Add reported-issues, Goodreads sync & notifs

Introduce user-reported-issues and Goodreads shelf sync features and wire them into notifications. Adds Prisma migrations and schema changes (ReportedIssue, GoodreadsShelf, GoodreadsBookMapping), API endpoints for reporting (POST /audiobooks/[asin]/report-issue) and admin management (list, resolve/dismiss, replace), and an admin UI section to view/dismiss/replace reported issues. Adds a new notification event (issue_reported) with updates to notification schemas, docs and provider handling, plus a notification-events constants file. Refactors request creation to use createRequestForUser service, adds a Goodreads sync processor/service/hooks/UI modals, a scrape-resilience util, and related tests and minor integration updates.

tests/services/apprise.provider.test.ts

@@ -18,6 +18,7 @@ prismaMock.notificationBackend = {
 const encryptionMock = vi.hoisted(() => ({
   encrypt: vi.fn((value: string) => `enc:${value}`),
   decrypt: vi.fn((value: string) => value.replace('enc:', '')),
+  isEncryptedFormat: vi.fn((value: string) => typeof value === 'string' && value.startsWith('enc:')),
 }));
 
 const fetchMock = vi.hoisted(() => vi.fn());
@@ -370,14 +371,12 @@ describe('AppriseProvider', () => {
       const { NotificationService } = await import('@/lib/services/notification');
       const service = new NotificationService();
 
-      // Use iv:authTag:data format to pass isEncrypted() check
-      // Note: the value must have exactly 3 colon-separated segments
       await service.sendToBackend(
         'apprise',
         {
           serverUrl: 'http://apprise:8000',
-          urls: 'iv:tag:encryptedUrlsData',
-          authToken: 'iv:tag:mytoken123',
+          urls: 'enc:encryptedUrlsData',
+          authToken: 'enc:mytoken123',
         },
         {
           event: 'request_approved',
@@ -390,16 +389,16 @@ describe('AppriseProvider', () => {
       );
 
       // Verify decrypt was called for the sensitive fields
-      expect(encryptionMock.decrypt).toHaveBeenCalledWith('iv:tag:encryptedUrlsData');
-      expect(encryptionMock.decrypt).toHaveBeenCalledWith('iv:tag:mytoken123');
+      expect(encryptionMock.decrypt).toHaveBeenCalledWith('enc:encryptedUrlsData');
+      expect(encryptionMock.decrypt).toHaveBeenCalledWith('enc:mytoken123');
 
       // Verify the decrypted values reach the fetch call
       expect(fetchMock).toHaveBeenCalledTimes(1);
       const fetchCall = fetchMock.mock.calls[0];
-      expect(fetchCall[1].headers['Authorization']).toBe('Bearer iv:tag:mytoken123');
+      expect(fetchCall[1].headers['Authorization']).toBe('Bearer mytoken123');
 
       const body = JSON.parse(fetchCall[1].body);
-      expect(body.urls).toBe('iv:tag:encryptedUrlsData');
+      expect(body.urls).toBe('encryptedUrlsData');
     });
 
     it('does not decrypt non-sensitive fields', async () => {

tests/services/encryption.service.test.ts

@@ -51,4 +51,116 @@ describe('EncryptionService', () => {
     expect(typeof key).toBe('string');
     expect(key.length).toBeGreaterThan(40);
   });
+
+  describe('isEncryptedFormat', () => {
+    async function createService() {
+      process.env.CONFIG_ENCRYPTION_KEY = 'c'.repeat(32);
+      vi.resetModules();
+      const { EncryptionService } = await import('@/lib/services/encryption.service');
+      return new EncryptionService();
+    }
+
+    it('returns true for values produced by encrypt()', async () => {
+      const service = await createService();
+
+      const encrypted = service.encrypt('hello world');
+      expect(service.isEncryptedFormat(encrypted)).toBe(true);
+    });
+
+    it('returns true for various encrypted values (round-trip)', async () => {
+      const service = await createService();
+
+      const testValues = [
+        'simple',
+        'tgram://1234567890:PLPe1Hh-VhbRC3MoT5QngwkPHoMTD/-100181291455/',
+        'slack://tokenA/tokenB/tokenC',
+        'https://hooks.slack.com/services/T00/B00/xxx',
+        'a',
+        'a'.repeat(1000),
+        'json://user:password@host:8080/path',
+      ];
+
+      for (const val of testValues) {
+        const encrypted = service.encrypt(val);
+        expect(service.isEncryptedFormat(encrypted)).toBe(true);
+        expect(service.decrypt(encrypted)).toBe(val);
+      }
+    });
+
+    it('returns false for Telegram notification URLs (the reported bug)', async () => {
+      const service = await createService();
+
+      // This URL has exactly 3 colon-separated parts, which fooled the old check
+      expect(service.isEncryptedFormat(
+        'tgram://1234567890:PLPe1Hh-VhbRC3MoT5QngwkPHoMTD/-100181291455/'
+      )).toBe(false);
+    });
+
+    it('returns false for common notification URL schemes', async () => {
+      const service = await createService();
+
+      const urls = [
+        'slack://tokenA/tokenB/tokenC',
+        'discord://webhook_id/webhook_token',
+        'mailto://user:pass@gmail.com',
+        'json://user:pass@hostname',
+        'https://hooks.slack.com/services/T00/B00/xxx',
+        'gotify://hostname/token',
+        'ntfy://topic',
+        'tgram://bot_token:chat_id/',
+      ];
+
+      for (const url of urls) {
+        expect(service.isEncryptedFormat(url)).toBe(false);
+      }
+    });
+
+    it('returns false for non-string values', async () => {
+      const service = await createService();
+
+      expect(service.isEncryptedFormat(null as any)).toBe(false);
+      expect(service.isEncryptedFormat(undefined as any)).toBe(false);
+      expect(service.isEncryptedFormat(123 as any)).toBe(false);
+      expect(service.isEncryptedFormat({} as any)).toBe(false);
+    });
+
+    it('returns false for strings with wrong number of colon parts', async () => {
+      const service = await createService();
+
+      expect(service.isEncryptedFormat('no-colons-at-all')).toBe(false);
+      expect(service.isEncryptedFormat('one:part')).toBe(false);
+      expect(service.isEncryptedFormat('a:b:c:d')).toBe(false);
+    });
+
+    it('returns false for 3-part strings with invalid base64', async () => {
+      const service = await createService();
+
+      // Contains characters not in base64 alphabet
+      expect(service.isEncryptedFormat('not base64!:also not!:data')).toBe(false);
+      expect(service.isEncryptedFormat('//invalid:##bad:data')).toBe(false);
+    });
+
+    it('returns false for 3-part base64 strings with wrong decoded lengths', async () => {
+      const service = await createService();
+
+      // Valid base64, but wrong byte lengths (not 16 bytes each)
+      const shortIv = Buffer.from('short').toString('base64');        // 5 bytes
+      const shortTag = Buffer.from('alsoshort').toString('base64');    // 9 bytes
+      const data = Buffer.from('somedata').toString('base64');
+
+      expect(service.isEncryptedFormat(`${shortIv}:${shortTag}:${data}`)).toBe(false);
+    });
+
+    it('returns false for empty string', async () => {
+      const service = await createService();
+      expect(service.isEncryptedFormat('')).toBe(false);
+    });
+
+    it('returns false for 3-part string with empty segments', async () => {
+      const service = await createService();
+      expect(service.isEncryptedFormat('::data')).toBe(false);
+      expect(service.isEncryptedFormat('iv::data')).toBe(false);
+      expect(service.isEncryptedFormat('iv:tag:')).toBe(false);
+    });
+  });
 });

tests/services/job-queue-notifications.service.test.ts

@@ -4,6 +4,7 @@
  */
 
 import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { NotificationEvent } from '@/lib/constants/notification-events';
 
 describe('JobQueueService - Notification Integration', () => {
   beforeEach(() => {
@@ -50,7 +51,7 @@ describe('JobQueueService - Notification Integration', () => {
     });
 
     it('handles all event types', () => {
-      const events: Array<'request_pending_approval' | 'request_approved' | 'request_available' | 'request_error'> = [
+      const events: NotificationEvent[] = [
         'request_pending_approval',
         'request_approved',
         'request_available',

tests/services/job-queue.service.test.ts

@@ -21,6 +21,7 @@ const processorsMock = vi.hoisted(() => ({
   processRetryMissingTorrents: vi.fn().mockResolvedValue('ok'),
   processRetryFailedImports: vi.fn().mockResolvedValue('ok'),
   processCleanupSeededTorrents: vi.fn().mockResolvedValue('ok'),
+  processSyncGoodreadsShelves: vi.fn().mockResolvedValue('ok'),
   // Ebook processors
   processSearchEbook: vi.fn().mockResolvedValue('ok'),
   processStartDirectDownload: vi.fn().mockResolvedValue('ok'),
@@ -115,6 +116,10 @@ vi.mock('@/lib/processors/cleanup-seeded-torrents.processor', () => ({
   processCleanupSeededTorrents: processorsMock.processCleanupSeededTorrents,
 }));
 
+vi.mock('@/lib/processors/sync-goodreads-shelves.processor', () => ({
+  processSyncGoodreadsShelves: processorsMock.processSyncGoodreadsShelves,
+}));
+
 // Ebook processors
 vi.mock('@/lib/processors/search-ebook.processor', () => ({
   processSearchEbook: processorsMock.processSearchEbook,
@@ -559,6 +564,7 @@ describe('JobQueueService', () => {
     expect(processorsMock.processRetryMissingTorrents).toHaveBeenCalled();
     expect(processorsMock.processRetryFailedImports).toHaveBeenCalled();
     expect(processorsMock.processCleanupSeededTorrents).toHaveBeenCalled();
+    expect(processorsMock.processSyncGoodreadsShelves).toHaveBeenCalled();
   });
 
   it('returns repeatable jobs from the queue', async () => {

tests/services/notification.service.test.ts

@@ -18,6 +18,7 @@ prismaMock.notificationBackend = {
 const encryptionMock = vi.hoisted(() => ({
   encrypt: vi.fn((value: string) => `enc:${value}`),
   decrypt: vi.fn((value: string) => value.replace('enc:', '')),
+  isEncryptedFormat: vi.fn((value: string) => typeof value === 'string' && value.startsWith('enc:')),
 }));
 
 const fetchMock = vi.hoisted(() => vi.fn());
@@ -196,10 +197,9 @@ describe('NotificationService', () => {
       const { NotificationService } = await import('@/lib/services/notification');
       const service = new NotificationService();
 
-      // Use iv:authTag:data format to pass isEncrypted() check
       await service.sendToBackend(
         'pushover',
-        { userKey: 'iv:tag:user123', appToken: 'iv:tag:app456', priority: 1 },
+        { userKey: 'enc:user123', appToken: 'enc:app456', priority: 1 },
         {
           event: 'request_approved',
           requestId: 'req-1',
@@ -210,8 +210,8 @@ describe('NotificationService', () => {
         }
       );
 
-      expect(encryptionMock.decrypt).toHaveBeenCalledWith('iv:tag:user123');
-      expect(encryptionMock.decrypt).toHaveBeenCalledWith('iv:tag:app456');
+      expect(encryptionMock.decrypt).toHaveBeenCalledWith('enc:user123');
+      expect(encryptionMock.decrypt).toHaveBeenCalledWith('enc:app456');
       expect(fetchMock).toHaveBeenCalled();
     });
 
@@ -519,6 +519,91 @@ describe('NotificationService', () => {
     });
   });
 
+  describe('reEncryptUnprotectedBackends', () => {
+    it('re-encrypts plaintext sensitive fields stored due to isEncrypted bug', async () => {
+      // Simulate a backend with a Telegram URL stored as plaintext (the bug)
+      prismaMock.notificationBackend.findMany.mockResolvedValue([
+        {
+          id: 'backend-1',
+          type: 'apprise',
+          name: 'Telegram via Apprise',
+          config: {
+            serverUrl: 'http://apprise:8000',
+            urls: 'tgram://1234567890:PLPe1Hh-VhbRC3MoT5QngwkPHoMTD/-100181291455/',
+          },
+          events: ['request_available'],
+          enabled: true,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ]);
+
+      prismaMock.notificationBackend.update.mockResolvedValue({} as any);
+
+      // Mock isEncryptedFormat to return false for the plaintext URL
+      encryptionMock.isEncryptedFormat.mockImplementation(
+        (value: string) => typeof value === 'string' && value.startsWith('enc:')
+      );
+
+      const { NotificationService } = await import('@/lib/services/notification');
+      const service = new NotificationService();
+
+      const fixed = await service.reEncryptUnprotectedBackends();
+
+      expect(fixed).toBe(1);
+      expect(encryptionMock.encrypt).toHaveBeenCalledWith(
+        'tgram://1234567890:PLPe1Hh-VhbRC3MoT5QngwkPHoMTD/-100181291455/'
+      );
+      expect(prismaMock.notificationBackend.update).toHaveBeenCalledWith({
+        where: { id: 'backend-1' },
+        data: {
+          config: {
+            serverUrl: 'http://apprise:8000',
+            urls: 'enc:tgram://1234567890:PLPe1Hh-VhbRC3MoT5QngwkPHoMTD/-100181291455/',
+          },
+        },
+      });
+    });
+
+    it('skips backends with already-encrypted fields', async () => {
+      prismaMock.notificationBackend.findMany.mockResolvedValue([
+        {
+          id: 'backend-1',
+          type: 'discord',
+          name: 'Discord',
+          config: { webhookUrl: 'enc:https://discord.com/webhook', username: 'Bot' },
+          events: ['request_available'],
+          enabled: true,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ]);
+
+      encryptionMock.isEncryptedFormat.mockImplementation(
+        (value: string) => typeof value === 'string' && value.startsWith('enc:')
+      );
+
+      const { NotificationService } = await import('@/lib/services/notification');
+      const service = new NotificationService();
+
+      const fixed = await service.reEncryptUnprotectedBackends();
+
+      expect(fixed).toBe(0);
+      expect(prismaMock.notificationBackend.update).not.toHaveBeenCalled();
+    });
+
+    it('returns 0 when no backends exist', async () => {
+      prismaMock.notificationBackend.findMany.mockResolvedValue([]);
+
+      const { NotificationService } = await import('@/lib/services/notification');
+      const service = new NotificationService();
+
+      const fixed = await service.reEncryptUnprotectedBackends();
+
+      expect(fixed).toBe(0);
+    });
+  });
+
   describe('maskConfig', () => {
     it('masks sensitive Discord config values', async () => {
       const { NotificationService } = await import('@/lib/services/notification');

tests/services/ntfy.provider.test.ts

@@ -18,6 +18,7 @@ prismaMock.notificationBackend = {
 const encryptionMock = vi.hoisted(() => ({
   encrypt: vi.fn((value: string) => `enc:${value}`),
   decrypt: vi.fn((value: string) => value.replace('enc:', '')),
+  isEncryptedFormat: vi.fn((value: string) => typeof value === 'string' && value.startsWith('enc:')),
 }));
 
 const fetchMock = vi.hoisted(() => vi.fn());
@@ -65,7 +66,8 @@ describe('NtfyProvider', () => {
       expect(fetchMock).toHaveBeenCalledTimes(1);
 
       const fetchCall = fetchMock.mock.calls[0];
-      expect(fetchCall[0]).toBe('https://ntfy.example.com/audiobooks');
+      // ntfy JSON publishing: POST to base server URL, topic is in JSON body
+      expect(fetchCall[0]).toBe('https://ntfy.example.com');
       expect(fetchCall[1].method).toBe('POST');
       expect(fetchCall[1].headers['Content-Type']).toBe('application/json');
       expect(fetchCall[1].headers['Authorization']).toBe('Bearer tk_mytoken123');
@@ -104,7 +106,7 @@ describe('NtfyProvider', () => {
       );
 
       const fetchCall = fetchMock.mock.calls[0];
-      expect(fetchCall[0]).toBe('https://ntfy.sh/audiobooks');
+      expect(fetchCall[0]).toBe('https://ntfy.sh');
     });
 
     it('does not include Authorization header when accessToken is not provided', async () => {
@@ -210,7 +212,7 @@ describe('NtfyProvider', () => {
       );
 
       const fetchCall = fetchMock.mock.calls[0];
-      expect(fetchCall[0]).toBe('https://ntfy.example.com/audiobooks');
+      expect(fetchCall[0]).toBe('https://ntfy.example.com');
     });
 
     it('throws descriptive error when API returns non-OK response', async () => {
@@ -275,13 +277,12 @@ describe('NtfyProvider', () => {
       const { NotificationService } = await import('@/lib/services/notification');
       const service = new NotificationService();
 
-      // Use iv:authTag:data format to pass isEncrypted() check
       await service.sendToBackend(
         'ntfy',
         {
           serverUrl: 'https://ntfy.example.com',
           topic: 'audiobooks',
-          accessToken: 'iv:tag:tk_mytoken123',
+          accessToken: 'enc:tk_mytoken123',
         },
         {
           event: 'request_approved',
@@ -294,12 +295,12 @@ describe('NtfyProvider', () => {
       );
 
       // Verify decrypt was called for the sensitive field
-      expect(encryptionMock.decrypt).toHaveBeenCalledWith('iv:tag:tk_mytoken123');
+      expect(encryptionMock.decrypt).toHaveBeenCalledWith('enc:tk_mytoken123');
 
       // Verify the decrypted value reaches the fetch call
       expect(fetchMock).toHaveBeenCalledTimes(1);
       const fetchCall = fetchMock.mock.calls[0];
-      expect(fetchCall[1].headers['Authorization']).toBe('Bearer iv:tag:tk_mytoken123');
+      expect(fetchCall[1].headers['Authorization']).toBe('Bearer tk_mytoken123');
     });
 
     it('does not decrypt non-sensitive fields', async () => {

tests/services/scheduler.service.test.ts

@@ -18,6 +18,7 @@ const jobQueueMock = vi.hoisted(() => ({
   addRetryFailedImportsJob: vi.fn(),
   addCleanupSeededTorrentsJob: vi.fn(),
   addMonitorRssFeedsJob: vi.fn(),
+  addSyncGoodreadsShelvesJob: vi.fn(),
 }));
 
 const configServiceMock = vi.hoisted(() => ({
@@ -25,6 +26,10 @@ const configServiceMock = vi.hoisted(() => ({
   getMany: vi.fn(),
 }));
 
+const notificationServiceMock = vi.hoisted(() => ({
+  reEncryptUnprotectedBackends: vi.fn().mockResolvedValue(0),
+}));
+
 vi.mock('@/lib/services/job-queue.service', () => ({
   getJobQueueService: () => jobQueueMock,
 }));
@@ -33,6 +38,10 @@ vi.mock('@/lib/services/config.service', () => ({
   getConfigService: () => configServiceMock,
 }));
 
+vi.mock('@/lib/services/notification', () => ({
+  getNotificationService: () => notificationServiceMock,
+}));
+
 vi.mock('@/lib/db', () => ({
   prisma: prismaMock,
 }));
@@ -69,7 +78,7 @@ describe('SchedulerService', () => {
     const service = new SchedulerService();
     await service.start();
 
-    expect(prismaMock.scheduledJob.create).toHaveBeenCalledTimes(7);
+    expect(prismaMock.scheduledJob.create).toHaveBeenCalledTimes(8);
     expect(jobQueueMock.addRepeatableJob).toHaveBeenCalledWith(
       'audible_refresh',
       { scheduledJobId: 'job-1' },
@@ -280,6 +289,7 @@ describe('SchedulerService', () => {
     ['retry_failed_imports', 'addRetryFailedImportsJob'],
     ['cleanup_seeded_torrents', 'addCleanupSeededTorrentsJob'],
     ['monitor_rss_feeds', 'addMonitorRssFeedsJob'],
+    ['sync_goodreads_shelves', 'addSyncGoodreadsShelvesJob'],
   ])('triggers %s jobs with job queue', async (type, queueMethod) => {
     prismaMock.scheduledJob.findUnique.mockResolvedValue({
       id: 'job-type',