Fix #34: Allow non-admins to use blocklist-search under qualifying conditions

- Expose ARR ID fields (arrQueueId, arrType, arrInstanceUrl, arrContentId, arrContentType) to non-admins in DownloadMatcher.js for blocklist functionality
- Replace blanket admin check in dashboard.js with canBlocklist() validation and server-side API key lookup
- Update integration tests to reflect new permission model
- Non-admins can now blocklist downloads with import issues or stale low-availability torrents

tests/integration/dashboard.test.js

@@ -352,7 +352,7 @@ describe('GET /api/dashboard/user-downloads', () => {
       expect(dl.downloadPath).toBeDefined();
     });
 
-    it('does not include admin-only fields for non-admin user', async () => {
+    it('includes ARR ID fields for non-admin user (for blocklist functionality)', async () => {
       const app = createApp({ skipRateLimits: true });
       const { cookies } = await loginAs(app);
       seedSabSonarrCache();
@@ -362,8 +362,14 @@ describe('GET /api/dashboard/user-downloads', () => {
       expect(res.status).toBe(200);
       const dl = res.body.downloads.find(d => d.type === 'series');
       expect(dl).toBeDefined();
-      expect(dl.arrQueueId).toBeUndefined();
-      expect(dl.arrType).toBeUndefined();
+      // ARR IDs are now exposed to non-admins for blocklist functionality
+      expect(dl.arrQueueId).toBe(1001);
+      expect(dl.arrType).toBe('sonarr');
+      // But sensitive fields remain admin-only
+      expect(dl.arrInstanceKey).toBeUndefined();
+      expect(dl.arrLink).toBeUndefined();
+      expect(dl.downloadPath).toBeUndefined();
+      expect(dl.targetPath).toBeUndefined();
     });
 
     it('does not return downloads tagged for a different user', async () => {
@@ -739,17 +745,74 @@ describe('POST /api/dashboard/blocklist-search', () => {
     expect(res.status).toBe(403);
   });
 
-  it('returns 403 for non-admin user', async () => {
+  it('returns 403 for non-admin user without qualifying conditions', async () => {
     const app = createApp({ skipRateLimits: true });
     const { cookies, csrf } = await loginAs(app);
     const csrfCookie = cookies.find(c => c.startsWith('csrf_token='));
+    
+    // Mock getAllDownloads to return a download that doesn't qualify for blocklist
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([
+      { arrQueueId: 1, arrType: 'sonarr', importIssues: [], qbittorrent: null }
+    ]);
+
     const res = await request(app)
       .post('/api/dashboard/blocklist-search')
       .set('Cookie', [...cookies, csrfCookie].join('; '))
       .set('X-CSRF-Token', csrf)
       .send({ arrQueueId: 1, arrType: 'sonarr', arrInstanceUrl: SONARR_BASE, arrInstanceKey: 'key', arrContentId: 501, arrContentType: 'episode' });
     expect(res.status).toBe(403);
-    expect(res.body.error).toMatch(/admin/i);
+    expect(res.body.error).toMatch(/permission denied/i);
+    mockGetAllDownloads.mockRestore();
+  });
+
+  it('returns 403 for non-admin when download not found in active downloads', async () => {
+    const app = createApp({ skipRateLimits: true });
+    const { cookies, csrf } = await loginAs(app);
+    const csrfCookie = cookies.find(c => c.startsWith('csrf_token='));
+    
+    // Mock getAllDownloads to return empty array (download not found)
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([]);
+
+    const res = await request(app)
+      .post('/api/dashboard/blocklist-search')
+      .set('Cookie', [...cookies, csrfCookie].join('; '))
+      .set('X-CSRF-Token', csrf)
+      .send({ arrQueueId: 1, arrType: 'sonarr', arrInstanceUrl: SONARR_BASE, arrContentId: 501, arrContentType: 'episode' });
+    expect(res.status).toBe(403);
+    expect(res.body.error).toMatch(/download not found/i);
+    mockGetAllDownloads.mockRestore();
+  });
+
+  it('returns 200 for non-admin with import issues (qualifying condition)', async () => {
+    const app = createApp({ skipRateLimits: true });
+    const { cookies, csrf } = await loginAs(app);
+    const csrfCookie = cookies.find(c => c.startsWith('csrf_token='));
+    
+    // Mock getAllDownloads to return a download with import issues (qualifies for blocklist)
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([
+      { arrQueueId: 1, arrType: 'sonarr', importIssues: ['Import error 1'], qbittorrent: null }
+    ]);
+
+    // Mock Sonarr DELETE and command endpoints
+    nock(SONARR_BASE)
+      .delete('/api/v3/queue/1')
+      .query({ removeFromClient: 'true', blocklist: 'true' })
+      .reply(200, {});
+    nock(SONARR_BASE)
+      .post('/api/v3/command')
+      .reply(200, {});
+
+    const res = await request(app)
+      .post('/api/dashboard/blocklist-search')
+      .set('Cookie', [...cookies, csrfCookie].join('; '))
+      .set('X-CSRF-Token', csrf)
+      .send({ arrQueueId: 1, arrType: 'sonarr', arrInstanceUrl: SONARR_BASE, arrContentId: 501, arrContentType: 'episode' });
+    expect(res.status).toBe(200);
+    expect(res.body.ok).toBe(true);
+    mockGetAllDownloads.mockRestore();
   });
 
   it('returns 400 when required fields are missing', async () => {
@@ -780,6 +843,12 @@ describe('POST /api/dashboard/blocklist-search', () => {
     const app = createApp({ skipRateLimits: true });
     const { cookies, csrf, csrfCookie } = await getAuthHeaders(app);
 
+    // Mock getAllDownloads to return a matching download for admin
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([
+      { arrQueueId: 1001, arrType: 'sonarr', importIssues: [], qbittorrent: null }
+    ]);
+
     nock(SONARR_BASE)
       .delete('/api/v3/queue/1001')
       .query({ removeFromClient: 'true', blocklist: 'true' })
@@ -795,12 +864,19 @@ describe('POST /api/dashboard/blocklist-search', () => {
       .send({ arrQueueId: 1001, arrType: 'sonarr', arrInstanceUrl: SONARR_BASE, arrInstanceKey: 'sk', arrContentId: 501, arrContentType: 'episode' });
     expect(res.status).toBe(200);
     expect(res.body.ok).toBe(true);
+    mockGetAllDownloads.mockRestore();
   });
 
   it('calls Radarr DELETE+command and returns ok:true', async () => {
     const app = createApp({ skipRateLimits: true });
     const { cookies, csrf, csrfCookie } = await getAuthHeaders(app);
 
+    // Mock getAllDownloads to return a matching download for admin
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([
+      { arrQueueId: 2001, arrType: 'radarr', importIssues: [], qbittorrent: null }
+    ]);
+
     nock(RADARR_BASE)
       .delete('/api/v3/queue/2001')
       .query({ removeFromClient: 'true', blocklist: 'true' })
@@ -816,12 +892,19 @@ describe('POST /api/dashboard/blocklist-search', () => {
       .send({ arrQueueId: 2001, arrType: 'radarr', arrInstanceUrl: RADARR_BASE, arrInstanceKey: 'rk', arrContentId: 99, arrContentType: 'movie' });
     expect(res.status).toBe(200);
     expect(res.body.ok).toBe(true);
+    mockGetAllDownloads.mockRestore();
   });
 
   it('returns 502 when Sonarr DELETE request fails', async () => {
     const app = createApp({ skipRateLimits: true });
     const { cookies, csrf, csrfCookie } = await getAuthHeaders(app);
 
+    // Mock getAllDownloads to return a matching download for admin
+    const downloadClientRegistry = require('../../server/utils/downloadClients');
+    const mockGetAllDownloads = vi.spyOn(downloadClientRegistry, 'getAllDownloads').mockResolvedValue([
+      { arrQueueId: 1001, arrType: 'sonarr', importIssues: [], qbittorrent: null }
+    ]);
+
     nock(SONARR_BASE)
       .delete('/api/v3/queue/1001')
       .query(true)
@@ -833,6 +916,7 @@ describe('POST /api/dashboard/blocklist-search', () => {
       .set('X-CSRF-Token', csrf)
       .send({ arrQueueId: 1001, arrType: 'sonarr', arrInstanceUrl: SONARR_BASE, arrInstanceKey: 'sk', arrContentId: 501, arrContentType: 'episode' });
     expect(res.status).toBe(502);
+    mockGetAllDownloads.mockRestore();
   });
 });