		finished TEXT,
+		updated_at TEXT NOT NULL
+	);
+	CREATE TABLE IF NOT EXISTS books (
+		goodreads_id TEXT PRIMARY KEY,
+		title TEXT NOT NULL,
+		authors TEXT NOT NULL DEFAULT '[]',
+		description TEXT,
+		pages INTEGER,
+		published TEXT,
+		genres TEXT NOT NULL DEFAULT '[]',
+		average_rating REAL,
+		rating_count INTEGER,
+		cover_source TEXT,
+		shelf TEXT NOT NULL DEFAULT 'read',
+		rating INTEGER,
+		series_name TEXT,
+		series_url TEXT,
+		series_position TEXT,
+		added TEXT,
+		started TEXT,
+		finished TEXT,
+		updated_at TEXT NOT NULL
+	);
+	CREATE TABLE IF NOT EXISTS images (
+		id TEXT PRIMARY KEY,
+		source TEXT NOT NULL,
+		content_type TEXT NOT NULL,
+		data BLOB NOT NULL,
+		updated_at TEXT NOT NULL
+	);
+`;
+
+let opening: Promise<SqlDatabase> | null = null;
+
+export function libraryDatabase(): Promise<SqlDatabase> {
+	opening ??= openSqlite(databasePath, schema);
+	return opening;
+}
+
+export function timestamp(): string {
+	return new Date().toISOString();
+}
+
+export function today(): string {
+	return timestamp().slice(0, 10);
+}

src/lib/server/library/images.ts

@@ -0,0 +1,68 @@
+import { timestamp, type SqlDatabase } from './database';
+
+export interface StoredImage {
+	contentType: string;
+	data: Uint8Array;
+}
+
+const requestHeaders = { 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' };
+const maxImageBytes = 8 * 1024 * 1024;
+
+export function imageUrl(id: string): string {
+	return `/api/library/images/${id}`;
+}
+
+export function storedImageIds(database: SqlDatabase): Set<string> {
+	const rows = database.prepare('SELECT id FROM images').all() as { id: string }[];
+	return new Set(rows.map((row) => row.id));
+}
+
+export function hasImage(database: SqlDatabase, id: string): boolean {
+	return !!database.prepare('SELECT id FROM images WHERE id = ?').get(id);
+}
+
+export function readImage(database: SqlDatabase, id: string): StoredImage | null {
+	const row = database.prepare('SELECT content_type, data FROM images WHERE id = ?').get(id) as
+		| { content_type: string; data: Uint8Array }
+		| null
+		| undefined;
+	return row ? { contentType: row.content_type, data: row.data } : null;
+}
+
+export function removeImage(database: SqlDatabase, id: string) {
+	database.prepare('DELETE FROM images WHERE id = ?').run(id);
+}
+
+async function downloadImage(source: string): Promise<StoredImage> {
+	if (!/^https?:\/\//.test(source)) throw new Error(`${source} is not a web address`);
+	const response = await fetch(source, { headers: requestHeaders });
+	if (!response.ok) throw new Error(`image request returned ${response.status}`);
+
+	const contentType = response.headers.get('content-type')?.split(';')[0] ?? 'image/jpeg';
+	if (!contentType.startsWith('image/')) throw new Error(`${source} is not an image`);
+
+	const data = new Uint8Array(await response.arrayBuffer());
+	if (data.byteLength > maxImageBytes) throw new Error(`${source} is larger than 8 MB`);
+	return { contentType, data };
+}
+
+export async function syncImage(database: SqlDatabase, id: string, source: string | null) {
+	if (!source) {
+		removeImage(database, id);
+		return;
+	}
+	const stored = database.prepare('SELECT source FROM images WHERE id = ?').get(id) as { source: string } | null | undefined;
+	if (stored?.source === source) return;
+
+	try {
+		const image = await downloadImage(source);
+		database
+			.prepare(
+				`INSERT INTO images (id, source, content_type, data, updated_at) VALUES (?, ?, ?, ?, ?)
+				ON CONFLICT(id) DO UPDATE SET source = excluded.source, content_type = excluded.content_type, data = excluded.data, updated_at = excluded.updated_at`
+			)
+			.run(id, source, image.contentType, image.data, timestamp());
+	} catch (downloadError) {
+		console.error(`Could not save image ${id}:`, downloadError);
+	}
+}

src/lib/server/library/index.ts

@@ -0,0 +1,11 @@
+import type { LibraryData } from '#lib/library/types';
+import { libraryDatabase } from './database';
+import { storedImageIds } from './images';
+import { listMedia } from './media';
+import { listBooks } from './books';
+
+export async function getLibrary(): Promise<LibraryData> {
+	const database = await libraryDatabase();
+	const imageIds = storedImageIds(database);
+	return { ...listMedia(database, imageIds), books: listBooks(database, imageIds) };
+}

src/lib/server/library/input.ts

@@ -0,0 +1,86 @@
+import { error } from '@sveltejs/kit';
+import { today } from './database';
+
+export type RequestBody = Record<string, unknown>;
+
+const datePattern = /^\d{4}-\d{2}-\d{2}$/;
+
+export async function readBody(request: Request): Promise<RequestBody> {
+	const body = await request.json().catch(() => null);
+	if (!body || typeof body !== 'object' || Array.isArray(body)) error(400, 'Body must be a JSON object');
+	return body as RequestBody;
+}
+
+export function readText(body: RequestBody, key: string, current: string | null): string | null {
+	if (!(key in body)) return current;
+	const value = body[key];
+	if (value === null || value === undefined) return null;
+	if (typeof value !== 'string') error(400, `${key} must be text`);
+	return value.trim() || null;
+}
+
+export function readNumber(body: RequestBody, key: string, current: number | null): number | null {
+	if (!(key in body)) return current;
+	const value = body[key];
+	if (value === null || value === undefined || value === '') return null;
+	const number = Number(value);
+	if (!Number.isFinite(number)) error(400, `${key} must be a number`);
+	return number;
+}
+
+export function readRating(body: RequestBody, current: number | null): number | null {
+	const rating = readNumber(body, 'rating', current);
+	if (rating !== null && (!Number.isInteger(rating) || rating < 0 || rating > 10)) error(400, 'rating must be a whole number from 0 to 10');
+	return rating;
+}
+
+export function readChoice<Choice extends string>(body: RequestBody, key: string, choices: readonly Choice[], current: Choice): Choice {
+	if (!(key in body)) return current;
+	const value = body[key];
+	if (!choices.includes(value as Choice)) error(400, `${key} must be one of ${choices.join(', ')}`);
+	return value as Choice;
+}
+
+export function readTextList(body: RequestBody, key: string, current: string[]): string[] {
+	if (!(key in body)) return current;
+	const value = body[key];
+	if (value === null || value === undefined) return [];
+	if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) error(400, `${key} must be a list of text`);
+	return (value as string[]).map((item) => item.trim()).filter(Boolean);
+}
+
+export function readDate(body: RequestBody, key: string, current: string | null): string | null {
+	const value = readText(body, key, current);
+	if (value !== null && !datePattern.test(value)) error(400, `${key} must be a date like 2026-01-31`);
+	return value;
+}
+
+export interface HistoryDates {
+	added: string | null;
+	started: string | null;
+	finished: string | null;
+}
+
+export interface StatusChange<Status extends string> {
+	isNew: boolean;
+	previousStatus: Status | null;
+	status: Status;
+	activeStatus: Status;
+	doneStatus: Status;
+}
+
+export function readHistory<Status extends string>(body: RequestBody, current: HistoryDates, change: StatusChange<Status>): HistoryDates {
+	const statusChanged = change.status !== change.previousStatus;
+	const autoDate = (key: keyof HistoryDates, status: Status, value: string | null) =>
+		!(key in body) && statusChanged && change.status === status && !value ? today() : value;
+
+	const added = readDate(body, 'added', current.added);
+	const started = readDate(body, 'started', current.started);
+	const finished = readDate(body, 'finished', current.finished);
+
+	return {
+		added: !('added' in body) && change.isNew ? today() : added,
+		started: autoDate('started', change.activeStatus, started),
+		finished: autoDate('finished', change.doneStatus, finished)
+	};
+}

src/lib/server/library/media.ts

@@ -0,0 +1,153 @@
+import { error } from '@sveltejs/kit';
+import type { RatedTitle, WatchStatus } from '#lib/content';
+import type { MediaDetails, MediaKind } from '#lib/media/types';
+import type { LibraryMedia } from '#lib/library/types';
+import { timestamp, type SqlDatabase } from './database';
+import { hasImage, imageUrl, removeImage, syncImage } from './images';
+import { readChoice, readHistory, readRating, readText, type RequestBody } from './input';
+
+interface MediaRow {
+	imdb_id: string;
+	kind: MediaKind;
+	name: string;
+	status: WatchStatus;
+	rating: number | null;
+	collection: string | null;
+	year: string | null;
+	genre: string | null;
+	runtime: string | null;
+	plot: string | null;
+	poster_source: string | null;
+	added: string | null;
+	started: string | null;
+	finished: string | null;
+}
+
+export interface SavedMedia {
+	kind: MediaKind;
+	item: RatedTitle;
+	details: MediaDetails;
+}
+
+const mediaKinds: MediaKind[] = ['show', 'movie'];
+const watchStatuses: WatchStatus[] = ['watched', 'watching', 'planning'];
+const imdbIdPattern = /^tt\d{7,9}$/;
+
+export function isImdbId(text: string): boolean {
+	return imdbIdPattern.test(text);
+}
+
+function posterImageId(imdbId: string): string {
+	return `media-${imdbId}`;
+}
+
+function titleUrl(imdbId: string): string {
+	return `https://www.imdb.com/title/${imdbId}/`;
+}
+
+function toRatedTitle(row: MediaRow): RatedTitle {
+	return {
+		name: row.name,
+		url: titleUrl(row.imdb_id),
+		...(row.rating !== null && { rating: row.rating }),
+		...(row.status !== 'watched' && { status: row.status }),
+		...(row.collection && { collection: row.collection }),
+		...(row.added && { added: row.added }),
+		...(row.started && { started: row.started }),
+		...(row.finished && { finished: row.finished })
+	};
+}
+
+function toMediaDetails(row: MediaRow, hasPoster: boolean): MediaDetails {
+	return {
+		poster: hasPoster ? imageUrl(posterImageId(row.imdb_id)) : row.poster_source,
+		year: row.year,
+		genre: row.genre,
+		runtime: row.runtime,
+		plot: row.plot
+	};
+}
+
+function findRow(database: SqlDatabase, imdbId: string): MediaRow | null {
+	return (database.prepare('SELECT * FROM media WHERE imdb_id = ?').get(imdbId) as MediaRow | undefined) ?? null;
+}
+
+export function listMedia(database: SqlDatabase, imageIds: Set<string>): LibraryMedia {
+	const rows = database.prepare('SELECT * FROM media ORDER BY name COLLATE NOCASE').all() as MediaRow[];
+	return {
+		shows: rows.filter((row) => row.kind === 'show').map(toRatedTitle),
+		movies: rows.filter((row) => row.kind === 'movie').map(toRatedTitle),
+		mediaDetails: Object.fromEntries(
+			rows.map((row) => [titleUrl(row.imdb_id), toMediaDetails(row, imageIds.has(posterImageId(row.imdb_id)))])
+		)
+	};
+}
+
+function mergeRow(imdbId: string, existing: MediaRow | null, body: RequestBody): MediaRow {
+	const name = readText(body, 'name', existing?.name ?? null);
+	if (!name) error(400, 'name is required');
+	if (!existing && !('kind' in body)) error(400, 'kind is required');
+	const status = readChoice(body, 'status', watchStatuses, existing?.status ?? 'watched');
+
+	return {
+		imdb_id: imdbId,
+		kind: readChoice(body, 'kind', mediaKinds, existing?.kind ?? 'movie'),
+		name,
+		status,
+		rating: readRating(body, existing?.rating ?? null),
+		collection: readText(body, 'collection', existing?.collection ?? null),
+		year: readText(body, 'year', existing?.year ?? null),
+		genre: readText(body, 'genre', existing?.genre ?? null),
+		runtime: readText(body, 'runtime', existing?.runtime ?? null),
+		plot: readText(body, 'plot', existing?.plot ?? null),
+		poster_source: readText(body, 'posterSource', existing?.poster_source ?? null),
+		...readHistory(
+			body,
+			{ added: existing?.added ?? null, started: existing?.started ?? null, finished: existing?.finished ?? null },
+			{ isNew: !existing, previousStatus: existing?.status ?? null, status, activeStatus: 'watching', doneStatus: 'watched' }
+		)
+	};
+}
+
+export async function saveMedia(database: SqlDatabase, imdbId: string, body: RequestBody): Promise<SavedMedia> {
+	const row = mergeRow(imdbId, findRow(database, imdbId), body);
+
+	database
+		.prepare(
+			`INSERT INTO media (imdb_id, kind, name, status, rating, collection, year, genre, runtime, plot, poster_source, added, started, finished, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT(imdb_id) DO UPDATE SET kind = excluded.kind, name = excluded.name, status = excluded.status, rating = excluded.rating,
+				collection = excluded.collection, year = excluded.year, genre = excluded.genre, runtime = excluded.runtime, plot = excluded.plot,
+				poster_source = excluded.poster_source, added = excluded.added, started = excluded.started, finished = excluded.finished,
+				updated_at = excluded.updated_at`
+		)
+		.run(
+			row.imdb_id,
+			row.kind,
+			row.name,
+			row.status,
+			row.rating,
+			row.collection,
+			row.year,
+			row.genre,
+			row.runtime,
+			row.plot,
+			row.poster_source,
+			row.added,
+			row.started,
+			row.finished,
+			timestamp()
+		);
+
+	if ('posterSource' in body) await syncImage(database, posterImageId(imdbId), row.poster_source);
+
+	return { kind: row.kind, item: toRatedTitle(row), details: toMediaDetails(row, hasImage(database, posterImageId(imdbId))) };
+}
+
+export function deleteMedia(database: SqlDatabase, imdbId: string): boolean {
+	const existing = findRow(database, imdbId);
+	if (!existing) return false;
+	database.prepare('DELETE FROM media WHERE imdb_id = ?').run(imdbId);
+	removeImage(database, posterImageId(imdbId));
+	return true;
+}