Add series fields to audiobooks and update related logic

Introduces 'series' and 'seriesPart' fields to the Audiobook model and database schema. Updates API routes, file organization, and path template utilities to support series metadata. Enhances chapter merging logic, improves notification backend testing, and expands test coverage for admin and API routes.

tests/api/admin-users.routes.test.ts

@@ -67,6 +67,105 @@ describe('Admin users routes', () => {
     expect(payload.user.role).toBe('admin');
   });
 
+  it('rejects invalid roles', async () => {
+    const request = { json: vi.fn().mockResolvedValue({ role: 'owner' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'u3' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toMatch(/Invalid role/);
+  });
+
+  it('rejects invalid autoApproveRequests values', async () => {
+    const request = { json: vi.fn().mockResolvedValue({ role: 'user', autoApproveRequests: 'yes' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'u3' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toMatch(/autoApproveRequests/);
+  });
+
+  it('prevents changing your own role', async () => {
+    const request = { json: vi.fn().mockResolvedValue({ role: 'user' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'admin-1' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/cannot change your own role/i);
+  });
+
+  it('returns 404 when updating a missing user', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce(null);
+    const request = { json: vi.fn().mockResolvedValue({ role: 'admin' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'missing' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(404);
+    expect(payload.error).toMatch(/User not found/);
+  });
+
+  it('prevents modifying deleted users', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      isSetupAdmin: false,
+      authProvider: 'local',
+      plexUsername: 'user',
+      deletedAt: new Date(),
+      role: 'user',
+    });
+    const request = { json: vi.fn().mockResolvedValue({ role: 'admin' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'u3' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/deleted user/);
+  });
+
+  it('prevents changing setup admin role', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      isSetupAdmin: true,
+      authProvider: 'local',
+      plexUsername: 'setup-admin',
+      deletedAt: null,
+      role: 'admin',
+    });
+    const request = { json: vi.fn().mockResolvedValue({ role: 'user' }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'setup-1' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/setup admin role/);
+  });
+
+  it('rejects admin role with autoApproveRequests false', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      isSetupAdmin: false,
+      authProvider: 'local',
+      plexUsername: 'admin',
+      deletedAt: null,
+      role: 'admin',
+    });
+    const request = { json: vi.fn().mockResolvedValue({ role: 'admin', autoApproveRequests: false }) };
+
+    const { PUT } = await import('@/app/api/admin/users/[id]/route');
+    const response = await PUT(request as any, { params: Promise.resolve({ id: 'admin-2' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toMatch(/auto-approve requests/);
+  });
+
   it('allows autoApproveRequests update for OIDC users without role change', async () => {
     prismaMock.user.findUnique.mockResolvedValueOnce({
       isSetupAdmin: false,
@@ -151,6 +250,80 @@ describe('Admin users routes', () => {
     expect(payload.success).toBe(true);
   });
 
+  it('prevents deleting yourself', async () => {
+    const { DELETE } = await import('@/app/api/admin/users/[id]/route');
+    const response = await DELETE({} as any, { params: Promise.resolve({ id: 'admin-1' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/delete your own account/);
+  });
+
+  it('returns 404 when deleting a missing user', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce(null);
+
+    const { DELETE } = await import('@/app/api/admin/users/[id]/route');
+    const response = await DELETE({} as any, { params: Promise.resolve({ id: 'missing' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(404);
+    expect(payload.error).toMatch(/User not found/);
+  });
+
+  it('returns 400 when deleting an already deleted user', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      id: 'u4',
+      plexUsername: 'user',
+      isSetupAdmin: false,
+      authProvider: 'local',
+      deletedAt: new Date(),
+      _count: { requests: 1 },
+    });
+
+    const { DELETE } = await import('@/app/api/admin/users/[id]/route');
+    const response = await DELETE({} as any, { params: Promise.resolve({ id: 'u4' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toMatch(/already been deleted/);
+  });
+
+  it('prevents deleting setup admin users', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      id: 'setup-1',
+      plexUsername: 'setup-admin',
+      isSetupAdmin: true,
+      authProvider: 'local',
+      deletedAt: null,
+      _count: { requests: 2 },
+    });
+
+    const { DELETE } = await import('@/app/api/admin/users/[id]/route');
+    const response = await DELETE({} as any, { params: Promise.resolve({ id: 'setup-1' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/setup admin/);
+  });
+
+  it('prevents deleting non-local users', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      id: 'plex-1',
+      plexUsername: 'plexuser',
+      isSetupAdmin: false,
+      authProvider: 'plex',
+      deletedAt: null,
+      _count: { requests: 0 },
+    });
+
+    const { DELETE } = await import('@/app/api/admin/users/[id]/route');
+    const response = await DELETE({} as any, { params: Promise.resolve({ id: 'plex-1' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(payload.error).toMatch(/Cannot delete Plex users/);
+  });
+
   it('approves a pending user', async () => {
     prismaMock.user.findUnique.mockResolvedValueOnce({
       id: 'u5',
@@ -166,6 +339,49 @@ describe('Admin users routes', () => {
 
     expect(payload.success).toBe(true);
   });
+
+  it('returns 404 when approving a missing user', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce(null);
+    const request = { json: vi.fn().mockResolvedValue({ approve: true }) };
+
+    const { POST } = await import('@/app/api/admin/users/[id]/approve/route');
+    const response = await POST(request as any, { params: Promise.resolve({ id: 'missing' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(404);
+    expect(payload.error).toMatch(/not found/i);
+  });
+
+  it('returns 400 when user is not pending approval', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      id: 'u6',
+      plexUsername: 'user',
+      registrationStatus: 'approved',
+    });
+    const request = { json: vi.fn().mockResolvedValue({ approve: true }) };
+
+    const { POST } = await import('@/app/api/admin/users/[id]/approve/route');
+    const response = await POST(request as any, { params: Promise.resolve({ id: 'u6' }) });
+    const payload = await response.json();
+
+    expect(response.status).toBe(400);
+    expect(payload.error).toMatch(/not pending/);
+  });
+
+  it('rejects a pending user when approve is false', async () => {
+    prismaMock.user.findUnique.mockResolvedValueOnce({
+      id: 'u7',
+      plexUsername: 'user',
+      registrationStatus: 'pending_approval',
+    });
+    prismaMock.user.delete.mockResolvedValueOnce({});
+    const request = { json: vi.fn().mockResolvedValue({ approve: false }) };
+
+    const { POST } = await import('@/app/api/admin/users/[id]/approve/route');
+    const response = await POST(request as any, { params: Promise.resolve({ id: 'u7' }) });
+    const payload = await response.json();
+
+    expect(payload.success).toBe(true);
+    expect(payload.message).toMatch(/rejected/);
+  });
 });
-
-