v0.2.0 Lab Refresh

Pagemaster v0.2.0 is the authentication and activity milestone. Cookie sessions, CSRF protection, a durable activity event log, four metadata provider clients, and a completed-download background poller are all live.

Included

Authentication

• Cookie-based sessions with PBKDF2-SHA256 password hashing; SHA256 token storage in DB; 30-day duration.
• CSRF enforcement on all state-changing routes via X-CSRF-Token header.
• POST /api/auth/login, POST /api/auth/logout, GET /api/auth/me endpoints.
• Route middleware splits public routes (health, setup, login) from all protected routes.
• Login screen in the SPA with automatic redirect based on session state.
• Sidebar footer shows current operator display name with sign-out button.

Activity Event Log

• app_events table added via additive migration — existing databases are not affected.
• GET /api/activity/events?limit=N endpoint.
• Activity view backed by real persisted events from scans, searches, download handoffs, client tests, and apply operations.

Metadata Providers

• Open Library (no key required), Google Books (optional key), Hardcover (GraphQL Bearer token), and Audible (locale-aware, no key) provider clients implemented.
• GET /api/metadata/authors?q= endpoint wires all enabled DB-configured providers through the existing resolver; falls back to Open Library when none are configured.

Completed-Download Polling

• Background goroutine polls SABnzbd history and qBittorrent torrent list every 60 seconds.
• Completed jobs are marked in download_jobs and an event is logged.

Tests

• testClient auth helper injects session cookie and CSRF token transparently.
• All 11 server integration tests pass.

Install Or Update

Run the helper from the Proxmox host shell as root:

bash -c 'set -e; apt-get update; apt-get install -y git ca-certificates; tmp_dir="$(mktemp -d)"; git clone --depth 1 https://repository.spitzerhome.com/david/library-manager.git "$tmp_dir/library-manager"; bash "$tmp_dir/library-manager/scripts/proxmox/install-pagemaster-lxc.sh"'

Current Tracker

• #11 (Back Add New and Activity with durable APIs) — closed by this release.
• #12 adds real indexer and search configuration.
• #13 tracks the docs/wiki refresh.
• #2 remains open for the final versioned Docker release packaging train.

Known Limits

• Metadata author search is live; enrichment not yet wired into release candidate ranking.
• Download poller detects completion but does not yet trigger automated import.
• This is a lab refresh, not the final packaged Docker release.