fix(downloads): Use mediaSource.Id instead of item.Id in direct download URL (#1666)

Co-authored-by: lance chant <13349722+lancechant@users.noreply.github.com>
Co-authored-by: Gauvain <contact@uruk.dev>

.github/workflows/trivy-scan.yml

@@ -0,0 +1,60 @@
+name: 🛡️ Trivy Security Scan
+
+# Filesystem scan (Streamyfin ships no container image): finds vulnerable dependencies,
+# leaked secrets and misconfigurations, and reports them to GitHub code scanning.
+# Runs post-merge + weekly (not on PRs — dependency-review already gates PRs, and SARIF
+# upload needs a write token that fork PRs don't get).
+on:
+  push:
+    branches: [develop, master]
+  schedule:
+    - cron: "50 7 * * 5" # Weekly, Friday 07:50 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: trivy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trivy:
+    name: 🔎 Filesystem scan
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write # upload SARIF to code scanning
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Rotate the DB cache weekly (matches the scheduled scan): cache hits within the week
+      # instead of a fresh immutable entry per run, still refreshing the DB every week.
+      - name: 🗓️ Compute weekly Trivy cache key
+        id: trivy-cache-key
+        run: echo "value=trivy-db-${{ runner.os }}-$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
+
+      - name: 💾 Cache Trivy vulnerability DB
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/trivy
+          key: ${{ steps.trivy-cache-key.outputs.value }}
+          restore-keys: trivy-db-${{ runner.os }}-
+
+      - name: 🔎 Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,secret,misconfig
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: 📤 Upload results to code scanning
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy-fs

components/search/TVSearchPage.tsx

@@ -2,7 +2,7 @@ import type { BaseItemDto } from "@jellyfin/sdk/lib/generated-client/models";
 import { useAtom } from "jotai";
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Platform, ScrollView, TextInput, View } from "react-native";
+import { ScrollView, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { Text } from "@/components/common/Text";
 import { TVDiscover } from "@/components/jellyseerr/discover/TVDiscover";
@@ -231,48 +231,26 @@ export const TVSearchPage: React.FC<TVSearchPageProps> = ({
           paddingTop: insets.top + TOP_PADDING,
         }}
       >
-        {/* Search bar: native tvOS SwiftUI `.searchable` on Apple TV, standard
-            TextInput fallback on Android TV (the native module is Apple-only). */}
-        {Platform.OS === "ios" ? (
+        {/* Native tvOS search field (SwiftUI `.searchable`, our `tv-search`
+            module). It renders the native search bar + grid keyboard and
+            forwards typed text into the existing query pipeline via setSearch;
+            our own results grid renders below. */}
+        {/* No horizontal margin here: the native tvOS search bar centers itself
+            and renders a trailing "Hold to Dictate in <Language>" hint. Extra
+            margins squeeze the bar's width and clip that trailing hint, so let
+            the native view span the full width and own its own insets. */}
         <View
           style={{
             marginBottom: 24,
             height: SEARCH_AREA_HEIGHT,
           }}
         >
-            {/* No horizontal margin here: the native tvOS search bar centers
-                itself and renders a trailing "Hold to Dictate" hint. */}
           <TvSearchView
             style={{ width: "100%", height: "100%" }}
             placeholder={t("search.search")}
             onChangeText={(e) => setSearch(e.nativeEvent.text)}
           />
         </View>
-        ) : (
-          <View
-            style={{
-              marginHorizontal: HORIZONTAL_PADDING,
-              marginBottom: 24,
-            }}
-          >
-            <TextInput
-              style={{
-                height: 56,
-                width: "100%",
-                backgroundColor: "#262626",
-                borderRadius: 12,
-                paddingHorizontal: 20,
-                fontSize: 28,
-                color: "#fff",
-              }}
-              placeholder={t("search.search")}
-              placeholderTextColor='rgba(255,255,255,0.4)'
-              onChangeText={setSearch}
-              defaultValue=''
-              autoFocus={false}
-            />
-          </View>
-        )}
       </View>
 
       <ScrollView

modules/tv-recommendations/android/src/main/AndroidManifest.xml

@@ -1,12 +1,10 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
   <application>
-    <receiver android:name=".TvRecommendationsReceiver" android:exported="true">
+    <receiver
+      android:name=".TvRecommendationsReceiver"
+      android:exported="true">
       <intent-filter>
         <action android:name="android.media.tv.action.INITIALIZE_PROGRAMS" />
-        <category android:name="android.intent.category.DEFAULT" />
-      </intent-filter>
-      <intent-filter>
-        <action android:name="android.media.tv.action.PREVIEW_PROGRAM_BROWSABLE_DISABLED" />
       </intent-filter>
     </receiver>
   </application>

modules/tv-recommendations/android/src/main/java/expo/modules/tvrecommendations/TvRecommendationsPublisher.kt

@@ -61,61 +61,31 @@ internal object TvRecommendationsPublisher {
 
   fun clear(context: Context): Boolean {
     val prefs = preferences(context)
+    val channelId = prefs.getLong(KEY_CHANNEL_ID, -1L)
+    val programIds = prefs.getString(KEY_PROGRAM_IDS, null)?.let(::JSONObject)
     val contentResolver = context.contentResolver
 
-    // KEY_PROGRAM_IDS is now { channelId: "{ providerId: programId }" }
-    val allProgramIds = prefs.getString(KEY_PROGRAM_IDS, null)?.let(::JSONObject)
-    if (allProgramIds != null) {
+    if (programIds != null) {
       var deletedPrograms = 0
-      val channelKeys = allProgramIds.keys()
-      while (channelKeys.hasNext()) {
-        val channelIdStr = channelKeys.next()
-        val programIdsJson = allProgramIds.optString(channelIdStr)
-        if (programIdsJson.isBlank()) continue
-
-        try {
-          val programIds = JSONObject(programIdsJson)
       val keys = programIds.keys()
       while (keys.hasNext()) {
-            val providerId = keys.next()
-            val programId = programIds.optLong(providerId, -1L)
+        val key = keys.next()
+        val programId = programIds.optLong(key, -1L)
         if (programId > 0L) {
-              deletePreviewProgram(contentResolver, programId)
+          contentResolver.delete(
+            TvContractCompat.buildPreviewProgramUri(programId),
+            null,
+            null
+          )
           deletedPrograms += 1
         }
       }
-        } catch (e: Exception) {
-          Log.w(TAG, "clear(): failed to parse programIds for channel $channelIdStr", e)
-        }
-
-        // Notify the channel
-        val channelId = channelIdStr.toLongOrNull() ?: -1L
-        if (channelId > 0L) {
-          try {
-            contentResolver.notifyChange(TvContractCompat.buildChannelUri(channelId), null)
-          } catch (e: SecurityException) {
-            Log.w(TAG, "clear(): lost provider permission, cannot notify channel $channelId", e)
-          }
-        }
-
-        // Remove per-channel pref
-        prefs.edit().remove("programIds_$channelIdStr").apply()
-      }
       Log.d(TAG, "clear(): deleted $deletedPrograms preview program(s)")
     }
 
-    // Also handle legacy format (flat { providerId: programId }) for migration
-    val legacyProgramIds = prefs.getString("legacy_" + KEY_PROGRAM_IDS, null)?.let(::JSONObject)
-    if (legacyProgramIds != null) {
-      val keys = legacyProgramIds.keys()
-      while (keys.hasNext()) {
-        val key = keys.next()
-        val programId = legacyProgramIds.optLong(key, -1L)
-        if (programId > 0L) {
-          deletePreviewProgram(contentResolver, programId)
-        }
-      }
-      prefs.edit().remove("legacy_" + KEY_PROGRAM_IDS).apply()
+    if (channelId > 0L) {
+      contentResolver.notifyChange(TvContractCompat.buildChannelUri(channelId), null)
+      Log.d(TAG, "clear(): notified channel $channelId")
     }
 
     prefs.edit()
@@ -126,93 +96,27 @@ internal object TvRecommendationsPublisher {
     return true
   }
 
-  /**
-   * Delete a single preview program from the TvProvider.
-   * Called by clear(), synchronize() (stale programs), and TvRecommendationsReceiver (user removed).
-   */
-  fun deletePreviewProgram(context: Context, programId: Long) {
-    try {
-      context.contentResolver.delete(
-        TvContractCompat.buildPreviewProgramUri(programId),
-        null,
-        null
-      )
-      Log.d(TAG, "deletePreviewProgram(): deleted programId=$programId")
-
-      // Also remove from stored programIds prefs
-      removeProgramFromPrefs(context, programId)
-    } catch (e: SecurityException) {
-      Log.w(TAG, "deletePreviewProgram(): lost provider permission for programId=$programId", e)
-    }
-  }
-
-  private fun deletePreviewProgram(contentResolver: android.content.ContentResolver, programId: Long) {
-    try {
-      contentResolver.delete(
-        TvContractCompat.buildPreviewProgramUri(programId),
-        null,
-        null
-      )
-    } catch (e: SecurityException) {
-      Log.w(TAG, "deletePreviewProgram(): lost provider permission for programId=$programId", e)
-    }
-  }
-
-  private fun removeProgramFromPrefs(context: Context, programId: Long) {
-    val prefs = preferences(context)
-    val programIdsJson = prefs.getString(KEY_PROGRAM_IDS, null) ?: return
-    try {
-      val programIds = JSONObject(programIdsJson)
-      val keys = programIds.keys()
-      while (keys.hasNext()) {
-        val key = keys.next()
-        if (programIds.optLong(key, -1L) == programId) {
-          programIds.remove(key)
-          break
-        }
-      }
-      prefs.edit().putString(KEY_PROGRAM_IDS, programIds.toString()).apply()
-    } catch (e: Exception) {
-      Log.w(TAG, "removeProgramFromPrefs(): failed to update prefs for programId=$programId", e)
-    }
-  }
-
   private fun synchronize(context: Context, payload: JSONObject): Boolean {
     val sections = payload.optJSONArray("sections") ?: JSONArray()
-    if (sections.length() == 0) {
-      Log.w(TAG, "synchronize(): no sections in payload")
-      return false
-    }
-
-    val prefs = preferences(context)
-    val allNextProgramIds = JSONObject()
-    var totalActive = 0
-    var totalDeleted = 0
-
-    for (sectionIndex in 0 until sections.length()) {
-      val section = sections.optJSONObject(sectionIndex) ?: continue
-      val sectionTitle = section.optString("title")?.takeIf { it.isNotBlank() } ?: DEFAULT_CHANNEL_NAME
-      val items = section.optJSONArray("items") ?: JSONArray()
+    val firstSection = if (sections.length() > 0) sections.optJSONObject(0) else null
+    val sectionTitle = firstSection?.optString("title")?.takeIf { it.isNotBlank() } ?: DEFAULT_CHANNEL_NAME
+    val items = firstSection?.optJSONArray("items") ?: JSONArray()
 
     Log.d(
       TAG,
-        "synchronize(): section \"$sectionTitle\" ($sectionIndex/${sections.length()}) with ${items.length()} item(s)"
+      "synchronize(): using section \"$sectionTitle\" with ${items.length()} item(s)"
     )
 
     val channelId = getOrCreateChannel(context, sectionTitle)
     if (channelId <= 0L) {
-        Log.w(TAG, "synchronize(): failed to get or create channel for \"$sectionTitle\"")
-        continue
+      Log.w(TAG, "synchronize(): failed to get or create preview channel")
+      return false
     }
 
-      // Per Android docs: check channel.isBrowsable() and request if needed.
-      if (!isChannelBrowsable(context, channelId)) {
-        Log.d(TAG, "synchronize(): channel $channelId not browsable, requesting browsable")
-        TvContractCompat.requestChannelBrowsable(context, channelId)
-      }
+    Log.d(TAG, "synchronize(): publishing into channelId=$channelId")
 
-      val prefKey = "programIds_$channelId"
-      val previousProgramIds = prefs.getString(prefKey, null)
+    val previousProgramIds = preferences(context)
+      .getString(KEY_PROGRAM_IDS, null)
       ?.let(::JSONObject)
       ?: JSONObject()
     val nextProgramIds = JSONObject()
@@ -246,98 +150,44 @@ internal object TvRecommendationsPublisher {
 
       val programId = previousProgramIds.optLong(providerId, -1L)
       if (programId > 0L) {
-          deletePreviewProgram(context, programId)
+        context.contentResolver.delete(
+          TvContractCompat.buildPreviewProgramUri(programId),
+          null,
+          null
+        )
         deletedPrograms += 1
         Log.d(TAG, "synchronize(): deleted stale programId=$programId for item=$providerId")
       }
     }
 
-      allNextProgramIds.put(channelId.toString(), nextProgramIds.toString())
-      prefs.edit().putString(prefKey, nextProgramIds.toString()).apply()
-      totalActive += activeProviderIds.size
-      totalDeleted += deletedPrograms
+    preferences(context)
+      .edit()
+      .putLong(KEY_CHANNEL_ID, channelId)
+      .putString(KEY_PROGRAM_IDS, nextProgramIds.toString())
+      .apply()
 
     logProviderState(context, channelId)
-    }
-
-    // Store all channel program IDs for clear() to use
-    prefs.edit().putString(KEY_PROGRAM_IDS, allNextProgramIds.toString()).apply()
 
     Log.d(
       TAG,
-      "synchronize(): completed across ${sections.length()} section(s), $totalActive active program(s), deleted $totalDeleted stale program(s)"
+      "synchronize(): completed with ${activeProviderIds.size} active program(s), deleted $deletedPrograms stale program(s)"
     )
 
     return true
   }
 
-  /**
-   * Query provider to check if a channel is browsable.
-   * Per Android docs: "check channel.isBrowsable() before updating programs."
-   */
-  private fun isChannelBrowsable(context: Context, channelId: Long): Boolean {
-    return try {
-      context.contentResolver.query(
-        TvContractCompat.buildChannelUri(channelId),
-        null,
-        null,
-        null,
-        null
-      )?.use { cursor ->
-        if (cursor.moveToFirst()) {
-          val browsableIndex = cursor.getColumnIndex(TvContractCompat.Channels.COLUMN_BROWSABLE)
-          if (browsableIndex >= 0) cursor.getInt(browsableIndex) == 1 else true
-        } else {
-          false
-        }
-      } ?: false
-    } catch (e: SecurityException) {
-      Log.w(TAG, "isChannelBrowsable(): lost provider permission for channelId=$channelId", e)
-      true // Assume browsable if we can't check, to avoid blocking updates
-    }
-  }
-
-  /**
-   * Query provider to verify a channel actually exists.
-   * Prevents the channel-delete-recreate bug: if update() returns 0 rows
-   * we must first check whether the channel was deleted by the system
-   * or if the update simply failed for another reason.
-   */
-  private fun channelExistsInProvider(context: Context, channelId: Long): Boolean {
-    return try {
-      context.contentResolver.query(
-        TvContractCompat.buildChannelUri(channelId),
-        null,
-        null,
-        null,
-        null
-      )?.use { cursor ->
-        cursor.moveToFirst()
-      } ?: false
-    } catch (e: SecurityException) {
-      Log.w(TAG, "channelExistsInProvider(): lost provider permission for channelId=$channelId", e)
-      false
-    }
-  }
-
   private fun getOrCreateChannel(context: Context, displayName: String): Long {
     val prefs = preferences(context)
     val existingChannelId = prefs.getLong(KEY_CHANNEL_ID, -1L)
     val contentResolver = context.contentResolver
 
     if (existingChannelId > 0L) {
-      // Query provider first to verify channel actually exists (prevents recreate bug)
-      val exists = channelExistsInProvider(context, existingChannelId)
-
-      if (exists) {
-        // Channel exists — update it in place, never recreate
       val updated = Channel.Builder()
         .setType(TvContractCompat.Channels.TYPE_PREVIEW)
         .setDisplayName(displayName)
         .setAppLinkIntentUri(buildIntentUri(context, "streamyfin://"))
         .build()
 
-        try {
       val updatedRows = contentResolver.update(
         TvContractCompat.buildChannelUri(existingChannelId),
         updated.toContentValues(),
@@ -352,36 +202,20 @@ internal object TvRecommendationsPublisher {
         return existingChannelId
       }
 
-          // Update returned 0 rows but channel exists — log and return existing ID, don't recreate
-          Log.e(TAG, "getOrCreateChannel(): update returned 0 for existing channelId=$existingChannelId but channel exists — not recreating")
-          return existingChannelId
-        } catch (e: SecurityException) {
-          Log.w(TAG, "getOrCreateChannel(): lost provider permission updating channelId=$existingChannelId", e)
-          return existingChannelId
-        }
-      }
-
-      // Channel truly doesn't exist in provider — recreate
-      Log.w(TAG, "getOrCreateChannel(): channelId=$existingChannelId not in provider, recreating")
+      Log.w(TAG, "getOrCreateChannel(): stored channelId=$existingChannelId was stale, recreating")
       prefs.edit().remove(KEY_CHANNEL_ID).apply()
     }
 
-    // Create a new channel
     val channel = Channel.Builder()
       .setType(TvContractCompat.Channels.TYPE_PREVIEW)
       .setDisplayName(displayName)
       .setAppLinkIntentUri(buildIntentUri(context, "streamyfin://"))
       .build()
 
-    val channelUri = try {
-      contentResolver.insert(
+    val channelUri = contentResolver.insert(
       TvContractCompat.Channels.CONTENT_URI,
       channel.toContentValues()
-      )
-    } catch (e: SecurityException) {
-      Log.e(TAG, "getOrCreateChannel(): lost provider permission, cannot create channel", e)
-      null
-    } ?: return -1L
+    ) ?: return -1L
 
     val channelId = ContentUris.parseId(channelUri)
     TvContractCompat.requestChannelBrowsable(context, channelId)
@@ -415,19 +249,17 @@ internal object TvRecommendationsPublisher {
       builder.setDescription(it)
     }
 
-    // Per Android docs: use unique URIs for all images to avoid stale cache
     imageUrl.takeIf { it.isNotBlank() }?.let {
-      val uniqueImageUrl = appendCacheBuster(it)
-      val imageUri = Uri.parse(uniqueImageUrl)
+      val imageUri = Uri.parse(it)
       builder.setPosterArtUri(imageUri)
       builder.setThumbnailUri(imageUri)
     }
 
+
     val contentValues = builder.build().toContentValues()
     val contentResolver = context.contentResolver
 
     if (previousProgramId > 0L) {
-      try {
       val updatedRows = contentResolver.update(
         TvContractCompat.buildPreviewProgramUri(previousProgramId),
         contentValues,
@@ -441,36 +273,18 @@ internal object TvRecommendationsPublisher {
       }
 
       Log.w(TAG, "upsertPreviewProgram(): existing programId=$previousProgramId was stale, inserting new row")
-      } catch (e: SecurityException) {
-        Log.w(TAG, "upsertPreviewProgram(): lost provider permission for programId=$previousProgramId", e)
-      }
     }
 
-    val insertedUri = try {
-      contentResolver.insert(
+    val insertedUri = contentResolver.insert(
       TvContractCompat.PreviewPrograms.CONTENT_URI,
       contentValues
-      )
-    } catch (e: SecurityException) {
-      Log.w(TAG, "upsertPreviewProgram(): lost provider permission, cannot insert program", e)
-      null
-    } ?: return -1L
+    ) ?: return -1L
 
     val programId = ContentUris.parseId(insertedUri)
     Log.d(TAG, "upsertPreviewProgram(): inserted new programId=$programId")
     return programId
   }
 
-  /**
-   * Append a cache-busting parameter to ensure unique URIs when images change.
-   * Per Android docs: "Use unique Uris for all images... the old image will
-   * continue to appear if you don't change the Uri."
-   */
-  private fun appendCacheBuster(imageUrl: String): String {
-    val separator = if (imageUrl.contains("?")) "&" else "?"
-    return "$imageUrl${separator}_t=${System.currentTimeMillis()}"
-  }
-
   private fun buildIntentUri(context: Context, deepLink: String): Uri {
     val intent = Intent(Intent.ACTION_VIEW).apply {
       data = Uri.parse(deepLink)
@@ -492,7 +306,6 @@ internal object TvRecommendationsPublisher {
 
   private fun storeChannelLogo(context: Context, channelId: Long) {
     val bitmap = applicationIconBitmap(context) ?: return
-    try {
     val outputStream = context.contentResolver.openOutputStream(
       TvContractCompat.buildChannelLogoUri(channelId)
     ) ?: return
@@ -501,9 +314,6 @@ internal object TvRecommendationsPublisher {
       bitmap.compress(Bitmap.CompressFormat.PNG, 100, stream)
       stream.flush()
     }
-    } catch (e: SecurityException) {
-      Log.w(TAG, "storeChannelLogo(): lost provider permission for channelId=$channelId", e)
-    }
   }
 
   private fun applicationIconBitmap(context: Context): Bitmap? {
@@ -531,14 +341,9 @@ internal object TvRecommendationsPublisher {
     return bitmap
   }
 
-  fun getChannelId(context: Context): Long {
-    return preferences(context).getLong(KEY_CHANNEL_ID, -1L)
-  }
-
   private fun preferences(context: Context): SharedPreferences {
     return context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
   }
-
   private fun logProviderState(context: Context, channelId: Long) {
     val contentResolver = context.contentResolver
 
@@ -567,8 +372,8 @@ internal object TvRecommendationsPublisher {
           Log.w(TAG, "logProviderState(): channelId=$channelId exists=false")
         }
       } ?: Log.w(TAG, "logProviderState(): channel query returned null for channelId=$channelId")
-    } catch (error: SecurityException) {
-      Log.w(TAG, "logProviderState(): lost provider permission for channelId=$channelId", error)
+    } catch (error: Exception) {
+      Log.w(TAG, "logProviderState(): failed to query channelId=$channelId", error)
     }
   }
 }

modules/tv-search/src/TvSearchView.tsx

@@ -1,19 +1,12 @@
 import { requireNativeView } from "expo";
 import * as React from "react";
 import type { View } from "react-native";
-import { Platform } from "react-native";
 
 import type { TvSearchViewProps } from "./TvSearchView.types";
 
-// The native TvSearchModule is Apple-only (tvOS SwiftUI `.searchable`).
-// On Android the component is never rendered, but we must avoid calling
-// `requireNativeView` at module-scope because it would crash on import.
 const NativeView: React.ComponentType<
   TvSearchViewProps & React.RefAttributes<View>
-> =
-  Platform.OS === "ios"
-    ? requireNativeView("TvSearchModule")
-    : ((() => null) as any);
+> = requireNativeView("TvSearchModule");
 
 /**
  * Forwards its ref to the underlying native view so it can be used as a

utils/jellyfin/media/getDownloadUrl.ts

@@ -50,7 +50,7 @@ export const getDownloadUrl = async ({
   if (maxBitrate.key === "Max" && !streamDetails?.mediaSource?.TranscodingUrl) {
     console.log("Downloading item directly");
     return {
-      url: `${api.basePath}/Items/${item.Id}/Download?api_key=${api.accessToken}`,
+      url: `${api.basePath}/Items/${mediaSource.Id}/Download?api_key=${api.accessToken}`,
       mediaSource: streamDetails?.mediaSource ?? null,
     };
   }