sofarr/server/routes/webhook.js

// Copyright (c) 2026 Gordon Bolton. MIT License.
const express = require('express');
const { logToFile } = require('../utils/logger');
const { getWebhookSecret, getSonarrInstances, getRadarrInstances } = require('../utils/config');
const cache = require('../utils/cache');
const arrRetrieverRegistry = require('../utils/arrRetrievers');
const { pollAllServices, POLL_INTERVAL, POLLING_ENABLED } = require('../utils/poller');

const router = express.Router();

// Cache TTL mirrors poller.js logic: 3x poll interval when active, 30s when on-demand
const CACHE_TTL = POLLING_ENABLED ? POLL_INTERVAL * 3 : 30000;

// Event classification — determines which cache keys to refresh
const QUEUE_EVENTS = new Set([
  'Grab',
  'Download',
  'DownloadFailed',
  'ManualInteractionRequired'
]);

const HISTORY_EVENTS = new Set([
  'DownloadFolderImported',
  'ImportFailed',
  'EpisodeFileRenamed',
  'MovieFileRenamed',
  'EpisodeFileRenamedBySeries'
]);

/**
 * Validate webhook secret from the X-Sofarr-Webhook-Secret header
 * @param {Object} req - Express request object
 * @returns {boolean} True if secret is valid, false otherwise
 */
function validateWebhookSecret(req) {
  const expectedSecret = getWebhookSecret();
  const providedSecret = req.get('X-Sofarr-Webhook-Secret');

  if (!expectedSecret) {
    logToFile('[Webhook] WARNING: SOFARR_WEBHOOK_SECRET not configured, rejecting webhook');
    return false;
  }

  if (!providedSecret) {
    logToFile('[Webhook] WARNING: Missing X-Sofarr-Webhook-Secret header');
    return false;
  }

  if (providedSecret !== expectedSecret) {
    logToFile('[Webhook] WARNING: Invalid webhook secret provided');
    return false;
  }

  return true;
}

/**
 * Process a webhook event by refreshing the affected cache and broadcasting SSE.
 * This is a fire-and-forget background task — callers must respond to the webhook
 * sender before awaiting this function.
 *
 * Phase 2: lightweight refresh via arrRetrieverRegistry + cache update + SSE broadcast.
 *
 * @param {string} serviceType - 'sonarr' or 'radarr'
 * @param {string} eventType   - the eventType from the *arr webhook payload
 */
async function processWebhookEvent(serviceType, eventType) {
  const affectsQueue = QUEUE_EVENTS.has(eventType);
  const affectsHistory = HISTORY_EVENTS.has(eventType);

  if (!affectsQueue && !affectsHistory) {
    logToFile(`[Webhook] Event ${eventType} does not affect queue or history, skipping refresh`);
    return;
  }

  logToFile(`[Webhook] ${serviceType} event "${eventType}" → queue=${affectsQueue}, history=${affectsHistory}`);

  // Ensure retrievers are initialized (idempotent)
  await arrRetrieverRegistry.initialize();

  if (serviceType === 'sonarr') {
    const sonarrInstances = getSonarrInstances();

    if (affectsQueue) {
      const queuesByType = await arrRetrieverRegistry.getQueuesByType();
      const sonarrQueues = queuesByType.sonarr || [];
      cache.set('poll:sonarr-queue', {
        records: sonarrQueues.flatMap(q => {
          const inst = sonarrInstances.find(i => i.id === q.instance);
          const url = inst ? inst.url : null;
          const key = inst ? inst.apiKey : null;
          return (q.data.records || []).map(r => {
            if (r.series) r.series._instanceUrl = url;
            r._instanceUrl = url;
            r._instanceKey = key;
            return r;
          });
        })
      }, CACHE_TTL);
      logToFile(`[Webhook] Refreshed poll:sonarr-queue (${sonarrQueues.length} instance(s))`);
    }

    if (affectsHistory) {
      const historyByType = await arrRetrieverRegistry.getHistoryByType({ pageSize: 10 });
      const sonarrHistories = historyByType.sonarr || [];
      cache.set('poll:sonarr-history', {
        records: sonarrHistories.flatMap(h => h.data.records || [])
      }, CACHE_TTL);
      logToFile(`[Webhook] Refreshed poll:sonarr-history (${sonarrHistories.length} instance(s))`);
    }
  } else if (serviceType === 'radarr') {
    const radarrInstances = getRadarrInstances();

    if (affectsQueue) {
      const queuesByType = await arrRetrieverRegistry.getQueuesByType();
      const radarrQueues = queuesByType.radarr || [];
      cache.set('poll:radarr-queue', {
        records: radarrQueues.flatMap(q => {
          const inst = radarrInstances.find(i => i.id === q.instance);
          const url = inst ? inst.url : null;
          const key = inst ? inst.apiKey : null;
          return (q.data.records || []).map(r => {
            if (r.movie) r.movie._instanceUrl = url;
            r._instanceUrl = url;
            r._instanceKey = key;
            return r;
          });
        })
      }, CACHE_TTL);
      logToFile(`[Webhook] Refreshed poll:radarr-queue (${radarrQueues.length} instance(s))`);
    }

    if (affectsHistory) {
      const historyByType = await arrRetrieverRegistry.getHistoryByType({ pageSize: 10 });
      const radarrHistories = historyByType.radarr || [];
      cache.set('poll:radarr-history', {
        records: radarrHistories.flatMap(h => h.data.records || [])
      }, CACHE_TTL);
      logToFile(`[Webhook] Refreshed poll:radarr-history (${radarrHistories.length} instance(s))`);
    }
  }

  // Broadcast to all SSE subscribers using the same mechanism poller.js uses.
  // pollAllServices() refreshes all data, updates every cache key, and then
  // iterates pollSubscribers to push fresh payloads to every open SSE connection.
  // If a poll is already in progress this call is a no-op, but the cache keys
  // above were already updated so the next broadcast (or dashboard request)
  // will see fresh data.
  logToFile('[Webhook] Triggering SSE broadcast via pollAllServices()');
  await pollAllServices();
}

/**
 * POST /api/webhook/sonarr
 * Receives webhook events from Sonarr instances.
 * Validates the secret, logs the event, refreshes cache, broadcasts SSE, and returns 200.
 *
 * Phase 2: integrated with PALDRA cache + SSE for real-time dashboard updates.
 */
router.post('/sonarr', (req, res) => {
  if (!validateWebhookSecret(req)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  try {
    const { eventType, instanceName } = req.body || {};
    logToFile(`[Webhook] Sonarr event received - Type: ${eventType || 'unknown'}, Instance: ${instanceName || 'unknown'}`);
    logToFile(`[Webhook] Sonarr payload: ${JSON.stringify(req.body)}`);

    // Phase 2: background cache refresh + SSE broadcast (fire-and-forget)
    processWebhookEvent('sonarr', eventType).catch(err => {
      logToFile(`[Webhook] Sonarr background refresh error: ${err.message}`);
    });

    res.status(200).json({ received: true });
  } catch (error) {
    logToFile(`[Webhook] Sonarr error: ${error.message}`);
    res.status(200).json({ received: true });
  }
});

/**
 * POST /api/webhook/radarr
 * Receives webhook events from Radarr instances.
 * Validates the secret, logs the event, refreshes cache, broadcasts SSE, and returns 200.
 *
 * Phase 2: integrated with PALDRA cache + SSE for real-time dashboard updates.
 */
router.post('/radarr', (req, res) => {
  if (!validateWebhookSecret(req)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  try {
    const { eventType, instanceName } = req.body || {};
    logToFile(`[Webhook] Radarr event received - Type: ${eventType || 'unknown'}, Instance: ${instanceName || 'unknown'}`);
    logToFile(`[Webhook] Radarr payload: ${JSON.stringify(req.body)}`);

    // Phase 2: background cache refresh + SSE broadcast (fire-and-forget)
    processWebhookEvent('radarr', eventType).catch(err => {
      logToFile(`[Webhook] Radarr background refresh error: ${err.message}`);
    });

    res.status(200).json({ received: true });
  } catch (error) {
    logToFile(`[Webhook] Radarr error: ${error.message}`);
    res.status(200).json({ received: true });
  }
});

module.exports = router;